If I create an IPA Service is the default state for the keys in the keytab to never
expire?
How do I set a password policy max life to never expire? Use "0"? Leave that
field blank in the GUI?
Since the keys and password are separate it sounds like I can't use an IPA service as
an LDAP bind user if I need to know the password plaintext. Even if I use the trick where
I set the password when I execute "ipa-getkeytab -P" I assume the password
I'm setting is really a key and not the userPassword in LDAP? Or can I still bind
using that plain text password?
You mentioned that both the userPassword and Kerberos keys are updated when ipa-getkeytab
is executed. Does that mean it is a bug that the IPA command line shows "Password:
False" and the GUI shows Password and Password Expiration fields as blank after
executing ipa-getkeytab?
It would be nice to say in all cases when you need an account for a script or application
just use an IPA service account. It still isn't clear if that is the case.