IDM コマンドラインユーティリティー
・IdMサーバ起動
[centos7]$ ipactl start
Starting Directory Service
Starting krb5kdc Service
Starting kadmin Service
Starting named Service
Starting httpd Service
Starting ipa-custodia Service
Starting ntpd Service
Starting pki-tomcatd Service
Starting ipa-otpd Service
Starting ipa-dnskeysyncd Service
ipa: INFO: The ipactl command was successful
[centos7]$ ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
named Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa-dnskeysyncd Service: RUNNING
ipa: INFO: The ipactl command was successful
※IdMサーバ停止は
ipactl stop
[centos7]$ ipa --version
VERSION: 4.6.6, API_VERSION: 2.231
・IdMへのログイン
[centos7]$ klist
klist: Credentials cache keyring 'persistent:0:0' not found
[centos7]$ kinit admin
Password for admin@DAGYAH.COM:Password123
※OSユーザではなくIdMユーザでログインする
[centos7]$ klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin@DAGYAH.COM
Valid starting Expires Service principal
11/26/2020 12:20:04 11/27/2020 12:19:58 krbtgt/DAGYAH.COM@DAGYAH.COM
※klistコマンドではキャッシュしたTGT（kerberosチケットが含まれる認証情報キャッシュ）を表示
※kerberosチケットが含まれる認証情報キャッシュを破棄するには
kdestroy
[centos7]$ ls -l ~admin
ls: cannot access /home/admin: No such file or directory
[centos7]$ id admin
uid=1942000000(admin) gid=1942000000(admins) groups=1942000000(admins)
[centos7]$ grep admin /etc/passwd;echo $?
1
・ipaユーザ確認
[centos7]$ ipa user-find
---------------
4 users matched
---------------
User login: admin
Last name: Administrator
Home directory: /home/admin
Login shell: /bin/bash
Principal alias: admin@DAGYAH.COM
UID: 1942000000
GID: 1942000000
Account disabled: False
User login: dagyah1
First name: dagyah
Last name: one
Home directory: /home/dagyah1
Login shell: /bin/sh
Principal name: dagyah1@DAGYAH.COM
Principal alias: dagyah1@DAGYAH.COM
Email address: dagyah1@dagyah.com
UID: 1942000001
GID: 1942000001
Account disabled: False
User login: dagyah2
First name: dagyah
Last name: two
Home directory: /home/dagyah2
Login shell: /bin/sh
Principal name: dagyah2@DAGYAH.COM
Principal alias: dagyah2@DAGYAH.COM
Email address: dagyah2@dagyah.com
UID: 1942000003
GID: 1942000003
Account disabled: False
User login: dagyah3
First name: dagyah
Last name: three
Home directory: /home/dagyah3
Login shell: /bin/sh
Principal name: dagyah3@DAGYAH.COM
Principal alias: dagyah3@DAGYAH.COM
Email address: dagyah3@dagyah.com
UID: 1942000004
GID: 1942000004
Account disabled: False
----------------------------
Number of entries returned 4
----------------------------
・IdMからログアウト
[centos7]$ kdestroy
[centos7]$ klist
klist: Credentials cache keyring 'persistent:0:0' not found
[centos7]$ ipa user-find
ipa: ERROR: did not receive Kerberos credentials
・ipaヘルプがカバーしたトピックの一覧（user,cert,serverなど多数）の表示
[centos7]$ ipa help topics | cat
automember Auto Membership Rule.
automount Automount
ca Manage Certificate Authorities
caacl Manage CA ACL rules.
cert IPA certificate operations
certmap Certificate Identity Mapping
certprofile Manage Certificate Profiles
config Server configuration
delegation Group to Group Delegation
dns Domain Name System (DNS)
domainlevel Raise the IPA Domain Level.
group Groups of users
hbac Host-based access control commands
hbactest Simulate use of Host-based access controls
host Hosts/Machines
hostgroup Groups of hosts.
idrange ID ranges
idviews ID Views
krbtpolicy Kerberos ticket policy
location IPA locations
migration Migration to IPA
misc Misc plug-ins
netgroup Netgroups
otp One time password commands
passwd Set a user's password
permission Permissions
ping Ping the remote IPA server to ensure it is running.
pkinit Kerberos PKINIT feature status reporting tools.
privilege Privileges
pwpolicy Password policy
radiusproxy RADIUS Proxy Servers
realmdomains Realm domains
role Roles
schema API Schema
selfservice Self-service Permissions
selinuxusermap SELinux User Mapping
server IPA servers
serverrole IPA server roles
service Services
servicedelegation Service Constrained Delegation
stageuser Stageusers
sudo commands for controlling sudo configuration
topology Topology
trust Cross-realm trusts
user Users
vault Vaults
※catに渡さないとlessで出力される。
・ipaヘルプでカバーされるコマンド（user-add,ca-enable,server-showなど多数）などのコマンドの一覧を表示
[centos7]$ ipa help commands | cat -n
1 automember-add Add an automember rule.
2 automember-add-condition Add conditions to an automember rule.
3 automember-default-group-remove Remove default (fallback) group for all unmatched entries.
4 automember-default-group-set Set default (fallback) group for all unmatched entries.
5 automember-default-group-show Display information about the default (fallback) automember groups.
6 automember-del Delete an automember rule.
7 automember-find Search for automember rules.
8 automember-find-orphans Search for orphan automember rules. The command might need to be run as
9 a privileged user user to get all orphan rules.
10 automember-mod Modify an automember rule.
----(略)----
418 vault-find Search for vaults.
419 vault-mod Modify a vault.
420 vault-remove-member Remove members from a vault.
421 vault-remove-owner Remove owners from a vault.
422 vault-retrieve Retrieve a data from a vault.
423 vault-show Display information about a vault.
424 vaultconfig-show Show vault configuration.
425 vaultcontainer-add-owner Add owners to a vault container.
426 vaultcontainer-del Delete a vault container.
427 vaultcontainer-remove-owner Remove owners from a vault container.
428 vaultcontainer-show Display information about a vault container.
※catに渡さないとlessで出力される。
・ipaサブコマンドのヘルプ
[centos7]$ ipa help user-add | cat -n
1 Usage: ipa [global-options] user-add LOGIN [options]
2
3 Add a new user.
4 Options:
5 -h, --help show this help message and exit
6 --first=STR First name
7 --last=STR Last name
8 --cn=STR Full name
9 --displayname=STR Display name
10 --initials=STR Initials
11 --homedir=STR Home directory
12 --gecos=STR GECOS
13 --shell=STR Login shell
14 --principal=PRINCIPAL
15 Principal alias
16 --principal-expiration=DATETIME
17 Kerberos principal expiration
18 --password-expiration=DATETIME
19 User password expiration
20 --email=STR Email address
21 --password Prompt to set the user password
22 --random Generate a random user password
23 --uid=INT User ID Number (system will assign one if not
24 provided)
25 --gidnumber=INT Group ID Number
26 --street=STR Street address
27 --city=STR City
28 --state=STR State/Province
29 --postalcode=STR ZIP
30 --phone=STR Telephone Number
31 --mobile=STR Mobile Telephone Number
32 --pager=STR Pager Number
33 --fax=STR Fax Number
34 --orgunit=STR Org. Unit
35 --title=STR Job Title
36 --manager=STR Manager
37 --carlicense=STR Car License
38 --sshpubkey=STR SSH public key
39 --user-auth-type=['password', 'radius', 'otp']
40 Types of supported user authentication
41 --class=STR User category (semantics placed on this attribute are
42 for local interpretation)
43 --radius=STR RADIUS proxy configuration
44 --radius-username=STR
45 RADIUS proxy username
46 --departmentnumber=STR
47 Department Number
48 --employeenumber=STR Employee Number
49 --employeetype=STR Employee Type
50 --preferredlanguage=STR
51 Preferred Language
52 --certificate=CERTIFICATE
53 Base-64 encoded user certificate
54 --setattr=STR Set an attribute to a name/value pair. Format is
55 attr=value. For multi-valued attributes, the command
56 replaces the values already present.
57 --addattr=STR Add an attribute/value pair. Format is attr=value. The
58 attribute must be part of the schema.
59 --noprivate Don't create user private group
60 --all Retrieve and print all attributes from the server.
61 Affects command output.
62 --raw Print entries as stored on the server. Only affects
63 output format.
64 --no-members Suppress processing of membership attributes.
[centos7]$ ipa help user-del | cat -n
1 Usage: ipa [global-options] user-del LOGIN... [options]
2
3 Delete a user.
4 Options:
5 -h, --help show this help message and exit
6 --continue Continuous mode: Don't stop on errors.
7 --preserve Delete a user, keeping the entry available for future use
8 --no-preserve Delete a user
[centos7]$ ipa help user-mod | cat -n
1 Usage: ipa [global-options] user-mod LOGIN [options]
2
3 Modify a user.
4 Options:
5 -h, --help show this help message and exit
6 --first=STR First name
7 --last=STR Last name
8 --cn=STR Full name
9 --displayname=STR Display name
10 --initials=STR Initials
11 --homedir=STR Home directory
12 --gecos=STR GECOS
13 --shell=STR Login shell
14 --principal=PRINCIPAL
15 Principal alias
16 --principal-expiration=DATETIME
17 Kerberos principal expiration
18 --password-expiration=DATETIME
19 User password expiration
20 --email=STR Email address
21 --password Prompt to set the user password
22 --random Generate a random user password
23 --uid=INT User ID Number (system will assign one if not
24 provided)
25 --gidnumber=INT Group ID Number
26 --street=STR Street address
27 --city=STR City
28 --state=STR State/Province
29 --postalcode=STR ZIP
30 --phone=STR Telephone Number
31 --mobile=STR Mobile Telephone Number
32 --pager=STR Pager Number
33 --fax=STR Fax Number
34 --orgunit=STR Org. Unit
35 --title=STR Job Title
36 --manager=STR Manager
37 --carlicense=STR Car License
38 --sshpubkey=STR SSH public key
39 --user-auth-type=['password', 'radius', 'otp']
40 Types of supported user authentication
41 --class=STR User category (semantics placed on this attribute are
42 for local interpretation)
43 --radius=STR RADIUS proxy configuration
44 --radius-username=STR
45 RADIUS proxy username
46 --departmentnumber=STR
47 Department Number
48 --employeenumber=STR Employee Number
49 --employeetype=STR Employee Type
50 --preferredlanguage=STR
51 Preferred Language
52 --certificate=CERTIFICATE
53 Base-64 encoded user certificate
54 --setattr=STR Set an attribute to a name/value pair. Format is
55 attr=value. For multi-valued attributes, the command
56 replaces the values already present.
57 --addattr=STR Add an attribute/value pair. Format is attr=value. The
58 attribute must be part of the schema.
59 --delattr=STR Delete an attribute/value pair. The option will be
60 evaluated last, after all sets and adds.
61 --rights Display the access rights of this entry (requires
62 --all). See ipa man page for details.
63 --all Retrieve and print all attributes from the server.
64 Affects command output.
65 --raw Print entries as stored on the server. Only affects
66 output format.
67 --no-members Suppress processing of membership attributes.
68 --rename=STR Rename the user object
[centos7]$ ipa help user-find | cat -n
1 Usage: ipa [global-options] user-find [CRITERIA] [options]
2
3 Search for users.
4 Options:
5 -h, --help show this help message and exit
6 --login=STR User login
7 --first=STR First name
8 --last=STR Last name
9 --cn=STR Full name
10 --displayname=STR Display name
11 --initials=STR Initials
12 --homedir=STR Home directory
13 --gecos=STR GECOS
14 --shell=STR Login shell
15 --principal=PRINCIPAL
16 Principal alias
17 --principal-expiration=DATETIME
18 Kerberos principal expiration
19 --password-expiration=DATETIME
20 User password expiration
21 --email=STR Email address
22 --password Prompt to set the user password
23 --uid=INT User ID Number (system will assign one if not
24 provided)
25 --gidnumber=INT Group ID Number
26 --street=STR Street address
27 --city=STR City
28 --state=STR State/Province
29 --postalcode=STR ZIP
30 --phone=STR Telephone Number
31 --mobile=STR Mobile Telephone Number
32 --pager=STR Pager Number
33 --fax=STR Fax Number
34 --orgunit=STR Org. Unit
35 --title=STR Job Title
36 --manager=STR Manager
37 --carlicense=STR Car License
38 --user-auth-type=['password', 'radius', 'otp']
39 Types of supported user authentication
40 --class=STR User category (semantics placed on this attribute are
41 for local interpretation)
42 --radius=STR RADIUS proxy configuration
43 --radius-username=STR
44 RADIUS proxy username
45 --departmentnumber=STR
46 Department Number
47 --employeenumber=STR Employee Number
48 --employeetype=STR Employee Type
49 --preferredlanguage=STR
50 Preferred Language
51 --certificate=CERTIFICATE
52 Base-64 encoded user certificate
53 --disabled=BOOL Account disabled
54 --preserved=BOOL Preserved user
55 --timelimit=INT Time limit of search in seconds (0 is unlimited)
56 --sizelimit=INT Maximum number of entries returned (0 is unlimited)
57 --whoami Display user record for current Kerberos principal
58 --all Retrieve and print all attributes from the server.
