From Fedora Project Wiki

< Features

Revision as of 17:00, 1 May 2012 by Sgallagh (talk | contribs) (Created page with "<!-- All fields on this form are required to be accepted by FESCo. We also request that you maintain the same order of sections so that all of the feature pages are uniform. --...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Feature Name

KRB5 DIR: Credential Caches


Kerberos 1.10 added a new cache storage type, DIR: which allows Kerberos to maintain TGTs for multiple KDCs simultaneously and auto-select between them when negotiating with Kerberized resources. Fedora should switch to using the DIR: cache format over the older FILE: cache format to support accessing mulitple Kerberos realms.


  • Email:

Current status

  • Targeted release: Fedora 18
  • Last updated: Sgallagh 17:00, 1 May 2012 (UTC)
  • Percentage of completion: 25%

Detailed Description

Support of multiple Kerberos realms is a critical feature and has been one of the most-requested enhancements of Kerberos. Having the ability to acquire a single-sign-on credential for other realms without traditional hurdles will allow users to set up environments such as: 1) Log on to their local machine using their corporate Kerberos environment, acquiring that TGT 2) Present credentials and acquire a ticket for their partner's environment and be able to access resources in both without additional steps.

Benefit to Fedora

The basics are described in the Detailed Description section. Other potential benefits would be that it would make it simpler to eventually migrate the Fedora development infrastructure to use Kerberos. One of the major hurdles to this effort has always been that it would be difficult for users who already sign in to Kerberos environments to also work in Fedora. With this capability added, that's one fewer roadblock to this conversion.


Multiple packages will need to be updated to support this, though the changes to those packages in many cases will be limited. The necessary functionality is already available in the kerberos libraries provided by the 'krb5' package.

  • krb5: Will need to change the default configuration to specify DIR: caches instead of FILE: caches
  • SSSD: Will need to add support for the DIR: caches internally. See

How To Test

User Experience


Contingency Plan


Release Notes

Comments and Discussion