This configuration parameter controls whether adclient deletes credentials from the Kerberos cache if they are the specified number of days old.

If you activate this parameter, the credentials will be cleared for all users whether or not they are logged on, have active processes running, or are specified in the following lists:


For example, to force adclient to clear the cache of credentials that were authenticated 6 days previously:

krb5.cache.clean.force.max: 6

The default value for this parameter is 0, which means that this configuration parameter will not clear the credential cache for any users.