59 Affects command output.
60 --raw Print entries as stored on the server. Only affects
61 output format.
62 --pkey-only Results should contain primary key attribute only
63 ("login")
64 --in-groups=STR Search for users with these member of groups.
65 --not-in-groups=STR Search for users without these member of groups.
66 --in-netgroups=STR Search for users with these member of netgroups.
67 --not-in-netgroups=STR
68 Search for users without these member of netgroups.
69 --in-roles=STR Search for users with these member of roles.
70 --not-in-roles=STR Search for users without these member of roles.
71 --in-hbacrules=STR Search for users with these member of HBAC rules.
72 --not-in-hbacrules=STR
73 Search for users without these member of HBAC rules.
74 --in-sudorules=STR Search for users with these member of sudo rules.
75 --not-in-sudorules=STR
76 Search for users without these member of sudo rules.
[centos7]$ ipa help user-show | cat -n
1 Usage: ipa [global-options] user-show LOGIN [options]
2
3 Display information about a user.
4 Options:
5 -h, --help show this help message and exit
6 --rights Display the access rights of this entry (requires --all). See
7 ipa man page for details.
8 --out=STR file to store certificate in
9 --all Retrieve and print all attributes from the server. Affects
10 command output.
11 --raw Print entries as stored on the server. Only affects output
12 format.
13 --no-members Suppress processing of membership attributes.
・ユーザをIdMデータベースに追加
[centos7]$ ipa user-add
First name: da
Last name: gyah
User login [dgyah]: dagyah
-------------------
Added user "dagyah"
-------------------
User login: dagyah
First name: da
Last name: gyah
Full name: da gyah
Display name: da gyah
Initials: dg
Home directory: /home/dagyah
GECOS: da gyah
Login shell: /bin/sh
Principal name: dagyah@DAGYAH.COM
Principal alias: dagyah@DAGYAH.COM
Email address: dagyah@dagyah.com
UID: 1942000005
GID: 1942000005
Password: False
Member of groups: ipausers
Kerberos keys available: False
[centos7]$ kdestroy
[centos7]$ kinit dagyah
kinit: Pre-authentication failed: Invalid argument while getting initial credentials
→adminで再びIdMにログイン
・IdMユーザにパスワード追加
[centos7]$ ipa user-mod dagyah --password
Password:Password123
Enter Password again to verify:Password123
----------------------
Modified user "dagyah"
----------------------
User login: dagyah
First name: da
Last name: gyah
Home directory: /home/dagyah
Login shell: /bin/sh
Principal name: dagyah@DAGYAH.COM
Principal alias: dagyah@DAGYAH.COM
Email address: dagyah@dagyah.com
UID: 1942000005
GID: 1942000005
Account disabled: False
Password: True
Member of groups: ipausers
Kerberos keys available: True
[centos7]$ id dagyah
uid=1000(dagyah) gid=1000(dagyah) groups=1000(dagyah) ←同名ユーザがOS（/etc/passwdや/etc/shadow）にも居る
[centos7]$ kdestroy
[centos7]$ kinit dagyah
Password for dagyah@DAGYAH.COM:Password123
Password expired. You must change it now.password123
Enter new password:password123
Enter it again:
[centos7]$ klist
Ticket cache: KEYRING:persistent:0:0
Default principal: dagyah@DAGYAH.COM
Valid starting Expires Service principal
11/26/2020 13:09:31 11/27/2020 13:09:31 krbtgt/DAGYAH.COM@DAGYAH.COM
・コマンドラインからIdMユーザとパスワードを同時かつ非対話式に追加
※上記のように「dagyah」アカウントのまま実行してみる
[centos7]$ ipa user-show dagyah
User login: dagyah
First name: da
Last name: gyah
Home directory: /home/dagyah
Login shell: /bin/sh
Principal name: dagyah@DAGYAH.COM
Principal alias: dagyah@DAGYAH.COM
Email address: dagyah@dagyah.com
UID: 1942000005
GID: 1942000005
Account disabled: False
Password: True
Member of groups: ipausers
Kerberos keys available: True
[centos7]$ ipa user-show admin
User login: admin
Last name: Administrator
Home directory: /home/admin
Login shell: /bin/bash
Principal alias: admin@DAGYAH.COM
UID: 1942000000
GID: 1942000000
Account disabled: False
Password: True
Member of groups: admins, trust admins
Kerberos keys available: True
[centos7]$ ipa user-add --first=unko --last=man --password
User login [uman]: unkoman
Password:Password123
Enter Password again to verify:Password123
ipa: ERROR: Insufficient access: Could not read UPG Definition originfilter. Check your permissions.
