5.10. Enabling the tracking of last successful Kerberos authentication for users in IdM

Procedure

1. Display the currently enabled password plug-in features:

   # ipa config-show | grep "Password plugin features"
     Password plugin features: pass:quotes[AllowNThash], pass:quotes[KDC:Disable Last Success]

   The output shows that the KDC:Disable Last Success plug-in is enabled. The plug-in hides the last successful Kerberos authentication attempt from being visible in the ipa user-status output.

2. Add the --ipaconfigstring=feature parameter for every feature to the ipa config-mod command that is currently enabled, except for KDC:Disable Last Success:

   # ipa config-mod --ipaconfigstring='AllowNThash'

   This command enables only the AllowNThash plug-in. To enable multiple features, specify the --ipaconfigstring=feature parameter separately for each feature.

3. Restart IdM:

   # ipactl restart