freeipa

#6017 Allow password change with principal alias
Opened by dkupka. Modified

Open
Close Issue 
$ echo -e "Secret123\nSecret123\n" | ipa user-add tuser --first Test --last User --password
$ ipa user-add-principal tuser test@EXAMPLE.ORG
$ ipa user-add-principal tuser test\\@example.org@EXAMPLE.ORG
$ echo -e "Secret123\nNewSecret123\nNewSecret123\n" | kinit -C test
Password for test@EXAMPLE.ORG: 
kinit: KDC reply did not match expectations while getting initial credentials
$ echo -e "Secret123\nNewSecret123\nNewSecret123\n" | kinit -C -E tuser@example.test
Password for tuser\@example.test@EXAMPLE.ORG: 
kinit: KDC reply did not match expectations while getting initial credentials
  • simo: the problem is on client side, kpasswd does not turn on the -E flag when getting changepw/...
  • sbose: SSSD would not use alias also
  • Postpone to 4.5, check with Greg if MIT wants to update kpasswd on client.
  • TODO: create kpasswd bug as a dependency/blocker

Metadata Update from @dkupka:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.5 backlog

@rharwood what do you think about this?

Metadata Update from @rcritten:
- Issue close_status updated to: None

I imagine the problem is with kpasswd not turning on -C, not -E?

Otherwise it seems like a reasonable thing to support; did a bug ever get created? If not, and you want this feature, please make one.
Metadata
None
None
None
Normal
enhancement
IPA
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.