RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1328552 - [RFE] Allow users to authenticate with alternative names
Summary: [RFE] Allow users to authenticate with alternative names
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Kaleem
Marc Muehlfeld
URL:
Whiteboard:
Depends On:
Blocks: 1361194
TreeView+ depends on / blocked
 
Reported: 2016-04-19 16:00 UTC by Petr Vobornik
Modified: 2016-11-04 05:53 UTC (History)
9 users (show)

Fixed In Version: ipa-4.4.0-1.el7
Doc Type: Enhancement
Doc Text:
IdM supports user principal aliases Previously, Identity Management (IdM) supported only the authentication using the user name. However, in some environments it is a requirement to authenticate with an email address or alias name. IdM has been enhanced and now supports principal aliases. The System Security Services Daemon (SSSD) has also been updated to support this functionality. To add the aliases "ualias" and "user@example.com" to the account "user", run the following command: # ipa user-add-principal user ualias user\\@example.com Use the "-C" option to the "kinit" command when with an alias, and the "-E" option when using an enterprise principal name: # kinit -C ualias # kinit -E user@example.com
Clone Of:
Environment:
Last Closed: 2016-11-04 05:53:19 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2404 0 normal SHIPPED_LIVE ipa bug fix and enhancement update 2016-11-03 13:56:18 UTC

Internal Links: 1361194

Description Petr Vobornik 2016-04-19 16:00:41 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/5413

Users sometimes prefer to use emails or other alises when they authenticate. In some environments it is a requirement to be able to authenticate with an email address. 

We already have a ticket to allow aliases for hosts and services #1365. This ticket calls for the similar functionality but for users.
Comment 1 Martin Bašti 2016-07-01 07:40:20 UTC 
Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/de6abc7af2dac7994b0fff4396115320d1a9a54d
https://fedorahosted.org/freeipa/changeset/e6fc8f84d3ad5fc4c030ad592a3d743c02393439
https://fedorahosted.org/freeipa/changeset/974eb7b5efd20ad2195b0ad578637ab31f4c1df4
https://fedorahosted.org/freeipa/changeset/c2af032c0333f7e210c54369159d1d9f5e3fec74
https://fedorahosted.org/freeipa/changeset/d1517482b5e9508780087ec48be63a5bb531fed9
https://fedorahosted.org/freeipa/changeset/7e803aa4625869ef6a8e78a09cd99270c4cc77e5
https://fedorahosted.org/freeipa/changeset/750a392fe22aa8ddcb21077e8c24b96d36ecf20c
https://fedorahosted.org/freeipa/changeset/a28d312796839e3413c98ee37d34ccc892e85357
https://fedorahosted.org/freeipa/changeset/e6ff83e3610d553f6ff98e3adbfbe3c6984b2f17
https://fedorahosted.org/freeipa/changeset/acf2234ebc8609a35a8f45598d5d817cbdbff121
Comment 2 Petr Vobornik 2016-07-13 14:57:15 UTC 
this bz was part of rebase to 4.4
Comment 4 Martin Babinsky 2016-07-15 13:29:09 UTC 
I have removed '-C' from the "kinit as enterprise principal" part of doctext since according to kinit man page:

"""
-E     treats the principal name as an enterprise name (implies the -C option).
"""

so "-E" automatically requests principal canonicalization.

Otherwise LGTM.
Comment 13 Xiyang Dong 2016-08-22 03:58:20 UTC 
Verified on ipa-server-4.4.0-7.el7:
# ipa user-add tuser --first test --last user --password
Password: 
Enter Password again to verify: 
------------------
Added user "tuser"
------------------
  User login: tuser
  First name: test
  Last name: user
  Full name: test user
  Display name: test user
  Initials: tu
  Home directory: /home/tuser
  GECOS: test user
  Login shell: /bin/sh
  Principal name: tuser@TESTRELM
  Principal alias: tuser@TESTRELM
  Email address: tuser
  UID: 1669000001
  GID: 1669000001
  Password: True
  Member of groups: ipausers
  Kerberos keys available: True
[root@auto-hv-02-guest08 ~]# kinit tuser
Password for tuser@TESTRELM: 
Password expired.  You must change it now.
Enter new password: 
Enter it again: 

# kinit admin
Password for admin@TESTRELM: 
# ipa user-add-principal tuser talias talias\\@ent.test
---------------------------------
Added new aliases to user "tuser"
---------------------------------
  User login: tuser
  Principal alias: talias@TESTRELM, talias\@ent.test@TESTRELM, tuser@TESTRELM
# kinit talias 
Password for talias@TESTRELM: 
# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_5ks0oe9
Default principal: tuser@TESTRELM

Valid starting       Expires              Service principal
08/21/2016 23:38:33  08/22/2016 23:38:30  krbtgt/TESTRELM@TESTRELM

# kinit -C talias
Password for talias@TESTRELM: 
# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_OhZfJlN
Default principal: tuser@TESTRELM

Valid starting       Expires              Service principal
08/21/2016 23:39:00  08/22/2016 23:38:54  krbtgt/TESTRELM@TESTRELM

# kinit talias\\@ent.test
Password for talias\@ent.test@TESTRELM: 
# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_2HXMy3a
Default principal: tuser@TESTRELM

Valid starting       Expires              Service principal
08/21/2016 23:40:02  08/22/2016 23:39:59  krbtgt/TESTRELM@TESTRE

# kinit -E talias
Password for talias\@ent.test@TESTRELM: 
# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_JEDF6Xy
Default principal: tuser@TESTRELM

Valid starting       Expires              Service principal
08/21/2016 23:40:37  08/22/2016 23:40:34  krbtgt/TESTRELM@TESTRELM
Comment 15 errata-xmlrpc 2016-11-04 05:53:19 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2404.html
Note You need to log in before you can comment on or make changes to this bug.