Skip Headers

Oracle® Database Advanced Security Administrator's Guide 10g Release 2 (10.2) Part Number B14268-02 |
Home | Book List | Contents | Index | Master Index | Feedback

Previous | Next
| View PDF

# 7 Configuring Kerberos Authentication

This chapter describes how to configure Oracle Advanced Security for Oracle Database for use with Kerberos authentication, and how to configure Kerberos to authenticate Oracle database users. This chapter contains the following sections:

- Enabling Kerberos Authentication

- Utilities for the Kerberos Authentication Adapter

- Configuring Interoperability with a Windows 2000 Domain Controller KDC

- Troubleshooting

See Also: Oracle Database Enterprise User Administrator's Guide for information on migrating Kerberos users to Kerberos-authenticated enterprise users

## 7.1 Enabling Kerberos Authentication

To enable Kerberos authentication:

- Task 1: Install Kerberos

- Task 2: Configure a Service Principal for an Oracle Database Server

- Task 3: Extract a Service Table from Kerberos

- Task 4: Install an Oracle Database Server and an Oracle Client

- Task 5: Install Oracle Net Services and Oracle Advanced Security

- Task 6: Configure Oracle Net Services and Oracle Database

- Task 7: Configure Kerberos Authentication

- Task 8: Create a Kerberos User

- Task 9: Create an Externally Authenticated Oracle User

- Task 10: Get an Initial Ticket for the Kerberos/Oracle User

### 7.1.1 Task 1: Install Kerberos

Install Kerberos on the system that functions as the authentication server.

See Also: About building and installing Kerberos from Kerberos version 5 source. Distribution for information about how to install Kerberos.

Note: After upgrading from a 32-bit version of Oracle Database, the first use of the Kerberos authentication adapter causes an error message: `ORA-01637: Packet receive failed`. Workaround: After upgrading to the 64-bit version of the database and before using Kerberos external authentication method, check for a file named `/usr/tmp/oracle_service_name.RC` on your computer, and remove it.

### 7.1.2 Task 2: Configure a Service Principal for an Oracle Database Server

To enable the Oracle database server to validate the identity of clients that authenticate themselves using Kerberos, you must create a service principal for Oracle Database.

The name of the principal should have the following format:

    kservice/kinstance@REALM

Each of the fields in the service principal specify the following values:

Service Principal Field | Description
--- | ---
kservice | A case-sensitive string that represents the Oracle service. This can be the same as the database service name.
kinstance | This is typically the fully qualified name of the system on which Oracle Database is running.
REALM | The domain name of the database server. REALM must always be uppercase and is typically the DNS domain name.

Note: The utility names in this section are executable programs. However, the Kerberos user name `krbuser` and the realm `SOMECO.COM` are examples only.

For example, suppose kservice is `oracle`, the fully qualified name of the system on which Oracle Database is running is `dbserver.someco.com` and the realm is `SOMECO.COM`. The principal name then is:

    oracle/dbserver.someco.com@SOMECO.COM

It is a convention to use the DNS domain name as the name of the realm. To create the service principal, run `kadmin.local`. On UNIX, run this command as the root user, by using the following syntax:

    # cd /kerberos-install-directory/sbin
    # ./kadmin.local

To add a principal named `oracle/dbserver.someco.com@SOMECO.COM` to the list of server principals known by Kerberos, enter the following:

    kadmin.local:addprinc -randkey oracle/dbserver.someco.com@SOMECO.COM

### 7.1.3 Task 3: Extract a Service Table from Kerberos

Extract the service table from Kerberos and copy it to the Oracle database server/Kerberos client system.

For example, use the following steps to extract a service table for `dbserver.someco.com`:

1. Enter the following to extract the service table:

       kadmin.local:  ktadd -k /tmp/keytab oracle/dbserver.someco.com

       Entry for principal oracle/dbserver.someco.com with kvno 2, encryption DES-CBC-CRC added to the keytab WRFILE: 'WRFILE:/tmp/keytab

       kadmin.local:  exit

       oklist -k -t /tmp/keytab

2. After the service table has been extracted, verify that the new entries are in the table in addition to the old ones. If they are not, or you need to add more, use `kadmin.local` to append to them.

   If you do not enter a realm when using `ktadd`, it uses the realm of the current host and displays it in the command output, as shown in Step 1.

