Configuring identifications to obtain tokens for AFS cells

The OpenAFS plug-in maintains a list of AFS cells for each identification. A list is created the first time AFS tokens are obtained for an identification or when the list of cells is specified in the identification configuration panels. Each AFS cell that is listed is associated with a method by which a token should be obtained and the name of the Kerberos realm that is used to obtain the service ticket (more details are provided in the Token Aquisition Methods topic).

The following sections detail the process by which AFS cells can be specified when obtaining new credentials or configuring identifications.

Specifying AFS cells when obtaining new credentials

When the OpenAFS plug-in is installed, it enhances the NetIDMgr new credentials dialog with an AFS tokens options panel. A typical new credentials dialog is shown below demonstrating AFS cells listed in the credentials summary window.

New credentials window showing AFS cells in the credentials summary window

Clicking on the AFS link in the credentials summary window will take you to the AFS options page. Alternatively, you can select the Options >> button which expands the dialog to show the credentials type buttons, and then click the AFS button at the bottom of the expanded dialog.

The AFS identification options page is shown below

AFS identification options page

This page allows you to specify if AFS tokens are obtained for this identification and if so, for which tokens and by which method will they be obtained. By unchecking the Obtain AFS tokens checkbox, you can prevent AFS tokens from being obtained for this idenfication.

Once the new credentials dialog successfully completes, the list of cells will be saved with the identification. The next time you obtain new credentials for the identification, the list of cells will be loaded automatically. This list can be edited either by using the new credentials dialog or the identity configuration panels. (See Changing persistent tokent lists).

To add a cell:

Note that only one token can exist per cell per login session. Which means that if you already have a token for cell X while you are logged in as user A, then you can't have another token for cell X. This means that only one identification can obtain a token for a given cell.

Therefore, if you try to add a cell to an identification which is already listed in the persistent cell list for another identification or which currently exists under a different identification, you will receive a warning such as the following:

Message displaying warning about a duplicate cell

From here, you can decide to keep the cell listed for both identifications (although only one of them can be active at any given time), or remove the cell from all the other identifications and add it to the current one. Also, you can cancel the add cell request.

To modify a cell

Note that if you don't click the Add / Update, the cell entry will not be updated.

To delete cells

Cell states

When you add cells or when you view the cell list, you will see an icon next to each cell name. This icon represents the current state of the cell's token. You can double-click on the cell to get details about the state.

Token for cell foo.bar is a new token while the token for net.mit.edu is in a problem state. Double clicking the problem token will display a balloon prompt indicating what the problem is.

Changing persistent cell lists for existing identifications

The configuration panel for a persistent identification contains a panel for specifying the AFS cells. This panel is identical to the panel used by the new credentials dialog. You can easily modify the cell lists as described above and click Apply and you are done.

The AFS configuration panel for an identification is shown below.

You can reach this configuration panel by opening the configuration dialog (Options menu), and then clicking the persistent identification you need to modify options for.