* `master`
    * 11435b1060675339263ce0a2a546cc44ab9bd576 - krb5: do not cache ccache or password during preauth
* `sssd-1-16`
    * 895aa34af41cc76aaac78c3cb74c68eeeb31a1d9 - krb5: do not cache ccache or password during preauth

Versions:
=========
Red Hat Enterprise Linux release 8.3 Beta (Ootpa)
sssd-krb5-2.3.0-7.el8.x86_64
python3-sssdconfig-2.3.0-7.el8.noarch
sssd-ipa-2.3.0-7.el8.x86_64
sssd-tools-2.3.0-7.el8.x86_64
sssd-kcm-2.3.0-7.el8.x86_64
sssd-proxy-2.3.0-7.el8.x86_64
sssd-debuginfo-2.2.0-19.el8.x86_64
sssd-dbus-2.3.0-7.el8.x86_64
sssd-common-pac-2.3.0-7.el8.x86_64
sssd-krb5-common-2.3.0-7.el8.x86_64
sssd-tools-debuginfo-2.2.0-19.el8.x86_64
sssd-client-2.3.0-7.el8.x86_64
sssd-common-2.3.0-7.el8.x86_64
sssd-nfs-idmap-2.2.0-16.el8.x86_64
sssd-ad-2.3.0-7.el8.x86_64
sssd-ldap-2.3.0-7.el8.x86_64
sssd-2.3.0-7.el8.x86_64

sssd.conf

[sssd]
config_file_version = 2
services = nss, pam
domains = example1

[domain/example1]
ldap_search_base = dc=example,dc=test
id_provider = ldap
auth_provider = krb5
ldap_uri = ldaps://ds-server.testrealm.test
ldap_tls_cacert = /etc/openldap/cacerts/cacert.pem
use_fully_qualified_names = False
debug_level = 9
ldap_sasl_mech = GSSAPI
krb5_realm = EXAMPLE.TEST
krb5_server = ds-server.testrealm.test
cache_credentials = True
offline_credentials_expiration = 0


Check /etc/krb5.conf has krb5 credential cache to FILE



includedir /etc/krb5.conf.d/

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
ticket_lifetime = 24h
default_realm = EXAMPLE.TEST
dns_lookup_realm = false
dns_lookup_kdc = false
forwardable = true
rdns = false
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
spake_preauth_groups = edwards25519
default_ccache_name = FILE:/tmp/krb5cc_%{uid}

[realms]
EXAMPLE.TEST = {
        kdc = ds-server.testrealm.test
        admin_server = ds-server.testrealm.test
        }

[domain_realm]
example.test = EXAMPLE.TEST
.example.test = EXAMPLE.TEST

[appdefaults]
validate = true

[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf

[root@ds-server ~]# getent passwd -s sss foo0
foo0:*:14583100:14564100:foo0 User:/home/foo0:/bin/bash


Login as foo0 user using graphical login 

[root@ds-server ~]# ls -l /tmp/krb5cc_*
-rw-------. 1 root root      703 Aug 12 17:28 /tmp/krb5cc_0
-rw-------. 1 foo0 ldapusers 514 Aug 17 12:22 /tmp/krb5cc_14583100


Lock the screen and unlock . 

[root@ds-server ~]# ls -l /tmp/krb5cc_*
-rw-------. 1 root root      703 Aug 12 17:28 /tmp/krb5cc_0
-rw-------. 1 foo0 ldapusers 514 Aug 17 12:22 /tmp/krb5cc_14583100


After locking and unlocking multiple times, there was no additional credential cache files apart
from what is shown above.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sssd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4569