[SSSD] SSSD (another) wish-list
John Hodrien
J.H.Hodrien at leeds.ac.uk
Mon Nov 21 15:10:48 UTC 2011
On Mon, 21 Nov 2011, Stephen Gallagher wrote:
> No, this is the entire point I was making. When you're joining the
> machine, you're doing so with Administrator credentials, not machine
> credentials. The privilege to change this value is not given to the
> machine, so it cannot change them later.
Nearly, but I wouldn't describe it as Administrator credentials. You're doing
it with credentials that can join a machine to the domain which is
significantly less privileged.
Question is, what *can* a machine do with its own credential? For example,
net ads keytab add works using a machine credential (at least it does on the
AD domain I'm testing against), so it can make service principals and update
its own ldap record as a result...
jh
More information about the sssd-devel
mailing list