[SSSD] SSSD (another) wish-list

John Hodrien J.H.Hodrien at leeds.ac.uk
Mon Nov 21 15:10:48 UTC 2011


On Mon, 21 Nov 2011, Stephen Gallagher wrote:

> No, this is the entire point I was making. When you're joining the
> machine, you're doing so with Administrator credentials, not machine
> credentials. The privilege to change this value is not given to the
> machine, so it cannot change them later.

Nearly, but I wouldn't describe it as Administrator credentials.  You're doing
it with credentials that can join a machine to the domain which is
significantly less privileged.

Question is, what *can* a machine do with its own credential?  For example,
net ads keytab add works using a machine credential (at least it does on the
AD domain I'm testing against), so it can make service principals and update
its own ldap record as a result...

jh



More information about the sssd-devel mailing list