22.2. Enabling Tracking of Last Successful Kerberos Authentication

For performance reasons, IdM running on Red Hat Enterprise Linux 7.4 and later does not store the time stamp of the last successful Kerberos authentication of a user. As a consequence, certain commands, such as ipa user-status do not display the time stamp.

To enable tracking of the last successful Kerberos authentication of a user:

Display the currently enabled password plug-in features:
```
ipa config-show | grep "Password plugin features"
```
```
# ipa config-show | grep "Password plugin features"
  Password plugin features: AllowNThash, KDC:Disable Last Success
```
Copy to Clipboard Toggle word wrap
You require the names of the features, except KDC:Disable Last Success, in the following step.
Pass the --ipaconfigstring=feature parameter for every feature to the ipa config-mod command that is currently enabled, except for KDC:Disable Last Success:
```
ipa config-mod --ipaconfigstring='AllowNThash'
```
```
# ipa config-mod --ipaconfigstring='AllowNThash'
```
Copy to Clipboard Toggle word wrap
This command enables only the AllowNThash plug-in. To enable multiple features, specify the --ipaconfigstring=feature parameter multiple times. For example, to enable the AllowNThash and KDC:Disable Lockout feature:
```
ipa config-mod --ipaconfigstring='AllowNThash' --ipaconfigstring='KDC:Disable Lockout'
```
```
# ipa config-mod --ipaconfigstring='AllowNThash' --ipaconfigstring='KDC:Disable Lockout'
```
Copy to Clipboard Toggle word wrap
Restart IdM:
```
ipactl restart
```
```
# ipactl restart
```
Copy to Clipboard Toggle word wrap

Voltar ao topo

Este conteúdo não está disponível no idioma selecionado.

22.2. Enabling Tracking of Last Successful Kerberos Authentication

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Tornando o open source mais inclusivo

Sobre a Red Hat

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links