23.8. Enforcing a Specific Authentication Indicator When Obtaining a Ticket from the KDC
To enforce a specific authentication indicator on:
- A host object, execute:
# ipa host-mod host_name --auth-ind=indicator
- A Kerberos service, execute:
# ipa service-mod service/host_name --auth-ind=indicator
To set multiple authentication indicators, specify the
--auth-ind parameter multiple times.
Warning
Setting an authentication indicator to the
HTTP/IdM_master service causes the IdM master to fail. Additionally, the utilities provided by IdM do not enable you to restore the master.
Example 23.2. Enforcing the pkinit Indicator on a Specific Host
The following command configures that only the users authenticated through a smart card can obtain a service ticket for the
host.idm.example.com host:
# ipa host-mod host.idm.example.com --auth-ind=pkinit
The setting above ensures that the ticket-granting ticket (TGT) of a user requesting a Kerberos ticket, contains the pkinit authentication indicator.
