33.4. Aplicação de indicadores de autenticação para um serviço IdM

Procedimento

1. Adicione um serviço IdM com o comando ipa service-add para criar um Kerberos principal associado a ele. Por exemplo, para criar a entrada do serviço IdM para a aplicação testservice que roda no host client.example.com:

   [root@client ~]# ipa service-add testservice/client.example.com
   -------------------------------------------------------------
   Modified service "testservice/client.example.com@EXAMPLE.COM"
   -------------------------------------------------------------
     Principal name: testservice/client.example.com@EXAMPLE.COM
     Principal alias: testservice/client.example.com@EXAMPLE.COM
     Managed by: client.example.com

   Copy to Clipboard Toggle word wrap

2. Gerar e armazenar um keytab Kerberos para o serviço no cliente.

   [root@client ~]# ipa-getkeytab -k /etc/testservice.keytab -p testservice/client.example.com
   Keytab successfully retrieved and stored in: /etc/testservice.keytab

   Copy to Clipboard Toggle word wrap

Etapas de verificação

1. Exibir informações sobre um serviço IdM com o comando ipa service-show.

   [root@server ~]# ipa service-show testservice/client.example.com
     Principal name: testservice/client.example.com@EXAMPLE.COM
     Principal alias: testservice/client.example.com@EXAMPLE.COM
     Keytab: True
     Managed by: client.example.com

   Copy to Clipboard Toggle word wrap

2. Exibir o conteúdo do keytab do serviço Kerberos com o comando klist.

   [root@server etc]# klist -ekt /etc/testservice.keytab
   Keytab name: FILE:/etc/testservice.keytab
   KVNO Timestamp           Principal
   ---- ------------------- ------------------------------------------------------
      2 04/01/2020 17:52:55 testservice/client.example.com@EXAMPLE.COM (aes256-cts-hmac-sha1-96)
      2 04/01/2020 17:52:55 testservice/client.example.com@EXAMPLE.COM (aes128-cts-hmac-sha1-96)
      2 04/01/2020 17:52:55 testservice/client.example.com@EXAMPLE.COM (camellia128-cts-cmac)
      2 04/01/2020 17:52:55 testservice/client.example.com@EXAMPLE.COM (camellia256-cts-cmac)

   Copy to Clipboard Toggle word wrap