Kerberos: The Definitive Guide

The ticket (or credential) cache

Now that we have all of these tickets, where do we put them? Well, unfortunately, the answer is: it depends. The original Kerberos implementation written by MIT uses a file-based credential cache. That is, when you log into Kerberos, and as you are issued tickets for Kerberized services, all of the tickets are stored in a file. This method was chosen because it is the most portable; every platform has a filesystem, and it is easy to read and write to files. However, this method is inflexible and insecure. Therefore, other ports of the MIT Kerberos code, as well as independent implementations from other vendors, include other methods of storing tickets. Both the Microsoft and Apple implementations of Kerberos include a memory-based credential cache that ensures that credentials are kept in memory and destroyed upon the termination of the login session.

Since the default credential cache is a file-based credential cache, we’ll take a look at what one looks like. No matter where the credential cache is stored, it still contains the same information: a user principal, and a set of service tickets that the user has obtained throughout their login session. A sample credential cache is shown below:

$ klist Ticket cache: FILE:/tmp/krb5cc_502_auJKaJ Default principal: [e-mail] Valid starting Expires Service principal 09/10/02 01:48:12 09/10/02 11:48:12 krbtgt/[e-mail] 09/10/02 01:48:14 09/10/02 11:48:12 host/[e-mail] ...