[centos7]$ ipa user-find unko
---------------
0 users matched
---------------
----------------------------
Number of entries returned 0
----------------------------
・adminでログインしなおしてユーザ追加
[centos7]$ kinit admin
Password for admin@DAGYAH.COM:Password123
[centos7]$ klist
Ticket cache: KEYRING:persistent:0:krb_ccache_gAEaY1x
Default principal: admin@DAGYAH.COM
Valid starting Expires Service principal
11/26/2020 13:20:38 11/27/2020 13:20:32 krbtgt/DAGYAH.COM@DAGYAH.COM
[centos7]$ ipa user-add --first=unko --last=man --password
User login [uman]: unkoman
Password:Password123
Enter Password again to verify:Password123
--------------------
Added user "unkoman"
--------------------
User login: unkoman
First name: unko
Last name: man
Full name: unko man
Display name: unko man
Initials: um
Home directory: /home/unkoman ←ホームディレクトリもつくられた？
GECOS: unko man
Login shell: /bin/sh
Principal name: unkoman@DAGYAH.COM
Principal alias: unkoman@DAGYAH.COM
User password expiration: 20201126212253Z
Email address: unkoman@dagyah.com
UID: 1942000006
GID: 1942000006
Password: True
Member of groups: ipausers
Kerberos keys available: True
[centos7]$ ls -ld /home/unkoman
ls: cannot access /home/unkoman: No such file or directory
→つくられず
[centos7]$ kinit unkoman
Password for unkoman@DAGYAH.COM:Password123
Password expired. You must change it now.
Enter new password:password123
Enter it again:password123
[centos7]$ klist
Ticket cache: KEYRING:persistent:0:krb_ccache_94MeLP1
Default principal: unkoman@DAGYAH.COM
Valid starting Expires Service principal
11/26/2020 13:25:32 11/27/2020 13:25:32 krbtgt/DAGYAH.COM@DAGYAH.COM
[centos7]$ id unkoman
uid=1942000006(unkoman) gid=1942000006(unkoman) groups=1942000006(unkoman)
[centos7]$ kdestroy
Other credential caches present, use -A to destroy all
[centos7]$ kdestroy -A
[centos7]$ klist
klist: Credentials cache keyring 'persistent:0:krb_ccache_94MeLP1' not found
[centos7]$ id unkoman
uid=1942000006(unkoman) gid=1942000006(unkoman) groups=1942000006(unkoman)
[centos7]$ ipactl stop
Stopping ipa-dnskeysyncd Service
Stopping ipa-otpd Service
Stopping pki-tomcatd Service
Stopping ntpd Service
Stopping ipa-custodia Service
Stopping httpd Service
Stopping named Service
Stopping kadmin Service
Stopping krb5kdc Service
Stopping Directory Service
ipa: INFO: The ipactl command was successful
[centos7]$ id unkoman
uid=1942000006(unkoman) gid=1942000006(unkoman) groups=1942000006(unkoman)
[centos7]$ systemctl disable ipa
[centos7]$ systemctl reboot
----（数分待つ）----
[centos7]$ systemctl status ipa
● ipa.service - Identity, Policy, Audit
Loaded: loaded (/usr/lib/systemd/system/ipa.service; disabled; vendor preset: disabled)
Active: inactive (dead)
[centos7]$ netstat -naptl | grep 389;echo $?
1
[centos7]$ id unkoman
uid=1942000006(unkoman) gid=1942000006(unkoman) groups=1942000006(unkoman)
→どこかにキャッシュされている？
[centos7]$ grep unkoman /etc/passwd;echo $?
