Hi Pedro,
On ma, 28 helmi 2022, Pedro Bezunartea López via FreeIPA-users wrote:
Hi Alexander,
I followed your instructions, and this is how far I got:
1. User is listed on the IPA server under: Identity > ID Views > Default Trust
View:
bezu(a)ourdomain.local
2. SSH to the client using my AD credentials
3. I run:
$ kinit bezu(a)example.local
Password for bezu(a)ourdomain.local:
4. Generated key and CSR using openssl > myreq.csr
5. Run:
$ ipa cert-request myreq.csr
Principal: bezu(a)ourdomain.local
ipa: ERROR: The realm for the principal does not match the realm for this IPA server.
$ klist
Ticket cache: KCM:176...1680:95288
Default principal: bezu(a)OURDOMAIN.LOCAL
Valid starting Expires Service principal
26/02/22 03:12:04 26/02/22 13:04:54 HTTP/ca.idm.ourdomain.local(a)IDM.OURDOMAIN.LOCAL
26/02/22 03:04:54 26/02/22 13:04:54 krbtgt/OURDOMAIN.LOCAL(a)OURDOMAIN.LOCAL
renew until 01/03/22 03:04:45
26/02/22 03:12:04 26/02/22 13:04:54 krbtgt/IDM.OURDOMAIN.LOCAL(a)OURDOMAIN.LOCAL
Where idm.ourdmoain.local is the IPA server; ca.idm.ourdomain.local is
the client; OURDMAIN.LOCAL is our AD domain.
Is this the error you were expecting?
Yes.
This is what I'd expect it to be, as of now, correct. This is because we
do validation of the realm --principal option. See
cert_request.takes_options definition in ipaserver/plugins/cert.py.
Principal option is defined as
Principal(
'principal',
validate_realm,
label=_('Principal'),
doc=_('Principal for this certificate (e.g.
HTTP/test.example.com)'),
normalizer=normalize_principal
),
where both 'validate_realm' and 'normalize_principal' helper come from
ipaserver/plugins/service.py and hard code assumption that we are
operating on the principals from our realm only.
This is one of the parts which would need to be extended to allow
principals from other realms to be acted upon. It is going to be a quite
delicate processing, though, as we need to make sure it is not giving a
possibility to impersonate some other Kerberos realm.
What probably could be done here is an extension of access controls to
allow operations like this to work on multiple realms. It would,
probably, be a global config setting because at this point we have not
yet even started to look at the CA ACLs. In fact, realm validation is
used in multiple places, all those paths would need to be carefully
investigated:
$ git grep validate_realm
ipaserver/plugins/baseuser.py:from ipaserver.plugins.service import (validate_realm,
normalize_principal)
ipaserver/plugins/baseuser.py: validate_realm,
ipaserver/plugins/baseuser.py: validate_realm,
ipaserver/plugins/cert.py:from ipaserver.plugins.service import normalize_principal,
validate_realm
ipaserver/plugins/cert.py: validate_realm,
ipaserver/plugins/host.py: validate_realm, validate_auth_indicator,
normalize_principal,
ipaserver/plugins/host.py: validate_realm,
ipaserver/plugins/host.py: validate_realm,
ipaserver/plugins/passwd.py:from ipaserver.plugins.service import validate_realm
ipaserver/plugins/passwd.py: validate_realm,
ipaserver/plugins/service.py:def validate_realm(ugettext, principal):
ipaserver/plugins/service.py: validate_realm,
ipaserver/plugins/service.py: validate_realm,
ipaserver/plugins/vault.py:from .service import normalize_principal, validate_realm
ipaserver/plugins/vault.py: validate_realm,
I don't fully understand the error message. Does it have to do
with the
CSR? The Subject contains the same O= as the IPA Server... Does it need
a specific format?
It has to do with the principal, not CSR (yet). Just to remind,
cert-request command looks like this:
$ ipa cert-request --help
Usage: ipa [global-options] cert-request [CSR-FILE] [options]
Submit a certificate signing request.
Options:
-h, --help show this help message and exit
--profile-id=STR Certificate Profile to use
--ca=STR Name of issuing CA
--principal=PRINCIPAL
Principal for this certificate (e.g.
HTTP/test.example.com)
--add automatically add the principal if it doesn't exist
(service principals only)
--chain Include certificate chain in output
--all Retrieve and print all attributes from the server.
Affects command output.
--raw Print entries as stored on the server. Only affects
output format.
--certificate-out=FILE
Write certificate (chain if --chain used) to file
'--principal' option specifies the object for which certificate will be
issued. All objects in IPA that could be used to issue certificates for
are Kerberos principals in IPA realm: hosts, services, and users. You
are aiming at adding another class of Kerberos principals for
certificate issuance: Kerberos principals from a different (trusted)
realm. Existing code does not account for this and hence rejects basic
validation of the requested principal.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland