[freeipa PR#4015][opened] ipa-kdd: Remove keys password auth is disabled
by sumit-bose
URL: https://github.com/freeipa/freeipa/pull/4015
Author: sumit-bose
Title: #4015: ipa-kdd: Remove keys password auth is disabled
Action: opened
PR body:
"""
With commit 15ff9c8 a check was removed and as a result Kerberos keys
are unconditionally added to the user entry struct if they are
available. As a result the password related pre-authentication methods
PA-ENC-TIMESTAMP and PA-ETYPE-INFO2 are advertised in the NEEDED_PREAUTH
reply to an AS_REQ.
With respect to the KDC policies this does not matter much because if
password authentication is disabled for the given principal the policy
will reject the AS_REQ if the user tries password authentication. This
is possible because with commit 15ff9c8 kinit will ask for a password if
called without any additional options (e.g. armor ticket or PKINIT
identity). Before 15ff9c8 was committed it just failed with 'kinit:
Pre-authentication failed: Invalid argument while getting initial
credentials' because no suitable pre-authentication method was
available. This is the same behavior as if no password was set for the
given principal.
But with this change SSSD fails to detect the available authentication
types for the given principal properly. As described in
https://docs.pagure.org/SSSD.sssd/design_pages/prompting_for_multiple_aut...
SSSD uses the MIT Kerberos responder interface to determine the
available authentication methods for the principal and does not check
the ipaUserAuthType LDAP attribute. As a result if a user has 2FA (otp)
authentication configured, which implies that a password is set as the
first factor, the responder interface will always indicate that password
authentication is available even if only opt is enabled for the user.
In this case SSSD will use a prompting which indicates that the second
factor might be optional. Additionally if prompting the user directly is
not possible (e.g. ssh with ChallengeResponseAuthentication /
KbdInteractiveAuthentication disabled) the single string entered by the
user will always be assumed as a password and not as a combination of
password and otp-token value. As a consequence authentication will
always fail because password authentication is disabled for the user and
since SSSD does not do try-and-error 2FA is not tried.
This patch add back the check so that if password authentication is not
available for the principal the Kerberos will not be added to the entry
struct and the KDC will not advertise PA-ENC-TIMESTAMP or
PA-ETYPE-INFO2. If you think this is wrong and the behavior added by
15ff9c8 should be preferred SSSD handing of the available authentication
types must be extended to read ipaUserAuthType as well to restore the
user experience with respect to 2FA prompting and ssh behavior.
Related to https://pagure.io/freeipa/issue/8001
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/4015/head:pr4015
git checkout pr4015
4 years, 3 months
[freeipa PR#4001][opened] WIP: DNS install check: allow overlapping zone to be from the master itself
by abbra
URL: https://github.com/freeipa/freeipa/pull/4001
Author: abbra
Title: #4001: WIP: DNS install check: allow overlapping zone to be from the master itself
Action: opened
PR body:
"""
When re-running `ipa-server-install --setup-dns` on already installed
server, we do not get to the check of being already installed because
DNS zone overlap forces us to fail earlier.
Change exception returned for this case from check_zone_overlap() to
return structured information that allows to understand whether we are
finding a conflict with ourselves.
Use the returned information to only fail DNS check at this point if DNS
zone overlap is generated by a different name server than ourselves.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/4001/head:pr4001
git checkout pr4001
4 years, 3 months
FreeIPA 4.8.4 release plan
by Alexander Bokovoy
Hi,
I'm planning to cut FreeIPA 4.8.4 release tomorrow (around noon East coast
timezone). Please look into outstanding PRs and review/push them before
that.
The release diff is rather small. I'm showing the log diff against 4.8.2
because 4.8.3 was a security only release and ipa-4-8 branch includes
the fixes from that release already.
$ git log --oneline release-4-8-2..ipa-4-8
9462e4c4b (origin/ipa-4-8, ipa-4-8) Fix get_trusted_domain_object_from_sid()
b39ee3e17 Fix service ldap_disable()
6a953733f Require idstart to be larger than UID_MAX
2fc5990a7 Check valid before/after of external certs
999ebc176 Add config that maintains existing content to ipa-client-install manpage
9f726a20d Fix lite-server to work with GSS_NAME
fa952666d ipatests : Login via ssh using private-key for ipa-user should work.
bb8da7d38 ipatests: fix TestMigrateDNSSECMaster teardown
5d847cfb1 Fix logic of check_client_configuration
0785a032d Optimize user-add by caching ldap2.has_upg()
b21128c2d trust upgrade: ensure that host is member of adtrust agents
6486b1aa4 travis: Remove CI integration
b65558622 Don't hard-code client's TLS versions and ciphers
ae9e41bad Update Apache HTTPd for RHBZ#1775146
f7de64c38 Enable TLS 1.3 support on the server
82a4faefd Skip paramiko tests in FIPS mode
9091290a3 FIPS: server key has different name in FIPS mode
6ce6b53de Remove FIPS noise from SSHd
dd06dfc97 ipatests: fix test_crlgen_manage
ab67e0ed3 ipatests: fix teardown
c77b06265 ipatests: generic uninstall should call ipa server-del
eebabb5c5 covscan: free ucs2-encoded password copy when generating NTLM hash
84592e32c covscan: free encryption types in case there is an error
dfa356e3d Add test case for OTP login
90f286616 Fix otptoken_sync plugin
11be13906 Become FreeIPA 4.8.3
7db2000e1 CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
d2e0d9452 Make sure to have storage space for tag
8cbf47ae6 ipatests: add check that ipa-adtrust-install generates sane smb.conf
d5be38a5b DSU: add Design for Disable Stale Users
04cfaa186 Nightly definition: use right template for krbtpolicy
1ca93942b Debian: Fix font-awesome path.
bc007eca9 Add integration test for Kerberos ticket policy
14ff82f3b Add Authentication Indicator Kerberos ticket policy options
4dbd689e3 Allow presence of LDAP attribute options
d26429ea2 WebUI: Fix notification area layout
185403862 Do not run trust upgrade code if master lacks Samba bindings
e011906af Update selinux-policy minimal requirement
2c98d7604 Show group-add/remove-member-manager failures
444df81a3 WebUI: Fix adding member manager for groups and host groups
0cd2f4ee3 Test installation with (fake) userspace FIPS
2422970c3 Use default ssh host key algorithms
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
4 years, 3 months