Return
-
Title
Single Sign on fails using OpenSuSe client with "No Kerberos credentials available" -
Description
Single Sign on fails using an OpenSuSe client.
ssh -vv output shows the following error:
debug1: Unspecified GSS failure. Minor code may provide more information
No Kerberos credentials available
-
Cause
The default Kerberos ticket cache location in openSuSe is set to:
/tmp/krb5cc_[uid]_xxxxxxHowever the Kerberos library assumes it is: (if no KRB5CCNAME variable is set)
/run/user/[uid]/krb5cc/tkt -
Resolution
This is a 3rd party issue that affects OpenSuSe clients.
WORKAROUND:
Manually set the correct KRB5CCNAME variable before running the ssh command.
e.g
# KRB5CCNAME=FILE:/tmp/krb5cc_${uid}; export KRB5CCNAME
You can also set the KRB5CCNAME in the environment variables
KRB5CCNAME=FILE:/tmp/krb5cc_${uid} -
Additional Information
Strace the ssh command to see which file it tries to open: # strace -Tvxf -o /tmp/ssh_strace.out ssh servername This should show a line similar to the following: 9915 stat("/run/user/32794/krb5cc/tkt", 0x7ffea5f84b50) = -1 ENOENT (No such file or directory)