8.7. Enabling GSSAPI authentication for sudo on an IdM client

Procedure

1. Open the /etc/sssd/sssd.conf configuration file.

2. Add the following entry to the [domain/<domain_name>] section.

   [domain/<domain_name>]
   pam_gssapi_services = sudo, sudo-i

3. Save and close the /etc/sssd/sssd.conf file.

4. Restart the SSSD service to load the configuration changes.

   [root@idmclient ~]# systemctl restart sssd

5. Optional: Determine if you have selected the sssd authselect profile:

   # authselect current
   Profile ID: sssd

6. If the sssd authselect profile is selected, enable GSSAPI authentication:

   # authselect enable-feature with-gssapi

7. If the sssd authselect profile is not selected, select it and enable GSSAPI authentication:

   # authselect select sssd with-gssapi

Verification

1. Log into the host as the idm_user account.

   [root@idm-client ~]# ssh -l idm_user@idm.example.com localhost
   idm_user@idm.example.com's password:

2. Verify that you have a ticket-granting ticket as the idm_user account.

   [idmuser@idmclient ~]$ klist
   Ticket cache: KCM:1366201107
   Default principal: idm_user@IDM.EXAMPLE.COM
   
   Valid starting       Expires              Service principal
   01/08/2021 09:11:48  01/08/2021 19:11:48  krbtgt/IDM.EXAMPLE.COM@IDM.EXAMPLE.COM
   	renew until 01/15/2021 09:11:44

3. Optional: If you do not have Kerberos credentials for the idm_user account, delete your current Kerberos credentials and request the correct ones.

   [idm_user@idmclient ~]$ kdestroy -A
   
   [idm_user@idmclient ~]$ kinit idm_user@IDM.EXAMPLE.COM
   Password for idm_user@idm.example.com:

4. Reboot the machine using sudo, without specifying a password.

   [idm_user@idmclient ~]$ sudo /usr/sbin/reboot