On Fri, Jul 19, 2013 at 01:46:02PM +0200, Jakub Hrozek wrote:
The krb5 child contacts the PAC responder for any user except for the
IPA
native users if the PAC is configured. This works fine for the general
case but the ipa_server_mode is a special one. The PAC responder is there,
but since in the server mode we should be operating as AD provider default,
the PAC shouldn't be analyzed either in this case.
I already confused Alexander on IRC, so I should also clarify the path
-- the PAC is not used only during *password auth*. The PAC responder is
still up and running and the PAC is used in case of Kerberos auth.