Dale Macartney wrote:


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On 05/09/12 13:39, Rob Crittenden wrote:
Dale Macartney wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Afternoon all

I have a demo lab set up with RHEV 3.0 and IPA running on RHEL 6.3 (
ipa-server-2.2-16)

I have an api script that handles all my deployments and I am trying to
set up a role account for my script to run within a jenkins environment.

I have created an ldap sysaccount, however that doesn't appear in the
RHEV users list when I do a search. So its clear its looking for
specific IPA users.

Is there a way (or on the roadmap), to create service/role accounts in
IPA where the password doesn't expire?

I'm trying to avoid scenarios like this

https://access.redhat.com/knowledge/solutions/67562

Any comments / suggestions are welcome

Thanks everyone

Dale


A work-around is to set krbpasswordexpiration of the user somewhere
far in the future to prevent expiration.
That'll work.. Do I need to do anything fancy though? I tried running
the below on a new user called rhev-build but it keeps erroring out. I
know I have a current TGT otherwise I wouldn't be able to add the user
in the first place.

[root@ds01 ~]# ipa user-mod rhev-build
--setattr=krbPasswordExpiration=20131231011529Z
ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the
'krbPasswordExpiration' attribute of entry
'uid=rhev-build,cn=users,cn=accounts,dc=example,dc=com'.
[root@ds01 ~]#

We don't let admins muck with the expiration date. Please file an RFE ticket if you'd like that capability.

You'll have to resort to ldapmodify:

$ ldapmodify -x -D 'cn=directory manager' -W
Enter LDAP Password:
dn: uid=tuser1,cn=users,cn=accounts,dc=example,dc=com
changetype: modify
replace: krbPasswordExpiration
krbPasswordExpiration: 20131231011529Z

modifying entry "uid=tuser1,cn=users,cn=accounts,dc=example,dc=com"

You might want to consider 2037 as the year. 2014 will be here before you know it.

rob



We have a ticket open on this,
https://fedorahosted.org/freeipa/ticket/2111, currently targeted for IPA
3.3.
Good to know its on its way. This is a demo lab so setting a long
password expiry addresses my needs.

rob



_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Reply via email to