Show Table of Contents
22.2. Enabling Tracking of Last Successful Kerberos Authentication
For performance reasons, IdM running on Red Hat Enterprise Linux 7.4 and later does not store the time stamp of the last successful Kerberos authentication of a user. As a consequence, certain commands, such as
ipa user-status
do not display the time stamp.
To enable tracking of the last successful Kerberos authentication of a user:
- Display the currently enabled password plug-in features:
# ipa config-show | grep "Password plugin features" Password plugin features: AllowNThash, KDC:Disable Last Success
You require the names of the features, exceptKDC:Disable Last Success
, in the following step. - Pass the
--ipaconfigstring=feature
parameter for every feature to theipa config-mod
command that is currently enabled, except forKDC:Disable Last Success
:# ipa config-mod --ipaconfigstring='AllowNThash'
This command enables only theAllowNThash
plug-in. To enable multiple features, specify the--ipaconfigstring=feature
parameter multiple times. For example, to enable theAllowNThash
andKDC:Disable Lockout
feature:# ipa config-mod --ipaconfigstring='AllowNThash' --ipaconfigstring='KDC:Disable Lockout'
- Restart IdM:
# ipactl restart