Forum Discussion
Rene_Bader_1308
Altostratus
AltostratusAPM - show Kerberos Tickets
All,
I configured APM with a Kerberos Constrained Delegation for Kerberos SSO.
This is working so far but for debugging it would be helpfull to list all Kerberos Tickets granted.
Is t...
Hi René,
It seems F5 stores the TGTs for Kerberos in different cache files under the "/var/run/krb5cc/*" directory. Once there, depending on your partition set, there should be a different cache file for every user account which has been "delegated".
PATH for kerberos cache files: /var/run/krb5cc/"PartitionName"/"ADAuthServerName"/
For example, in my lab:
"[] config klist /var/run/krb5cc/Common/portal_f5_lab_aaa_srvr/krb5cc_0
Ticket cache: FILE:/var/run/krb5cc/Common/portal_f5_lab_aaa_srvr/krb5cc_0
Default principal: USER1@F5.LAB
Valid starting Expires Service principal
01/04/15 15:39:11 01/05/15 01:39:11 krbtgt/F5.LAB@F5.LAB renew until 01/05/15 15:39:11
01/04/15 15:39:11 01/05/15 01:39:11 ldap/dc1.f5.lab@F5.LAB renew until 01/05/15 15:39:11
[] config klist /var/run/krb5cc/Common/portal_f5_lab_aaa_srvr/krb5cc_1
Ticket cache: FILE:/var/run/krb5cc/Common/portal_f5_lab_aaa_srvr/krb5cc_1
Default principal: USER2@F5.LAB
Valid starting Expires Service principal
01/04/15 15:39:11 01/05/15 01:39:11 krbtgt/F5.LAB@F5.LAB renew until 01/05/15 15:39:11 "
Sivasubramaniam
Nimbostratus
NimbostratusHi,
I am using F5 APM version 12.1.2 and on this version, I am unable to find any kerberos ticket caches under /var/run/. Has the location changes on this version?
I have a working Kerberos SSO configuration and in /var/log/apm, I can see logs saying that TGTs have been fetched. I want to clear the credentials cache so that all tickets are re-fetched. However, I am unable to find where the kerberos tickets are stored.
Thanks!
- Stanislas_Piro2
Cumulonimbus
Hi,
look in
/var/run/apmd/krb5cc/Common/'AD Auth Profile'/krb5cc_1