22.2. Enabling Tracking of Last Successful Kerberos Authentication

For performance reasons, IdM running on Red Hat Enterprise Linux 7.4 and later does not store the time stamp of the last successful Kerberos authentication of a user. As a consequence, certain commands, such as ipa user-status do not display the time stamp.
To enable tracking of the last successful Kerberos authentication of a user:
  1. Display the currently enabled password plug-in features: 
    # ipa config-show | grep "Password plugin features"
  Password plugin features: AllowNThash, KDC:Disable Last Success
    You require the names of the features, except KDC:Disable Last Success, in the following step.
  2. Pass the --ipaconfigstring=feature parameter for every feature to the ipa config-mod command that is currently enabled, except for KDC:Disable Last Success: 
    # ipa config-mod --ipaconfigstring='AllowNThash'
    This command enables only the AllowNThash plug-in. To enable multiple features, specify the --ipaconfigstring=feature parameter multiple times. For example, to enable the AllowNThash and KDC:Disable Lockout feature: 
    # ipa config-mod --ipaconfigstring='AllowNThash' --ipaconfigstring='KDC:Disable Lockout'
  3. Restart IdM: 
    # ipactl restart