IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-01-24 07:06:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

docs: add security section to idp

Browse Source 
Related: https://pagure.io/freeipa/issue/8805
Related: https://pagure.io/freeipa/issue/8804
Related: https://pagure.io/freeipa/issue/8803
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Pavel Březina 2022-11-10 13:27:00 +01:00 committed by Rob Crittenden
parent dbebed2e3a
commit c6a16a7e53
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
doc/designs/external-idp/external-idp.md
View File

@ -497,3 +497,23 @@ and calls out to the `oidc_child` process to verify the user identity against an
associated IdP.
[idp-api]: idp-api.html
## Security
* communication between Kerberos client and KDC happens over FAST channel
* communication between KDC and FreeIPA (`ipa-otpd`) happens over root-owned
UNIX domain socket
* communication between `oidc_child` and IdP happens over `https`
* no authentication tokens are exchanged between client, KDC and FreeIPA
* IdP server URLs can only be set by administrator
* IdP server URLs are not auto discovered, they need to be added manually
* user authenticates to the external identity provider using the method required
by the provider, FreeIPA does not have any control over the selected method
### Recommendations
* administrators must thoroughly check all URLs they add when creating the IdP
server
* users must check that the presented device authorization URL is correct and
that the authentication happens over secure channel (usually `https`) with
valid certificate