Deleting expired credentials cache files

The kdestroy command deletes a Kerberos credentials cache file. Users need to periodically delete old credentials by using the kdestroy command.

The -e option causes the kdestroy command to check all of the credentials cache files in the default cache directory /QIBM/UserData/OS400/NetworkAuthentication/creds. Any file that contains only expired tickets that have been expired for the time_delta is deleted. The time_delta is expressed as nwndnhnmns, where n represents a number, w indicates weeks, d indicates days, h indicates hours, m indicates minutes, and s indicates seconds. The components must be specified in this order, but any component can be omitted (for example, 4h5m represents 4 hours and 5 minutes, and 1w2h represents 1 week and 2 hours). If only a number is specified, the default is hours.

1. To delete your default credentials cache:

   • On a Qshell command line, enter kdestroy

   • On an i5/OS^® control language (CL) command line, enter call qsys/qkrbkdstry

2. To delete all credentials cache files that have expired tickets older than 1 day:

   • On a Qshell command line, enter kdestroy -e 1d

   • On a CL command line, entercall qsys/qkrbkdstry parm ('-e' '1d')

See the kdestroy usage notes on this Qshell command for specifics on its usage and restrictions.

• kdestroy
  The Qshell command kdestroy destroys a Kerberos credentials cache.

Parent topic: