The current FreeIPA core dispatch code requires that URLs be either kerberos authenticated or not authenticated at all. However, for token syncing, we need both.
For this case: 1. if kerberos authentication has succeded, no further information is required. 2. if kerberos authentication failed, the user should be denied. 3. if kerberos authentication is absent, additional parameters are required.
This will require a large refactoring of the HTTP dispatch code.
pvoborni and npmccallum discussed the design and found other ways to fix it, without this refactoring.
Until there is other real use case, we do not plan on addressing it.
Metadata Update from @npmccallum: - Issue assigned to someone - Issue set to the milestone: Tickets Deferred
Login to comment on this ticket.