On ti, 13 elo 2019, Boyd Ako via FreeIPA-users wrote:
> On to, 01 elo 2019, Boyd Ako via FreeIPA-users wrote:
> Are you retrieving existing key or the key does not exist yet?
Created the host and the service. Not entirely sure about creating a key.
> What does 'ipa service-show NFS/...' show?
[root@ipa binary]# ipa service-show nfs/abyss.neverland.ddns.me
Principal name: NFS/abyss.neverland.ddns.me(a)NEVERLAND.DDNS.ME
Principal alias: NFS/abyss.neverland.ddns.me(a)NEVERLAND.DDNS.ME
Keytab: False
Managed by: abyss.neverland.ddns.me
Hosts allowed to retrieve keytab: ipa.neverland.ddns.me
> Does it have 'Keytab: True' in the output?
Apparently no... How do I change it to true?
By running ipa-getkeytab. Please read the documentation for
ipa-getkeytab and note the difference in behavior when '-r' is passed.
In short, if you haven't yet created a key (Keytab: False) you should
not use '-r' option.
If you have already generated the key (Keytab: True) and you want to
retrieve it for other server (typically for clustered environment), you
must use '-r' option, after setting up who is allowed to retrieve the
keytab.
> BTW, for NFS your service principal has to be nfs/..., not NFS/....
> This is described in the man page for rpc.gssd, section "Machine
> credentials".
Well the Web UI seems to have made them with caps.
It does not. The code for Web UI
has the following (editable) list of
pre-filled values:
....
name: 'service',
label: '@i18n:objects.service.service',
options: [
'cifs',
'DNS',
'ftp',
'HTTP',
'imap',
'ldap',
'libvirt',
'nfs',
'smtp',
'qpidd'
],
editable: true,
....
and in the code of Web UI I don't see the service value normalized
either way.
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland