mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
committed by
Martin Kosek
parent
f695f79748
commit
8bbb42b410
@@ -90,7 +90,7 @@ When True provides detailed information. Specifically this set the global log le
|
||||
loggers matching regexp will be assigned XXX level.
|
||||
.IP
|
||||
Logger levels can be explicitly specified for specific loggers as
|
||||
opposed to a global logging level. Specific loggers are indiciated
|
||||
opposed to a global logging level. Specific loggers are indicated
|
||||
by a list of regular expressions bound to a level. If a logger's
|
||||
name matches the regexp then it is assigned that level. This config item
|
||||
must begin with "log_logger_level_" and then be
|
||||
|
||||
@@ -28,7 +28,7 @@ By default this configures SSSD to connect to an IPA server for authentication a
|
||||
|
||||
An authorized user is required to join a client machine to IPA. This can take the form of a kerberos principal or a one\-time password associated with the machine.
|
||||
|
||||
This same tool is used to unconfigure IPA and attemps to return the machine to its previous state. Part of this process is to unenroll the host from the IPA server. Unenrollment consists of disabling the prinicipal key on the IPA server so that it may be re\-enrolled. The machine principal in /etc/krb5.keytab (host/<fqdn>@REALM) is used to authenticate to the IPA server to unenroll itself. If this principal does not exist then unenrollment will fail and an administrator will need to disable the host principal (ipa host\-disable <fqdn>).
|
||||
This same tool is used to unconfigure IPA and attempts to return the machine to its previous state. Part of this process is to unenroll the host from the IPA server. Unenrollment consists of disabling the prinicipal key on the IPA server so that it may be re\-enrolled. The machine principal in /etc/krb5.keytab (host/<fqdn>@REALM) is used to authenticate to the IPA server to unenroll itself. If this principal does not exist then unenrollment will fail and an administrator will need to disable the host principal (ipa host\-disable <fqdn>).
|
||||
|
||||
.SS "HOSTNAME REQUIREMENTS"
|
||||
Client must use a \fBstatic hostname\fR. If the machine hostname changes for example due to a dynamic hostname assignment by a DHCP server, client enrollment to IPA server breaks and user then would not be able to perform Kerberos authentication.
|
||||
|
||||
@@ -47,7 +47,7 @@ example above).
|
||||
\fBWARNING:\fR retrieving the keytab resets the secret for the Kerberos principal.
|
||||
This renders all other keytabs for that principal invalid.
|
||||
|
||||
This is used during IPA client enrollement to retrieve a host service principal and store it in /etc/krb5.keytab. It is possible to retrieve the keytab without Kerberos credentials if the host was pre\-created with a one\-time password. The keytab can be retrieved by binding as the host and authenticating with this one\-time password. The \fB\-D|\-\-binddn\fR and \fB\-w|\-\-bindpw\fR options are used for this authentication.
|
||||
This is used during IPA client enrollment to retrieve a host service principal and store it in /etc/krb5.keytab. It is possible to retrieve the keytab without Kerberos credentials if the host was pre\-created with a one\-time password. The keytab can be retrieved by binding as the host and authenticating with this one\-time password. The \fB\-D|\-\-binddn\fR and \fB\-w|\-\-bindpw\fR options are used for this authentication.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-s ipaserver\fR
|
||||
|
||||
@@ -136,4 +136,4 @@ The exit status is 0 on success, nonzero on error.
|
||||
|
||||
.SH "SEE ALSO"
|
||||
.BR ipa-rmkeytab (1)
|
||||
.BR ipa-client-instal (1)
|
||||
.BR ipa-client-install (1)
|
||||
|
||||
Reference in New Issue
Block a user