I am trying to get Kerberos PAM to pull a ticket and not destroy it after an RStudio login on CentOS 7.

My rstudio file in /etc/pam.d/ looks like:

    auth    required        pam_krb5.so retain_after_close debug
    session requisite       pam_krb5.so retain_after_close debug
    account required        pam_krb5.so debug

I know that RStudio is communicating fine with the PAM Stack because if I delete the first line, RStudio will not login. I an also do other manipulations that let me know the two are in sync.

Per the RStudio documentation, if I run the command: pamtester --verbose rstudio <user> authenticate setcred open_session

After entering my password, a ticket is created in /tmp called krb5cc_(uid) which is what I would expect. I can make the above pamtester line fail to pull a ticket by removing the setcred flag which tells me that this the key component.

A look in the Keberos PAM documentation says that session performs the same as auth but it runs with the command pam_setcred(PAM_ESTABLISH_CRED) flag, which is what I want. The same documentation says that if I add retain_after_close then the ticket should be retained. However, this is not happening and I'm not even sure it's actually pulling the ticket.

Any help is appreciated, I have tried nearly every combination of flags and parameters in the PAM file as possible but to no avail. Kerberos is a nightmare. LMK what else I can add to help. The log files are not useful unfortunately as they do not log an error due to the fact that PAM "silently fails" if a line is not understood.


The pam_krb5 from CentOS doesn't support retain_after_close.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.