Bug 2178298
| Summary: | Make ticket signature optional during PAC verification [rhel-9] | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Julien Rische <jrische> | |
| Component: | krb5 | Assignee: | Julien Rische <jrische> | |
| Status: | CLOSED ERRATA | QA Contact: | Michal Polovka <mpolovka> | |
| Severity: | unspecified | Docs Contact: | Filip Hanzelka <fhanzelk> | |
| Priority: | unspecified | |||
| Version: | 9.2 | CC: | frenaud, gfialova, mjurasek | |
| Target Milestone: | rc | Keywords: | Triaged, ZStream | |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
|
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | krb5-1.21.1-1.el9 | Doc Type: | Enhancement | |
| Doc Text: |
.The `optional_pac_tkt_chksum` option helps preserve interoperability between different versions of `krb5`
You can now use the `optional_pac_tkt_chksum` option to preserve the interoperability between RHEL Kerberos Distribution Center (KDC) servers running different versions of the `krb5` package. Specifically, you can change their behavior regarding Privilege Attribute Certificate (PAC) ticket signature verification. If you set the `optional_pac_tkt_chksum` string attribute to `true` for the Kerberos principal expected to sign a ticket, then the KDC does not reject service for user (S4U) requests containing a ticket that lacks the PAC ticket signature. The principal to sign the ticket is the ticket-granting service (TGS) one or a cross-realm TGS one, depending on the realm of the ticket's target service.
Since the `krb5-1.20` release, MIT Kerberos KDCs have required the presence of ticket signatures in PACs based on the encrypted part of Kerberos tickets so that they could process S4U requests successfully. Previously, this was a problem in gradual upgrade scenarios where certain KDCs used `krb5-1.19` or older, while others used `krb5-1.20` or newer. KDCs using the newer versions of `krb5` for S4U requests rejected service tickets that were provided by KDCs using the older versions of `krb5` if a service used them for S4U requests.
For more information about how this feature is used in Identity Management (IdM), see link:https://github.com/freeipa/freeipa/pull/6785#issue-1673265260[this pull request].
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 2181311 2211388 (view as bug list) | Environment: | ||
| Last Closed: | 2023-11-07 08:56:13 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 2181311, 2211388 | |||
|
Description
Julien Rische
2023-03-14 18:42:08 UTC
Upstream pull request: https://github.com/krb5/krb5/pull/1295 Fixed upstream master: https://pagure.io/freeipa/c/9cd5f49c74f28dbe070b072b394747a039cef463 https://pagure.io/freeipa/c/3f1b373cb2028416e40a26e3dd99b0f4c82525c7 https://pagure.io/freeipa/c/545a363dd2f7f551fa3ec3fed66c80b30ae3c1e1 Fixed upstream ipa-4-10: https://pagure.io/freeipa/c/630cda5c06428825dd5604493621b9cbdab70073 https://pagure.io/freeipa/c/bbe545ff9feb972e549c743025e4a26b14ef8f89 https://pagure.io/freeipa/c/7ea3b86696f5451f1d227d365018ab7dc53024af Moving back to assigned, the mentioned commits are related to IPA. The krb5 part is not done yet. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: krb5 security and bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2023:6699 |