On Fri, 19 Jun 2026, Adam Williamson wrote:
And thankfully, the renew window was recently changed from 24 hours
to "a bit longer than 24 hours" so you don't have to renew it earlier
and earlier each day any more :D
Thanks for the tip. I’d overlooked this, since /etc/krb5.conf has
“ticket_lifetime = 24h” by default. I’ve raised
https://src.fedoraproject.org/rpms/fedora-packager/pull-request/20 to make
fkinit always request a ticket with this length.
Ideally your desktop would be able to renew it for you automatically
but it seems like this doesn't work at least on GNOME ATM.
You can get sssd_kcm to do it for you, instead.
I’ve attached a few Ansible snippets to set that up (which I’m sure you can
make sense of even if you’re not an Ansible user).
--
Peter Oliver
- name: Install SSSD Kerberos cache manager
dnf:
name:
sssd-kcm
- name: Ensure SSSD config snippets are checked for
template:
src: templates/etc/sssd/sssd.conf.jinja2
dest: /etc/sssd/sssd.conf
owner: root
group: sssd
mode: ug+r,o=
notify:
- Reload sssd-kcm
- name: Renew Kerberos tickets
template:
src: templates/etc/sssd/conf.d/kcm_tgt_renewal.conf.jinja2
dest: /etc/sssd/conf.d/kcm_tgt_renewal.conf
owner: root
group: sssd
mode: ug+r,o=
notify:
- Reload sssd-kcm
- name: Reload sssd-kcm
service:
name: sssd-kcm
state: restarted
# {{ ansible_managed }}
#
# The snippets in /etc/sssd/conf.d/ are ignored is this file does not exist.
# {{ ansible_managed }}
#
# The snippets in /etc/sssd/conf.d/ are ignored is this file does not exist.
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
