Centrify

Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-8073: What configuration is needed to not create unique kerberos cache file from SSH SSO ticket forwarding

Authentication Service ,  

16 January,17 at 10:39 PM

Applies to Centrify Enabled OpenSSH

Question:

When Windows users login to a centrified linux/unix server with a password, by default centrify agent will create a unique kerberos cache file with the following format:

krb5cc_<uid>

For example for user with uid=127138

krb5cc_127138

If that file already exists, then a new cache will created with a unique file name:

krb5cc_cdc<uid>_<6 Random Digit>

For example:
krb5cc_cdc127138_08XvhG

Please read KB-3167 for detail on how to configure the environment to not the create unique kerberos cache file with password login.

But for user ssh to system with single sign on (SSO), and system is enabled for ticket forwarding, the parameter described in KB-3167 does not take effect and each forwarded ticket would generate a unique kerberos cache file.  
Why and is there a way to configure the system to not always generate a new file?

Answer:

With stock OpenSSH, this is the expected behavior and currently there is no parameter to override this behavior.  With Centrify Enabled OpenSSH, we have implemented a parameter to allow override.  This parameter is introduced in Centrify OpenSSH version 5.3.0 and up.  

To configure not to create a unique kerberos cache when forwarding the kerberos ticket, please add the following parameter to /etc/centrifydc/ssh/sshd_config file:

Krb5ccUnique yes

Centrify OpenSSH needs to be restarted to take effect.  
 

Related Articles

 articleKB-6041: How to show current license type in use by adclient articleKB-20210: Common Questions Regarding Centrify DirectControl and CoreOS articleKB-6040: How to change the license type in use after adclient successful joined to the AD? articleKB-6044: How to configure users for automatic Kerberos Credentials for infinite renewal even after users have logged out? articleKB-6073: How to join the Linux/Unix Centrify Server to Active Directory with specific Computer Role? articleKB-6056: How to report the group policy settings that are in effect for the local computer? articleKB-3925: How to add Centrify parameter to a group policy articleKB-6050: How to configure a group for automatic Kerberos Credentials for infinite renewal? articleKB-4303: How to troubleshoot SSH Single-Sign-On (SSO) and nested SSO?