Kerberos Problem with 'cron' or 'at'

After many days of hair pulling I have run into a problem running a perl script that uses Kerberos for authentication. This started out as what I thought was a problem with the perl module Authen::Krb5. I had a script that worked fine from the command line but when run from 'cron' or 'at' (i.e. no attached console) it would fail with the error:

Credentials cache I/O operation failed XXX

It turns out, according to the perl module author, that is error is coming from the Kerberos library not his module. He then suggested that I check the environment variable, KRB5CCNAME. Under normal implementations this is supposed to be the path for the credentials cache file. Under OS X this variable does not exist. If I set this variable, it apparently is not used.

So I have 2 basic questions. Where does OS X put the credentials cache file? Where ever that place is, why can it not be written when a script runs without a console? TIA.

Xserve, Mac OS X (10.4.11)

Posted on Nov 12, 2008 4:18 AM

Reply
1 reply

Nov 12, 2008 11:19 AM in response to Dennis Putnam

Hi Dennis,

I'm out of my league here, but these clues may help you...

MacOSX uses Memory based credential cache instead of file based cache...


http://tinyurl.com/57pabp

The basic reason is that instead of using file-based ticket caches,
Mac OS X keeps Kerberos credentials in memory [2]. And because of the
way that Mach (on which the Mac OS X kernel is based) partitions
memory, I suspect that standard CUPS backends which run as root cannot
access those tickets. Changing your effective UID is not a sufficient
workaround: you actually have to be launched in the user's context to
get the data.


http://lists.samba.org/archive/samba-technical/2005-June/041321.html

Notes on Kerberos, Directory Services, and AD on OS X...


https://psdcomputing.uchicago.edu/groups/psditweb/wiki/89173/Kerberoson_OSX.html

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Kerberos Problem with 'cron' or 'at'

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.