freeipa

#9670 when setting a keytab over LDAP, make sure to synchronize userPassword if it is allowed to be present
Opened by abbra. Modified

Open
Close Issue

Kerberos services cannot currently be used for simple LDAP authentication because they don't contain userPassword attribute by default. However, if one of objectclasses which allow use of userPassword attribute were to be present in the entry, keys generator control needs to update userPassword attribute as well.

This was reported in 2018 in https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org/message/43P6UPAB2FYRBZINAYW3SYEN3FAGK5BM/ but we missed it.

This bug prevents using services as 'LDAP system accounts'.

Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.