3. If the Kerberos service table is on the same system as the Kerberos client, you can move it. If the service table is on a different system from the Kerberos client, you must transfer the file with a program such as FTP. If using FTP, transfer the file in binary mode.

   The following example shows how to move the service table on a UNIX platform:

       # mv /tmp/keytab /etc/v5srvtab

   The default name of the service file is `/etc/v5srvtab`.

4. Verify that the owner of the Oracle database server executable can read the service table (`/etc/v5srvtab` in the previous example). To do so, set the file owner to the Oracle user, or make the file readable by the group to which Oracle belongs.

   Caution: Do not make the file readable to all users. This can cause a security breach.

### 7.1.4 Task 4: Install an Oracle Database Server and an Oracle Client

Install the Oracle database server and client software.

See Also: Oracle Database operating system-specific installation documentation

### 7.1.5 Task 5: Install Oracle Net Services and Oracle Advanced Security

Install Oracle Net Services and Oracle Advanced Security on the Oracle database server and Oracle client systems.

See Also: Oracle Database operating system-specific installation documentation

### 7.1.6 Task 6: Configure Oracle Net Services and Oracle Database

Configure Oracle Net Services on the Oracle database server and client.

See Also: Oracle Database operating system-specific installation documentation Oracle Database Net Services Administrator's Guide.

### 7.1.7 Task 7: Configure Kerberos Authentication

Perform these tasks to set required parameters in the Oracle database server and client `sqlnet.ora` files:

- Step 1: Configure Kerberos on the Client and on the Database Server

- Step 2: Set the Initialization Parameters

- Step 3: Set sqlnet.ora Parameters (optional)

#### 7.1.7.1 Step 1: Configure Kerberos on the Client and on the Database Server

Use Oracle Net Manager to perform the following steps to configure Kerberos authentication service parameters on the client and on the database server (Refer to, "Starting Oracle Net Manager"):

1. Navigate to the Oracle Advanced Security profile. ( Refer to "Navigating to the Oracle Advanced Security Profile") The Oracle Advanced Security window is displayed (Figure 7-1):

Figure 7-1 Oracle Advanced Security Authentication Window (Kerberos)

Description of the illustration kerb0001.gif

2. Click the Authentication tab.

3. From the Available Methods list, select KERBEROS5.

4. Move KERBEROS5 to the Selected Methods list by clicking the right arrow (>).

5. Arrange the selected methods in order of use. To do this, select a method in the Selected Methods list, then click Promote or Demote to position it in the list. For example, if you want `KERBEROS5` to be the first service used, move it to the top of the list.

6. Click the Other Params tab (Figure 7-2).

Figure 7-2 Oracle Advanced Security Other Params Window (Kerberos)

Description of the illustration kerb0002.gif

1. From the Authentication Service list, select KERBEROS(V5).

2. Type Kerberos into the Service field. This field defines the name of the service Oracle Database uses to obtain a Kerberos service ticket. When you provide the value for this field, the other fields are enabled.

3. Optionally enter values for the following fields:

   - Credential Cache File

   - Configuration File

   - Realm Translation File

   - Key Table

   - Clock Skew

     See Also: Oracle Net Manager online Help, and "Step 3: Set sqlnet.ora Parameters (optional)", for more information about the fields and the parameters they configure

4. Select File, Save Network Configuration.

   The `sqlnet.ora` file is updated with the following entries:

       SQLNET.AUTHENTICATION_SERVICES=(KERBEROS5)
       SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=kservice

#### 7.1.7.2 Step 2: Set the Initialization Parameters

To set parameters in the initialization parameter file:

1. Add the following parameter to the initialization parameter file:

       REMOTE_OS_AUTHENT=FALSE

   Caution: Setting `REMOTE_OS_AUTHENT` to `TRUE` can enable a security breach, because it lets someone using a non-secure protocol, such as TCP, perform an operating system-authorized login (formerly called an `OPS$` login).

   Note: In addition to setting the `REMOTE_OS_AUTHENT` initialization parameter file to `FALSE`, you should issue the startup command with a `PFILE` option. This ensures that the parameters from `initSID.ora` file are used.

2. Because Kerberos user names can be long, and Oracle user names are limited to 30 characters, Oracle strongly recommends that you set the value of `OS_AUTHENT_PREFIX` to null as follows:

       OS_AUTHENT_PREFIX=""

   Setting this parameter to null overrides the default value of `OPS$`.

#### 7.1.7.3 Step 3: Set sqlnet.ora Parameters (optional)

In addition to the required parameters, you can optionally set the following parameters in the `sqlnet.ora` file on the client and the Oracle database server:

Attribute | Description
--- | ---
Parameter: | `SQLNET.KERBEROS5_CC_NAME=``pathname_to_credentials_cache_file`
Description: | Specifies the complete path name to the Kerberos credentials cache (CC) file. The default value is operating system-dependent. For UNIX, it is `/tmp/krb5cc_userid`. You can also set this parameter by using the `KRB5CCNAME` environment variable, but the value set in the `sqlnet.ora` file takes precedence over the value set in `KRB5CCNAME`.
Example: | `SQLNET.KERBEROS5_CC_NAME=/usr/tmp/krbcache`
Parameter: | `SQLNET.KERBEROS5_CLOCKSKEW=``number_of_seconds_accepted_as_network_delay`
Description: | This parameter specifies how many seconds can pass before a Kerberos credential is considered out-of-date. It is used when a credential is actually received by either a client or a database server. An Oracle database server also uses it to decide if a credential needs to be stored to protect against a replay attack. The default is 300 seconds.
Example: | `SQLNET.KERBEROS5_CLOCKSKEW=1200`
Parameter: | `SQLNET.KERBEROS5_CONF=``pathname_to_Kerberos_configuration_file`
Description: | This parameter specifies the complete path name to the `Kerberos` configuration file. The configuration file contains the realm for the default KDC (key distribution center) and maps realms to KDC hosts. The default is operating system-dependent. For UNIX, it is `/krb5/krb.conf`.
Example: | `SQLNET.KERBEROS5_CONF=/krb/krb.conf`
Parameter: | `SQLNET.KERBEROS5_CONF_MIT=[TRUE|FALSE]`
Description: | This parameter specifies whether the new MIT Kerberos configuration format is used. If the value is set to `TRUE`, it will parse the file according to the new configuration format rules. When the value is set to `FALSE`, the default (non-MIT) configuration is used. The default is `FALSE`.
Example: | `SQLNET.KERBEROS5_CONF_MIT=False`
Parameter: | `SQLNET.KERBEROS5_KEYTAB=``pathname_to_Kerberos_principal/key_table`
Description: | This parameter specifies the complete path name to the Kerberos principal/secret key mapping file. It is used by the Oracle database server to extract its key and decrypt the incoming authentication information from the client. The default is operating system-dependent. For UNIX, it is `/etc/v5srvtab`.
Example: | `SQLNET.KERBEROS5_KEYTAB=/etc/v5srvtab`
Parameter: | `SQLNET.KERBEROS5_REALMS=``pathname_to_Kerberos_realm_translation_file`
Description: | This parameter specifies the complete path name to the Kerberos realm translation file. The translation file provides a mapping from a host name or domain name to a realm. The default is operating system-dependent. For UNIX, it is `/etc/krb.realms`.
Example: | `SQLNET.KERBEROS5_REALMS=/krb5/krb.realms`

### 7.1.8 Task 8: Create a Kerberos User

To create Oracle users that Kerberos can authenticate, perform this task on the Kerberos authentication server where the administration tools are installed. The realm must already exist.

Note: The utility names in this section are executable programs. However, the Kerberos user name `krbuser` and realm `SOMECO.COM` are examples only. They can vary among systems.

Run `/krb5/admin/kadmin.local` as root to create a new Kerberos user, such as `krbuser`.

