Bug 1312275

Summary:	Support authentication indicators from IPA
Product:	Red Hat Enterprise Linux 7	Reporter:	Jakub Hrozek <jhrozek>
Component:	sssd	Assignee:	SSSD Maintainers <sssd-maint>
Status:	CLOSED ERRATA	QA Contact:	Steeve Goveas <sgoveas>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.3	CC:	grajaiya, jhrozek, ksiddiqu, lslebodn, mkosek, mvarun, mzidek, pbrezina, pkis, sbose
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	sssd-1.14.0-1.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-04 07:16:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jakub Hrozek 2016-02-26 09:54:21 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/sssd/ticket/2966

This ticket tracks the SSSD side of this IPA feature:
http://www.freeipa.org/page/V4/Authentication_Indicators

From the design page:
"""
SSSD will have to learn how to handle receiving both encrypted challenge and OTP when FAST is present. Currently, it should force the use of OTP. We need to make this optional.
"""

Comment 1 Jakub Hrozek 2016-07-07 11:29:46 UTC

* master: 78027feeb56d6fe216f699be86a4716aaef3f628

Comment 3 Varun Mylaraiah 2016-09-21 05:39:47 UTC

Could you please provide the steps to verify it?

Comment 4 Sumit Bose 2016-09-21 07:26:48 UTC

To verify please setup an FreeIPA-4.4 or above server and configure an IPA user for OTP authentication (see http://www.freeipa.org/page/V4/OTP for details). Additionally allow password authentication for the user either with the WebUI or on the command line with 'ipa user-mod --user-auth-type=...' (please note that you have to give both 'otp' and 'password' on the command line to not overwrite the 'otp' option).

Now SSSD should prompt you both for the password (first factor) and the option second factor. Both authentication types 1FA (password and empty second factor) and 2FA (password and OTP token value as second factor) should work for the user. Older versions of IPA only allowed 2FA in this case.

Comment 5 Varun Mylaraiah 2016-09-21 09:05:45 UTC

Verified. 

Sanity check with below Scenarios

sssd-1.14.0-42.el7.x86_64
ipa-server-4.4.0-12.el7.x86_64


Scenario 1: Modify existing service entry to different authentication indicator as user

Setup
Service entry with an authentication indicator already exists.

Action
1) Kinit as normal user
2) Modify existing service entry to different authentication indicator.
# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_lm6SFga
Default principal: tuser01

Valid starting       Expires              Service principal
2016-08-03T17:54:22  2016-08-04T17:53:53  HTTP/client1.testrelm.test
2016-08-03T17:54:10  2016-08-04T17:53:53  krbtgt/TESTRELM.TEST

# ipa service-mod --auth-ind= HTTP/client1.testrelm.test
ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the 'krbPrincipalAuthInd' attribute of entry 'krbprincipalname=http/client1.testrelm.test,cn=services,cn=accounts,dc=testrelm,dc=test'.

Expected result:
Modification should fail because of insufficient access
===================================================================

Scenario 2: Add another authentication indicators for existing service.

Setup
Service entry with an any one authentication indicator already exists.

Action
1) Verify service entry

# kinit admin
Password for admin: 

# ipa service-show HTTP/client1.testrelm.test
  Principal name: HTTP/client1.testrelm.test
  Principal alias: HTTP/client1.testrelm.test
  Authentication Indicators: otp
  Keytab: True
  Managed by: client1.testrelm.test

2) Modify existing service entry to add another authentication indicator.

# ipa service-mod --auth-ind=otp --auth-ind=radius HTTP/client1.testrelm.test
-----------------------------------------------------------
Modified service "HTTP/client1.testrelm.test"
-----------------------------------------------------------
  Principal name: HTTP/client1.testrelm.test
  Principal alias: HTTP/client1.testrelm.test
  Authentication Indicators: otp, radius
  Managed by: client1.testrelm.test
  
Expected result:
Authentication indicator added successfully and Both authentication indicator should be exists
===================================================================


Scenario 3: Access service only with otp authentication

Setup :
User already exists with authentication types 'otp', 'radius' and 'password'.

Action
1) Modify existing service entry to add sufficient otp authentication indicator.

