Services
How service principals are named, when one is needed, how certificates and keytabs reach it, and what the PAC type and pre-authentication options mean.
A service principal is the Kerberos identity of "a service on a host", such as HTTP/web01.linux.ipa.test@LINUX.IPA.TEST. Only services that authenticate clients with Kerberos or need a certificate from the IPA CA need one: HTTP (SSO / SPNEGO), nfs, cifs, ldap, postgres. Plain ssh logins do not; the host/ principal covers them.
The IPA server's own DNS/, HTTP/, ldap/, cifs/, dogtag/ and ipa-dnskeysyncd/ principals are created by the installer; leave them.
Adding
Service name + host. The host must already be a host object; the service name is case-sensitive and must match what the client software expects (HTTP for Apache mod_auth_gssapi, nfs for nfs-utils). Then fetch the keytab on the host:
ipa-getkeytab -p HTTP/web01.linux.ipa.test -k /etc/httpd/http.keytabor grant the host the right to fetch it itself with ipa service-add-host.
Detail page
| Block | Meaning |
|---|---|
| Principal alias | other names for the same service, e.g. a load-balancer VIP. The ticket must match the name the client connects to |
| PAC type | whether tickets carry an MS-PAC / PAD. "Inherited from server configuration" is the default; only Samba-style services need MS-PAC |
| Authentication indicators | as on the host page: require tickets for this service to have been obtained by a specific method |
| Trusted for delegation / Trusted to authenticate as user | let this service act on the user's behalf towards other services (S4U2Proxy). Reverse proxies and gateways only |
| Requires pre-authentication | on by default. Off lets anyone request a TGS for this service; only for rare legacy clients |
| Service certificate | certificate from the IPA CA; issue, revoke and renew here |
| Allow to retrieve / create keytab | principals allowed to fetch or regenerate this service's keytab |
"Is a member of" is roles; "Is managed by" is the hosts that may obtain certificates / keytabs on its behalf.
Boundaries
- Service principals are deleted with their host.
- The UI never hands out keytab files; a keytab is generated on the target host with
ipa-getkeytab, and regenerating one invalidates the old one at once. - The certificate profile is chosen on the CLI:
ipa cert-request --profile-id=; the UI uses the default profile.