freeipa

#8531 RFE: Use host keytab to obtain ticket for ipa-certupdate
Closed: fixed by rcritten. Opened by rcritten.

Closed: fixed
Reopen Issue

Request for enhancement

As an administrator I don't want to have to manually obtain a TGT in order to execute ipa-certupdate when the CA chain is updated. This will allow for easier automation.

Steps to Reproduce

  1. # rm -rf ~/.cache/ipa/s*
  2. # ipa-certupdate

Actual behavior

did not receive Kerberos credentials
The ipa-certupdate command failed.

This happens if there is no schema downloaded from the IPA server in the user's cache. The api.finalize() happens before the kinit_keytab() call.

A better solution may be to drop the kinit_keytab() call and add this before api.finalize():

os.environ['KRB5_CLIENT_KTNAME'] = '/etc/krb5.keytab'

+1

Metadata Update from @pcech:
- Issue priority set to: important (was: normal)

Metadata Update from @rcritten:
- Issue assigned to rcritten

https://github.com/freeipa/freeipa/pull/5246

master:

  • d9b259dd584eb65e2c4796968f18542a41efb42c Use host keytab to obtain credentials needed for ipa-certupdate
  • d30939ebfdcd820c7e26c0709f48185cc88431fc ipatests: Test that ipa-certupdate can run without credentials

ipa-4-9:

  • 1a09ce9f3fa503eeefe394856be538892652accf Use host keytab to obtain credentials needed for ipa-certupdate
  • 4941d3d4b1ba10ccddf5429463debcefac6fbd9f ipatests: Test that ipa-certupdate can run without credentials

ipa-4-8:

  • 1e541a6ddd1a108889fa991b6ed06e68022fa4b7 Use host keytab to obtain credentials needed for ipa-certupdate
  • 449df021d1ddb5c085bb35f6599e5337922f9efe ipatests: Test that ipa-certupdate can run without credentials

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.