Bug 1859751
| Summary: | [RFE] Allow SSSD to use anonymous pkinit for FAST | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Abhijit Roy <abroy> |
| Component: | sssd | Assignee: | Sumit Bose <sbose> |
| Status: | CLOSED ERRATA | QA Contact: | Madhuri <mupadhye> |
| Severity: | low | Docs Contact: | |
| Priority: | medium | ||
| Version: | 9.0 | CC: | aboscatt, atikhono, grajaiya, jhrozek, lslebodn, mupadhye, mzidek, pbrezina, sgadekar, spurrier, thalman, tscherf |
| Target Milestone: | rc | Keywords: | FutureFeature, Triaged |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | sync-to-jira | ||
| Fixed In Version: | sssd-2.7.0-1.el9 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-11-15 11:17:20 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
At this stage this RFE should target RHEL9. Once/if implemented, backport to RHEL8 might be considered. Pushed PR: https://github.com/SSSD/sssd/pull/5962 * `master` * 7e839befe84995f28b34bf3774ae65813218e047 - krb5: add krb5_fast_use_anonymous_pkinit option * 58ab4137c45d3d284cd25ef485614a61456fad05 - krb5_child: add fast-use-anonymous-pkinit option * d1ad68fab06cb61d9c935b698c40cf745b54d672 - krb5_child: move FAST TGT request into a function Hi,
to test this feature please setup a FreeIPA server with default setting, a trust is AD is not needed. After the setup is finished the following should just work:
# kinit -n
# klist
Ticket cache: KCM:0
Default principal: WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS
Valid starting Expires Service principal
03/10/2022 10:14:26 03/11/2022 09:39:15 krbtgt/IPA.VM
If you now set
krb5_fast_use_anonymous_pkinit = True
in the [domain/...] section of sssd.conf, restart SSSD and do a login as IPA user, e.g.
ssh admin@localhost
you should have a ccache file with the FAST armor ticket like:
# klist /var/lib/sss/db/fast_ccache_IPA.VM
Ticket cache: FILE:/var/lib/sss/db/fast_ccache_IPA.VM
Default principal: WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS
Valid starting Expires Service principal
03/10/2022 10:33:45 03/10/2022 10:43:45 krbtgt/IPA.VM
(please note your realm might be different than IPA.VM)
The important part is 'Default principal: WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS' which indicates that anonymous pkinit was used. By default (without 'krb5_fast_use_anonymous_pkinit = True') the ccache will have a ticket for the host principal e.g.:
# klist /var/lib/sss/db/fast_ccache_IPA.VM
Ticket cache: FILE:/var/lib/sss/db/fast_ccache_IPA.VM
Default principal: host/master.client.vm
Valid starting Expires Service principal
03/10/2022 10:40:06 03/11/2022 10:10:28 krbtgt/IPA.VM
HTH
bye,
Sumit
Verified with automation, 2022-05-30T08:07:32 ok: [master.testrealm.test] => (item=ipa-server) => 2022-05-30T08:07:32 msg: 2022-05-30T08:07:32 - arch: x86_64 2022-05-30T08:07:32 epoch: null 2022-05-30T08:07:32 name: ipa-server 2022-05-30T08:07:32 release: 8.el9 2022-05-30T08:07:32 source: rpm 2022-05-30T08:07:32 version: 4.9.8 2022-05-30T08:07:32 skipping: [client.testrealm.test] => (item=ipa-server) 2022-05-30T08:07:32 ok: [master.testrealm.test] => (item=sssd-common) => 2022-05-30T08:07:32 msg: 2022-05-30T08:07:32 - arch: x86_64 2022-05-30T08:07:32 epoch: null 2022-05-30T08:07:32 name: sssd-common 2022-05-30T08:07:32 release: 2.el9 2022-05-30T08:07:32 source: rpm 2022-05-30T08:07:32 version: 2.7.0 2022-05-30T07:57:39 ============================= test session starts ============================== 2022-05-30T07:57:39 platform linux -- Python 3.9.12, pytest-7.1.1, pluggy-1.0.0 -- /usr/bin/python3 2022-05-30T07:57:39 cachedir: .pytest_cache ... ... 2022-05-30T08:05:47 src/tests/multihost/ipa/test_misc.py::Testipabz::test_anonymous_pkinit_for_fast PASSED [ 66%] 2022-05-30T08:06:36 src/tests/multihost/ipa/test_misc.py::Testipabz::test_anonymous_pkinit_for_fast_false PASSED [ 75%] ... ... Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (sssd bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:8325 |
[RFE] Allow SSSD to use anonymous pkinit for FAST 1. Proposed title of this feature request SSSD FAST implementation using Anonymous PKINIT 2. What is the nature and description of the request? For SSSD to use FAST a Kerberos keytab and service principal must exist. Anonymous PKINIT can be used to create a credential cache to be used to established the FAST session. I would like sssd to be enhanced to allow for the use on anonymous pkinit to create the FAST session. 3. Please provide us the business requirements for this feature. Allows for use of FAST/OTP so that system admins can use MFA on a system without first having to create a system keytab. RH8 deprecated pam_krb5 which allowed for the use of anonymous pkinit, therefore causing issues at our site in using FAST/OTP 4. Please provide us functional requirements for this feature RH8 deprecated pam_krb5 which allowed for the use of anonymous pkinit, therefore causing issues at our site in using FAST/OTP