Kerberos ticket policy
Requires the krb-sso module. Global ticket life and renewal caps, separate caps per authentication method (OTP, RADIUS, PKINIT, IdP, passkey), and when a change takes effect.
This page covers the Kerberos ticket policy page under Policy. It requires the krb-sso module. The page holds the global Kerberos ticket policy: how long a user's TGT may live and how far it may be renewed. A per-user override sits on the user's detail page under Kerberos ticket policy; empty means the global value.
Fields
| Field | Default (seconds) | Meaning |
|---|---|---|
| Max life | 86400 (1 day) | Validity of a ticket from issue. After that, kinit again |
| Max renew | 604800 (7 days) | A ticket may be renewed with kinit -R while alive, up to this total |
The Authentication indicators block sets caps per method the ticket was obtained with. Password logins use the global values above; tickets obtained through OTP, RADIUS, PKINIT (smart card), an external IdP or a passkey use their own, and empty means global. This allows longer tickets for strong authentication or shorter ones for password logins.
| Method | Fields |
|---|---|
| OTP | OTP max life, OTP max renew |
| RADIUS | RADIUS max life, RADIUS max renew |
| PKINIT | PKINIT max life, PKINIT max renew |
| External IdP | IdP max life, IdP max renew |
| Passkey | Passkey max life, Passkey max renew |
Effective lifetime
A ticket lives for the smallest of three values: this policy, ticket_lifetime in the client's krb5.conf (ipa-client-install sets 24h), and the kinit -l request. Raising the policy without changing the client's krb5.conf has no effect.
Service tickets (TGS) never outlive the remaining TGT lifetime.
When it applies
Only tickets issued afterwards; existing tickets keep their values. No KDC restart is needed.
Boundaries
| Topic | Notes |
|---|---|
| Lifetime cap | Long lifetimes widen the window for a stolen ticket. Keep 8 to 10 hours for bastions and shared terminals |
admin | No special policy; the global one applies |
| AD users | Tickets for AD users across the trust are issued by the AD KDC; this page does not affect them |
Password policies
Requires the pwpolicy module. Global versus per-group policies, how priority picks the one a user gets, field defaults and meanings, lockout and unlock.
OTP tokens
TOTP and HOTP token fields, user self-service, enabling two-factor on a user, how password plus OTP is entered, and resynchronising a drifted token.