KRB5CCNAME new semantics under Maverick?
Lars-Johan Liman <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.heimdal.general |
|---|---|
| Message-ID | <[email protected]> |
[I thought I'd start here, but I'm happy to be directed to a better forum if there is one.] It seems to me that the semantics of the KRB5CCNAME environment variable has changed between MacOS X 10.6 and 10.9. I realize the two use different implementations of Kerberos, but what I used to do, no longer works, and I would like to be referred to the documentation for the KRB5CCNAME variable, and how it's supposed to be used. #---------------------------------------------------------------------- Under 10.6.8 you can use it to switch between different credentials caches, e.g., OLDMAC$ uname -rs Darwin 10.8.0 OLDMAC$ kinit liman Please enter the password for [email protected]: OLDMAC$ klist Kerberos 5 ticket cache: 'API:Initial default ccache' Default principal: [email protected] Valid Starting Expires Service Principal 04/28/14 13:06:57 04/28/14 23:06:53 krbtgt/[email protected] OLDMAC$ setenv KRB5CCNAME API:0 OLDMAC$ kinit liman/root Please enter the password for liman/[email protected]: OLDMAC$ klist Kerberos 5 ticket cache: 'API:0' Default principal: liman/[email protected] Valid Starting Expires Service Principal 04/28/14 13:07:23 04/28/14 23:07:19 krbtgt/[email protected] OLDMAC$ unsetenv KRB5CCNAME OLDMAC$ klist Kerberos 5 ticket cache: 'API:Initial default ccache' Default principal: [email protected] Valid Starting Expires Service Principal 04/28/14 13:06:57 04/28/14 23:06:53 krbtgt/[email protected] #---------------------------------------------------------------------- This is what happens under 10.9.2. Do note that the two UUID strings are different, which is an interesting addition of incomprehensibility. ;-) NEWMAC$ uname -rs Darwin 13.1.0 NEWMAC$ kinit liman [email protected]'s Password: NEWMAC$ klist Credentials cache: API:0D485760-CE2A-4FC5-9B33-05FA84709E90 Principal: [email protected] Issued Expires Principal Apr 28 13:09:34 2014 Apr 28 23:09:31 2014 krbtgt/[email protected] NEWMAC$ setenv KRB5CCNAME API:0 NEWMAC$ kinit liman/root liman/[email protected]'s Password: NEWMAC$ klist klist: krb5_cc_get_principal: No credentials cache file found NEWMAC$ unsetenv KRB5CCNAME NEWMAC$ klist Credentials cache: API:E97F20D4-66D9-460B-9F29-6552F98B020C Principal: liman/[email protected] Issued Expires Principal Apr 28 13:10:16 2014 Apr 28 23:10:13 2014 krbtgt/[email protected] Any hints that leads to my better understanding of this are welcome. Best regards, /Lars-Johan Liman #---------------------------------------------------------------------- # Lars-Johan Liman, M.Sc. ! E-mail/SIP/Jabber: [email protected] # Senior Systems Specialist ! Tel: +46 8 - 562 860 12 # Netnod/Autonomica, Sweden ! http://www.netnod.se/ #----------------------------------------------------------------------