홈
제품
Red Hat Enterprise Linux
10
Managing IdM users, groups, hosts, and access control rules
40.4. Enrollment and authentication of IdM hosts and users: comparison

40.4. Enrollment and authentication of IdM hosts and users: comparison

There are many similarities between users and hosts in IdM, some of which can be observed during the enrollment stage as well as those that concern authentication during the deployment stage.

The enrollment stage (User and host enrollment):
- An administrator can create an LDAP entry for both a user and a host before the user or host actually join IdM: for the stage user, the command is ipa stageuser-add; for the host, the command is ipa host-add.

A file containing a key table or, abbreviated, keytab, a symmetric key resembling to some extent a user password, is created during the execution of the ipa-client-install command on the host, resulting in the host joining the IdM realm. Analogically, a user is asked to create a password when they activate their account, therefore joining the IdM realm.

While the user password is the default authentication method for a user, the keytab is the default authentication method for a host. The keytab is stored in a file on the host.

Expand

표 40.1. User and host enrollment
Action	User	Host
Pre-enrollment	$ *ipa stageuser-add user_name* [--password]**	$ *ipa host-add host_name* [--random]**
Activating the account	$ ipa stageuser-activate user_name	$ ipa-client install [--password] (must be run on the host itself)

The deployment stage (User and host session authentication):

When a user starts a new session, the user authenticates using a password; similarly, every time it is switched on, the host authenticates by presenting its keytab file. The System Security Services Daemon (SSSD) manages this process in the background.
If the authentication is successful, the user or host obtains a Kerberos ticket granting ticket (TGT).

The TGT is then used to obtain specific tickets for specific services.

Expand

표 40.2. User and host session authentication
	User	Host
Default means of authentication	Password	Keytabs
Starting a session (ordinary user)	$ kinit user_name	[switch on the host]
The result of successful authentication	TGT to be used to obtain access to specific services	TGT to be used to obtain access to specific services

TGTs and other Kerberos tickets are generated as part of the Kerberos services and policies defined by the server. The initial granting of a Kerberos ticket, the renewing of the Kerberos credentials, and even the destroying of the Kerberos session are all handled automatically by the IdM services.

Alternative authentication options for IdM hosts

Apart from keytabs, IdM supports two other types of machine authentication:

SSH keys. The SSH public key for the host is created and uploaded to the host entry. From there, the System Security Services Daemon (SSSD) uses IdM as an identity provider and can work in conjunction with OpenSSH and other services to reference the public keys located centrally in IdM.
Machine certificates. In this case, the machine uses an SSL certificate that is issued by the IdM server’s certificate authority and then stored in IdM’s Directory Server. The certificate is then sent to the machine to present when it authenticates to the server. On the client, certificates are managed by a service called certmonger.

40.4. Enrollment and authentication of IdM hosts and users: comparison

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat 소개

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links