Cloned from https://issues.redhat.com/browse/RHEL-43143

What were you trying to do that didn't work?

Following: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_identity_management/configuring-idm-for-smart-card-auth_configuring-and-managing-idm

[root@server SmartCard]# kinit admin
[root@server SmartCard]# ipa-advise config-client-for-smart-card-auth > config-client-for-smart-card-auth.sh

This requires root privileges with a kerberos admin ticket to IPA. This might be seen as onerous for Cu who have idm clients needing this where the ipa admin doesn't want to give admin privileges to all client hosts.

We have changed ipa-certupdate to run as root and draw from the host keytab instead of needing a ticket.

Yet the script still includes:

klist
if [ "$?" -ne "0" ]
then
    echo "Credential cache is empty" >&2
    echo "Use kinit as privileged user to obtain Kerberos credentials" >&2
    exit 1
fi

Perhaps this could be now removed and only detect for root.

Please provide the package NVR for which bug is seen:

Latest Rhel 8.10
(nvr is ipa-common-4.9.13-10.module+el8.10.0+21944+3943ad77.noarch.rpm)

How reproducible:

Always

Steps to reproduce

From ipa client run the script generated without a ticket and it fails

    kdestroy -A
    ./config-client-for-smart-card-auth.sh rootca.pem

Expected results

For this to now work.

Actual results

requests a privileged kerberos ticket for execution.