# Kerberos Ticket forwarding support
**URL:** https://community.thinlinc.com/t/kerberos-ticket-forwarding-support/1962
**Category:** Community Support
**Created:** [29 March 2026 11:18 UTC](https://community.thinlinc.com/t/kerberos-ticket-forwarding-support/1962 "2026-03-29T11:18:00Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Thulium-Drake](https://community.thinlinc.com/u/Thulium-Drake)
#### Post date: [29 March 2026 11:18 UTC](https://community.thinlinc.com/t/kerberos-ticket-forwarding-support/1962/1 "2026-03-29T11:18:00Z")
š
So I was fiddling with my replacement TL server at home and I wanted to play a bit more with the Kerberos part of it.
So up until now Iāve been using Kerberos to sign in on my TL server (yes, I know, Iām a nerd š I run Kerberos at home). Which works absolutely fine, but when logging in on the session itself, itās ticketless, which then causes login errors on other services that normally authenticate fine when using a password.
So I tried the workaround Karl wrote (see below) in 2018 which works fine. NOTE, I opted to only set this up for a single host instead of all hosts I log in on.
1. On the client: Add the following to `~/.thinlinc/config`:
`Host myhost`
` GSSAPIDelegateCredentials yes`\*
2. On the server, remove `/opt/thinlinc/etc/xstartup.d/01-tl-kinit.sh`
3. Log in, and š forwarded ticket available and I can immediately start using it
> **[4712 ā kerberos ticket/tgt forwarding support](https://bugzilla.cendio.com/show_bug.cgi?id=4712)**
So with regards to the caveats posted in that ticket:
- Delay between session and connection without a ticket: I didnāt observe this, but Iāve been using a single-node TL server in this test.
- My system runs with KCM enabled, which means that all Kerberos sessions are handled by SSSD. So all sessions will re-use the same cache, regardless of means of entering the system/session (TL, SSH, sudo, console, etc.). And every time a new login is made (or password prompt is filled in) this ticket will be refreshed.
- Disconnecting destroys the ticket: not true, I logged in on my system with Kerberos and disconnected the session. I then logged in with a different user and `sudo`-ed to my own session. The forwarded ticket sticks around and will be until itās renewal period expires (in my case, thatās 7 days)
So I _think_ this can be used in a stable manner, and given the correct server setup, I think it would be better to add a checkbox in the client that will āEnable Kerberos Credential Forwardingā instead of having to tinker with the config file š
---
### Author:  [@aaron](https://community.thinlinc.com/u/aaron)
#### Post date: [30 March 2026 01:33 UTC](https://community.thinlinc.com/t/kerberos-ticket-forwarding-support/1962/2 "2026-03-30T01:33:43Z")
Major kudos for running Kerberos at home š I thought I was nerdy for running a mail server from my lounge. Sounds like I might have to up my game.
Anyway, thanks for testing. This does seem like it should work, it probably just hasnāt been considered enough of a priority to make it into ThinLinc yet.
Iāve made note of your comments though. Is this a requirement youāre seeing āin the wildā, i.e. in production environments? Or just a rainy day experiment at home?
---
### Author:  [@wilsj](https://community.thinlinc.com/u/wilsj)
#### Post date: [30 March 2026 16:22 UTC](https://community.thinlinc.com/t/kerberos-ticket-forwarding-support/1962/3 "2026-03-30T16:22:03Z")
> Delay between session and connection without a ticket: I didnāt observe this, but Iāve been using a single-node TL server in this test.
IIRC, the delay discussed only becomes a problem when trying to do things that depend on the Kerberos ticket very early during session startup. The prime example here is a home directory thatās an NFS mount with Kerberos authentication. In that scenario, the ThinLinc session will begin starting up without a Kerberos ticket (and therefore no home directory).
Anyway, thank you for taking the time to share your results! Itās highly appreciated.
---
### Author:  [@Thulium-Drake](https://community.thinlinc.com/u/Thulium-Drake)
#### Post date: [14 April 2026 16:06 UTC](https://community.thinlinc.com/t/kerberos-ticket-forwarding-support/1962/4 "2026-04-14T16:06:40Z")
> [@aaron](#):
>
> Major kudos for running Kerberos at home š I thought I was nerdy for running a mail server from my lounge. Sounds like I might have to up my game.
Well, Iām cheating sorta-kinda, I run FreeIPA š
> [@aaron](#):
>
> Iāve made note of your comments though. Is this a requirement youāre seeing āin the wildā, i.e. in production environments? Or just a rainy day experiment at home?
Mostly rainy day experimenting, most scenarios where we use Thinlinc thereās no domain connection for the system running the client. But it might be useful in scenarioās where users are provided a company laptop _and_ VPN and need to log in to the office to work on e.g. location-restricted licensed software (Yes, those existā¦ That was fun during COVID š)
> [@wilsj](#):
>
> IIRC, the delay discussed only becomes a problem when trying to do things that depend on the Kerberos ticket very early during session startup. The prime example here is a home directory thatās an NFS mount with Kerberos authentication. In that scenario, the ThinLinc session will begin starting up without a Kerberos ticket (and therefore no home directory).
The scenario where I can see this being an issue would probably be where thereās a master server that doesnāt host session, but a bunch of agents that do.
However, as the user is forwarding their current ticket for authenticating, I donāt think it will matter as much. The desktop also needs to load and, well, GNOME isnāt _that_ fast š