I'm following the instructions here:
to try to allow a Windows machine to authenticate logins against a FreeIPA server on RHEL. I'm wondering if this might be a case of me misunderstanding the instructions in the link. I've only started dealing with Kerberos recently and I find myself occasionally getting confused about some of the concepts and terminology.
The page instructs that the
ipa-getkeytab command be run on the FreeIPA server to generate a keytab (which I assume contains a new host principal key) for a Windows machine being kerberized. At no point in the instructions does it say anything about copying that generated keytab over to the Windows machine. This is where my I feel my limited understanding of Kerberos begin to unravel.
When joining Linux machines to the FreeIPA server, the
ipa-getkeytab command is used on the host that is joining (client) to request a keytab from the FreeIPA server. This has lead me to think a Windows machine would also need to obtain a keytab from the FreeIPA server somehow but the instructions for joining Windows machines just say to run the
ipa-getkeytab command directly on the FreeIPA server instead.
If the Windows machine does not have a keytab with the host principal key then would I be correct in saying that it would not be able to use Kerberos to authenticate and get a ticket?
If the opposite is true then could someone please explain how it would work?