Looks good for me.

Why using tempfile.mkstemp is safer in this case?

Because it ensures that odcs is the only process which can access that file and that the file did not exist before. WIthout this, it might happen that attacker creates that file, odcs opens it, writes the keytab to it and attacker can read the keytab.

On Mon, 2018-01-08 at 09:05 +0000, Jan Kaluža wrote:

jkaluza commented on the pull-request: Use tempfile.mkstemp as default KRB_AUTH_CCACHE_FILE value. that you are following:
Because it ensures that odcs is the only process which can access that file and that the file did not exist before. WIthout this, it might happen that attacker creates that file, odcs opens it, writes the keytab to it and attacker can read the keytab.

I see. Thanks for explanation. :thumbsup: