14.6. Configuring global ticket policies per authentication indicator

Procedure

• For example, to set the global two-factor ticket lifetime and renewal age values to one week, and the global smart card ticket lifetime and renewal age values to two weeks:

  [root@server ~]# ipa krbtpolicy-mod --otp-maxlife=604800 --otp-maxrenew=604800 --pkinit-maxlife=172800 --pkinit-maxrenew=172800

Verification

• Display the global ticket policy:

  [root@server ~]# ipa krbtpolicy-show
    Max life: 86400
    OTP max life: 604800
    PKINIT max life: 172800
    Max renew: 604800
    OTP max renew: 604800
    PKINIT max renew: 172800

  Notice that the OTP and PKINIT values are different from the global default Max life and Max renew values.