Bug 1747452
| Summary: | realmd.conf user-principal RFE and clarification | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Sumit Bose <sbose> |
| Component: | realmd | Assignee: | Sumit Bose <sbose> |
| Status: | CLOSED ERRATA | QA Contact: | sssd-qe <sssd-qe> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.2 | CC: | erinn.looneytriggs, fhanzelk, pcech, sgadekar, sgoveas, sssd-qe |
| Target Milestone: | rc | Keywords: | FutureFeature |
| Target Release: | 8.2 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | sync-to-jira | ||
| Fixed In Version: | realmd-0.16.3-17.el8 | Doc Type: | Enhancement |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1643814 | Environment: | |
| Last Closed: | 2020-04-28 16:59:49 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1643814 | ||
| Bug Blocks: | |||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1884 |
Verified with comparing the man pages from the previous and latest packages. In the previous version ======================= [root@ci-vm-10-0-137-82 tmp.L5GZBNCmPd]# rpm -q realmd realmd-0.16.3-16.el8.x86_64 [root@ci-vm-10-0-137-82 tmp.L5GZBNCmPd]# man realm |col -b|sed -n '/--user-principal/,/LEAVE/p' --user-principal=host/name@REALM Set the userPrincipalName field of the computer account to this kerberos principal. If you omit the value for this option, then a principal will be set in the form of host/shortname@REALM --os-name=xxx The name of the operation system of the client. When joining an AD domain the value is store in the matching AD attribute. --os-version=xxx The version of the operation system of the client. When joining an AD domain the value is store in the matching AD attribute. LEAVE =============================================== In the fixed version ======================= [root@ci-vm-10-0-138-156 tmp.KyOTf6MvJL]# rpm -q realmd realmd-0.16.3-17.el8.x86_64 [root@ci-vm-10-0-138-156 tmp.KyOTf6MvJL]# man realm|col -b |sed -n '/--user-principal/,/LEAVE/p' --user-principal=host/name@REALM Set the userPrincipalName field of the computer account to this kerberos principal. If you omit the value for this option, then a principal will be set based on the defaults of the membership software. AD makes a distinction between user and service principals. Only with user principals you can request a Kerberos Ticket-Granting-Ticket (TGT), i.e. only user principals can be used with the kinit command. By default the user principal and the canonical principal name of an AD computer account is shortname$@AD.DOMAIN, where shortname is the NetBIOS name which is limited to 15 characters. If there are applications which are not aware of the AD default and are using a hard-coded default principal the --user-principal can be used to make AD aware of this principal. Please note that userPrincipalName is a single value LDAP attribute, i.e. only one alternative user principal besides the AD default user principal can be set. LEAVE [root@ci-vm-10-0-138-156 tmp.KyOTf6MvJL]# ============================================================================ In the previous version ============================ ZBNCmPd]# rpm -q realmd realmd-0.16.3-16.el8.x86_64 [root@ci-vm-10-0-137-82 tmp.L5GZBNCmPd]# man realmd.conf|col -b|sed -n '/user-prin/,/automatic/p' user-prinicpal Set the user-prinicpal to yes to create userPrincipalName attributes for the computer account in the realm, in the form host/computer@REALM [domain.example.com] user-principal = yes automatic-join [root@ci-vm-10-0-137-82 tmp.L5GZBNCmPd]# ============================================================================================== In the fixed version ===================== [root@ci-vm-10-0-138-156 tmp.KyOTf6MvJL]# rpm -q realmd realmd-0.16.3-17.el8.x86_64 [root@ci-vm-10-0-138-156 tmp.KyOTf6MvJL]# man realmd.conf|col -b |sed -n '/user-principal/,/automatic/p' user-principal Set the user-principal to yes to create userPrincipalName attribute for the computer accounts in the realm. The exact value depends on the defaults of the used membership software. To have full control over the value please use the --user-principal option of the realm command, see realm(8) for details. [domain.example.com] user-principal = yes automatic-join [root@ci-vm-10-0-138-156 Marking verified.