Chapter 12. Managing Kerberos principal aliases for users, hosts, and services

Procedure

• To add the alias name useralias to the account user, enter:

  # ipa user-add-principal <user> <useralias>
  --------------------------------
  Added new aliases to user "user"
  --------------------------------
           User login: user
      Principal alias: user@IDM.EXAMPLE.COM, useralias@IDM.EXAMPLE.COM

  To add an alias to a host or service, use the ipa host-add-principal or ipa service-add-principal command respectively instead.

  If you use an alias name to authenticate, use the -C option with the kinit command:

  # kinit -C <useralias>
  Password for <user>@IDM.EXAMPLE.COM:

Procedure

• To remove the alias useralias from the account user, enter:

  # ipa user-remove-principal <user> <useralias>
  --------------------------------
  Removed aliases from user "user"
  --------------------------------
    User login: user
    Principal alias: user@IDM.EXAMPLE.COM

  To remove an alias from a host or service, use the ipa host-remove-principal or ipa service-remove-principal command respectively instead.

  Note that you cannot remove the canonical principal name:

  # ipa user-show <user>
    User login: user
    ...
    Principal name: user@IDM.EXAMPLE.COM
    ...
  
  # ipa user-remove-principal user user
  ipa: ERROR: invalid 'krbprincipalname': at least one value equal to the canonical principal name must be present

Procedure

• To add the enterprise principal alias user@example.com to the user account:

  # ipa user-add-principal <user> <user\\@example.com>
  --------------------------------
  Added new aliases to user "user"
  --------------------------------
           User login: user
      Principal alias: user@IDM.EXAMPLE.COM, user\@example.com@IDM.EXAMPLE.COM

  To add an enterprise alias to a host or service, use the ipa host-add-principal or ipa service-add-principal command respectively instead.

  Note

  When adding or removing enterprise principal aliases, escape the @ symbol using two backslashes (\\). Otherwise, the shell interprets the @ symbol as part of the Kerberos realm name and leads to the following error:

  ipa: ERROR: The realm for the principal does not match the realm for this IPA server.

  If you use an enterprise principal name to authenticate, use the -E option with the kinit command:

  # kinit -E <user@example.com>
  Password for user\@example.com@IDM.EXAMPLE.COM:

Procedure

• To remove the enterprise principal alias user@example.com from the account user, enter:

  # ipa user-remove-principal <user> <user\\@example.com>
  --------------------------------
  Removed aliases from user "user"
  --------------------------------
    User login: user
    Principal alias: user@IDM.EXAMPLE.COM

  To remove an alias from a host or service, use the ipa host-remove-principal or ipa service-remove-principal command respectively instead.

  Note

  When adding or removing enterprise principal aliases, escape the @ symbol using two backslashes (\\). Otherwise, the shell interprets the @ symbol as part of the Kerberos realm name and leads to the following error:

  ipa: ERROR: The realm for the principal does not match the realm for this IPA server