Bug 2087247
Summary: | Add new Active Directory related certificate mapping templates | ||
---|---|---|---|
Product: | Red Hat Enterprise Linux 9 | Reporter: | Sumit Bose <sbose> |
Component: | sssd | Assignee: | Sumit Bose <sbose> |
Status: | CLOSED ERRATA | QA Contact: | Scott Poore <spoore> |
Severity: | medium | Docs Contact: | lmcgarry |
Priority: | medium | ||
Version: | 9.0 | CC: | aboscatt, atikhono, cilmar, dlavu, grajaiya, jhrozek, lmcgarry, lslebodn, mzidek, pasik, pbrezina, pkettman, spoore, tscherf |
Target Milestone: | rc | Keywords: | Improvement, Triaged |
Target Release: | --- | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | sync-to-jira | ||
Fixed In Version: | sssd-2.8.2-1.el9 | Doc Type: | Enhancement |
Doc Text: |
.IdM now supports new Active Directory certificate mapping templates
Active Directory (AD) domain administrators can manually map certificates to a user in AD using the `altSecurityIdentities` attribute. There are six supported values for this attribute, though three mappings are now considered insecure. As part of link:https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16[May 10,2022 security update], once this update is installed on a domain controller, all devices are in compatibility mode. If a certificate is weakly mapped to a user, authentication occurs as expected but a warning message is logged identifying the certificates that are not compatible with full enforcement mode. As of November 14, 2023 or later, all devices will be updated to full enforcement mode and if a certificate fails the strong mapping criteria, authentication will be denied.
IdM now supports the new mapping templates, making it easier for an AD administrator to use the new rules and not maintain both. IdM now supports the following new mapping templates :
* Serial Number: `LDAPU1:(altSecurityIdentities=X509:<I>{issuer_dn!ad_x500}<SR>{serial_number!hex_ur})`
* Subject Key Id: `LDAPU1:(altSecurityIdentities=X509:<SKI>{subject_key_id!hex_u})`
* User SID: `LDAPU1:(objectsid={sid})`
If you do not want to reissue certificates with the new SID extension, you can create a manual mapping by adding the appropriate mapping string to a user's `altSecurityIdentities` attribute in AD.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2023-05-09 08:19:50 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Sumit Bose
2022-05-17 16:38:29 UTC
Upstream PR: https://github.com/SSSD/sssd/pull/6405 Pushed PR: https://github.com/SSSD/sssd/pull/6467 * `sssd-2-8` * 12e39a45613a5b5d1236d911386cf28edd96f147 - certmap: Add documentation for some internal functions * 925d8a9f1281f984ebfacc5d00ba561de54366b6 - certmap: add LDAPU1 rules to man page * 17142068c58255b2809a4cdb3c8feb43d5393cdb - certmap: add tests for new attributes and LDAPU1 rules * 698d56882477753de37e078f7b1647aea6016f65 - certmap: add LDAPU1 mapping rules * 8a6a874ba4cb3d245160dba967aa32173041a3d8 - certmap: dump new attributes in sss_cert_dump_content() * 3f336da42d87fa86749264343f5933485c4bd973 - certmap: add get_digest_list() and get_hash() * 9a45e6162760c6d6b1e94644e5eb51d87b0d49c6 - sssctl: add cert-eval-rule sub-command * 6ad29f9999324b951d4ae7b214558cc8e26636a9 - certmap: add bin_to_hex() helper function * 8d8e3c7c616a347e2de8d7a1117e5a4ebd996a2d - certmap: fix for SAN URI * 47f3408e9ea122fab7c1f847b5ffcd1839f5b4b1 - certmap: add support for SID extension * a2bca35c7f7b0d7b1f5a633284d54be15ed4858b - certamp: add support for subject key id * cca0233ef16fd7be5ebc931b0f673486a52130fd - certmap: add support for serial number Verified. Expected version is in nightly build. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (sssd bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:2514 |