RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2087247 - Add new Active Directory related certificate mapping templates
Summary: Add new Active Directory related certificate mapping templates
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: sssd
Version: 9.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Sumit Bose
QA Contact: Scott Poore
lmcgarry
URL:
Whiteboard: sync-to-jira
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-05-17 16:38 UTC by Sumit Bose
Modified: 2023-06-22 09:40 UTC (History)
14 users (show)

Fixed In Version: sssd-2.8.2-1.el9
Doc Type: Enhancement
Doc Text:
.IdM now supports new Active Directory certificate mapping templates Active Directory (AD) domain administrators can manually map certificates to a user in AD using the `altSecurityIdentities` attribute. There are six supported values for this attribute, though three mappings are now considered insecure. As part of link:https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16[May 10,2022 security update], once this update is installed on a domain controller, all devices are in compatibility mode. If a certificate is weakly mapped to a user, authentication occurs as expected but a warning message is logged identifying the certificates that are not compatible with full enforcement mode. As of November 14, 2023 or later, all devices will be updated to full enforcement mode and if a certificate fails the strong mapping criteria, authentication will be denied. IdM now supports the new mapping templates, making it easier for an AD administrator to use the new rules and not maintain both. IdM now supports the following new mapping templates : * Serial Number: `LDAPU1:(altSecurityIdentities=X509:<I>{issuer_dn!ad_x500}<SR>{serial_number!hex_ur})` * Subject Key Id: `LDAPU1:(altSecurityIdentities=X509:<SKI>{subject_key_id!hex_u})` * User SID: `LDAPU1:(objectsid={sid})` If you do not want to reissue certificates with the new SID extension, you can create a manual mapping by adding the appropriate mapping string to a user's `altSecurityIdentities` attribute in AD.
Clone Of:
Environment:
Last Closed: 2023-05-09 08:19:50 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 6403 0 None open Add new Active Directory related certificate mapping templates 2022-10-25 09:24:21 UTC
Github SSSD sssd pull 6405 0 None open certmap: add LDAPU1 mapping rules 2022-10-25 11:27:10 UTC
Red Hat Issue Tracker RHELPLAN-122593 0 None None None 2022-05-19 13:15:40 UTC
Red Hat Issue Tracker SSSD-4683 0 None None None 2022-05-30 10:57:50 UTC
Red Hat Product Errata RHBA-2023:2514 0 None None None 2023-05-09 08:20:14 UTC

Description Sumit Bose 2022-05-17 16:38:29 UTC 
Description of problem:
New and updates versions of Active Directory will deprecate some of the existing  certificate mapping schemes and will in future only allow some of the existing or new mapping. See https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 for details.

Although the certificate mapping on the AD side is not strictly related to what is required on the Active Directory side it would be convenient to use the same mappings.

For this SSSD's libsss_certmap should get new mapping templates for the altSecurityIdentities options:
 - <SR>
 - <SKI>

I think <SHA1-PUBKEY> can be skipped because of SHA1.

Additionally Microsoft's new SID extension should be supported so that libsss_certmap can extract the SID form the certificate and use it in search filters. A split into domain-SID and RID might be needed as well.
Comment 4 Alexey Tikhonov 2022-10-25 11:27:10 UTC 
Upstream PR: https://github.com/SSSD/sssd/pull/6405
Comment 5 Alexey Tikhonov 2022-12-02 16:11:16 UTC 
Pushed PR: https://github.com/SSSD/sssd/pull/6467

* `sssd-2-8`
    * 12e39a45613a5b5d1236d911386cf28edd96f147 - certmap: Add documentation for some internal functions
    * 925d8a9f1281f984ebfacc5d00ba561de54366b6 - certmap: add LDAPU1 rules to man page
    * 17142068c58255b2809a4cdb3c8feb43d5393cdb - certmap: add tests for new attributes and LDAPU1 rules
    * 698d56882477753de37e078f7b1647aea6016f65 - certmap: add LDAPU1 mapping rules
    * 8a6a874ba4cb3d245160dba967aa32173041a3d8 - certmap: dump new attributes in sss_cert_dump_content()
    * 3f336da42d87fa86749264343f5933485c4bd973 - certmap: add get_digest_list() and get_hash()
    * 9a45e6162760c6d6b1e94644e5eb51d87b0d49c6 - sssctl: add cert-eval-rule sub-command
    * 6ad29f9999324b951d4ae7b214558cc8e26636a9 - certmap: add bin_to_hex() helper function
    * 8d8e3c7c616a347e2de8d7a1117e5a4ebd996a2d - certmap: fix for SAN URI
    * 47f3408e9ea122fab7c1f847b5ffcd1839f5b4b1 - certmap: add support for SID extension
    * a2bca35c7f7b0d7b1f5a633284d54be15ed4858b - certamp: add support for subject key id
    * cca0233ef16fd7be5ebc931b0f673486a52130fd - certmap: add support for serial number
Comment 13 Scott Poore 2023-01-11 13:28:13 UTC 
Verified.

Expected version is in nightly build.
Comment 15 errata-xmlrpc 2023-05-09 08:19:50 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sssd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2514
Note You need to log in before you can comment on or make changes to this bug.