20.2. Setting Kerberos Ticket Policies

download PDF
The Kerberos ticket policy sets basic restrictions on managing tickets within the Kerberos realm, such as the maximum ticket lifetime and the maximum renewal age (the period during which the ticket is renewable).
The Kerberos ticket policy is set globally so that it applies to every ticket issued within the realm. IdM also has the ability to set user-level ticket policies which override the global policies. This can be used, for example, to set extended expiration times for administrators or to set shorter expiration times for some employees.

20.2.1. Setting Global Ticket Policies From the Web UI

  1. Click the Policy tab, and then click the Kerberos Ticket Policy subtab.
  2. Change the ticket lifetime policies.
    • Max renew sets the period after a ticket expires that it can be renewed.
    • Max life sets the active period (lifetime) of a Kerberos ticket.
  3. Click the Update link at the top of the policy page.
  4. Restart the KDC.
    # service krb5kdc restart


    Any change to the global Kerberos ticket policy requires a restart of the KDC for the changes to take effect. From the Command Line

The ipa krbtpolicy-mod command modifies the policy, while the ipa krbtpolicy-reset command resets the policy to the default values.
For example:
# ipa krbtpolicy-mod --maxlife=3600 --maxrenew=18000
  Max life: 3600
  Max renew: 18000


Any change to the global Kerberos ticket policy requires a restart of the KDC for the changes to take effect. Restart the KDC:
# service krb5kdc restart

20.2.2. Setting User-Level Ticket Policies

User-level Kerberos ticket policies are set using the same commands as global policies, but the user is specified in the command.
For example:
# ipa krbtpolicy-mod jsmith --maxlife=3600
  Max life: 3600


User-level policies take effect immediately on the next requested ticket (such as running kinit), without having to restart the KDC service.
Red Hat logoGithubRedditYoutubeTwitter


Try, buy, & sell


About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

© 2024 Red Hat, Inc.