Chapter 20. Managing Kerberos Flags and Principal Aliases 20.1. Kerberos Flags for Services and Hosts You can use various Kerberos flags to define certain specific aspects of the Kerberos ticket behavior. You can add these flags to service and host Kerberos principals. Principals in Identity Management (IdM) accept the following Kerberos flags: OK_AS_DELEGATE Use this flag to specify Kerberos tickets trusted for delegation. Active directory (AD) clients check the OK_AS_DELEGATE flag on the Kerberos ticket to determine whether the user credentials can be forwarded or delegated to the specific server. AD forwards the ticket-granting ticket (TGT) only to services or hosts with OK_AS_DELEGATE set. With this flag, system security services daemon (SSSD) can add the AD user TGT to the default Kerberos credentials cache on the IdM client machine. REQUIRES_PRE_AUTH Use this flag to specify that only pre-authenticated tickets are allowed to authenticate to the principal. With the REQUIRES_PRE_AUTH flag set, the key distribution center (KDC) requires additional authentication: the KDC issues the TGT for a principal with REQUIRES_PRE_AUTH only if the TGT has been pre-authenticated. You can clear REQUIRES_PRE_AUTH to disable pre-authentication for selected services or hosts, which lowers the load on the KDC but also slightly increases the possibility of a brute-force attack on a long-term key to succeed. OK_TO_AUTH_AS_DELEGATE Use the OK_TO_AUTH_AS_DELEGATE flag to specify that the service is allowed to obtain a kerberos ticket on behalf of the user. Note, that while this is enough to perform protocol transition, in order to obtain other tickets on behalf of the user, the service needs the OK_AS_DELEGATE flag and a corresponding policy decision allowed on the key distribution center side. 20.1.1. Setting Kerberos Flags from the Web UI To add OK_AS_DELEGATE , REQUIRES_PRE_AUTH , or OK_TO_AUTH_AS_DELEGATE to a principal: Select the Services subtab, accessible through the Identity main tab. Figure 20.1. List of Services Click on the service to which you want to add the flags. Check the option that you want to set. For example, to set the REQUIRES_PRE_AUTH flag, check the Requires pre-authentication option: Figure 20.2. Adding the REQUIRES_PRE_AUTH flag The following table lists the names of the Kerberos flags and the corresponding name in the Web UI: Table 20.1. Kerberos flags' mapping in WebUI Kerberos flag name Web UI option OK_AS_DELEGATE Trusted for delegation REQUIRES_PRE_AUTH Requires pre-authentication OK_TO_AUTH_AS_DELEGATE Trusted to authenticate as user 20.1.2. Setting and Removing Kerberos Flags from the Command Line To add a flag to a principal from the command line or to remove a flag, add one of the following options to the ipa service-mod command: --ok-as-delegate for OK_AS_DELEGATE --requires-pre-auth for REQUIRES_PRE_AUTH --ok-to-auth-as-delegate for OK_TO_AUTH_AS_DELEGATE To add a flag, set the corresponding option to 1 . For example, to add the OK_AS_DELEGATE flag to the service/ipa.example.com@EXAMPLE.COM principal: To remove a flag or to disable it, set the corresponding option to 0 . For example, to disable the REQUIRES_PRE_AUTH flag for the test/ipa.example.com@EXAMPLE.COM principal: 20.1.3. Displaying Kerberos Flags from the Command Line To find out if OK_AS_DELEGATE is currently set for a principal: Run the kvno utility. Run the klist -f command. OK_AS_DELEGATE is represented by the O character in the klist -f output: Table 20.2. Abbreviations for kerberos flags Kerberos flag name Abbreviation OK_AS_DELEGATE O REQUIRES_PRE_AUTH A OK_TO_AUTH_AS_DELEGATE F To find out what flags are currently set for a principal, use the kadmin.local utility. The current flags are displayed on the Attributes line of kadmin.local output, for example:

Commands:
ipa service-mod service/ipa.example.com@EXAMPLE.COM --ok-as-delegate= 1
ipa service-mod test/ipa.example.com@EXAMPLE.COM --requires-pre-auth= 0
kvno test/ipa.example.com@EXAMPLE.COM klist -f Ticket cache: KEYRING:persistent:0:0 Default principal: admin@EXAMPLE.COM Valid starting Expires Service principal 02/19/2014 09:59:02 02/20/2014 08:21:33 test/ipa/example.com@EXAMPLE.COM Flags: FAT O
kadmin.local kadmin.local: getprinc test/ipa.example.com Principal: test/ipa.example.com@EXAMPLE.COM Expiration date: [never] Attributes: REQUIRES_PRE_AUTH OK_AS_DELEGATE OK_TO_AUTH_AS_DELEGATE Policy: [none]