On Wed, 2014-07-09 at 18:38 +0200, Stijn De Weirdt wrote:
> hi all,
> we are investigating the possibility to use an existing and valid AD 
> token to obtain a token from a realm under FreeIPA (3.3.3 from el7), 
> without having to setup the full IPA AD cross realm trust. (in 
> particular, to avoid that AD has to trust the IPA setup; and with the 
> goal that we can minimise any required actions on the AD setup).
> what we would like to achieve is the following:
> kinit user@AD
> --- authenticate via AD password
> kinit otherusername@IPA
> -- no password required, authentication based on valid AD token
> so one can then eg "ssh otherusern...@machine.under.ipa.control"
> the user@AD to otherusername@IPA mapping is provided somewhere on the 
> IPA server and is static.
> as far as i understood, this is (very?) different from actual trust 
> relation where having the user@AD token is sufficient to do "ssh 
> otherusern...@machine.under.ipa.control".
> any hints are welcome!

It's not possible*, sorry.


* At the very theoretical level it would, but it would require extensive
changes to the kerberos libraries on each client as well as changes to
the KDC. Operationally unfeasible even if you had those code changes.

Simo Sorce * Red Hat, Inc * New York

Manage your subscription for the Freeipa-users mailing list:
Go To http://freeipa.org for more info on the project

Reply via email to