Upstream ticket:
https://pagure.io/SSSD/sssd/issue/3560

master:
* 2297cc7d6cd5c38a7d64027165e4e82ca497f418

FailedQA.

Seeing a problem with verification of AD certs without OCSP attributes set.  SSSD appears to be allowing the use of a certificate when OCSP checking is disabled even when issuing cert is not in /etc/pki/nssdb.

1. AD CA Certificate is missing from /etc/pki/nssdb
2. sssd.conf is configured to default for certificate_verification (meaning commented out or not set).
3. AD User Certificate does not have OCSP data, just CRL and "Authority Information Access".
4. authentication results in an OCSP error in p11_child.log

Certificate [singleuser1-01 (OpenSC Card):cert.01][CN=adcertsingleuser1] failed OCSP check [-8179][Peer's Certificate issuer is not recognized.], skipping.

If I set certificate_verification = no_ocsp, though, it works and I can authenticate with the Card and PIN.



[root@seceng-idm-1 test_certs]# certutil -d /etc/pki/nssdb -L

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

Smart Card CA 9b41ad38-4373-4d74-a7be-2bc8269432b1           CT,C,C
IPA CA                                                       CT,C,C


^^^ the "Smart Card..." one isn't the AD cert


########## Fails with certificate_verification defaulting #######################

[root@seceng-idm-1 test_certs]# vim /etc/sssd/sssd.conf

[root@seceng-idm-1 test_certs]# systemctl stop sssd; rm -rf /var/lib/sss/{db,mc}/*; systemctl start sssd 

[root@seceng-idm-1 test_certs]# grep verification /etc/sssd/sssd.conf
# certificate_verification = no_ocsp

[root@seceng-idm-1 test_certs]# su - adcertsingleuser1 -c "su - adcertsingleuser1 -c whoami"
Password: 

su: Authentication failure

############## Works with certificate_verification set to no_ocsp #################

[root@seceng-idm-1 test_certs]# vim /etc/sssd/sssd.conf

[root@seceng-idm-1 test_certs]# systemctl stop sssd; rm -rf /var/lib/sss/{db,mc}/*; systemctl start sssd 

[root@seceng-idm-1 test_certs]# grep verification /etc/sssd/sssd.conf
certificate_verification = no_ocsp

[root@seceng-idm-1 test_certs]# su - adcertsingleuser1 -c "su - adcertsingleuser1 -c whoami"
PIN for singleuser1-01 (OpenSC Card)

adcertsingleuser1

(In reply to Lukas Slebodnik from comment #6)
> master:
> * 2297cc7d6cd5c38a7d64027165e4e82ca497f418

that patches was reverter by commit c221b5fb4d3fc511cebcae2f042e43fb1c577bc7

master:
* 787ba9c882f1d7ff9ea4f2745e779c5fb04dfafc

Verified.

Version ::

Results ::

test1:  revoked cert

# ipa cert-show 0xCF
  Issuing CA: ipa
  Certificate: MII...
  Subject: CN=ipauser1,O=TESTRELM.TEST
  Subject email address: ipauser1
  Issuer: CN=Certificate Authority,O=TESTRELM.TEST
  Not Before: Thu Dec 14 16:26:35 2017 UTC
  Not After: Sun Dec 15 16:26:35 2019 UTC
  Serial number: 207
  Serial number (hex): 0xCF
  Revoked: True
  Revocation reason: 6

# ipa certmap-match /tmp/cardcert1
--------------
1 user matched
--------------
  Domain: TESTRELM.TEST
  User logins: ipauser1
----------------------------
Number of entries returned 1
----------------------------

# su - ipauser1 -c "su - ipauser1 -c id"
su: warning: cannot change directory to /home/ipauser1: Permission denied
-bash: /home/ipauser1/.bash_profile: Permission denied
Password: 
su: Authentication failure

^^^^ Prompting for Password above instead of PIN indicates expected failure.

We can also double check in /var/log/sssd/p11_child.log:

(Thu Dec 14 16:38:37 2017) [[sssd[p11_child[7012]]]] [do_work] (0x4000): found cert[ipauser1-01 (OpenSC Card):cert.01][CN=ipauser1,O=TESTRELM.TEST]
(Thu Dec 14 16:38:37 2017) [[sssd[p11_child[7012]]]] [do_work] (0x0040): Certificate [ipauser1-01 (OpenSC Card):cert.01][CN=ipauser1,O=TESTRELM.TEST] not valid [-8102][Certificate key usage inadequate for attempted operation.], skipping.



test2: signing cert missing:

# certutil -d /etc/pki/nssdb -L

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

Smart Card CA 9b41ad38-4373-4d74-a7be-2bc8269432b1           CT,C,C
IPA CA                                                       CT,C,C
AD-ROOT-CA                                                   CT,c,c
nssdb_rootCA                                                 CT,c,c


# certutil -d /etc/pki/nssdb -D -n AD-ROOT-CA

# certutil -d /etc/pki/nssdb -L

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

Smart Card CA 9b41ad38-4373-4d74-a7be-2bc8269432b1           CT,C,C
IPA CA                                                       CT,C,C
nssdb_rootCA                                                 CT,c,c

# grep certificate_verification /etc/sssd/sssd.conf
# certificate_verification = no_ocsp

# !systemctl
systemctl stop sssd; rm -rf /var/lib/sss/{db,mc}/*; systemctl start sssd 

# su - adcertsingleuser1 -c "su - adcertsingleuser1 -c whoami"
Password: 
su: Authentication failure


Then doublecheck /var/log/sssd/p11_child.log for messages:

(Thu Dec 14 17:01:07 2017) [[sssd[p11_child[8255]]]] [do_work] (0x4000): found cert[singleuser1-01 (OpenSC Card):cert.01][CN=adcertsingleuser1]
(Thu Dec 14 17:01:07 2017) [[sssd[p11_child[8255]]]] [do_work] (0x0040): Certificate [singleuser1-01 (OpenSC Card):cert.01][CN=adcertsingleuser1] not valid [-8179][Peer's Certificate issuer is not recognized.], skipping.

Forgot to list the Version for verification.

sssd-1.16.0-13.el7.x86_64

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:0929