54.2. Using RBCD to delegate access to a service

Procedure

1. On the client.example.test host, obtain a Kerberos ticket:

   # kinit -k

2. Define the RBCD ACL:

   # ipa service-add-delegation nfs/client.example.test HTTP/client.example.test
   
   -------------------------------------------------------
   Added new resource delegation to the service principal "nfs/client.example.test@EXAMPLE.TEST"
   -------------------------------------------------------
     Principal name: nfs/client.example.test@EXAMPLE.TEST
     Delegation principal: HTTP/client.example.test@EXAMPLE.TEST

1. View the NFS service to verify that the delegation rule is present:

   # ipa service-show nfs/client.example.test
   
     Principal name: nfs/client.example.test@EXAMPLE.TEST
     Principal alias: nfs/client.example.test@EXAMPLE.TEST
     Delegation principal: HTTP/client.example.test@EXAMPLE.TEST
     Keytab: True
     Managed by: client.example.test

2. Obtain a Kerberos ticket for the HTTP service principal:

   # kinit -kt http.keytab HTTP/client.example.test

3. Verify that the ticket granting ticket is present:

   # klist -f
   Ticket cache: KCM:0:99799
   Default principal: HTTP/client.example.test@EXAMPLE.TEST
   
   Valid starting       Expires              Service principal
   10/13/2023 14:39:23  10/14/2023 14:05:07  krbtgt/EXAMPLE.TEST@EXAMPLE.TEST
   	Flags: FIA

4. Perform a protocol transition on behalf of testuser:

   # kvno -U testuser -P nfs/client.example.test
   nfs/client.example.test@EXAMPLE.TEST: kvno = 1

5. Verify that tickets obtained during protocol transition on behalf of testuser are present:

   # klist -f
   Ticket cache: KCM:0:99799
   Default principal: HTTP/client.example.test@EXAMPLE.TEST
   
   Valid starting       Expires              Service principal
   10/13/2023 14:39:38  10/14/2023 14:05:07  HTTP/client.example.test@EXAMPLE.TEST
   	for client testuser@EXAMPLE.TEST, Flags: FAT
   10/13/2023 14:39:23  10/14/2023 14:05:07  krbtgt/EXAMPLE.TEST@EXAMPLE.TEST
   	Flags: FIA
   10/13/2023 14:39:38  10/14/2023 14:05:07  nfs/client.example.test@EXAMPLE.TEST
   	for client testuser@EXAMPLE.TEST, Flags: FAT