167
edits
Enroll Mac in Kerberos: Difference between revisions
Jump to navigation
Jump to search
no edit summary
No edit summary |
No edit summary |
||
| Line 7: | Line 7: | ||
# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt | # Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt | ||
# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA | # As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA | ||
# Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/ | # Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/user.key -out ~/Library/IPA/user.csr | ||
# Go to your user in IPA | # Go to your user in IPA | ||
# Click on Actions > New Certificate | # Click on Actions > New Certificate | ||
# CA = ipa | # CA = ipa | ||
# Profile ID = caIPAserviceCert | # Profile ID = caIPAserviceCert | ||
# Paste the contents of this command into the big textfield: cat ~/Library/IPA/ | # Paste the contents of this command into the big textfield: cat ~/Library/IPA/user.csr | ||
# Request the certificate | # Request the certificate | ||
# Store the resulting certificate in ~/Library/IPA/ | # Store the resulting certificate in ~/Library/IPA/user.crt | ||
# Add the following lines to your ~/.bash_profile. Make sure to replace <mac_username> with your Mac username and <ipa_username> with your IPA username! | # Add the following lines to your ~/.bash_profile. Make sure to replace <mac_username> with your Mac username and <ipa_username> with your IPA username! | ||
## alias ds_pkinit="kinit -C FILE:/Users/<mac_username>/Library/IPA/ | ## alias ds_pkinit="kinit -C FILE:/Users/<mac_username>/Library/IPA/user.crt,/Users/<mac_username>/Library/IPA/user.key --keychain <ipa_username>" | ||
## ds_pkinit & disown | ## ds_pkinit & disown | ||