Hello,
I found out that running ipa on rhel8 in the file /etc/krb5.conf.d/freeipa
the setting
[libdefaults]
spake_preauth_groups=edwards25519
prevents ad domain account users from logging in to the ipa server running
on rhel8
according to this site it's protection against dictionary attacks
https://web.mit.edu/kerberos/krb5-latest/doc/admin/spake.html
commenting those two lines and restarting the sssd service allows the ad
domain users to login to the rhel8 systems
however, this means I lose the extra protection against dictionary attacks.
Is there a way to have both ?
( login for ad users on rhel8 and dictionary attack protection )
Cheers
Rob