Hi, I'm running FreeIPA v4.8.7. I have a requirement that end user systems (not enrolled in FreeIPA) be allowed SSH access on FreeIPA enrolled servers through Kerberos authentication. As of now I'm using user keytabs on the end systems to get a ticket and then authenticate to SSH with GSSAPI.
However, I've run into few issues: 1) I've read about authentication indicators in FreeIPA, how can enforce a policy where the end user is required to enter their password+OTP when authenticating to the web UI? But, OTP remains optional for SSH login. This policy assumes that I've both "Password and Two factor authentication (password + OTP)" set as user authentication method. 2) Probably a long shot, but, is there any way that user keytabs can be generated and retrieved via an API call? I'd like to have some automation so that when a new user is created on the FreeIPA server or a user changes their password, the new resulting keytab can be downloaded on the end user systems via an API call to the JSON RPC endpoint. Any help is appreciated. Thanks. _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