The following example is UNIX-specific:

    # ./kadmin.local
    kadmin.local: addprinc krbuser
    Enter password for principal: "krbuser@SOMECO.COM": (password does not display)
    Re-enter password for principal: "krbuser@SOMECO.COM": (password does not display)
    kadmin.local: exit

### 7.1.9 Task 9: Create an Externally Authenticated Oracle User

Run SQL*Plus on the Oracle database server to create the Oracle user that corresponds to the Kerberos user. In the following example, `OS_AUTHENT_PREFIX` is set to null (`""`). The Oracle user name is in uppercase enclosed in double quotation marks as shown in the following example:

    SQL> CONNECT / AS SYSDBA;
    SQL> CREATE USER "KRBUSER@SOMECO.COM" IDENTIFIED EXTERNALLY;
    SQL> GRANT CREATE SESSION TO "KRBUSER@SOMECO.COM";

### 7.1.10 Task 10: Get an Initial Ticket for the Kerberos/Oracle User

Before you can connect to the database, you must ask the Key Distribution Center (KDC) for an initial ticket. To do so, run the following on the client:

    % okinit username

If, when making a database connection, a reference such as the following follows a database link, you must use the forwardable flag (`-f`) option:

    sqlplus /@oracle

Executing `okinit -f` enables credentials that can be used across database links. Run the following commands on the Oracle client:

    % okinit -f
    Password for krbuser@SOMECO.COM:password

## 7.2 Utilities for the Kerberos Authentication Adapter

Three utilities are shipped with the Oracle Kerberos authentication adapter. These utilities are intended for use on an Oracle client with Oracle Kerberos authentication support installed. Use the following utilities for these specified tasks:

- Obtaining the Initial Ticket with the okinit Utility

- Displaying Credentials with the oklist Utility

- Removing Credentials from the Cache File with the okdstry Utility

### 7.2.1 Obtaining the Initial Ticket with the okinit Utility

The `okinit` utility obtains and caches Kerberos tickets. This utility is typically used to obtain the ticket-granting ticket, using a password entered by the user to decrypt the credential from the key distribution center (KDC). The ticket-granting ticket is then stored in the user's credential cache.

The options available with `okinit` are listed in Table 7-1:

Table 7-1 Options for the okinit Utility

Option | Description
--- | ---
`-f` | Ask for a forwardable ticket-granting ticket. This option is necessary to follow database links.
`-l` | Specify the lifetime of the ticket-granting ticket and all subsequent tickets. By default, the ticket-granting ticket is good for eight (8) hours, but shorter or longer-lived credentials may be desired. Note that the KDC can ignore this option or put site-configured limits on what can be specified. The lifetime value is a string that consists of a number qualified by `w` (weeks), `d` (days), `h` (hours), `m` (minutes), or `s` (seconds), as in the following example:
    okinit -l 2wld6h20m30s
The example requests a ticket-granting ticket that has a life time of 2 weeks, 1 day, 6 hours, 20 minutes, and 30 seconds.
`-c` | Specify an alternative credential cache. For UNIX, the default is `/tmp/krb5cc_`uid. You can also specify the alternate credential cache by using the `SQLNET.KERBEROS5_CC_NAME` parameter in the `sqlnet.ora` file.
`-?` | List command line options.

### 7.2.2 Displaying Credentials with the oklist Utility

Run the `oklist` utility to display the list of tickets held. Available `oklist` options are listed in Table 7-2:

Table 7-2 Options for the oklist Utility

Option | Description
--- | ---
`-f` | Show flags with credentials. Relevant flags are: `I`, credential is a ticket-granting ticket `F`, credential is forwardable `f`, credential is forwarded.
`-c` | Specify an alternative credential cache. In UNIX, the default is `/tmp/krb5cc_``uid`. The alternate credential cache can also be specified by using the `SQLNET.KERBEROS5_CC_NAME` parameter in the `sqlnet.ora` file.
`-k` | List the entries in the service table (default `/etc/v5srvtab`) on UNIX. The alternate service table can also be specified by using the `SQLNET.KERBEROS5_KEYTAB` parameter in the `sqlnet.ora` file.

The show flag option (`-f`) displays additional information, as shown in the following example:

    % oklist -f
    27-Jul-1999 21:57:51   28-Jul-1999 05:58:14
    krbtgt/SOMECO.COM@SOMECO.COM
    Flags: FI

### 7.2.3 Removing Credentials from the Cache File with the okdstry Utility

Use the `okdstry` utility to remove credentials from the credentials cache file:

    $ okdstry -f

where the `-f` command option lets you specify an alternative credential cache. For UNIX, the default is `/tmp/krb5cc_``uid`. You can also specify the alternate credential cache by using the `SQLNET.KRB5_CC_NAME` parameter in the `sqlnet.ora` file.

