freeipa

#8276 Add default password policy for sysaccounts
Closed: fixed by cheimes. Opened by cheimes.

Closed: fixed
Reopen Issue

Request for enhancement

IPA defines a default password policy for hosts, services, and kerberos services but not for system accounts. System accounts are limited accounts that allow e.g. LDAP bind for read operations.

With a default password policy it is possible to create sysaccounts with krbPrincipalAux object class to bind with a Kerberos keytab. Without a dedicated policy the default policy may interfere and e.g. expire passwords.

master:

  • bb24641e8ffdc1083565b9de9496606cd458cf8d Use api.env.container_sysaccounts
  • ca6d6781c741fe5aedc68f8de592b9806ebe21d7 Define default password policy for sysaccounts

ipa-4-8:

  • 7509f42516246a012a51a798859dbecbc708642d Use api.env.container_sysaccounts
  • e74cfcc96e0f7c43303b4121683c3d1b3594ce3a Define default password policy for sysaccounts

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to cn=sysaccounts,cn=etc now has a default password policy to permit system accounts with krbPrincipalAux object class. This allows system accounts to have a keytab that does not expire. The "Default System Accounts Password Policy" has a minimum password length in case the password is directly modified with LDAP.
Metadata
None
None
None
Normal
cn=sysaccounts,cn=etc now has a default password policy to permit system accounts with krbPrincipalAux object class. This allows system accounts to have a keytab that does not expire. The "Default System Accounts Password Policy" has a minimum password length in case the password is directly modified with LDAP.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.