Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-RT-Original-Encoding: iso-8859-1
Content-Length: 3850

<div>i have krb5 kdc server with ldap backend.</div><div>when i try to renew tiket i get:</div><div><div>$ kinit -R</div><div>kinit(v5): Ticket expired while renewing credentials</div><div><br></div><div><div>$ kinit -r 7d -l 2d</div>
<div>Password for f_anton@DOMAIN.MY: </div><div>$ klist -f</div><div>Ticket cache: FILE:/tmp/krb5cc_1013_s1kvrE</div><div>Default principal: f_anton@DOMAIN.MY</div><div><br></div><div>Valid starting     Expires            Service principal</div>
<div><b>08/20/10 19:54:27</b>  08/21/10 19:54:27  krbtgt/DOMAIN.MY@DOMAIN.MY</div><div><span class="Apple-tab-span" style="white-space:pre">	</span>renew until <b>08/20/10 19:54:27</b>, Flags: RI</div></div><div><br></div>
<div>Valid starting = renew until.</div><div><br></div><div><br></div><div>in kadmin.local:</div><div><div>kadmin.local:  getprinc f_anton</div><div>[..]</div><div>Maximum ticket life: 2 days 00:00:00</div><div>Maximum renewable life: 28 days 00:00:00</div>
<div>[..]</div><div>Attributes:</div><div>Policy: default</div><div>kadmin.local:  getpol default</div><div>Policy: default</div><div>Maximum password life: 157766400</div><div>Minimum password life: 86400</div><div>Minimum password length: 6</div>
<div>Minimum number of password character classes: 2</div><div>Number of old keys kept: 3</div><div>Reference count: 2</div></div><div><br></div><div><br></div><div>==========</div><div>kdc.conf:</div><div><div><br></div>
<div>[realms]</div><div>DOMAIN.MY = {</div><div>  master_key_type = des-cbc-crc</div><div>  supported_enctypes = rc4-hmac:normal des-cbc-crc:normal des3-cbc-raw:normal des3-cbc-sha1:normal des-cbc-crc:afs3</div><div>  max_renewable_life = 7d 0h 0m 0s</div>
<div>  max_life = 2d 0h 0m 0s</div><div>  default_principal_flags = +renewable</div><div>  krbMaxTicketLife = 172800 </div><div>  krbMaxRenewableAge = 604800</div><div>}</div><div><br></div><div>==========</div>
<div>krb5.conf:</div></div><div><div><br></div><div>[libdefaults]</div><div>default_realm = DOMAIN.MY</div><div>dns_lookup_realm = false</div><div>dns_lookup_kdc = false</div><div>ticket_lifetime = 2d</div><div>renew_lifetime = 7d</div>
<div><br></div><div>[dbdefaults]</div><div>ldap_kerberos_container_dn = &quot;cn=kerberos,ou=kdcroot,dc=domain,dc=my&quot;</div><div><br></div><div>[dbmodules]</div><div>domain.my = {</div><div>    db_library = kldap</div>
<div>    ldap_kdc_dn = cn=kdc,ou=kdcroot,dc=domain,dc=my</div><div>    ldap_kadmind_dn = cn=kadmin,ou=kdcroot,dc=domain,dc=my</div><div>    ldap_service_password_file = /var/lib/kerberos/krb5kdc/domain.my.ldapkey</div><div>
    ldap_servers = ldap://localhost/</div><div>    ldap_conns_per_server = 15</div><div>}</div><div><br></div><div>[realms]</div><div>DOMAIN.MY = {</div><div>    database_module = domain.my</div><div>    admin_server = <a href="http://server6.domain.my">server6.domain.my</a></div>
<div>    default_domain = domain.my</div><div>    kdc = <a href="http://server7.domain.my">server7.domain.my</a></div><div>    kdc = <a href="http://server6.domain.my">server6.domain.my</a></div><div>    krbMaxTicketLife = 172800             </div>
<div>    krbMaxRenewableAge = 604800    </div><div>}</div></div><div>=============</div><div><br></div></div><div><div># rpm -qa &#39;*krb*&#39;</div><div>libkrb5-1.6.3-alt9</div><div>libkrb5-devel-1.6.3-alt9</div><div>krb5-ticket-watcher-1.0.2-alt3</div>
<div>krb5-kinit-1.6.3-alt9</div><div>krb5-kadmin-1.6.3-alt9</div><div>krb5-server-1.6.3-alt9</div><div>krb5-services-1.6.3-alt9</div><div>krb5-kdc-1.6.3-alt9</div><div>libkrb5-ldap-1.6.3-alt9</div><div>pam_krb5-3.13-alt1</div>
</div><div><br></div>