Hello,

I found out that running ipa on rhel8 in the file /etc/krb5.conf.d/freeipa the setting
[libdefaults]
spake_preauth_groups=edwards25519
prevents ad domain account users from logging in to the ipa server running on rhel8

according to this site it's protection against dictionary attacks
https://web.mit.edu/kerberos/krb5-latest/doc/admin/spake.html

commenting those two lines and restarting the sssd service allows the ad domain users to login to the rhel8 systems

however, this means I lose the extra protection against dictionary attacks.

Is there a way to have both ?
( login for ad users on rhel8 and dictionary attack protection )

Cheers
Rob