On ti, 30 loka 2018, Ryan Slominski via FreeIPA-users wrote:
As far as option D goes I'm now starting to understand IPA makes
a
distinction between a password and Kerberos keys. If you don't set a
password, but use ipa-getkeytab followed by ipa user-show the "Kerberos
keys available" attribute changes from Fasle to True, but "Password"
remains False. The web GUI doesn't seem to show whether keys were
deployed for user accounts and I was expecting to see some indication
that I had used ipa-getkeytab, but now see I can only tell using the
command line. Can a user have a separate random key as well as a known
plain text password simultaneously? Does the krblastpwdchange apply
to both password and keys or do keys never expire?
I don't think you can have an
independent password and a random key.
When a password is set via LDAP, a special plugin will propagate it to
Kerberos attributes (by setting hashes of it using specific algorithms
for those attributes). When a password is updated via Kerberos kadmin
protocol, the same happens for LDAP password too.
When ipa-getkeytab is used to generate a random key the very same plugin
in LDAP server is placing this random key to both the userPassword
attribute and to the Kerberos attributes. So they should be synchronized
all the time.
When password expires is defined by the password policy. At that point
both Kerberos keys and the userPassword in LDAP are expired and unusable
for authentication (other than a request to change the password).
Obviously, you can create a policy that avoids expiring a password and
that would be an equivalent to a never expiring key for a user.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland