Enroll Mac in Kerberos

This will make your laptop automatically log you in to IPA. Only do this on machines that are exclusively used by you!

1. Create host on IPA
2. Create a keytab on an enrolled host: TMPFILE="$(mktemp -u)"; ipa-getkeytab -s ipa.delftsolutions.nl -p host/<hostname> -k "$TMPFILE"; base64 -w0 "$TMPFILE" && echo; rm -f "$TMPFILE";
3. On the mac as root, create the keytab: umask 026; base64 -D >/etc/krb5.keytab <<<"<key>"; umask 022
4. Ensure /etc/krb5.conf file has the correct contents.
5. Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt
6. As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA
7. Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/laptop.key -out ~/Library/IPA/laptop.csr
8. Go to your user in IPA
9. Click on Actions > New Certificate
10. CA = ipa
11. Profile ID = caIPAserviceCert
12. Paste the contents of this command into the big textfield: cat ~/Library/IPA/laptop.csr
13. Request the certificate
14. Store the resulting certificate in ~/Library/IPA/laptop.crt
15. Add the following lines to your ~/.bash_profile. Make sure to replace <mac_username> with your Mac username and <ipa_username> with your IPA username!
    1. alias ds_pkinit="kinit -C FILE:/Users/<mac_username>/Library/IPA/laptop.crt,/Users/<mac_username>/Library/IPA/laptop.key --keychain <ipa_username>"
    2. ds_pkinit & disown

krb5.conf

[libdefaults]
    default_realm = DELFTSOLUTIONS.NL
    kdc_timesync = 1
    ccache_type = 4
    forwardable = true
    proxiable = true
    fcc-mit-ticketflags = true
    ticket_lifetime = 24h

[appdefaults]
    pkinit_anchors = FILE:/etc/ipa/ca.crt

[realms]
    DELFTSOLUTIONS.NL = {
        default_domain = delftsolutions.nl
    }

[domain_realm]
    .delftsolutions.nl = DELFTSOLUTIONS.NL
    delftsolutions.nl = DELFTSOLUTIONS.NL