Currently, SSSD is only capable of extending a user's kerberos tickets as long as there is renewable time remaining on the ticket. We have had many users over the years request the ability to have SSSD retain the user's credentials outside of the user session for use in cron jobs which may take place well outside of the user's login period.

We acknowledge that this represents an implicit security complication. With the user ticket being effectively eternal, the window of potential attack is significantly wider. Additionally, this action is implicitly violating the KDC administrator's restrictions on the length of ticket validity.

That being said, there is nothing preventing this from happening today (and many of our users are implementing workarounds to this effect). By building this feature into SSSD and using the kernel keyring, we can at least minimize the impact by limiting the possible access to the credentials (and avoiding the need for a plaintext file on the disk).

I envision this behaving as follows:

1. The first time a user logs in after an SSSD restart, we will save the kerberos credentials to the kernel keyring (similar to how we behave in the krb5_store_password_if_offline) add a new timer task set to one-half the lifetime of the acquired ticket, as well as a cancellation task at five seconds prior to total expiration.
2. When the timer task fires, we will acquire a new ticket on behalf of the user with the available credentials in the kernel keyring. If the system is offline, we will enqueue an online event similar to krb5_store_password_if_offline. If the system is online but the re-kinit fails (such as because the password has changed) we will stop processing kinit events. If it succeeds, we will enqueue another timer event.

When discussing this on IRC, I originally thought to use the periodic task API for this, but I suspect that the need to handle offline events specially will leave us using regular timers instead.

Things to keep in mind

1. If a user logs in to the system more than once, we should not have multiple kinit timers started from each session.
2. We should add a feature to sss_cache to allow us to shut down the periodic task and purge the password from the kernel keyring.
3. Once this task series is started, it will run until the sss_cache tool purges it or the SSSD is restarted. If the latter happens, there will need to be a real login event to re-enable this feature (we do not want to be keeping plaintext passwords anywhere that can survive an SSSD restart).