Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

hi, I have changed the krb5.conf ticket expiration and renewal time both to 30 second. Now if i create a ticket using kinit, it gets expired in 30 sec while if I write a java program and provide userPrincipal and keytab there, it wont expire in 30 sec.

avatar

Kindly help me to understand the logic.

1 ACCEPTED SOLUTION

avatar
Master Mentor
hide-solution

This problem has been solved!

Want to get a detailed solution you have to login/registered on the community

Register/Login
4 REPLIES 4

avatar
Master Mentor
hide-solution

This problem has been solved!

Want to get a detailed solution you have to login/registered on the community

Register/Login

avatar

Hi Jay, after adding these 2 properties, my program is reading from /etc/krb5.conf but it is creating a ticket for 24 hour instead of 30 sec. Following is the debug message:

Found ticket for hbase/ip@domain to go to krbtgt/domain@REALM expiring on Fri Dec 23 12:00:07 IST 2016 Entered Krb5Context.initSecContext with state=STATE_NEW Found ticket for hbase/ip@REALM to go to krbtgt/domain@REALM expiring on Fri Dec 23 12:00:07 IST 2016 Service ticket not found in the subject >>> Credentials acquireServiceCreds: same realm Using builtin default etypes for default_tgs_enctypes default etypes for default_tgs_enctypes: 18 17 16 23 1 3. >>> CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType >>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType >>> KrbKdcReq send: kdc=kdc.domain UDP:88, timeout=30000, number of retries =3, #bytes=714 >>> KDCCommunication: kdc=kdc.domain UDP:88, timeout=30000,Attempt =1, #bytes=714 >>> KrbKdcReq send: #bytes read=725 >>> KdcAccessibility: remove kdc.domain >>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType >>> KrbApReq: APOptions are 00100000 00000000 00000000 00000000 >>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.

Please let me know from where it is reading to create a ticket for 24 hour

avatar
Master Mentor

@priyanshu bindal

In your "krb5.conf" how have you defined the expiration?

I can see it working like following in /etc/krb5.conf:

[libdefaults]
  renew_lifetime = 7d
  forwardable = true
  default_realm = EXAMPLE.COM
  ticket_lifetime = 30m

- See here i am setting [ticket_lifetime = 30m] 30 minute and i can see the following in/etc/krb5.conf

:

[root@kjss1 ~]# kdestroy
[root@kjss1 ~]# kinit -kt /etc/security/keytabs/hdfs.headless.keytab hdfs-JoyCluster@EXAMPLE.COM 
[root@kjss1 ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: hdfs-JoyCluster@EXAMPLE.COM

Valid starting     Expires            Service principal
12/22/16 07:18:12  12/22/16 07:48:12  krbtgt/EXAMPLE.COM@EXAMPLE.COM
    renew until 12/22/16 07:18:12

.

Similarly for 30 seconds i did the following [ticket_lifetime = 30s] in /etc/krb5.conf

[root@kjss1 ~]# kdestroy
[root@kjss1 ~]# kinit -kt /etc/security/keytabs/hdfs.headless.keytab hdfs-JoyCluster@EXAMPLE.COM 
[root@kjss1 ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: hdfs-JoyCluster@EXAMPLE.COM

Valid starting     Expires            Service principal
12/22/16 07:22:12  12/22/16 07:22:42  krbtgt/EXAMPLE.COM@EXAMPLE.COM
    renew until 12/22/16 07:22:12

-

http://web.mit.edu/Kerberos/krb5-1.12/doc/basic/date_format.html#duration

.

avatar
New Contributor