On Wed, Apr 04, 2018 at 11:07:55AM -0500, Michael Rainey (Contractor, Code 7320) via
My organization is working to remove the need for passwords for its
end-users. While moving forward on this project I have noticed after
logging into a system the user is never given a TGT after login. A TGT can
be obtained by using kinit and entering a password, but this defeats the
purpose eliminating the use of passwords. Is there some guidance I can
follow to configure freeIPA to obtain a TGT at login. So farmy searches
have come up empty.
Is this type of configuration handled by SSSD or do I need to configure
Any guidance is greatly appreciated.
I guess you are talking about Smartcard based authentication. The
keyword here is PKINIT and since RHEL-7.4 can handled PKINIT as well.
If the IPA server side is already configured properly you can check with
'ipa-pkinit-manage status'. There is also 'ipa-advise
config-server-for-smart-card-auth' and 'ipa-advise
config-client-for-smart-card-auth'. Please see Chapter 23: Smart-card
Authentication in Identity Management of
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org