[SSSD-users] Cant get new TGT after kdestroy on gdm login with smartcard.

I am having problems consistently getting a TGT after logging in via GDM with smartcard. On first login it normally works, but if I do a 'kdestroy' and then logout of my gnome session, I don't get a new TGT when I login to a new session. Instead, the root user has a TGT for my AD user: [a001329@c20693 ~]$ klist klist: Credentials cache 'KCM:60483' not found [root@c20693 ~]# klist Ticket cache: KCM:0:63363 Default principal: a001329(a)EXAMPLE.COM Valid starting Expires Service principal 2019-02-13 15:11:38 2019-02-14 01:11:33 krbtgt/EXAMPLE.com(a)EXAMPLE.com renew until 2019-02-20 15:11:33 A wild guess is that krb5-pkinit works by letting the root user get a TGT for my user and then transfer that cache to my user, or something? In my case that transfer does not happen if I previously performed a kdestroy. From krb5_child.log: (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [sss_get_ccache_name_for_principal] (0x4000): Location: [KCM:] (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [sss_get_ccache_name_for_principal] (0x4000): tmp_ccname: [KCM:0:71555] (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache] (0x4000): Initializing ccache of type [KCM] (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache] (0x4000): CC supports switch (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [create_ccache] (0x4000): returning: 0 (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [safe_remove_old_ccache_file] (0x0400): New and old ccache file are the same, none will be deleted. (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [k5c_send_data] (0x0200): Received error code 0 (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [pack_response_packet] (0x2000): response packet size: [95] (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [k5c_send_data] (0x4000): Response sent. (Wed Feb 13 14:46:14 2019) [[sssd[krb5_child[12020]]]] [main] (0x0400): krb5_child completed successfully After a while (not sure how long) it works as expected again, presumably after a timeout of some sort. If I disable KCM (by removing /etc/krb5.conf.d/kcm_default_ccache) TGT retrieval works as expected. Am I missing something or is this a bug? Regards, Adam