Search code examples
kerberosgssapi

automate TGT renewal

I’m automating a service that needs to access a kerberized resource. Passwordless kinit with a keytab works fine. The resource is then connected to using SASL.

Is there a way, maybe via GSSAPI or libkrb5, to ensure a TGT is present whenever the resource is being accessed? Forking kinit before every access seems the pragmatic thing to do. However, there’s an obvious race between the time of TGT acquisition and its use to acquire a TGS that I’d like to avoid.

I imagine something like receiving an fd for authentication whose validity is guaranteed until it is being closed by the user.

I’d prefer to stay away from heavy-duty solutions like sssd to auto-renew the TGT.

Solution

  • The answer turns out to be providing the client keytab for libkrb5 in the KRB5_CLIENT_KTNAME parameter:

    If no existing tickets are available for the desired name, but the name
has an entry in the default client keytab, the krb5 mechanism will
acquire initial tickets for the name using the default client keytab.

    From the MIT Kerberos docs.

    The wiki also has a write-up of the implementation.