22.2. Enabling Tracking of Last Successful Kerberos Authentication

For performance reasons, IdM running on Red Hat Enterprise Linux 7.4 and later does not store the time stamp of the last successful Kerberos authentication of a user. As a consequence, certain commands, such as ipa user-status do not display the time stamp.

To enable tracking of the last successful Kerberos authentication of a user:

Display the currently enabled password plug-in features:
```
ipa config-show | grep "Password plugin features"
```
```
# ipa config-show | grep "Password plugin features"
  Password plugin features: AllowNThash, KDC:Disable Last Success
```
Copy to Clipboard Toggle word wrap
You require the names of the features, except KDC:Disable Last Success, in the following step.
Pass the --ipaconfigstring=feature parameter for every feature to the ipa config-mod command that is currently enabled, except for KDC:Disable Last Success:
```
ipa config-mod --ipaconfigstring='AllowNThash'
```
```
# ipa config-mod --ipaconfigstring='AllowNThash'
```
Copy to Clipboard Toggle word wrap
This command enables only the AllowNThash plug-in. To enable multiple features, specify the --ipaconfigstring=feature parameter multiple times. For example, to enable the AllowNThash and KDC:Disable Lockout feature:
```
ipa config-mod --ipaconfigstring='AllowNThash' --ipaconfigstring='KDC:Disable Lockout'
```
```
# ipa config-mod --ipaconfigstring='AllowNThash' --ipaconfigstring='KDC:Disable Lockout'
```
Copy to Clipboard Toggle word wrap
Restart IdM:
```
ipactl restart
```
```
# ipactl restart
```
Copy to Clipboard Toggle word wrap

Volver arriba

Este contenido no está disponible en el idioma seleccionado.

22.2. Enabling Tracking of Last Successful Kerberos Authentication

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Hacer que el código abierto sea más inclusivo

Acerca de Red Hat

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links