When realmd calls ipa-client-install it should take advantage of the automatic SSH configuration. For more information on this feature of IPA client see following ticket: https://fedorahosted.org/freeipa/ticket/3452
Related (probably prerequisite bug) upstream: https://bugs.freedesktop.org/show_bug.cgi?id=61858
Dmitri, it's hard to understand from the linked freeipa tickets what exactly we need realmd to do here. In realmd we don't specify --nossh or -nosshd by default, so as I understand it SSH should be configured as expected.
Just making sure that SSH works properly out of box with realmd enrollment would probably be sufficient.
ssh is working to ipa-users, what causes problems is public-key authentication. E.g. if ssh to ipa-user that knows the public-key of user who is doing the ssh, the sshd server still asks for password. This is known bug of ipa-client. It should be tested with realmd too once it is fixed (freeipa bug 953617) openssh-6.2p1-3.fc19 freeipa-client-3.2.0-0.2.beta1.fc19 W/A: add to /etc/ssh/sshd_config: AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys AuthorizedKeysCommandUser nobody and restart the ssh server.
realmd-0.13.90-1.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/realmd-0.13.90-1.fc19
Package realmd-0.13.90-1.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing realmd-0.13.90-1.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-7111/realmd-0.13.90-1.fc19 then log in and leave karma (feedback).
realmd-0.13.91-1.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/realmd-0.13.91-1.fc19
Fixed in Fedora 19 after this release: https://admin.fedoraproject.org/updates/FEDORA-2013-7787/realmd-0.14.0-1.fc19