I am really new to but I am trying to use Kerberos to authenticate my active directory service account from my own CentOS 7 box, after which I then proceed to run queries in a remote database using sqlcmd.To give more context, a snippet of my working Python code is below:import subprocesskinit = ['kinit', 'serviceaccount@DIRECTORY.COM', '-k', '-t', '/usr/local/var/krb5kdc/serviceaccount.keytab']kinit_cl = subprocess.Popen(kinit, stdout=subprocess.PIPE)kinit_output = kinit_cl.stdout.read()klist = ['klist','-l']klist_cl = subprocess.Popen(klist, stdout=subprocess.PIPE)klist_output = klist_cl.stdout.read()print klist_outputif 'KEYRING:persistent' in klist_output:    print Service Account Authenticated    #proceed to run sqlcmd queriesMy question relates more to the management of the keytab where my credential is stored, which is great because my password is not stored in the clear. The password expires every 30 days though, and I've noticed that if I use kpasswd to change my password from the command line, it will ask for my old password. This would mean I would have to store it in the clear somewhere and pass it, whereas I am happy not knowing my password and letting a script manage this for me.To generate a new strong password in Python wont be an issue, my question is what command can I use to change a password without being prompted for the old password. A command from kadmin.local says the password is changed, but the password accepted is still the old password. kadmin gives me the error below even though I added the service account in as an admin to the local file:[root@osboxes krb5kdc]# kadmin.local -q addprinc serviceaccount/adminAuthenticating as principal serviceaccount/admin@DIRECTORY.COM with password.WARNING: no policy specified for serviceaccount/admin@DIRECTORY.COM; defaulting to no policyEnter password for principal serviceaccount/admin@DIRECTORY.COM: Re-enter password for principal serviceaccount/admin@DIRECTORY.COM: Principal serviceaccount/admin@DIRECTORY.COM created.[root@osboxes krb5kdc]# kinit serviceaccount/adminkinit: Client 'serviceaccount/admin@DIRECTORY.COM' not found in Kerberos database while getting initial credentials[root@osboxes krb5kdc]# kadmin serviceaccountkadmin: Client 'serviceaccount/admin@DIRECTORY.COM' not found in Kerberos database while initializing kadmin interfaceDo I need to do this only through kadmin? Or else how would I script this?
Changing Active Directory password for service account in Linux
centos;python;password;active directory;kerberos