Bug 1328552 - [RFE] Allow users to authenticate with alternative names
Summary: [RFE] Allow users to authenticate with alternative names
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Kaleem
Marc Muehlfeld
URL:
Whiteboard:
Keywords: FutureFeature
Depends On:
Blocks: 1361194
TreeView+ depends on / blocked
 
Reported: 2016-04-19 16:00 UTC by Petr Vobornik
Modified: 2016-11-04 05:53 UTC (History)
9 users (show)

(edit)
IdM supports user principal aliases

Previously, Identity Management (IdM) supported only the authentication using the user name. However, in some environments it is a requirement to authenticate with an email address or alias name. IdM has been enhanced and now supports principal aliases. The System Security Services Daemon (SSSD) has also been updated to support this functionality.

To add the aliases "ualias" and "user@example.com" to the account "user", run the following command:
   # ipa user-add-principal user ualias user\\@example.com

Use the "-C" option to the "kinit" command when with an alias, and the "-E" option when using an enterprise principal name:
   # kinit -C ualias
   # kinit -E user@example.com
Clone Of:
(edit)
Last Closed: 2016-11-04 05:53:19 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2404 normal SHIPPED_LIVE ipa bug fix and enhancement update 2016-11-03 13:56:18 UTC

Internal Trackers: 1361194

Description Petr Vobornik 2016-04-19 16:00:41 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/5413

Users sometimes prefer to use emails or other alises when they authenticate. In some environments it is a requirement to be able to authenticate with an email address. 

We already have a ticket to allow aliases for hosts and services #1365. This ticket calls for the similar functionality but for users.

Comment 2 Petr Vobornik 2016-07-13 14:57:15 UTC
this bz was part of rebase to 4.4

Comment 4 Martin Babinsky 2016-07-15 13:29:09 UTC
I have removed '-C' from the "kinit as enterprise principal" part of doctext since according to kinit man page:

"""
-E     treats the principal name as an enterprise name (implies the -C option).
"""

so "-E" automatically requests principal canonicalization.

Otherwise LGTM.

Comment 13 Xiyang Dong 2016-08-22 03:58:20 UTC
Verified on ipa-server-4.4.0-7.el7:
# ipa user-add tuser --first test --last user --password
Password: 
Enter Password again to verify: 
------------------
Added user "tuser"
------------------
  User login: tuser
  First name: test
  Last name: user
  Full name: test user
  Display name: test user
  Initials: tu
  Home directory: /home/tuser
  GECOS: test user
  Login shell: /bin/sh
  Principal name: tuser@TESTRELM
  Principal alias: tuser@TESTRELM
  Email address: tuser@testrelm.test
  UID: 1669000001
  GID: 1669000001
  Password: True
  Member of groups: ipausers
  Kerberos keys available: True
[root@auto-hv-02-guest08 ~]# kinit tuser
Password for tuser@TESTRELM: 
Password expired.  You must change it now.
Enter new password: 
Enter it again: 

# kinit admin
Password for admin@TESTRELM: 
# ipa user-add-principal tuser talias talias\\@ent.test
---------------------------------
Added new aliases to user "tuser"
---------------------------------
  User login: tuser
  Principal alias: talias@TESTRELM, talias\@ent.test@TESTRELM, tuser@TESTRELM
# kinit talias 
Password for talias@TESTRELM: 
# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_5ks0oe9
Default principal: tuser@TESTRELM

Valid starting       Expires              Service principal
08/21/2016 23:38:33  08/22/2016 23:38:30  krbtgt/TESTRELM@TESTRELM

# kinit -C talias
Password for talias@TESTRELM: 
# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_OhZfJlN
Default principal: tuser@TESTRELM

Valid starting       Expires              Service principal
08/21/2016 23:39:00  08/22/2016 23:38:54  krbtgt/TESTRELM@TESTRELM

# kinit talias\\@ent.test
Password for talias\@ent.test@TESTRELM: 
# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_2HXMy3a
Default principal: tuser@TESTRELM

Valid starting       Expires              Service principal
08/21/2016 23:40:02  08/22/2016 23:39:59  krbtgt/TESTRELM@TESTRE

# kinit -E talias@ent.test
Password for talias\@ent.test@TESTRELM: 
# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_JEDF6Xy
Default principal: tuser@TESTRELM

Valid starting       Expires              Service principal
08/21/2016 23:40:37  08/22/2016 23:40:34  krbtgt/TESTRELM@TESTRELM

Comment 15 errata-xmlrpc 2016-11-04 05:53:19 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2404.html


Note You need to log in before you can comment on or make changes to this bug.