Go to file
Julien Rische 3f1b373cb2 Tolerate absence of PAC ticket signature depending of server capabilities
Since November 2020, Active Directory KDC generates a new type of
signature as part of the PAC. It is called "ticket signature", and is
generated based on the encrypted part of the ticket. The presence of
this signature is not mandatory in order for the PAC to be accepted for
S4U requests.

However, the behavior is different for MIT krb5. Support was added as
part of the 1.20 release, and this signature is required in order to
process S4U requests. Contrary to the PAC extended KDC signature, the
code generating this signature cannot be isolated and backported to
older krb5 versions because this version of the KDB API does not allow
passing the content of the ticket's encrypted part to IPA.

This is an issue in gradual upgrade scenarios where some IPA servers
rely on 1.19 and older versions of MIT krb5, while others use version
1.20 or newer. A service ticket that was provided by 1.19- IPA KDC will
be rejected when used by a service against a 1.20+ IPA KDC for S4U
requests.

On Fedora, CentOS 9 Stream, and RHEL 9, when the krb5 version is 1.20 or
newer, it will include a downstream-only update adding the
"optional_pac_tkt_chksum" KDB string attribute allowing to tolerate the
absence of PAC ticket signatures, if necessary.

This commit adds an extra step during the installation and update
processes where it adds a "pacTktSignSupported" ipaConfigString
attribute in "cn=KDC,cn=[server],cn=masters,cn=ipa,cn=etc,[basedn]" if
the MIT krb5 version IPA what built with was 1.20 or newer.

This commit also set "optional_pac_tkt_chksum" as a virtual KDB entry
attribute. This means the value of the attribute is not actually stored
in the database (to avoid race conditions), but its value is determined
at the KDC starting time by search the "pacTktSignSupported"
ipaConfigString in the server list. If this value is missing for at
least of them is missing, enforcement of the PAC ticket signature is
disabled by setting "optional_pac_tkt_chksum" to true for the local
realm TGS KDB entry.

For foreign realm TGS KDB entries, the "optional_pac_tkt_chksum" virtual
string attribute is set to true systematically, because, at least for
now, trusted AD domains can still have PAC ticket signature support
disabled.

Given the fact the "pacTktSignSupported" ipaConfigString for a single
server is added when this server is updated, and that the value of
"optional_pac_tkt_chksum" is determined at KDC starting time based on
the ipaConfigString attributes of all the KDCs in the domain, this
requires to restart all the KDCs in the domain after all IPA servers
were updated in order for PAC ticket signature enforcement to actually
take effect.

