diff options
| author | Martin Babinsky <mbabinsk@redhat.com> | 2015-03-16 16:30:55 +0100 |
|---|---|---|
| committer | Jan Cholasta <jcholast@redhat.com> | 2015-04-20 08:27:35 +0000 |
| commit | a8e30e96716992e4160abdb7ac5995bb75e54eae (patch) | |
| tree | 40163905452de8fb15b05708970a3bc7ec964e97 /ipa-client/man | |
| parent | 415a5ff372fccee38a799cae37fb170145222107 (diff) | |
| download | freeipa-a8e30e96716992e4160abdb7ac5995bb75e54eae.tar.gz freeipa-a8e30e96716992e4160abdb7ac5995bb75e54eae.tar.xz freeipa-a8e30e96716992e4160abdb7ac5995bb75e54eae.zip | |
ipa-client-install: try to get host TGT several times before giving up
New option '--kinit-attempts' enables the host to make multiple attempts to
obtain host TGT from master before giving up and aborting client installation.
In addition, all kinit attempts were replaced by calls to
'ipautil.kinit_keytab' and 'ipautil.kinit_password'.
https://fedorahosted.org/freeipa/ticket/4808
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Diffstat (limited to 'ipa-client/man')
| -rw-r--r-- | ipa-client/man/ipa-client-install.1 | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/ipa-client/man/ipa-client-install.1 b/ipa-client/man/ipa-client-install.1 index 726a6c133..985cfb064 100644 --- a/ipa-client/man/ipa-client-install.1 +++ b/ipa-client/man/ipa-client-install.1 @@ -152,6 +152,14 @@ Do not use Authconfig to modify the nsswitch.conf and PAM configuration. \fB\-f\fR, \fB\-\-force\fR Force the settings even if errors occur .TP +\fB\-\-kinit\-attempts\fR=\fIKINIT_ATTEMPTS\fR +In case of unresponsive KDC (e.g. when enrolling multiple hosts at once in a +heavy load environment) repeat the request for host Kerberos ticket up to a +total number of \fIKINIT_ATTEMPTS\fR times before giving up and aborting client +installation. Default number of attempts is 5. The request is not repeated when +there is a problem with host credentials themselves (e.g. wrong keytab format +or invalid principal) so using this option will not lead to account lockouts. +.TP \fB\-d\fR, \fB\-\-debug\fR Print debugging information to stdout .TP |