Re: can gssproxy be used for both cron jobs and normal users?

[Charles Hedrick <hedrick@rutgers.edu>]

> I just did some testing. With constrained delegation I can make cron
> jobs work. However when I do, normal users can no longer useNFS. It
> appears that when rpc.gssd has GSS_USE_PROXY set, it always uses the
> proxy. So normal Kerberos tickets from login or ssh don't work. I looked
> at the source for gssproxy. It appears that when impersonation is turned
> on, it always tries to impersonate. It doesn't check if there's a
> TGT that would allow it to get a normal service ticket.

The answer seems to be that

GSSPROXY_BEHAVIOR=LOCAL_FIRST

must be set. The default effectively uses only gssproxy, so users who 
could access NFS using a normal TGT fail if impersonation isn't set for 
them. However LOCAL_FIRST causes it to try normal credentiais before 
using gssproxy.