Am 23.12.22 um 18:29 schrieb Stefan Kania via samba:>
>
> Am 23.12.22 um 18:17 schrieb Rowland Penny via samba:
>>
>>
>> On 23/12/2022 16:55, Stefan Kania via samba wrote:
>>>
>>>
>>> Am 23.12.22 um 17:48 schrieb Rowland Penny via samba:
>>>>>
>>>>
>>>> It could be that pam_mount is looking for the kerberos ticket
>>>> '/tmp/krb5cc_1001107' and as you can see, it is
actually
>>>> '/tmp/krb5cc_1001107_dUP4GZ'
>>>
>>> That's what I also thought, but this is the ticket filename
creating
>>> when the user logs in to the system. Do you know a way to force the
>>> system NOT to add the last digits after the uid?
>>>
>>
>> I think there is a parameter you can set, try reading the krb5.conf
>> manpage. Have you tried turning on debug in pam_mount.conf.xml ?
>>
>
> Yes, and I got the same error :-(.
>
> One more thing:
>
> I just testet kinit together with MIT-Kerberos and OpenLDAP and there I
> got a filename krb5cc_<uid> without the suffix after the uid, so it
must
> have something to do with heimdal-kerberos if so, it would be bad.
>
>
>> Rowland
>>
>
>
I found out, Heimdal is NOT using default_ccache_name but
default_cc_name. I now changed my krb5.conf to:
-----------------
[libdefaults]
default_realm = EXAMPLE.NET
dns_lookup_realm = false
dns_lookup_kdc = true
default_cc_name = FILE:/tmp/krb5cc_%{uid}
-----------------
But still the same, but it has someting to do with Heimdal-Kerberos.
Change the filename together with MIT-Kerberos and OpenLDAP works.