Re: [Freeipa-users] authenticate with base domain name?

2013-08-01 Thread Sumit Bose
On Wed, Jul 31, 2013 at 03:03:04PM -0500, KodaK wrote: On Wed, Jul 31, 2013 at 1:28 PM, KodaK sako...@gmail.com wrote: On Wed, Jul 31, 2013 at 11:24 AM, Sumit Bose sb...@redhat.com wrote: On Wed, Jul 31, 2013 at 11:12:47AM -0500, KodaK wrote: On Wed, Jul 31, 2013 at 11:09 AM, KodaK

Re: [Freeipa-users] authenticate with base domain name?

2013-07-31 Thread Sumit Bose
On Tue, Jul 30, 2013 at 03:01:18PM -0500, KodaK wrote: Ok, so, yeah -- my first question stands. This works when it falls back to LDAP, but it does not honor a kerberos ticket. Is there a way to do that in the same circumstances? Thanks again, --Jason On Tue, Jul 30, 2013 at 2:58 PM,

Re: [Freeipa-users] authenticate with base domain name?

2013-07-31 Thread KodaK
On Wed, Jul 31, 2013 at 6:56 AM, Sumit Bose sb...@redhat.com wrote: I think that's the issue. You have to make sure that host.domain.com has a DNS entry somewhere, it does not have to be the IPA DNS but the DNS setup must be correct so the IPA DNS can forward the request to the right

Re: [Freeipa-users] authenticate with base domain name?

2013-07-31 Thread KodaK
On Wed, Jul 31, 2013 at 11:09 AM, KodaK sako...@gmail.com wrote: On Wed, Jul 31, 2013 at 6:56 AM, Sumit Bose sb...@redhat.com wrote: I think that's the issue. You have to make sure that host.domain.com has a DNS entry somewhere, it does not have to be the IPA DNS but the DNS setup

Re: [Freeipa-users] authenticate with base domain name?

2013-07-31 Thread Sumit Bose
On Wed, Jul 31, 2013 at 11:09:43AM -0500, KodaK wrote: On Wed, Jul 31, 2013 at 6:56 AM, Sumit Bose sb...@redhat.com wrote: I think that's the issue. You have to make sure that host.domain.com has a DNS entry somewhere, it does not have to be the IPA DNS but the DNS setup must be

Re: [Freeipa-users] authenticate with base domain name?

2013-07-31 Thread Sumit Bose
On Wed, Jul 31, 2013 at 11:12:47AM -0500, KodaK wrote: On Wed, Jul 31, 2013 at 11:09 AM, KodaK sako...@gmail.com wrote: On Wed, Jul 31, 2013 at 6:56 AM, Sumit Bose sb...@redhat.com wrote: I think that's the issue. You have to make sure that host.domain.com has a DNS entry

Re: [Freeipa-users] authenticate with base domain name?

2013-07-31 Thread KodaK
On Wed, Jul 31, 2013 at 11:24 AM, Sumit Bose sb...@redhat.com wrote: On Wed, Jul 31, 2013 at 11:12:47AM -0500, KodaK wrote: On Wed, Jul 31, 2013 at 11:09 AM, KodaK sako...@gmail.com wrote: On Wed, Jul 31, 2013 at 6:56 AM, Sumit Bose sb...@redhat.com wrote: I think that's the

Re: [Freeipa-users] authenticate with base domain name?

2013-07-31 Thread KodaK
On Wed, Jul 31, 2013 at 1:28 PM, KodaK sako...@gmail.com wrote: On Wed, Jul 31, 2013 at 11:24 AM, Sumit Bose sb...@redhat.com wrote: On Wed, Jul 31, 2013 at 11:12:47AM -0500, KodaK wrote: On Wed, Jul 31, 2013 at 11:09 AM, KodaK sako...@gmail.com wrote: On Wed, Jul 31, 2013 at 6:56

Re: [Freeipa-users] authenticate with base domain name?

2013-07-31 Thread Sumit Bose
On Wed, Jul 31, 2013 at 01:57:50PM -0500, KodaK wrote: On Wed, Jul 31, 2013 at 1:28 PM, KodaK sako...@gmail.com wrote: On Wed, Jul 31, 2013 at 11:24 AM, Sumit Bose sb...@redhat.com wrote: On Wed, Jul 31, 2013 at 11:12:47AM -0500, KodaK wrote: On Wed, Jul 31, 2013 at 11:09 AM, KodaK

Re: [Freeipa-users] authenticate with base domain name?

2013-07-31 Thread KodaK
On Wed, Jul 31, 2013 at 1:28 PM, KodaK sako...@gmail.com wrote: On Wed, Jul 31, 2013 at 11:24 AM, Sumit Bose sb...@redhat.com wrote: On Wed, Jul 31, 2013 at 11:12:47AM -0500, KodaK wrote: On Wed, Jul 31, 2013 at 11:09 AM, KodaK sako...@gmail.com wrote: On Wed, Jul 31, 2013 at 6:56

Re: [Freeipa-users] authenticate with base domain name?

2013-07-30 Thread KodaK
Nevermind, AIX problem (surprise, surprise!) Since it's half-kerberized at this point (the default is system auth, not kerb/ldap) it failed. I had to create entries in /etc/security/user for the users I wanted to test with and explicitly state that I wanted them to log on via krb5/ldap. --Jason

Re: [Freeipa-users] authenticate with base domain name?

2013-07-30 Thread KodaK
Ok, so, yeah -- my first question stands. This works when it falls back to LDAP, but it does not honor a kerberos ticket. Is there a way to do that in the same circumstances? Thanks again, --Jason On Tue, Jul 30, 2013 at 2:58 PM, KodaK sako...@gmail.com wrote: Nevermind, AIX problem