Bug 1202724 - [RFE] Add a way to lookup users based on CAC identity certificates
Summary: [RFE] Add a way to lookup users based on CAC identity certificates
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: SSSD Maintainers
QA Contact: Kaushik Banerjee
Depends On:
Blocks: 1127787 1169972 1181710 1241089 1270029
TreeView+ depends on / blocked
Reported: 2015-03-17 10:16 UTC by Jakub Hrozek
Modified: 2020-05-02 18:08 UTC (History)
12 users (show)

Fixed In Version: sssd-1.13.0-20.el7
Doc Type: Enhancement
Doc Text:
Clone Of:
: 1270029 (view as bug list)
Last Closed: 2015-11-19 11:36:41 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 3637 0 None None None 2020-05-02 17:58:16 UTC
Github SSSD sssd issues 3783 0 None None None 2020-05-02 18:08:08 UTC
Red Hat Product Errata RHSA-2015:2355 0 normal SHIPPED_LIVE Low: sssd security, bug fix, and enhancement update 2015-11-19 10:27:42 UTC

Description Jakub Hrozek 2015-03-17 10:16:04 UTC
This bug is created as a clone of upstream ticket:

FreeIPA ticket https://fedorahosted.org/freeipa/ticket/4238 asks for ability to map CAC identity certificates to users in IdM. When this is implemented, we will need a way to make a lookup using sssd based on the certificate or certificate attribute(s).

One use case is: Apache is configured to do SSL client authentication based on mod_ssl (or mod_nss). When the authentication passes, SSL_* variables are set, including SSL_CLIENT_S_DN, SSL_CLIENT_S_DN_*, or SSL_CLIENT_CERT. If the information about the certificate or the whole PEM-encoded certificate is stored in IdM database, it should be possible to amend for example mod_lookup_identity to query sssd, and lookup the username based on SSL_CLIENT_CERT. We are looking for something like org.freedesktop.sssd.infopipe.!LookupUserUsingCert but the name of the method (or how exactly this should be exposed) is to be determined.

Comment 1 Jakub Hrozek 2015-06-26 07:55:08 UTC
Related upstream tickets:

Comment 5 Jakub Hrozek 2015-08-13 15:33:19 UTC
Upstream ticket:

Comment 6 Jakub Hrozek 2015-08-14 08:14:40 UTC
Additional fix for #2742 is coming up, moving back to ASSIGNED.

Comment 7 Jakub Hrozek 2015-08-14 21:38:48 UTC
* master: 619e21ed9c7a71e35e53f38867b53ed974f1d36a

Comment 9 Scott Poore 2015-09-21 19:45:50 UTC
How can I test this?  

Would the same test as for bug #1241089 cover this as well?  Sounds like that bug specifically asks for an update to mod_lookup_identity to use the fix from this for org.freedesktop.sssd.infopipe.Users.FindByCertificate.

If I can't use the verification for that bug to verify this, please list steps to test.


Comment 10 Sumit Bose 2015-09-21 20:59:48 UTC
Please see 'How to Test' section of https://fedorahosted.org/sssd/wiki/DesignDocs/LookupUsersByCertificate for details.

Comment 11 Scott Poore 2015-09-22 01:26:15 UTC

Version ::


Results ::

[root@blade05 ~]# ipa user-add-cert bob20669 --certificate="$(cat bob20669.pem|grep -v -- '----' | tr -d '[\n\r]')"
Added certificates to user "bob20669"
  User login: bob20669

[root@blade05 ~]# dbus-send --system --print-reply  --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.FindByCertificate string:"$(cat bob20669.pem)"
method return sender=:1.7 -> dest=:1.17 reply_serial=2
   object path "/org/freedesktop/sssd/infopipe/Users/example_2etest/1690400001"

[root@blade05 ~]# dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users/example_2etest/1690400001 org.freedesktop.DBus.Properties.Get string:"org.freedesktop.sssd.infopipe.Users.User" string:"name"
method return sender=:1.7 -> dest=:1.18 reply_serial=2
   variant       string "bob20669"

[root@blade05 ~]# dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users/example_2etest/1690400001 org.freedesktop.DBus.Properties.GetAll string:"org.freedesktop.sssd.infopipe.Users.User"
method return sender=:1.7 -> dest=:1.29 reply_serial=2
   array [
      dict entry(
         string "name"
         variant             string "bob20669"
      dict entry(
         string "uidNumber"
         variant             uint32 1690400001
      dict entry(
         string "gidNumber"
         variant             uint32 1690400001
      dict entry(
         string "gecos"
         variant             string "Robert Chase"
      dict entry(
         string "homeDirectory"
         variant             string "/home/bob20669"
      dict entry(
         string "loginShell"
         variant             string "/bin/sh"
      dict entry(
         string "groups"
         variant             array [
               object path "/org/freedesktop/sssd/infopipe/Groups/example_2etest/1690400001"
               object path "/org/freedesktop/sssd/infopipe/Groups/example_2etest/1690400006"
      dict entry(
         string "extraAttributes"
         variant             array [

[root@blade05 ~]# getent group  1690400006

[root@blade05 ~]# getent group  1690400001

[root@blade05 ~]# getent passwd 1690400001
bob20669:*:1690400001:1690400001:Robert Chase:/home/bob20669:/bin/sh

Comment 12 errata-xmlrpc 2015-11-19 11:36:41 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.