[root@server ~]# ldapclient manual
         -a credentialLevel=anonymous
         -a authenticationMethod=none
         -a defaultSearchBase=dc=example,dc=com
         -a domainName=example.com
         -a defaultServerList=192.168.0.1
         -a attributeMap=group:memberuid=memberUid
         -a attributeMap=group:gidnumber=gidNumber
         -a attributeMap=passwd:gidnumber=gidNumber
         -a attributeMap=passwd:uidnumber=uidNumber
         -a attributeMap=passwd:homedirectory=homeDirectory
         -a attributeMap=passwd:loginshell=loginShell
         -a attributeMap=shadow:userpassword=userPassword
         -a objectClassMap=group:posixGroup=posixgroup
         -a objectClassMap=passwd:posixAccount=posixaccount
         -a objectClassMap=shadow:shadowAccount=posixaccount
         -a serviceSearchDescriptor=passwd:cn=users,cn=accounts,dc=example,dc=com
         -a serviceSearchDescriptor=group:cn=groups,cn=accounts,dc=example,dc=com

[root@server ~]# ntpdate ipaserver.example.com

[root@server ~]# vim /etc/krb5/krb5.conf

[libdefaults]
default_realm = EXAMPLE.COM
verify_ap_req_nofail = false

[realms]
EXAMPLE.COM = {
kdc = ipaserver.example.com
admin_server = ipaserver.example.com
}

[domain_realm]
example.com = EXAMPLE.COM
.example.com = EXAMPLE.COM

[logging]
default = FILE:/var/krb5/kdc.log
kdc = FILE:/var/krb5/kdc.log

[appdefaults]
kinit = {
renewable = true
forwardable= true
}

[root@server ~]# vim /etc/pam.conf 

# login service (explicit because of pam_dial_auth)
#
login   auth requisite          pam_authtok_get.so.1
login   auth required           pam_dhkeys.so.1
login   auth sufficient         pam_krb5.so.1 try_first_pass
login   auth required           pam_unix_auth.so.1
login   auth required           pam_dial_auth.so.1

# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authentication
#
other   auth requisite          pam_authtok_get.so.1
other   auth required           pam_dhkeys.so.1
other   auth required           pam_unix_cred.so.1
other   auth sufficient         pam_krb5.so.1
other   auth required           pam_unix_auth.so.1
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
#
other   account requisite       pam_roles.so.1
other   account required        pam_unix_account.so.1
other   account required        pam_krb5.so.1
# Password construction requirements apply to all users.
# Remove force_check to have the traditional authorized administrator
# bypass of construction requirements.
other   password requisite      pam_authtok_check.so.1 force_check
other   password sufficient     pam_krb5.so.1
other   password required       pam_authtok_store.so.1