[Freeipa-users] Re: Disabling "kinit admin" on all machines

Hi,

This is a rather late reply but I'm now to RedHat IdM.

Would it be possible to have a kdcpolicy plugin that only allow admin tokens issued on machines that are listed in some allow list? I guess the list could even by dynamic as I also would like to limit it to the IdM servers them selves.

I guess that it would require some C programming but maybe not that hard to do.

Regards, // mem