### 7.2.4 Connecting to an Oracle Database Server Authenticated by Kerberos

You can now connect to an Oracle database server without using a user name or password. Enter a command similar to the following:

    $ sqlplus /@net_service_name

where `net_service_name` is an Oracle Net Services service name. For example:

    $ sqlplus /@oracle_dbname

See Also: Chapter 1, "Introduction to Oracle Advanced Security" and Oracle Database Heterogeneous Connectivity Administrator's Guide for information about external authentication

## 7.3 Configuring Interoperability with a Windows 2000 Domain Controller KDC

Oracle Advanced Security, which complies with MIT Kerberos, can interoperate with tickets that are issued by a Kerberos Key Distribution Center (KDC) on a Windows 2000 domain controller to enable Kerberos authentication with an Oracle database. To configure Kerberos authentication that uses a Windows 2000 domain controller KDC, perform the following tasks:

- Task 1: Configure an Oracle Kerberos Client to Interoperate with a Windows 2000 Domain Controller KDC

- Task 2: Configure a Windows 2000 Domain Controller KDC to Interoperate with an Oracle Client

- Task 3: Configure an Oracle Database to Interoperate with a Windows 2000 Domain Controller KDC

- Task 4: Obtain an Initial Ticket for the Kerberos/Oracle User

### 7.3.1 Task 1: Configure an Oracle Kerberos Client to Interoperate with a Windows 2000 Domain Controller KDC

The following steps must be performed on the Oracle Kerberos client.

#### 7.3.1.1 Step 1: Create the Client Kerberos Configuration Files to Use a Windows Domain Controller KDC

Create the following Kerberos client configuration files that refer to the Windows 2000 domain controller as the Kerberos KDC. In the examples that follow, the Windows 2000 domain controller is running on a node named `sales3854.us.acme.com`.

- `krb.conf` file

  For example:

      SALES3854.US.ACME.COM
      SALES3854.US.ACME.COM sales3854.us.acme.com admin server

- `krb5.conf` file

  For example:

      [libdefaults]
      default_realm=SALES.US.ACME.COM
      [realms]
      SALES.US.ACME.COM= {

    kdc=sales3854.us.acme.com:88
    }

    [domain_realm]
    .us.acme.com=SALES.US.ACME.COM

- `krb5.realms` file

  For example:

      us.acme.com SALES.US.ACME.COM

#### 7.3.1.2 Step 2: Specify the Oracle Configuration Parameters in the sqlnet.ora File

Configuring an Oracle client to interoperate with a Windows 2000 domain controller KDC uses the same `sqlnet.ora` file parameters that are listed in "Step 1: Configure Kerberos on the Client and on the Database Server".

Set the following parameters in the `sqlnet.ora` file on the client:

    SQLNET.KERBEROS5_CONF=pathname_to_Kerberos_configuration_file
    SQLNET.KERBEROS5_CONF_MIT=TRUE
    SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=Kerberos_service_name
    SQLNET.AUTHENTICATION_SERVICES=(BEQ,KERBEROS5)

Note: Ensure that the `SQLNET.KERBEROS5_CONF_MIT` parameter is set to `TRUE` because the Windows 2000 operating system is designed to interoperate only with security services that are based on MIT Kerberos version 5.

#### 7.3.1.3 Step 3: Specify the Listening Port Number

The Windows 2000 domain controller KDC listens on UDP/TCP port 88. Ensure that the system file entry for `kerberos5` is set to UDP/TCP port 88 as follows:

For the UNIX environ,emt, ensure that the `kerberos5` entry in the `/etc/services` file is set to 88

### 7.3.2 Task 2: Configure a Windows 2000 Domain Controller KDC to Interoperate with an Oracle Client

The following steps must be performed on the Windows 2000 domain controller.

See Also: Microsoft documentation for information about how to create users in Active Directory.

#### 7.3.2.1 Step 1: Create the User

Create a new user for the Oracle client in Microsoft Active Directory.

#### 7.3.2.2 Step 2: Create the Oracle Database Principal

1. Create a new user for the Oracle database in Microsoft Active Directory.

   For example, if the Oracle database runs on the host `sales3854.us.acme.com`, then use Active Directory to create a user with the user name `sales3854.us.acme.com` and the password `oracle`.

