Chapter 19. Using the KDC Proxy in IdM

Procedure

1. Open the /etc/krb5.conf file for editing.

2. In the [realms] section, enter the URL of the KKDCP for the kdc, admin_server, and kpasswd_server options:

   [realms]
   EXAMPLE.COM = {
     kdc = https://kdc.example.com/KdcProxy
     admin_server = https://kdc.example.com/KdcProxy
     kpasswd_server = https://kdc.example.com/KdcProxy
     default_domain = example.com
   }

   For redundancy, you can add the parameters kdc, admin_server, and kpasswd_server multiple times to indicate different KKDCP servers.

3. Restart the sssd service to make the changes take effect:

   # systemctl restart sssd

Procedure

1. Remove the ipaConfigString=kdcProxyEnabled attribute and value pair from the directory:

   # ipa-ldap-updater /usr/share/ipa/kdcproxy-disable.uldif
   Update complete
   The ipa-ldap-updater command was successful

2. Restart the httpd service:

   # systemctl restart httpd.service

   KKDCP is now disabled on the current IdM server.

Procedure

1. Add the ipaConfigString=kdcProxyEnabled attribute and value pair to the directory:

   # ipa-ldap-updater /usr/share/ipa/kdcproxy-enable.uldif
   Update complete
   The ipa-ldap-updater command was successful

2. Restart the httpd service:

   # systemctl restart httpd.service

   KKDCP is now enabled on the current IdM server.

Procedure

1. Set the use_dns parameter in the [global] section of the /etc/ipa/kdcproxy/kdcproxy.conf file to false.

   [global]
   use_dns = false

2. Put the proxied realm information into the /etc/ipa/kdcproxy/kdcproxy.conf file. For example, for the [AD.EXAMPLE.COM] realm with proxy list the realm configuration parameters as follows:

   [AD.EXAMPLE.COM]
   kerberos = kerberos+tcp://1.2.3.4:88 kerberos+tcp://5.6.7.8:88
   kpasswd = kpasswd+tcp://1.2.3.4:464 kpasswd+tcp://5.6.7.8:464

   Important

   The realm configuration parameters must list multiple servers separated by a space, as opposed to /etc/krb5.conf and kdc.conf, in which certain options may be specified multiple times.

3. Restart Identity Management (IdM) services:

   # ipactl restart

Procedure

1. In the /etc/ipa/kdcproxy/kdcproxy.conf file, the [global] section, set the use_dns parameter to true.

   [global]
   configs = mit
   use_dns = true

   The configs parameter allows you to load other configuration modules. In this case, the configuration is read from the MIT libkrb5 library.

2. Optional: In case you do not want to use DNS service records, add explicit AD servers to the [realms] section of the /etc/krb5.conf file. If the realm with proxy is, for example, AD.EXAMPLE.COM, you add:

   [realms]
   AD.EXAMPLE.COM = {
       kdc = ad-server.ad.example.com
       kpasswd_server = ad-server.ad.example.com
   }

3. Restart Identity Management (IdM) services:

   # ipactl restart