Chapter 12. Managing Kerberos principal aliases for users, hosts, and services

Procedure

• To add the alias name useralias to the account user, enter:

  # ipa user-add-principal <user> <useralias>
  --------------------------------
  Added new aliases to user "user"
  --------------------------------
           User login: user
      Principal alias: user@IDM.EXAMPLE.COM, useralias@IDM.EXAMPLE.COM

  Copy to Clipboard Toggle word wrap

  To add an alias to a host or service, use the ipa host-add-principal or ipa service-add-principal command respectively instead.

  If you use an alias name to authenticate, use the -C option with the kinit command:

  # kinit -C <useralias>
  Password for <user>@IDM.EXAMPLE.COM:

  Copy to Clipboard Toggle word wrap

Procedure

• To remove the alias useralias from the account user, enter:

  # ipa user-remove-principal <user> <useralias>
  --------------------------------
  Removed aliases from user "user"
  --------------------------------
    User login: user
    Principal alias: user@IDM.EXAMPLE.COM

  Copy to Clipboard Toggle word wrap

  To remove an alias from a host or service, use the ipa host-remove-principal or ipa service-remove-principal command respectively instead.

  Note that you cannot remove the canonical principal name:

  # ipa user-show <user>
    User login: user
    ...
    Principal name: user@IDM.EXAMPLE.COM
    ...
  
  # ipa user-remove-principal user user
  ipa: ERROR: invalid 'krbprincipalname': at least one value equal to the canonical principal name must be present

  Copy to Clipboard Toggle word wrap

Procedure

• To add the enterprise principal alias user@example.com to the user account:

  # ipa user-add-principal <user> <user\\@example.com>
  --------------------------------
  Added new aliases to user "user"
  --------------------------------
           User login: user
      Principal alias: user@IDM.EXAMPLE.COM, user\@example.com@IDM.EXAMPLE.COM

  Copy to Clipboard Toggle word wrap

  To add an enterprise alias to a host or service, use the ipa host-add-principal or ipa service-add-principal command respectively instead.

  Note

  When adding or removing enterprise principal aliases, escape the @ symbol using two backslashes (\\). Otherwise, the shell interprets the @ symbol as part of the Kerberos realm name and leads to the following error:

  ipa: ERROR: The realm for the principal does not match the realm for this IPA server.

  Copy to Clipboard Toggle word wrap

  If you use an enterprise principal name to authenticate, use the -E option with the kinit command:

  # kinit -E <user@example.com>
  Password for user\@example.com@IDM.EXAMPLE.COM:

  Copy to Clipboard Toggle word wrap

Procedure

• To remove the enterprise principal alias user@example.com from the account user, enter:

  # ipa user-remove-principal <user> <user\\@example.com>
  --------------------------------
  Removed aliases from user "user"
  --------------------------------
    User login: user
    Principal alias: user@IDM.EXAMPLE.COM

  Copy to Clipboard Toggle word wrap

  To remove an alias from a host or service, use the ipa host-remove-principal or ipa service-remove-principal command respectively instead.

  Note

  When adding or removing enterprise principal aliases, escape the @ symbol using two backslashes (\\). Otherwise, the shell interprets the @ symbol as part of the Kerberos realm name and leads to the following error:

  ipa: ERROR: The realm for the principal does not match the realm for this IPA server

  Copy to Clipboard Toggle word wrap