22.2. Enabling Tracking of Last Successful Kerberos Authentication

For performance reasons, IdM running on Red Hat Enterprise Linux 7.4 and later does not store the time stamp of the last successful Kerberos authentication of a user. As a consequence, certain commands, such as ipa user-status do not display the time stamp.

To enable tracking of the last successful Kerberos authentication of a user:

Display the currently enabled password plug-in features:
```
ipa config-show | grep "Password plugin features"
```
```
# ipa config-show | grep "Password plugin features"
  Password plugin features: AllowNThash, KDC:Disable Last Success
```
Copy to Clipboard Toggle word wrap
You require the names of the features, except KDC:Disable Last Success, in the following step.
Pass the --ipaconfigstring=feature parameter for every feature to the ipa config-mod command that is currently enabled, except for KDC:Disable Last Success:
```
ipa config-mod --ipaconfigstring='AllowNThash'
```
```
# ipa config-mod --ipaconfigstring='AllowNThash'
```
Copy to Clipboard Toggle word wrap
This command enables only the AllowNThash plug-in. To enable multiple features, specify the --ipaconfigstring=feature parameter multiple times. For example, to enable the AllowNThash and KDC:Disable Lockout feature:
```
ipa config-mod --ipaconfigstring='AllowNThash' --ipaconfigstring='KDC:Disable Lockout'
```
```
# ipa config-mod --ipaconfigstring='AllowNThash' --ipaconfigstring='KDC:Disable Lockout'
```
Copy to Clipboard Toggle word wrap
Restart IdM:
```
ipactl restart
```
```
# ipactl restart
```
Copy to Clipboard Toggle word wrap

Torna in cima

Questo contenuto non è disponibile nella lingua selezionata.

22.2. Enabling Tracking of Last Successful Kerberos Authentication

Formazione

Prova, acquista e vendi

Community

Informazioni sulla documentazione di Red Hat

Rendiamo l’open source più inclusivo

Informazioni su Red Hat

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links