On 10/11/2011 09:53 AM, Gerhardus Geldenhuis wrote:
Hi

I am looking at doing certifcate based authentication using 389. The company where I am working currently issues a certificate for every new starter and these certs are well managed with regards to sensible expiry dates etc. This cert is your key to the whole environment and a lot of the applications like jira/confluence authenticate you based on your certificate.

I have read through the documentation:
http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html/Administration_Guide/Managing_SSL.html

and it seems to suggest that it is nessesary to convert the user certificate and upload it into 389 db.

It is not necessary, but it is on by default.  This is the certmap.conf "verifyCert" setting.  It is "on" by default.  If you set it to "off" it will not attempt to compare the client cert with the one in the 389 db.

This seems a bit of a duplication. Is there anyway to "talk" to the certificate provider to ascertain the validity or not of a certificate and obtain any other required information, rather than having a copy of the certificate in the database. The documentation also does not say whether this is the public or private part of the certificate that needs to be uploaded. I am assuming it is the public part.

Yes, the public part.  389 uses NSS for crypto which supports CRL and OCSP for checking certificate revocation status.  You would typically want to periodically install a new CRL into 389 using crlutil in order to check revocation status of incoming client certs.


The second part of the question is how would this work with regards to ssh authentication. Somehow via pam and ssh the certificate must be passed on to 389 when the authentication happens. I am not sure this is currently possible with pam but would be interested in any suggestions to achieve something like this.

pam_pkcs11?  Note that ssh public keys are not the same as the public key part of an x509 certificate - you cannot mix and match them afaik.  What exactly are you trying to do?  Do ssh/pam authentication and have ssh retrieve the public key from LDAP?


Regards

--
Gerhardus Geldenhuis
-- 389 users mailing list 389-users@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users