Fixes: https://pagure.io/freeipa/issue/9371
Signed-off-by: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2023-05-24 13:20:38 +02:00
.copr Adding auto COPR builds 2019-12-14 14:20:34 +02:00
.github Let GH auto-notify and auto-close stale PRs 2020-05-06 20:17:01 +02:00
asn1 fix minor spelling mistakes 2017-05-19 09:52:46 +02:00
client Pass the curl write callback by name instead of address 2022-11-16 14:50:22 -05:00
contrib Parse the debugging cache log to determine the read savings 2021-05-12 10:45:57 -04:00
daemons Tolerate absence of PAC ticket signature depending of server capabilities 2023-05-24 13:20:38 +02:00
doc Change doc theme to 'book' 2023-05-03 18:21:12 +02:00
init Fix ipa-ccache-sweeper activation timer and clean up service file 2022-08-29 18:28:42 +02:00
install Drop duplicate includedir from krb5.conf 2023-04-27 08:52:51 +02:00
ipaclient Drop duplicate includedir from krb5.conf 2023-04-27 08:52:51 +02:00
ipalib user or group name: explain the supported format 2023-05-22 20:22:59 +02:00
ipaplatform ipaplatform: add initial nixos support 2023-05-04 14:58:15 +02:00
ipapython Tolerate absence of PAC ticket signature depending of server capabilities 2023-05-24 13:20:38 +02:00
ipaserver Tolerate absence of PAC ticket signature depending of server capabilities 2023-05-24 13:20:38 +02:00
ipasphinx ipasphinx: Correct import of progress_message for Sphinx 6.1.0+ 2023-04-28 13:20:30 -04:00
ipatests user or group name: explain the supported format 2023-05-22 20:22:59 +02:00
po Update translations to FreeIPA master state 2023-05-19 09:58:02 +02:00
pypi Cleanup shebang and executable bit 2018-07-05 19:46:42 +02:00
selinux External IdP: initial SELinux policy 2022-05-10 15:52:41 +03:00
util ipa_pwd: Remove unnecessary conditional 2021-01-15 10:01:28 +01:00
.freeipa-pr-ci.yaml ipatests: revert wrong commit on gating definition 2021-11-02 11:40:25 +01:00
.git-commit-template Commit template: use either Fixes or Related 2022-02-14 11:21:01 +02:00
.gitignore gitignore: add install/oddjob/org.freeipa.server.config-enable-sid 2022-08-16 13:07:03 +02:00
.lgtm.yml Fix lgtm file classification 2021-03-08 08:31:41 +01:00
.mailmap mailmap: add ftweedal 2020-11-11 14:08:35 +02:00
.readthedocs.yaml docs: add the readthedocs configuration 2022-05-04 09:36:40 +03:00
.tox-install.sh azure: Don't customize pip's builddir 2021-10-21 08:03:03 +02:00
.wheelconstraints.in azure tests: move to fedora 37 2023-01-10 08:30:58 +01:00
ACI.txt IPA API changes to support RBCD 2023-04-05 14:55:22 -04:00
API.txt IPA API changes to support RBCD 2023-04-05 14:55:22 -04:00
autogen.sh build tweaks - use automake's foreign mode, avoid creating empty files to satisfy gnu mode - run autoreconf -f to ensure that everything matches 2010-11-29 11:39:55 -05:00
BUILD.txt BUILD.txt: remove redundant dnf-builddep option 2022-07-05 14:26:52 +02:00
CODE_OF_CONDUCT.md Changing Django's CoC to reflect FreeIPA CoC 2018-03-26 09:51:25 +02:00
configure.ac Tolerate absence of PAC ticket signature depending of server capabilities 2023-05-24 13:20:38 +02:00
Contributors.txt Update contributors list 2023-05-19 10:03:15 +02:00
COPYING Change FreeIPA license to GPLv3+ 2010-12-20 17:19:53 -05:00
COPYING.openssl Add a clear OpenSSL exception. 2015-02-23 16:25:54 +01:00
freeipa.doap.rdf Adding modified DOAP file 2018-06-22 11:02:40 -04:00
freeipa.spec.in Change fontawesome-fonts requires to match fontawesome 4.x 2023-05-23 09:26:58 -04:00
gpgkey-0E63D716D76AC080A4A33513F40800B6298EB963.asc spec: verify upstream source signature 2023-04-18 08:32:54 +02:00
ipa.in Replace PYTHONSHEBANG with valid shebang 2019-06-24 09:35:57 +02:00
ipasetup.py.in pylint: replace deprecated distutils module 2023-01-10 08:30:58 +01:00
make-doc Make an ipa-tests package 2013-06-17 19:22:50 +02:00
make-test Use pytest conftest.py and drop pytest.ini 2017-01-05 17:37:02 +01:00
makeaci.in Warn for permissions with read/write/search/compare and no attrs 2022-07-15 16:59:15 +02:00
makeapi.in doc: allow notes on Param API Reference pages 2023-03-29 10:53:25 +02:00
Makefile.am fastlint: Correct concatenation of file lists 2023-03-24 11:49:23 +01:00
Makefile.python.am Add PYTHON_INSTALL_EXTRA_OPTIONS and --install-layout=deb 2017-03-15 13:48:23 +01:00
Makefile.pythonscripts.am ipa-scripts: fix all ipa command line scripts to operate with -I 2019-09-19 10:44:09 -04:00
makerpms.sh Fix unnecessary usrmerge assumptions 2019-04-17 13:56:05 +02:00
pylint_plugins.py external-idp: add support to manage external IdP objects 2022-05-10 15:52:41 +03:00
pylintrc pylint: Fix useless-object-inheritance 2023-01-10 08:30:58 +01:00
README.md Update IRC links to point to Libera.chat 2021-05-27 18:26:28 +03:00
server.m4 kdb: Use krb5_pac_full_sign_compat() when available 2023-05-24 13:20:38 +02:00
tox.ini Fix tox in Azure CI 2023-03-21 16:54:28 +01:00
VERSION.m4 Tolerate absence of PAC ticket signature depending of server capabilities 2023-05-24 13:20:38 +02:00

FreeIPA Server

FreeIPA allows Linux administrators to centrally manage identity, authentication and access control aspects of Linux and UNIX systems by providing simple to install and use command line and web based management tools.

FreeIPA is built on top of well known Open Source components and standard protocols with a very strong focus on ease of management and automation of installation and configuration tasks.

FreeIPA can seamlessly integrate into an Active Directory environment via cross-realm Kerberos trust or user synchronization.

Benefits

FreeIPA:

  • Allows all your users to access all the machines with the same credentials and security settings
  • Allows users to access personal files transparently from any machine in an authenticated and secure way
  • Uses an advanced grouping mechanism to restrict network access to services and files only to specific users
  • Allows central management of security mechanisms like passwords, SSH Public Keys, SUDO rules, Keytabs, Access Control Rules
  • Enables delegation of selected administrative tasks to other power users
  • Integrates into Active Directory environments

Components

The FreeIPA project provides unified installation and management tools for the following components:

Project Website

Releases, announcements and other information can be found on the IPA server project page at http://www.freeipa.org/ .

Documentation

The most up-to-date documentation can be found at http://freeipa.org/page/Documentation .

Quick Start

To get started quickly, start here: http://www.freeipa.org/page/Quick_Start_Guide

For developers

Licensing

Please see the file called COPYING.

Contacts