# ipa service-mod --auth-ind=otp HTTP/client1.testrelm.test
-----------------------------------------------------------
Modified service "HTTP/client1.testrelm.test"
-----------------------------------------------------------
  Principal name: HTTP/client1.testrelm.test
  Principal alias: HTTP/client1.testrelm.test
  Authentication Indicators: otp
  Managed by: client1.testrelm.test

2) kinit user with password only
# kinit tuser01
Password for tuser01: 
 
# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_GcFvleK
Default principal: tuser01

Valid starting       Expires              Service principal
2016-08-04T19:29:17  2016-08-05T19:29:14  krbtgt/TESTRELM.TEST

3) Try to access service.
# kvno HTTP/client1.testrelm.test
kvno: KDC policy rejects request while getting credentials for HTTP/client1.testrelm.test

Expected result:
Access to service should not be granted

4) Now kinit user with otp
# kinit -T KEYRING:persistent:0:0 tuser01
Enter OTP Token Value: 

# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_GcFvleK
Default principal: tuser01

Valid starting       Expires              Service principal
2016-08-04T19:32:11  2016-08-05T19:31:40  krbtgt/TESTRELM.TEST

5) Try to access service now.
[root@master72 ~]# kvno HTTP/client1.testrelm.test
HTTP/client1.testrelm.test: kvno = 1

Expect output:
Access to service should be granted.

===================================================================

Scenario 4: Add multiple authentication indicator for service and try to access with different authentication types users(otpuser and radiususer)

Setup :
User1(otpuser) already exists with authentication types 'otp'
User2(radiususer) already exists with authentication types 'radius'

Action:
1) Add multiple authentication indicator for service

#ipa service-mod --auth-ind=otp --auth-ind=radius HTTP/client1.testrelm.test
-----------------------------------------------------------
Modified service "HTTP/client1.testrelm.test"
-----------------------------------------------------------
  Principal name: HTTP/client1.testrelm.test
  Principal alias: HTTP/client1.testrelm.test
  Authentication Indicators: otp, radius
  Managed by: client1.testrelm.test
  
2)  Kinit as Radius user and Try to access service

#kinit -T KEYRING:persistent:0:0 radiususer
Enter OTP Token Value: 

# kvno HTTP/client1.testrelm.test
HTTP/client1.testrelm.test: kvno = 1

Expected output: Access to service should be granted for radiususer

3) Kinit as OTP user and Try to access same service

# kinit -T KEYRING:persistent:0:0 otpuser
Enter OTP Token Value: 

# kvno HTTP/client1.testrelm.test
HTTP/client1.testrelm.test: kvno = 1

Expected result: Access to service should be granted for otpuser too.


===================================================================

Scenario 5: Add new authentication indicator for service and try to access with OTP and Radius authentication types users

Setup
User1(otpuser) already exists with authentication types 'otp'
User2(radiususer) already exists with authentication types 'radius'

Action:
1) Add new authentication indicator for service

# ipa service-mod --auth-ind=newauth HTTP/client1.testrelm.test
-----------------------------------------------------------
Modified service "HTTP/client1.testrelm.test"
-----------------------------------------------------------
  Principal name: HTTP/client1.testrelm.test
  Principal alias: HTTP/client1.testrelm.test
  Authentication Indicators: newauth
  Managed by: client1.testrelm.test

2)  Kinit as Radius user and Try to access service

#kinit -T KEYRING:persistent:0:0 radiususer
Enter OTP Token Value: 

# kvno HTTP/client1.testrelm.test
kvno: KDC policy rejects request while getting credentials for HTTP/client1.testrelm.test

Expected output: Access to service should not be granted for radiususer.


3) Kinit as OTP user and Try to access same service

# kinit -T KEYRING:persistent:0:0 otpuser
Enter OTP Token Value: 

# kvno HTTP/client1.testrelm.test
kvno: KDC policy rejects request while getting credentials for HTTP/client1.testrelm.test

Expected result: Access to service should not be granted for otpuser.

===================================================================

Scenario 6: Add authentication indicator with leading space
1)Modify --auth-ind with leading space
#ipa service-mod --auth-ind=' otp' HTTP/client1.testrelm.test
ipa: ERROR: invalid 'auth_ind': Leading and trailing spaces are not allowed

Expected output:-
authentication indicator should not added
===================================================================

Scenario 7: Add authentication indicator with trailing space
1) #ipa service-mod --auth-ind='otp ' HTTP/client1.testrelm.test
ipa: ERROR: invalid 'auth_ind': Leading and trailing spaces are not allowed

Expected output:-
authentication indicator should not added
===================================================================

Scenario 8: Try to access host with sufficient authentication
Setup
User already exists with authentication types 'radius'.

Action
1) Modify existing host entry to add radius authentication indicator.

