Setup Kerberos

WARNING: This page is obsolete.

Please look at https://atlas-software.docs.cern.ch/software-infrastructure/platforms-compilers/.

You will need root access for this.

Kerberos is the preferred method to access the svn repository at CERN. To set this up, add the following CERN specific information to these files in the appropriate sections (realms and domain_realm, proxiable and forwardable in the lib defaults sections):

• /etc/krb5.conf

It should look like the following:

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

# original (default) settings

# [libdefaults]
#  default_realm = EXAMPLE.COM
#  dns_lookup_realm = false
#  dns_lookup_kdc = false
#  ticket_lifetime = 24h
#  renew_lifetime = 7d
#  forwardable = true
#
# [realms]
#  EXAMPLE.COM = {
#   kdc = kerberos.example.com
#   admin_server = kerberos.example.com
#  }
#
# [domain_realm]
#  .example.com = EXAMPLE.COM
#  example.com = EXAMPLE.COM

# settings for CERN.CH realm 

[libdefaults]
  default_realm = CERN.CH
  ticket_lifetime = 24h
  renew_lifetime = 7d
  forwardable = true
  proxiable = true

[realms]
  CERN.CH = {
    default_domain = cern.ch
    kpasswd_server = afskrb5m.cern.ch
    admin_server = afskrb5m.cern.ch
    kdc = cerndc.cern.ch
  }

[domain_realm]
  cern.ch = CERN.CH
  .cern.ch = CERN.CH

• To test that this works, do the following (replace <user> with your lxplus username):

kinit user@CERN.CH

Note that the uppercase address CERN.CH is important.

You should see the tickets with

klist

and destroy the active tickets with

kdestroy

For usage, see this section on password-less logins.

-- AsokaDeSilva - 08 Nov 2007