Hide Forgot
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/2310 With IPA 2.2 we will be using a feature of the KDC called S4U2Proxy (services for user to proxy). We won't need users to delegated their TGT to IPA anymore. This means that people who have already configured their web browser to delegate their TGT can unset this. It won't cause problems if it is set but it is essentially sharing your full identity with a remote server so not doing so is safer. To do this the user will need to go to the URL about:config Search for delegation Select the value network.negotiate-auth.delegation-uris and clear out the IPA domain (.example.com or example.com) and click Ok. That's it. No need to restart the browser. This will only work against 2.2+.
Added upgrade info here: http://documentation-stage.bne.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/upgrading.html#ticket-delegation Removed delegation.uris part here: http://documentation-stage.bne.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/using-the-ui.html#config-browser
Fixed: * http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/upgrading.html#ticket-delegation * http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/using-the-ui.html#config-browser Just an FYI, spellchecking is the last thing I do before GA.