Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 20. Managing Kerberos Flags and Principal Aliases

20.1. Kerberos Flags for Services and Hosts
Copy link

You can use various Kerberos flags to define certain specific aspects of the Kerberos ticket behavior. You can add these flags to service and host Kerberos principals.
Principals in Identity Management (IdM) accept the following Kerberos flags:
OK_AS_DELEGATE
Use this flag to specify Kerberos tickets trusted for delegation.
Active directory (AD) clients check the OK_AS_DELEGATE flag on the Kerberos ticket to determine whether the user credentials can be forwarded or delegated to the specific server. AD forwards the ticket-granting ticket (TGT) only to services or hosts with OK_AS_DELEGATE set. With this flag, system security services daemon (SSSD) can add the AD user TGT to the default Kerberos credentials cache on the IdM client machine.
REQUIRES_PRE_AUTH
Use this flag to specify that only pre-authenticated tickets are allowed to authenticate to the principal.
With the REQUIRES_PRE_AUTH flag set, the key distribution center (KDC) requires additional authentication: the KDC issues the TGT for a principal with REQUIRES_PRE_AUTH only if the TGT has been pre-authenticated.
You can clear REQUIRES_PRE_AUTH to disable pre-authentication for selected services or hosts, which lowers the load on the KDC but also slightly increases the possibility of a brute-force attack on a long-term key to succeed.
OK_TO_AUTH_AS_DELEGATE
Use the OK_TO_AUTH_AS_DELEGATE flag to specify that the service is allowed to obtain a kerberos ticket on behalf of the user. Note, that while this is enough to perform protocol transition, in order to obtain other tickets on behalf of the user, the service needs the OK_AS_DELEGATE flag and a corresponding policy decision allowed on the key distribution center side.

20.1.1. Setting Kerberos Flags from the Web UI
Copy link

To add OK_AS_DELEGATE, REQUIRES_PRE_AUTH, or OK_TO_AUTH_AS_DELEGATE to a principal:
  1. Select the Services subtab, accessible through the Identity main tab.

    Figure 20.1. List of Services

    List of Services
    View larger image
    List of Services
  2. Click on the service to which you want to add the flags.
  3. Check the option that you want to set. For example, to set the REQUIRES_PRE_AUTH flag, check the Requires pre-authentication option:

    Figure 20.2. Adding the REQUIRES_PRE_AUTH flag

    Adding the REQUIRES_PRE_AUTH flag
    View larger image
    Adding the REQUIRES_PRE_AUTH flag
    The following table lists the names of the Kerberos flags and the corresponding name in the Web UI:
    Expand
    Table 20.1. Kerberos flags' mapping in WebUI
    Kerberos flag name Web UI option
    OK_AS_DELEGATE Trusted for delegation
    REQUIRES_PRE_AUTH Requires pre-authentication
    OK_TO_AUTH_AS_DELEGATE Trusted to authenticate as user
To add a flag to a principal from the command line or to remove a flag, add one of the following options to the ipa service-mod command:
  • --ok-as-delegate for OK_AS_DELEGATE
  • --requires-pre-auth for REQUIRES_PRE_AUTH
  • --ok-to-auth-as-delegate for OK_TO_AUTH_AS_DELEGATE
To add a flag, set the corresponding option to 1. For example, to add the OK_AS_DELEGATE flag to the service/ipa.example.com@EXAMPLE.COM principal: 
$ ipa service-mod service/ipa.example.com@EXAMPLE.COM --ok-as-delegate=1
Copy to Clipboard Toggle word wrap
To remove a flag or to disable it, set the corresponding option to 0. For example, to disable the REQUIRES_PRE_AUTH flag for the test/ipa.example.com@EXAMPLE.COM principal: 
$ ipa service-mod test/ipa.example.com@EXAMPLE.COM --requires-pre-auth=0
Copy to Clipboard Toggle word wrap
To find out if OK_AS_DELEGATE is currently set for a principal:
  1. Run the kvno utility.
  2. Run the klist -f command.
OK_AS_DELEGATE is represented by the O character in the klist -f output: 
$ kvno test/ipa.example.com@EXAMPLE.COM
$ klist -f
Ticket cache: KEYRING:persistent:0:0
Default principal: admin@EXAMPLE.COM

Valid starting		Expires			Service principal
02/19/2014 09:59:02	02/20/2014 08:21:33	test/ipa/example.com@EXAMPLE.COM
    Flags: FATO
Copy to Clipboard Toggle word wrap
Expand
Table 20.2. Abbreviations for kerberos flags
Kerberos flag name Abbreviation
OK_AS_DELEGATE O
REQUIRES_PRE_AUTH A
OK_TO_AUTH_AS_DELEGATE F
To find out what flags are currently set for a principal, use the kadmin.local utility. The current flags are displayed on the Attributes line of kadmin.local output, for example: 
# kadmin.local
kadmin.local: getprinc test/ipa.example.com
Principal: test/ipa.example.com@EXAMPLE.COM
Expiration date: [never]
...
Attributes: REQUIRES_PRE_AUTH OK_AS_DELEGATE OK_TO_AUTH_AS_DELEGATE
Policy: [none]
Copy to Clipboard Toggle word wrap
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat