Kerberos ticket policy
Requires the krb-sso module. Global ticket life and renewal caps, separate caps per authentication method (OTP / RADIUS / PKINIT / IdP / passkey), and when a change takes effect.
Requires the krb-sso module. This page is the global Kerberos ticket policy: how long a user's TGT may live and how far it may be renewed. A per-user override sits on the user's detail page under "Kerberos ticket policy"; empty means the global value.
Fields
| Field | Default (seconds) | Meaning |
|---|---|---|
| Max life | 86400 (1 day) | validity of a ticket from issue. After that, kinit again |
| Max renew | 604800 (7 days) | a ticket may be renewed with kinit -R while alive, up to this total |
The authentication indicators block sets caps per method the ticket was obtained with. Password logins use the global values above; tickets obtained through OTP, RADIUS, PKINIT (smart card), an external IdP or a passkey use their own, empty meaning global. Use it to grant longer tickets for strong authentication, or shorter ones for password logins.
| Method | Fields |
|---|---|
| OTP | OTP max life / max renew |
| RADIUS | RADIUS max life / max renew |
| PKINIT | PKINIT max life / max renew |
| External IdP | IdP max life / max renew |
| Passkey | Passkey max life / max renew |
Effective lifetime
A ticket lives for the smallest of: this policy, ticket_lifetime in the client's krb5.conf (ipa-client-install sets 24h), and the kinit -l request. Raising the policy without touching the client's krb5.conf changes nothing.
Service tickets (TGS) never outlive the remaining TGT lifetime.
When it applies
Only tickets issued afterwards; existing tickets keep their values. No KDC restart.
Boundaries
- Long lifetimes widen the window for a stolen ticket; keep 8–10 hours for bastions and shared terminals.
adminhas no special policy; the global one applies.- Tickets for AD users across the trust are issued by the AD KDC; this page does not affect them.
Password policies
Requires the pwpolicy module. Global versus per-group policies, how priority picks the one a user gets, field defaults and meanings, lockout and unlock.
OTP tokens
TOTP / HOTP token fields, user self-service, enabling two-factor on a user, how password + OTP is entered, and resynchronising a drifted token.