URL:
https://github.com/freeipa/freeipa/pull/823
Title: #823: ipa-kdb: reload certificate mapping rules periodically
dkupka commented:
"""
@sumit-bose Yes, I added rule that should allow the user to kinit with certificate. I
tried and it worked. Then I modified the rule so it no longer matched the user and
immediate pkinit failed. I see the message with each kinit not it the interval:
```
$ sudo grep "Initializing IPA certauth plugin" /var/log/krb5kdc.log
Jun 01 08:44:45
vm-150.example.com krb5kdc[3908](info): Initializing IPA certauth
plugin.
Jun 01 08:45:07
vm-150.example.com krb5kdc[3910](info): Initializing IPA certauth
plugin.
Jun 01 08:52:54
vm-150.example.com krb5kdc[3907](info): Initializing IPA certauth
plugin.
Jun 01 08:52:57
vm-150.example.com krb5kdc[3911](info): Initializing IPA certauth
plugin.
Jun 01 08:53:22
vm-150.example.com krb5kdc[3908](info): Initializing IPA certauth
plugin.
Jun 01 08:56:50
vm-150.example.com krb5kdc[3909](info): Initializing IPA certauth
plugin.
Jun 01 09:02:14
vm-150.example.com krb5kdc[3912](info): Initializing IPA certauth
plugin.
Jun 01 09:02:33
vm-150.example.com krb5kdc[3907](info): Initializing IPA certauth
plugin.
Jun 01 14:55:21
vm-150.example.com krb5kdc[3908](info): Initializing IPA certauth
plugin.
```
"""
See the full comment at
https://github.com/freeipa/freeipa/pull/823#issuecomment-305485079