# ipa host-mod client1.testrelm.test --auth-ind=radius
-------------------------------------
Modified host "client1.testrelm.test"
-------------------------------------
  Host name: client1.testrelm.test
  Principal name: host/client1.testrelm.test
  Principal alias: host/client1.testrelm.test
  SSH public key fingerprint: 45:1E:79:6F:2E:80:65:07:2C:27:BA:FE:99:27:E4:43 (ssh-rsa),
                              40:0D:1D:B7:52:31:CE:86:6B:8A:3A:C9:68:A9:6B:0D (ssh-ed25519),
                              30:44:60:F3:5D:B5:D2:16:4A:4E:6C:FC:AD:31:EF:C0 (ecdsa-sha2-nistp256)
  Authentication Indicators: radius
  Password: False
  Keytab: True
  Managed by: client1.testrelm.test

Expected result:
Authentication indicator added successfully for existing host.

2) login/kinit as radius user 
# kinit -T KEYRING:persistent:0:0 tuser02
Enter OTP Token Value: 
# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_aUg7vyl
Default principal: tuser02

Valid starting       Expires              Service principal
2016-08-08T13:54:20  2016-08-09T13:54:15  krbtgt/TESTRELM.TEST

3) try to ssh to host 
# ssh -l tuser02 client1.testrelm.test
Last login: Mon Aug  8 12:52:05 2016 from master73.testrelm.test
-sh-4.2$ 

Expected result:
Authentication should be successful.
===================================================================


Scenario 9: Create new host entry with specified authentication indicator.
Setup
Host entry does not exist.

Actions
1) Create new host entry with '--auth-ind=otp' or '--auth-ind=radius' option.
# ipa host-add --auth-ind=otp 
Host name: client1.testrelm.test
----------------------------------
Added host "host128.testrelm.test"
----------------------------------
  Host name: client1.testrelm.test
  Principal name: host/client1.testrelm.test
  Principal alias: host/client1.testrelm.test
  Authentication Indicators: otp
  Password: False
  Keytab: False
  Managed by: client1.testrelm.test

Expected results
Host entry should be added successful.
===================================================================

Scenario 10: Update existing host entry to another authentication indicator

Setup
Host entry with OTP authentication indicator already exists.

Actions
1) Update existing entry with '--auth-ind=radius' option.

# ipa host-mod client1.testrelm.test --auth-ind=radius
-------------------------------------
Modified host "client1.testrelm.test"
-------------------------------------
  Host name: client1.testrelm.test
  Principal name: host/client1.testrelm.test
  Principal alias: host/client1.testrelm.test
  SSH public key fingerprint: 45:1E:79:6F:2E:80:65:07:2C:27:BA:FE:99:27:E4:43 (ssh-rsa),
                              40:0D:1D:B7:52:31:CE:86:6B:8A:3A:C9:68:A9:6B:0D (ssh-ed25519),
                              30:44:60:F3:5D:B5:D2:16:4A:4E:6C:FC:AD:31:EF:C0 (ecdsa-sha2-nistp256)
  Authentication Indicators: radius
  Password: False
  Keytab: False
  Managed by: client1.testrelm.test

Expected result:
Authentication indicator added successfully for existing host.
===================================================================

Scenario 11: Verify that both authentication indicators can be set for a host
Setup
Host entry with no authentication indicator already exists.

Actions
1) Try to update the host to contain both 'otp' and 'radius' indicators.

#ipa host-mod client1.testrelm.test --auth-ind=radius --auth-ind=otp
-------------------------------------
Modified host "client1.testrelm.test"
-------------------------------------
  Host name: client1.testrelm.test
  Principal name: host/client1.testrelm.test
  Principal alias: host/client1.testrelm.test
  SSH public key fingerprint: 45:1E:79:6F:2E:80:65:07:2C:27:BA:FE:99:27:E4:43 (ssh-rsa),
                              40:0D:1D:B7:52:31:CE:86:6B:8A:3A:C9:68:A9:6B:0D (ssh-ed25519),
                              30:44:60:F3:5D:B5:D2:16:4A:4E:6C:FC:AD:31:EF:C0 (ecdsa-sha2-nistp256)
  Authentication Indicators: otp, radius
  Password: False
  Keytab: True
  Managed by: client1.testrelm.test


Expected results
Should be successful.
===================================================================


Scenario 12: Remove authentication indicators form hosts
Setup
Service entry with an authentication indicator already exists.

Actions
1) Update existing entry with blank authentication indicator.

