kinit: Credential cache directory "/run/user/0/krb5cc" does not exist while getting default ccache

This document (7019000) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 12 Service Pack 1 (SLES 12 SP1)
SUSE Linux Enterprise Server 12 Service Pack 2 (SLES 12 SP2)

Situation

After configuring sssd to cache credentials kinit fails with the following error when executing it via sudo or after su to another user:

kinit: Credential cache directory /run/user/0/krb5cc does not exist while getting default ccache

Resolution

The following lines need to be added to the /etc/krb5.conf file:

[libdefaults]
default_ccache_name = FILE:/tmp/krb5cc_%{uid}

Cause

As soon as the kerberos cache is enabled this option needs to be set in order to generate the cache files. So as soon as cache_credentials = true is set in /etc/sssd/sssd.conf it is also needed to have the below option set in the /etc/krb5.conf file.

Excerpt from the man page of krb5.conf:


default_ccache_name

This relation specifies the name of the default credential cache. The default is DIR:/run/user/%{uid}/krb5cc…


The reason not to use DIR:/run/user/%{uid}/krb5cc in the krb5.conf file as outlined in the man page is that it would cause a fail for kinit as the $XDG_RUNTIME_DIR variable would either be changed or empty depending on how kinit would be executed e.g. sudo or su.

Additional Information

On sudo, su or su - <user> to another user then the corresponding $XDG_RUNTIME_DIR variable is either still related to the first user (when using su) or is going to be emptied (when using su - <user>) and as a result the "cache directory does not exist" error will be received.

This can easily be tested as follows.

1. Loging in as root (direct console login or ssh)
1.1 echo $XDG_RUNTIME_DIR
result: /run/user/0
1.2 kinit admin
result: works fine and no cache file error

2. From the root user used in 1. su to any other user
2.1 echo $XDG_RUNTIME_DIR
result: still /run/user/0
2.2 kinit admin
result: cache file error

3. From the user used in 1. su - <user> to any other user
3.1 echo $XDG_RUNTIME_DIR
result: empty string
3.2 kinit admin
result: cache file error

4. Loging in as regular user (direct console login or ssh)
4.1echo $XDG_RUNTIME_DIR
result: /run/user/<uid> --> e.g. 1000
4.2 kinit admin
result: works fine no cache file error

5. su or su - to any other user or e.g. root and the issue again is shown because either the the original logged in user still is in $XDR_RUNTIME_DIR or it is empty

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:7019000
  • Creation Date: 17-May-2017
  • Modified Date:03-Mar-2020
    • SUSE Linux Enterprise Server

< Back to Support Search

For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com

SUSE Support Forums

Get your questions answered by experienced Sys Ops or interact with other SUSE community experts.

Join Our Community

Support Resources

Learn how to get the most from the technical support you receive with your SUSE Subscription, Premium Support, Academic Program, or Partner Program.


SUSE Customer Support Quick Reference Guide SUSE Technical Support Handbook Update Advisories
Support FAQ

Open an Incident

Open an incident with SUSE Technical Support, manage your subscriptions, download patches, or manage user access.

Go to Customer Center