On ti, 30 loka 2018, Ryan Slominski via FreeIPA-users wrote:
As far as option D goes I'm now starting to understand IPA makes a distinction between a password and Kerberos keys. If you don't set a password, but use ipa-getkeytab followed by ipa user-show the "Kerberos keys available" attribute changes from Fasle to True, but "Password" remains False. The web GUI doesn't seem to show whether keys were deployed for user accounts and I was expecting to see some indication that I had used ipa-getkeytab, but now see I can only tell using the command line. Can a user have a separate random key as well as a known plain text password simultaneously? Does the krblastpwdchange apply to both password and keys or do keys never expire?
I don't think you can have an independent password and a random key. When a password is set via LDAP, a special plugin will propagate it to Kerberos attributes (by setting hashes of it using specific algorithms for those attributes). When a password is updated via Kerberos kadmin protocol, the same happens for LDAP password too.
When ipa-getkeytab is used to generate a random key the very same plugin in LDAP server is placing this random key to both the userPassword attribute and to the Kerberos attributes. So they should be synchronized all the time.
When password expires is defined by the password policy. At that point both Kerberos keys and the userPassword in LDAP are expired and unusable for authentication (other than a request to change the password).
Obviously, you can create a policy that avoids expiring a password and that would be an equivalent to a never expiring key for a user.