kinit: Credential cache directory "/run/user/0/krb5cc" does not exist while getting default ccache

This document (7019000) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 12 Service Pack 1 (SLES 12 SP1)
SUSE Linux Enterprise Server 12 Service Pack 2 (SLES 12 SP2)

Situation

After configuring sssd to cache credentials kinit fails with the following error when executing it via sudo or after su to another user:

kinit: Credential cache directory /run/user/0/krb5cc does not exist while getting default ccache

Resolution

The following lines need to be added to the /etc/krb5.conf file:

[libdefaults]

default_ccache_name = FILE:/tmp/krb5cc_%{uid}

Cause

As soon as the kerberos cache is enabled this option needs to be set in order to generate the cache files. So as soon as cache_credentials = true is set in /etc/sssd/sssd.conf it is also needed to have the below option set in the /etc/krb5.conf file.

Excerpt from the man page of krb5.conf:

default_ccache_name
This relation specifies the name of the default credential cache. The default is DIR:/run/user/%{uid}/krb5cc…

The reason not to use DIR:/run/user/%{uid}/krb5cc in the krb5.conf file as outlined in the man page is that it would cause a fail for kinit as the $XDG_RUNTIME_DIR variable would either be changed or empty depending on how kinit would be executed e.g. sudo or su.

Additional Information

On sudo, su or su - <user> to another user then the corresponding $XDG_RUNTIME_DIR variable is either still related to the first user (when using su) or is going to be emptied (when using su - <user>) and as a result the "cache directory does not exist" error will be received.

This can easily be tested as follows.

1. Loging in as root (direct console login or ssh)

1.1 echo $XDG_RUNTIME_DIR
result: /run/user/0
1.2 kinit admin
result: works fine and no cache file error

2. From the root user used in 1. su to any other user

2.1 echo $XDG_RUNTIME_DIR
result: still /run/user/0
2.2 kinit admin
result: cache file error

3. From the user used in 1. su - <user> to any other user

3.1 echo $XDG_RUNTIME_DIR
result: empty string
3.2 kinit admin
result: cache file error

4. Loging in as regular user (direct console login or ssh)

4.1echo $XDG_RUNTIME_DIR
result: /run/user/<uid> --> e.g. 1000
4.2 kinit admin
result: works fine no cache file error

5. su or su - to any other user or e.g. root and the issue again is shown because either the the original logged in user still is in $XDR_RUNTIME_DIR or it is empty

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.