1
まあいいか。
・アカウントロック
[centos7]$ ipa pwpolicy-show --user=unkoman
Group: global_policy
Max lifetime (days): 90
Min lifetime (hours): 1
History size: 0
Character classes: 0
Min length: 8
Max failures: 6
Failure reset interval: 60
Lockout duration: 600
[centos7]$ kinit unkoman
Password for unkoman@DAGYAH.COM:1
kinit: Password incorrect while getting initial credentials
[centos7]$ kinit unkoman
Password for unkoman@DAGYAH.COM:1
kinit: Password incorrect while getting initial credentials
[centos7]$ kinit unkoman
Password for unkoman@DAGYAH.COM:1
kinit: Password incorrect while getting initial credentials
[centos7]$ kinit unkoman
Password for unkoman@DAGYAH.COM:1
kinit: Password incorrect while getting initial credentials
[centos7]$ kinit unkoman
Password for unkoman@DAGYAH.COM:1
kinit: Password incorrect while getting initial credentials
[centos7]$ kinit unkoman
Password for unkoman@DAGYAH.COM:1
kinit: Password incorrect while getting initial credentials
[centos7]$ kinit unkoman
kinit: Client's credentials have been revoked while getting initial credentials
[centos7]$ kinit admin
Password for unkoman@DAGYAH.COM:Password123
[centos7]$ ipa user-show unkoman --all
dn: uid=unkoman,cn=users,cn=accounts,dc=dagyah,dc=com
User login: unkoman
First name: unko
Last name: man
Full name: unko man
Display name: unko man
Initials: um
Home directory: /home/unkoman
GECOS: unko man
Login shell: /bin/sh
Principal name: unkoman@DAGYAH.COM
Principal alias: unkoman@DAGYAH.COM
User password expiration: 20210224212532Z
Email address: unkoman@dagyah.com
UID: 1942000006
GID: 1942000006
Account disabled: False
Preserved user: False
Password: True
Member of groups: ipausers
Kerberos keys available: True
ipauniqueid: 8c33a9ec-302d-11eb-9c5d-000c297101eb
krbextradata: AAJMHcBfa2FkbWluZEBEQUdZQUguQ09NAA==
krblastfailedauth: 20201126220839Z
krblastpwdchange: 20201126212532Z
krbloginfailedcount: 6
krbticketflags: 128
mepmanagedentry: cn=unkoman,cn=groups,cn=accounts,dc=dagyah,dc=com
objectclass: top, person, organizationalperson, inetorgperson, inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux, ipaobject, ipasshuser, ipaSshGroupOfPubKeys, mepOriginEntry
[centos7]$ ipa user-unlock unkoman
--------------------------
Unlocked account "unkoman"
--------------------------
[centos7]$ ipa user-show unkoman --all
----（略）----
krbloginfailedcount: 0
----（略）----
[centos7]$ kinit unkoman
Password for unkoman@DAGYAH.COM:password123
[centos7]$ klist
Ticket cache: KEYRING:persistent:0:krb_ccache_q2IjbVy
Default principal: unkoman@DAGYAH.COM
Valid starting Expires Service principal
11/26/2020 14:21:00 11/27/2020 14:20:55 krbtgt/DAGYAH.COM@DAGYAH.COM
・IdMユーザ無効化
adminでログイン
[centos7]$ kinit admin
Password for admin@DAGYAH.COM:Password123
[centos7]$ klist
Ticket cache: KEYRING:persistent:0:krb_ccache_rw9ULDN
Default principal: admin@DAGYAH.COM
----（略）----
[centos7]$ ipa user-disable unkoman
-------------------------------
Disabled user account "unkoman"
-------------------------------
[centos7]$ ipa user-show unkoman
User login: unkoman
First name: unko
Last name: man
Home directory: /home/unkoman
Login shell: /bin/sh
Principal name: unkoman@DAGYAH.COM
Principal alias: unkoman@DAGYAH.COM
Email address: unkoman@dagyah.com
UID: 1942000006
GID: 1942000006
Account disabled: True
Password: True
Member of groups: ipausers
Kerberos keys available: True
[centos7]$ kinit unkoman
kinit: Client's credentials have been revoked while getting initial credentials
[centos7]$ ipa user-enable unkoman
------------------------------
Enabled user account "unkoman"
------------------------------
[centos7]$ ipa user-show unkoman
User login: unkoman
----（略）----
Account disabled: False
----（略）----
[centos7]$ kinit unkoman
Password for unkoman@DAGYAH.COM:password123
[centos7]$ klist
Ticket cache: KEYRING:persistent:0:krb_ccache_q2IjbVy
Default principal: unkoman@DAGYAH.COM
----（略）----
