Re: KRB5CCNAME new semantics under Maverick?

On 04/28/2014 07:24 AM, Lars-Johan Liman wrote:
> It seems to me that the semantics of the KRB5CCNAME environment variable
> has changed between MacOS X 10.6 and 10.9. I realize the two use
> different implementations of Kerberos, but what I used to do, no longer
> works, and I would like to be referred to the documentation for the
> KRB5CCNAME variable, and how it's supposed to be used.

Short answer: if you want to force kinit to write to a particular
credential cache, use "kinit -c ccachename".

Longer answer: KRB5CCNAME determines the default credential cache name,
but kinit doesn't always use the default credential cache.  The Heimdal
kinit rules for a basic "kinit principal" operation are:

1. If there is a ccache in the collection for that principal, use it.
2. If the default ccache type supports switching, make a new ccache.
3. Otherwise, use the default ccache (KRB5CCNAME or system default).

The API: ccache type supports switching; the FILE: type does not.  If
you set KRB5CCNAME to a FILE: ccache, then rule 1 may apply (since the
API ccaches are still scanned for a principal match) but rule 2 will
not.  If you set KRB5CCNAME to an API: ccache, then rule 2 applies and
the default ccache will not be used.