If I create an IPA Service is the default state for the keys in the keytab to never expire?
How do I set a password policy max life to never expire? Use "0"? Leave that field blank in the GUI?
Since the keys and password are separate it sounds like I can't use an IPA service as an LDAP bind user if I need to know the password plaintext. Even if I use the trick where I set the password when I execute "ipa-getkeytab -P" I assume the password I'm setting is really a key and not the userPassword in LDAP? Or can I still bind using that plain text password?
You mentioned that both the userPassword and Kerberos keys are updated when ipa-getkeytab is executed. Does that mean it is a bug that the IPA command line shows "Password: False" and the GUI shows Password and Password Expiration fields as blank after executing ipa-getkeytab?
It would be nice to say in all cases when you need an account for a script or application just use an IPA service account. It still isn't clear if that is the case.