   Note: Do not create a user as `host/hostname.dns.com`, such as `oracle/sales3854.us.acme.com`, in Active Directory. Microsoft's KDC does not support multipart names like an MIT KDC does. An MIT KDC allows multipart names to be used for service principals because it treats all principals as user names. However, Microsoft's KDC does not.

2. Use the `Ktpass` command line utility to extract the keytab file with the following syntax:

       Ktpass -princ service/hostname@NT-DNS-REALM-NAME -mapuser account -pass password -out keytab.file

   Using the database user created in the previous step, the following is an example of `Ktpass` usage:

       C:> Ktpass -princ oracle/sales3854.us.acme.com@SALES.US.COM -mapuser sales3854 -pass oracle -out C:\temp\v5srvtab

   This utility is part of the Windows 2000 Support Tools and can be found on the Windows 2000 distribution media in the `\support\reskit\netmgmt\security` folder.

3. Copy the extracted keytab file to the host computer where the Oracle database is installed.

   For example, the keytab that was created in the previous step can be copied to `/krb5/v5svrtab`.

   See Also: Detailed information about Windows 2000 interoperability with Kerberos 5 that is available at the following URL:
       http://www.microsoft.com/WINDOWS2000/techinfo/planning/security/kerbsteps.asp

### 7.3.3 Task 3: Configure an Oracle Database to Interoperate with a Windows 2000 Domain Controller KDC

The following steps must be performed on the host computer where the Oracle database is installed.

#### 7.3.3.1 Step 1: Set Configuration Parameters in the sqlnet.ora File

Specify values for the following parameters in the `sqlnet.ora` file for the database server:

    SQLNET.KERBEROS5_CONF=pathname_to_Kerberos_configuration_file
    SQLNET.KERBEROS5_KEYTAB=pathname_to_Kerberos_principal/key_table
    SQLNET.KERBEROS5_CONF_MIT=TRUE
    SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=Kerberos_service_name
    SQLNET.AUTHENTICATION_SERVICES=(BEQ,KERBEROS5)

Note: Ensure that the `SQLNET.KERBEROS5_CONF_MIT` parameter is set to `TRUE` because the Windows 2000 operating system is designed to interoperate only with security services that are based on MIT Kerberos version 5.

#### 7.3.3.2 Step 2: Create an Externally Authenticated Oracle User

Follow the task information for "Task 9: Create an Externally Authenticated Oracle User" to create an externally authenticated Oracle user. Ensure that the username is created in all uppercase characters. For example, `ORAKRB@SALES.US.ACME.COM`.

See Also: "Task 7: Configure Kerberos Authentication" for information about using Oracle Net Manager to set the `sqlnet.ora` file parameters.

### 7.3.4 Task 4: Obtain an Initial Ticket for the Kerberos/Oracle User

Before a client can connect to the database, the client must request an initial ticket. To request an initial ticket, follow the task information for "Task 10: Get an Initial Ticket for the Kerberos/Oracle User".

## 7.4 Troubleshooting

This section lists some common configuration problems and explains how to resolve them.

- If you cannot get your ticket-granting ticket using `okinit`:

  - Ensure that the default realm is correct by examining the `krb.conf` file.

  - Ensure that the KDC is running on the host specified for the realm.

  - Ensure that the KDC has an entry for the user principal and that the passwords match.

  - Ensure that the `krb.conf` and `krb.realms` files are readable by Oracle.

- If you have an initial ticket but still cannot connect:

  - After trying to connect, check for a service ticket.

  - Check that the `sqlnet.ora` file on the database server side has a service name that corresponds to a service known by Kerberos.

  - Check that the clocks on all systems involved are set to times that are within a few minutes of each other or change the `SQLNET.KERBEROS5_CLOCKSKEW` parameter in the `sqlnet.ora` file.

- If you have a service ticket and you still cannot connect:

  - Check the clocks on the client and database server.

  - Check that the `v5srvtab` file exists in the correct location and is readable by Oracle. Remember to set the `sqlnet.ora` parameters.

  - Check that the `v5srvtab` file has been generated for the service named in the `sqlnet.ora` file on the database server side.

- If everything seems to work fine, but then you issue another query and it fails:

  - Check that the initial ticket is forwardable. You must have obtained the initial ticket by running the `okinit` utility.

  - Check the expiration date on the credentials. If the credentials have expired, then close the connection and run `okinit` to get a new initial ticket.