Kerberos ticket renewal after expiration

[swaroopmj]

I have a scenario where Kerberos is not working as desired. An User is working with a valid kerberos ticket and end of the day s/he closes the laptop instead of log off or shutdown. When the user enters the password and tries to mount a smb share or use a browser if the ticket is expired, it doesn't generate a new ticket.

Is there a way to generate kerberos ticket when it is expired without the user doing it manually?

[jrserapio]

So far the easiest way I've found is to have the user start screen saver and unlock the screensaver. This will grant you your Kerberos tgt.

This however requires you to be connected to your network, be bound to AD, and have a password protected screensaver.

Connecting to VPN should also grant you a tgt iirc.

Curious to see what else is out there.

[swaroopmj]

In my test, I did connect to VPN before trying to mount my share. It prompted for my AD password. I was also under the impression, connecting to VPN will generate a ticket, but it didn't.

[bentoms · Accepted solution]

@swaroopmj typically a VPN connection will not create a Kerberos ticket.

KerbMinder might help.

[Sachin_Parmar]

+1 for KerbMinder, especially with @bentoms forked ADPassMon works brilliantly!

[dprakash]

we had this exact problem with our old Sophos Proxy, KerbMinder alleviated most of those problems.

Before that we were just refreshing the ticket from Ticket Viewer which is in Applications>Utilities>Ticket Viewer.

[flyboy]

Talk to your Apple rep about Enterprise Connect. It will take care of this.