<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><br class=""></div><div class="">Hello,</div><div class=""><br class=""></div><div class="">On our current IPA realm where we have not used 2-factor, we’ve been able to kinit to our FreeIPA realm from our laptops. All a Mac user needed to do, for example was to configure a ‘krb5.conf’ file and then ‘kinit <a href="mailto:user1@our.ipa.realm.com" class="">user1@OUR.IPA.REALM.COM</a>'. This would allow us to work on our infrastructure without having to re-authenticate for the lifetime of our ticket-granting-ticket, usually the length of a work day.</div><div class=""><br class=""></div><div class="">We are building a new realm using 'ipa-server-4.2.0-15’ and will be requiring 2-factor for authentication. So far it works well, meaning we can ssh to a jump host enrolled in our realm and from there move to other hosts in the realm without having to re-authenticate.</div><div class=""><br class=""></div><div class="">However, we can no longer ‘kinit’. I’ve dug around in the webs and have concluded that either this is a known issue that is not yet fixed, or perhaps someone has fixed it but not yet shared how they got this to work.</div><div class=""><br class=""></div><div class="">How is this impacting anyone else? Does anyone have any helpful information they can share?</div><div class=""><br class=""></div><div class="">thanks,</div><div class="">Geordie Grindle</div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>