Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I observed that MacOS X 10.6, if machine is added to an Active Directory and set to authenticate over LDAP to the Active Directory server requests a Kerberos TGT as expected at each user login.

However, this TGT has a lifetime on the Active Directory and should be refreshed before the time expires. Windows machines does this automatically about 1 hour before expiration, but the MACs in our network does not do this. So, when a MacOS reaches the end of the TGT lifetime, nothing happens and access to services is limited accordingly by the Active Directory server.

I am looking for a way to configure the MACs to do a TGT refresh without user intervention. Preferably the solution should be a setting somewhere or a cron job to be run, and if that's impossible what software should I install to automatically refresh the TGT?

Thanks.

UPDATE: I found out that kinit -R or kinit -B should refresh the TGT. When I run it, it seems to run OK, klist shows updated times ... but I see this error in the logs: (com.apple.Kerberos.renew.plist[9299]): Exited with exit code: 1 and of course nothing happens on the Active Directory server.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.