12.3. Adding a Kerberos enterprise principal alias

Procedure

• To add the enterprise principal alias user@example.com to the user account:

  # ipa user-add-principal <user> <user\\@example.com>
  --------------------------------
  Added new aliases to user "user"
  --------------------------------
           User login: user
      Principal alias: user@IDM.EXAMPLE.COM, user\@example.com@IDM.EXAMPLE.COM

  To add an enterprise alias to a host or service, use the ipa host-add-principal or ipa service-add-principal command respectively instead.

  注意

  When adding or removing enterprise principal aliases, escape the @ symbol using two backslashes (\\). Otherwise, the shell interprets the @ symbol as part of the Kerberos realm name and leads to the following error:

  ipa: ERROR: The realm for the principal does not match the realm for this IPA server.

  If you use an enterprise principal name to authenticate, use the -E option with the kinit command:

  # kinit -E <user@example.com>
  Password for user\@example.com@IDM.EXAMPLE.COM: