Hi,

I use nslcd with sasl_mech GSSAPI to connect to an LDAP server.  nslcd
therefore invokes k5start to obtain a kerberos ticket and keep it alive
using the command line:

| /usr/bin/k5start -b -p /run/nslcd/k5start_nslcd.pid -o nslcd -g nslcd -m 600 -f /etc/krb5.keytab -K 60 -u host/myhost.mydomain.mytld -k /var/run/nslcd/nslcd.tkt

which looks fine to me.  k5start wakes up every 60 minutes and renews
the ticket if necessary.

When the machine goes to sleep (suspend to ram and/or disk), the ticket
may expire nevertheless.  After resume, it takes up to 60 minutes until
k5start wakes up, notices that the ticket has expired and obtains a new
one.

One could now use a smaller value for the "-K" on machines which use the
suspend functionality, or restart nslcd on each resume, but I'd consider
these are only workarounds.

In my opinion kstart is responsible here.  It should provide a service
that triggers on resume and wakes up all running instances of k5start so
they can immediately check their tickets.

Thanks,
- Dietrich