1:14 p.m.
Hi,
Can you please remind me from which IPA version you support service
principals not bound to hosts? I think that would be then a better solution
for my case, as I am really using this user for non-interactive workloads.
And in the meantime, what is the nicest solution for some service that has
instances on multiple hosts? I could of course define separate service
principals for each one of them (e.g.. MYSVC/hostname), but if - for
example - they need to read secrets from the same shared Vault, I then must
add all of them as its members. And there are 30 instances... That is why I
thought to let them authenticate with the same principal.
Any solution for this in current version of IPA (4.6)?
---
Regards,
Dmitry Perets
On Fri, 22 Nov 2019, 20:05 Alexander Bokovoy, <abokovoy(a)redhat.com> wrote:
On pe, 22 marras 2019, Charles Hedrick via FreeIPA-users wrote:
>Interesting idea, but seems to require a time machine. The kerberos in
>centos 8 is 1.16. I believe Ubuntu 18 is also.
Actually, I did check of the source code commits in upstream MIT
Kerberos and I attributed it wrongly. '-f' is part of 1.17 release and
'-s' is in 1.16 release. So, it should be in RHEL 8.
>On Nov 22, 2019, at 1:21 PM, Alexander Bokovoy via FreeIPA-users
><freeipa-users(a)lists.fedorahosted.org<mailto:
freeipa-users(a)lists.fedorahosted.org>>
>wrote:
>
>ktutil> add_entry -password -p principal -k kvno -f
>
>The key part here is '-f' which fetches a salt from KDC. Otherwise,
>you'd need to use '-s salt' option to specify a salt manually. Option
>'-f' appeared in MIT 1.18, '-s' in MIT Kerberos 1.17.
>
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland