1:58 p.m.
On ke, 01 marras 2017, Charles Hedrick via FreeIPA-users wrote:
I understood that kinit -n is supposed to work with IPA 4.5. I have a
server upgraded from 4.4 to 4.5. kinit -n prompts for a password.
What needs to be true on client and server for this to work?
What needs to be done
depends on what setup do you have.
Run 'ipa-pkinit-manage status' to see what is the current status.
For integrated IPA CA:
- Run 'ipa-pkinit-manage enable' to enable PKINIT KDC certificate. You
need to do so on all IPA 4.5 servers. Preferably do upgrade all
servers to 4.5 as mix between KDCs would create a lot of confusion.
For CA-less setup:
- IPA would be unable to issue KDC certificates automatically in this
case, so it would only issue self-signed KDC cert on each IPA master
for the purpose of internal Web UI usage.
- Use 'ipa-server-certinstall' to install KDC certificate issued by
your external CA. Use instructions on
https://web.mit.edu/kerberos/krb5-1.15/doc/admin/pkinit.html to
generate KDC certificate request and sign it by your CA.
For both cases:
- Make sure your clients trust CA which issued KDC certificate. By
default, IPA clients are configured to trust IPA CA in
/etc/krb5.conf:
pkinit_anchors = FILE:/etc/ipa/ca.crt
If you are using different CA, you need to make sure this line
mentions a proper CA certificate.
- run 'ipa-server-upgrade' to make sure all remaining parts are
created too.
- Don't forget to restart IPA on each updated master.
--
/ Alexander Bokovoy