# ipa host-mod client1.testrelm.test --auth-ind=
-------------------------------------
Modified host "client1.testrelm.test"
-------------------------------------
  Host name: client1.testrelm.test
  Principal name: host/client1.testrelm.test
  Principal alias: host/client1.testrelm.test
  SSH public key fingerprint: 45:1E:79:6F:2E:80:65:07:2C:27:BA:FE:99:27:E4:43 (ssh-rsa),
                              40:0D:1D:B7:52:31:CE:86:6B:8A:3A:C9:68:A9:6B:0D (ssh-ed25519),
                              30:44:60:F3:5D:B5:D2:16:4A:4E:6C:FC:AD:31:EF:C0 (ecdsa-sha2-nistp256)
  Password: False
  Keytab: True
  Managed by: client1.testrelm.test

Expected results
Removed existing authentication indicator from host successfully.
===================================================================

Scenario 13: Access hosts without authentication indicators

Setup
1)User already exists with authentication types 'otp', 'radius' and 'password'.
2)Host with no authentication indicators set already exists.

Actions
1) Authenticate as a user using any of the authentication types.
Login as user with only password
# kinit puser
Password for puser: 

2) Try to ssh to host
# ssh -l puser client1.testrelm.test
Last login: Mon Aug  8 15:13:42 2016 from master72.testrelm.test
-sh-4.2$ logout


Expected results
Should be successful.

3) Login as user with otp

# kinit -T KEYRING:persistent:0:0 puser
Enter OTP Token Value: 

# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_LVUiIr5
Default principal: puser

4) Try to ssh to host
# ssh -l puser client1.testrelm.test
Last login: Mon Aug  8 15:17:26 2016 from master72.testrelm.test
-sh-4.2$ 

Expected results
Should grant access for all types of authentication.
===================================================================

Scenario 14: Try to access host with insufficient authentication

Setup
1) User already exists with authentication types 'otp', 'radius' and 'password'.
2) host with authentication indicator 'otp' only already exists.

Actions
1) Modify host with authentication indicator 'otp'

# ipa host-mod client1.testrelm.test --auth-ind=otp
-------------------------------------
Modified host "client1.testrelm.test"
-------------------------------------
  Host name: client1.testrelm.test
  Principal name: host/client1.testrelm.test
  Principal alias: host/client1.testrelm.test
  SSH public key fingerprint: 45:1E:79:6F:2E:80:65:07:2C:27:BA:FE:99:27:E4:43 (ssh-rsa),
                              40:0D:1D:B7:52:31:CE:86:6B:8A:3A:C9:68:A9:6B:0D (ssh-ed25519),
                              30:44:60:F3:5D:B5:D2:16:4A:4E:6C:FC:AD:31:EF:C0 (ecdsa-sha2-nistp256)
  Authentication Indicators: otp
  Password: False
  Keytab: True
  Managed by: client1.testrelm.test
  
  
2) Run kinit as user with password only.

# kinit puser
Password for puser:

# klist
Ticket cache: KEYRING:persistent:0:krb_ccache_LVUiIr5
Default principal: puser

Valid starting       Expires              Service principal
2016-08-08T16:27:57  2016-08-09T16:27:50  krbtgt/TESTRELM.TEST

3) Try to access host
# ssh -l puser client1.testrelm.test
First Factor: 

Expected results:
Should refuse access because of host has authentication indicator 'otp'

4) Enter First Factor and Second Factor
# ssh -l puser client1.testrelm.test
First Factor: 
Second Factor (optional): 
Last login: Mon Aug  8 15:18:11 2016 from master72.testrelm.test
-sh-4.2$

Expected results:
Access Should be successful with key+token

===================================================================

Scenario 15:
Add authentication indicator with special characters

# ipa service-mod --auth-ind='!@#$%^' HTTP/client1.testrelm.test
-----------------------------------------------------------
Modified service "HTTP/client1.testrelm.test"
-----------------------------------------------------------
  Principal name: HTTP/client1.testrelm.test
  Principal alias: HTTP/client1.testrelm.test
  Authentication Indicators: !@#$%^
  Managed by: client1.testrelm.test

Expected output:
authentication indicator with special characters should added

Scenario 16:
Add authentication indicator with capital letters (eg: OTP, RADIUS)

Add authentication indicator with upper case

# ipa service-mod --auth-ind='OTP' HTTP/client1.testrelm.test
-----------------------------------------------------------
Modified service "HTTP/client1.testrelm.test"
-----------------------------------------------------------
  Principal name: HTTP/client1.testrelm.test
  Principal alias: HTTP/client1.testrelm.test
  Authentication Indicators: OTP
  Managed by: client1.testrelm.test

Expected output:
Authentication indicator with upper case is added successfully

Comment 7 errata-xmlrpc 2016-11-04 07:16:32 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-2476.html