7

We have found the most excellent program that that will allow our OSX machines to print through our Windows Print servers. (ksmbprint from http://deploystudio.com/)

The program allows for smb printing with to the servers through kerberos authentication - taking away the need to constantly put in the AD username and password for each print job and for us not to have to set up specific printers on the 300 or so machines that will be printing using lpadmin.

The issue is that the kerberos ticket lasts for 10 hours. 10 hour 1 second and the print job goes to the ether - looks like it goes through, but goes to nowhere.

In testing I can go to Keychain Access -> Ticket Viewer then renew the ticket, after entering my AD password. This is fine for the tester, but not for the user.

I've found a script that checks and when a user has less than 30 minutes left on their ticket it will ask them to re-authenticate. Set this up as a launch agent and it works - until asking the user to re-authenticate. This part doesn't happen when running as an agent.

Looking for a way to re-authorize the ticket with as little user intervention as possible. If I can get the launch agent to work as it does when just run, I'm okay with that for first run, but would really like a way to quietly re-authenticate the kerberos ticket.

Spoke with the Domain Admins and they don't suggest upping the ticket time and after discussion we realized that no matter what time we set it to expire there is going to be someone whose ticket is going to expire, so we better find a better solution.

Edit: I've gotten the launch agent to work, but am still looking for a way to do this sans user intervention. The thought of asking users to just trust us when this random box appears and type in their domain password is on the list of things we shouldn't be asking users to do.

2 Answers 2

2

kinit -R seems to do the trick for me. I'm tempted to suggest just having a LaunchAgent that runs this command with a StartInterval of, say, 7200 seconds (2 hrs); you could get fancier (e.g. testing network connectivity first, adjusting the retry frequency as your TGT gets closer to expiring, etc), but I think you'd mostly be going to a lot or work to avoid a tiny bit of computational expense.

4
  • -R does not seem to renew. -R 7200 complains about not knowing who 7200@mydomain is. I am trying -B to see how that works out.
    – eric.s
    Oct 25, 2010 at 15:08
  • and -B it is. This adds 10 minutes to the ticket and keeps it going.
    – eric.s
    Oct 25, 2010 at 15:44
  • Interesting. -B isn't in the kinit man page, but kinit -help lists "-B renew all tickets" (as opposed to "-R renew tickets"). Oct 25, 2010 at 16:03
  • -B is not in all versions of macOS. In 10.14, kinit -R exists, but fails in my case because the ticket is not renewable. A plain kinit without options works though.
    – Heiko Rupp
    Jan 31, 2019 at 8:54
0

Reviving an old thread since this is still meaningful today. A LaunchAgent to trigger "kinit -R" seems to be the best non-third-party way to accomplish this task.

The app store is filled with applications that can automatically renew your Kerberos tickets as well, so look there if you aren't comfortable with LaunchAgent plists.

Here is an example of mine in case you need a working example. I have it running every hour for testing purposes.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>com.kerberos.ticketrenew</string>
        
        <key>ProgramArguments</key>
        <array>
                <string>sh</string>
                <string>-c</string>
                <string>kinit -R</string>
        </array>
        
        <key>StartInterval</key>
        <integer>18000</integer>
        
        <key>StandardErrorPath</key>
        <string>/tmp/com.kerberos.ticketrenew.err</string>
        
        <key>StandardOutPath</key>
        <string>/tmp/com.kerberos.ticketrenew.out</string>
</dict>
</plist>

Also, per your edit, "kinit -R" should not be prompting for their credentials, and doesn't for me when applied correctly. A Kerberos ticket renewal does not require the credentials to be re-provided per the Kerberos standard. Only if the ticket expires and needs to be regenerated should users be prompted for credentials.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .