On 28/02/2024 11:31, Giuseppe Calò via FreeIPA-users wrote:
Hi all, the default User authentication methos that we use is only:
"Two
factor authentication (password + OTP)"
Threfore the users can access to host or service (LDAP) by OTP.
We are looking for a way to disable OTP on a specific host or for ldap
queries.
The user authentication methods determine what is required for the user
to initially log in. If you enable both 'password' ("Password" in the
web UI) and 'otp' ("Password + OTP" in the web UI) then the user will be
able to authenticate using EITHER their password alone, OR both their
password & OTP.
The user's ticket-granting-ticket will have recorded on it an
'authentication indicator', which tells the IPA server which method was
used during that initial authentication process.
Separately, a host or service in the directory has an 'authentication
indicators' setting. If set, the FreeIPA server will only issue a user
with a service ticket for the service if the user's
ticket-granting-ticket has the same authentication indicator on it.
For example, let's create a service 'HTTP/secure.example.com' and set
its 'authentication indicators' to 'otp'.
When a user logs in with their password alone, their
ticket-granting-ticket will have no authentication indicators recorded
on it. When the user requests a ticket for HTTP/secure.example.com, the
FreeIPA server will refuse to issue the ticket.
But if the user logged in with their password + OTP, their
ticket-granting-ticket will have the 'otp' indicator on it. When the
user requests a service ticket for HTTP/secure.example.com, the FreeIPA
server will see that their ticket-granting-ticket has a matching
authentication indicator and issue the ticket.
Now to try to implement your requirements in terms of how FreeIPA works.
I think you will need to go through all your hosts and services where
you require the user to have authenticated using two factors, and set
the 'otp' indicator on them. For the hosts/services where you are OK
with a single factor being used, you can set _no_ indicators on them.
See the docs for more info:
<
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/...
There's one really important thing to be aware of. You can't set
authentication indicators on your FreeIPA servers' own hosts or services
running on them. (In older FreeIPA versions this was possible but it
would break everything; newer versions explicitly throw an error if you
try to do so).
Because of this, it will always be possible for your users to query the
directory and make calls to the FreeIPA API even when they have only
authenticated with their password. So if you set the default policy for
users to allow authentication with both 'password' and 'otp' then you
should probably explicitly configure your admin users so that they only
have the 'otp' authentication method available & therefore cannot
authenticate with password alone.
(I've been meaning to write an RFE to enforce some or all of the above
automatically for a while but never got around to it...)
Another approach is possible, where you don't configure the
authentication indicator requirement on the host/service objects within
the directory; instead, the hosts/services are themselves responsible
for examining the authentication indicators on the tickets that clients
present, and enforcing a policy.
For authentication to hosts, this can be done with pam_sss_gss.so. I've
not seen it implemented anywhere else, so for cases such as having
Apache check the client's ticket for an 'otp' indicator, I don't think
that can be done yet.
--
Sam Morris