mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-24 16:10:02 -06:00
9c0a35f1e7
As of release 1.17, KDC can be configured to apply authentication indicator for SPAKE, PKINIT, and encrypted challenge preauth via FAST channel, which are not configured in current version of freeIPA. Note that even though the value of encrypted_challenge_indicator is attached only when encrypted challenge preauth is performed along a FAST channel, it's possible to perform FAST without encrypted challenge by using SPAKE. Since there is no reason to force clients not to use SPAKE while using FAST, we made a design choice to merge SPAKE and FAST in a new option called "Hardened Password", which requires user to use at least one of SPAKE or FAST channel. Hence same value attaching to both spake_preauth_indicator and encrypted_challenge_indicator. Resolves: https://pagure.io/freeipa/issue/8001 Signed-off-by: Changmin Teng <cteng@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
24 lines
620 B
Plaintext
24 lines
620 B
Plaintext
[kdcdefaults]
|
|
kdc_ports = 88
|
|
kdc_tcp_ports = 88
|
|
restrict_anonymous_to_tgt = true
|
|
spake_preauth_kdc_challenge = edwards25519
|
|
|
|
[realms]
|
|
$REALM = {
|
|
master_key_type = aes256-cts
|
|
max_life = 7d
|
|
max_renewable_life = 14d
|
|
acl_file = $KRB5KDC_KADM5_ACL
|
|
dict_file = $DICT_WORDS
|
|
default_principal_flags = +preauth
|
|
; admin_keytab = $KRB5KDC_KADM5_KEYTAB
|
|
pkinit_identity = FILE:$KDC_CERT,$KDC_KEY
|
|
pkinit_anchors = FILE:$KDC_CERT
|
|
pkinit_anchors = FILE:$CACERT_PEM
|
|
pkinit_pool = FILE:$CA_BUNDLE_PEM
|
|
pkinit_indicator = pkinit
|
|
spake_preauth_indicator = hardened
|
|
encrypted_challenge_indicator = hardened
|
|
}
|