On ti, 04 joulu 2018, Rob Foehl via FreeIPA-users wrote:
On Tue, 4 Dec 2018, Fraser Tweedale wrote:
>On Tue, Dec 04, 2018 at 01:49:04AM -0500, Rob Foehl via FreeIPA-users wrote:
>>Is the service principal necessary just to satisfy this requirement?
>>
>It is required, but you can use the host principal, i.e.
>"host/foo.example.com(a)YOUR.REALM".
Ahhh, of course. Works fine, thanks!
(For what it's worth, every reference I could find for ipa-getcert -K
explicitly calls it a service principal, while the getcert-request(1)
man page just says principal name. I also couldn't find an example of
how to create a host certificate using ipa-getcert, only via the UI or
at ipa-client-install time.)
In Kerberos jargon 'service principal' is the
one that is built with one
or more components stitched together with '/'. First part is typically a
service name, second is a hostname. There might be three-part service
principals (used by Active Directory) but typically service/host@REALM
is the way to express service principals.
getcert-request(1) talks about a 'principal name' because it is not a
certmonger which is considering the difference, KDC and CA are. FreeIPA
framework makes sure whatever Kerberos principal is added into the
certificate is validated to be allowed to be present there. Since client
certificate can be used to authenticate in lieu of a Kerberos key, the
principal specified in the certificate represents whose identity it
impersonates. You certainly wouldn't expect a regular certificate to
impersonate your 'admin' principal and gain ability to obtain a ticket
granting ticket for 'admin'.
See
https://ssimo.org/blog/id_016.html for more details.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland