[Freeipa-users] using AD token to get freeipa token

[Simo Sorce]

On Wed, 2014-07-09 at 18:38 +0200, Stijn De Weirdt wrote:
> hi all,
> 
> we are investigating the possibility to use an existing and valid AD 
> token to obtain a token from a realm under FreeIPA (3.3.3 from el7), 
> without having to setup the full IPA AD cross realm trust. (in 
> particular, to avoid that AD has to trust the IPA setup; and with the 
> goal that we can minimise any required actions on the AD setup).
> 
> what we would like to achieve is the following:
> kinit user at AD
> --- authenticate via AD password
> 
> kinit otherusername at IPA
> -- no password required, authentication based on valid AD token
> 
> so one can then eg "ssh otherusername at machine.under.ipa.control"
> 
> the user at AD to otherusername at IPA mapping is provided somewhere on the 
> IPA server and is static.
> 
> as far as i understood, this is (very?) different from actual trust 
> relation where having the user at AD token is sufficient to do "ssh 
> otherusername at machine.under.ipa.control".
> 
> 
> any hints are welcome!

It's not possible*, sorry.

Simo.

* At the very theoretical level it would, but it would require extensive
changes to the kerberos libraries on each client as well as changes to
the KDC. Operationally unfeasible even if you had those code changes.

-- 
Simo Sorce * Red Hat, Inc * New York