Menu Close
Red Hat Training
A Red Hat training course is available for RHEL 8
Chapter 48. Using the KDC Proxy in IdM
Some administrators might choose to make the default Kerberos ports inaccessible in their deployment. To allow users, hosts, and services to obtain Kerberos credentials, you can use the HTTPS
service as a proxy that communicates with Kerberos via the HTTPS
port 443.
In Identity Management (IdM), the Kerberos Key Distribution Center Proxy (KKDCP) provides this functionality.
On an IdM server, KKDCP is enabled by default and available at https://server.idm.example.com/KdcProxy
. On an IdM client, you must change its Kerberos configuration to access the KKDCP.
This chapter includes the following sections:
48.1. Configuring an IdM client to use KKDCP
As an Identity Management (IdM) system administrator, you can configure an IdM client to use the Kerberos Key Distribution Center Proxy (KKDCP) on an IdM server. This is useful if the default Kerberos ports are not accessible on the IdM server and the HTTPS
port 443 is the only way of accessing the Kerberos service.
Prerequisites
-
You have
root
access to the IdM client.
Procedure
-
Open the
/etc/krb5.conf
file for editing. In the
[realms]
section, enter the URL of the KKDCP for thekdc
,admin_server
, andkpasswd_server
options:[realms] EXAMPLE.COM = { kdc = https://kdc.example.com/KdcProxy admin_server = https://kdc.example.com/KdcProxy kpasswd_server = https://kdc.example.com/KdcProxy default_domain = example.com }
For redundancy, you can add the parameters
kdc
,admin_server
, andkpasswd_server
multiple times to indicate different KKDCP servers.Restart the
sssd
service to make the changes take effect:~]# systemctl restart sssd
48.2. Verifying that KKDCP is enabled on an IdM server
On an Identity Management (IdM) server, the Kerberos Key Distribution Center Proxy (KKDCP) is automatically enabled each time the Apache web server starts if the attribute and value pair ipaConfigString=kdcProxyEnabled
exists in the directory. In this situation, the symbolic link /etc/httpd/conf.d/ipa-kdc-proxy.conf
is created.
You can verify if the KKDCP is enabled on the IdM server, even as an unprivileged user.
Procedure
- Check that the symbolic link exists:
$ ls -l /etc/httpd/conf.d/ipa-kdc-proxy.conf
lrwxrwxrwx. 1 root root 36 Jun 21 2020 /etc/httpd/conf.d/ipa-kdc-proxy.conf -> /etc/ipa/kdcproxy/ipa-kdc-proxy.conf
The output confirms that KKDCP is enabled.
48.3. Disabling KKDCP on an IdM server
As an Identity Management (IdM) system administrator, you can disable the Kerberos Key Distribution Center Proxy (KKDCP) on an IdM server.
Prerequisites
-
You have
root
access to the IdM server.
Procedure
Remove the
ipaConfigString=kdcProxyEnabled
attribute and value pair from the directory:# ipa-ldap-updater /usr/share/ipa/kdcproxy-disable.uldif Update complete The ipa-ldap-updater command was successful
Restart the
httpd
service:# systemctl restart httpd.service
KKDCP is now disabled on the current IdM server.
Verification steps
Verify that the symbolic link does not exist:
$ ls -l /etc/httpd/conf.d/ipa-kdc-proxy.conf ls: cannot access '/etc/httpd/conf.d/ipa-kdc-proxy.conf': No such file or directory
48.4. Re-enabling KKDCP on an IdM server
On an IdM server, the Kerberos Key Distribution Center Proxy (KKDCP) is enabled by default and available at https://server.idm.example.com/KdcProxy
.
If KKDCP has been disabled on a server, you can re-enable it.
Prerequisites
-
You have
root
access to the IdM server.
Procedure
Add the
ipaConfigString=kdcProxyEnabled
attribute and value pair to the directory:# ipa-ldap-updater /usr/share/ipa/kdcproxy-enable.uldif Update complete The ipa-ldap-updater command was successful
Restart the
httpd
service:# systemctl restart httpd.service
KKDCP is now enabled on the current IdM server.
Verification steps
Verify that the symbolic link exists:
$ ls -l /etc/httpd/conf.d/ipa-kdc-proxy.conf lrwxrwxrwx. 1 root root 36 Jun 21 2020 /etc/httpd/conf.d/ipa-kdc-proxy.conf -> /etc/ipa/kdcproxy/ipa-kdc-proxy.conf
48.5. Additional resources
- See Configure IPA server as a KDC Proxy for AD Kerberos communication in Red Hat Knowledgebase.