<div dir="ltr"><div><div>SOLVED. </div>realm-proxy has to be indirect member of : memberofindirect: cn=manage host keytab,cn=privileges,cn=pbac,dc=example,dc=com </div>Thanks for your help. </div><div class="gmail_extra"> <div class="gmail_quote">2014-09-09 16:59 GMT+02:00 Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">James James wrote: > My user : realm-proxy is in a group (Smart Proxy Host Management) which > has the Manager host keytab permission : > > Permission name: Manage host keytab > Permissions: write > Attributes: krbprincipalkey, krblastpwdchange > Type: host > Granted to Privilege: Host Administrators, Host Enrollment, Smart > Proxy Host Management > > > When I try to retreive a keytab from another host when my principal is > the realm-proxy : > > > [root@client1 ~]# kinit <a href="mailto:realm-proxy@EXAMPLE.COM">realm-proxy@EXAMPLE.COM</a> > <mailto:<a href="mailto:realm-proxy@EXAMPLE.COM">realm-proxy@EXAMPLE.COM</a>> -k -t /tmp/freeipa.keytab > > [root@client1 ~]# klist > > Ticket cache: KEYRING:persistent:0:0 > Default principal: <a href="mailto:realm-proxy@EXAMPLE.COM">realm-proxy@EXAMPLE.COM</a> <mailto:<a href="mailto:realm-proxy@EXAMPLE.COM">realm-proxy@EXAMPLE.COM</a>> > > Valid starting Expires Service principal > 09/09/2014 14:35:50 09/10/2014 14:35:50 krbtgt/<a href="mailto:EXAMPLE.COM@EXAMPLE.COM">EXAMPLE.COM@EXAMPLE.COM</a> > <mailto:<a href="mailto:EXAMPLE.COM@EXAMPLE.COM">EXAMPLE.COM@EXAMPLE.COM</a>> > > [root@client1 ~]# ipa-getkeytab --server=<a href="http://ipa.example.com" target="_blank">ipa.example.com</a> > <<a href="http://ipa.example.com" target="_blank">http://ipa.example.com</a>> --principal=host/<a href="http://client1.example.com" target="_blank">client1.example.com</a> > <<a href="http://client1.example.com" target="_blank">http://client1.example.com</a>> --keytab=/etc/krb5.keytab > Operation failed! Insufficient access rights > > > I can't retrieve the key .. I'd need to see the smart-proxy user, show --all --raw would be best. I just tested this on a RHEL-6 instance I had handy and it worked fine: # ipa user-add --first=test --last=user tuser1 --password # ipa role-add 'host keytab' --desc 'manage host keytabs' # ipa privilege-add 'manage host keytab' --desc 'manage host keytabs' # ipa privilege-add-permission 'manage host keytab' --permissions='manage host keytab' # ipa role-add-privilege 'host keytab' --privileges='manage host keytab' # ipa role-add-member --users=tuser1 'host keytab' # kinit tuser1 # ipa-getkeytab -s `hostname` -k /tmp/test.keytab -p host/<a href="http://test.example.com" target="_blank">test.example.com</a> Keytab successfully retrieved and stored in: /tmp/test.keytab rob > > 2014-09-09 16:14 GMT+02:00 Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a> > <mailto:<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>>>: > > James James wrote: > > My IPA version is 3.0.0 . > > Thanks > > The permission 'Manage host keytab' should do the trick. > > rob > > > > > 2014-09-09 1:22 GMT+02:00 Dmitri Pal <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a> <mailto:<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>> > > <mailto:<a href="mailto:dpal@redhat.com">dpal@redhat.com</a> <mailto:<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>>>>: <div class="HOEnZb"><div class="h5">> > > > On 09/08/2014 06:52 PM, James James wrote: > >> Hi everybody, > >> > >> I want a user to be able to do ipa-getkeytab to retrieve the keys > >> from any host in the realm. > >> > >> How can I do this ? > >> > >> Where I can find an ACI example > >> > (<a href="https://www.redhat.com/archives/freeipa-users/2010-July/msg00024.html" target="_blank">https://www.redhat.com/archives/freeipa-users/2010-July/msg00024.html</a>) > >> which can helps me ? > >> > >> > >> Thanks for your help. > >> > >> > >> > >> > > Which version of IPA? > > There reason for the question is because in FreeIPA 4.0 the ACIs > > were significantly reworked. > > > > -- > > Thank you, > > Dmitri Pal > > > > Sr. Engineering Manager IdM portfolio > > Red Hat, Inc. > > > > > > -- > > Manage your subscription for the Freeipa-users mailing list: > > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> > > Go To <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project > > > > > > > > > > </div></div></blockquote></div> </div>