[19643] in Kerberos_V5_Development
Re: pkinit plugin logic in pkinit_srv.c
daemon@ATHENA.MIT.EDU (Craig Huckabee)
Thu Aug 24 15:27:28 2017
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
From: Craig Huckabee <craig.huckabee@spawar.navy.mil>
In-Reply-To: <6cd71bfb-ec18-e89f-4ed0-ea9fe4baa4b1@mit.edu>
Date: Thu, 24 Aug 2017 15:09:15 -0400
Message-Id: <C87B094A-36F9-4225-BFA2-8C11906C598B@spawar.navy.mil>
To: Greg Hudson <ghudson@mit.edu>
Cc: krbdev@mit.edu
Content-Type: multipart/mixed; boundary="===============3775608140903934043=="
Errors-To: krbdev-bounces@mit.edu
--===============3775608140903934043==
Content-Type: multipart/signed;
boundary="Apple-Mail=_09996D2B-58C9-487A-96BD-BC2A13A39D3A";
protocol="application/pkcs7-signature"; micalg=sha1
--Apple-Mail=_09996D2B-58C9-487A-96BD-BC2A13A39D3A
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=windows-1252
> On Aug 24, 2017, at 2:47 PM, Greg Hudson <ghudson@mit.edu> wrote:
>=20
> On 08/24/2017 01:42 PM, Craig Huckabee wrote:
>=20
>> In my use case, I=92m working with a DoD CAC so I have a SAN that =
looks
>> like this "1234567890@mil=94 - so to work around that I wanted to use =
the
>> dbmatch feature to add the relation between that SAN and my actual
>> principal.
>=20
> We expected some users to want to authorize client certs which weren't
> issued for PKINIT at all (so no id-pkinit-san SAN and no
> id-pkinit-KPClientAuth EKU). In this use case, the san module would
> return KRB5_PLUGIN_NO_HANDLE, the admin would disable EKU checking so
> that the eku modules returns KRB5_PLUGIN_NO_HANDLE, and the dbmatch
> module would control authorization.
>=20
> We didn't expect people to want to authorize client certs with an
> id-pkinit-san SAN containing the wrong principal name. The only way =
to
> make that work in the current code is to use module configuration to
> disable the san certauth module, which would mean that you'd have to =
use
> dbmatch for everyone.
>=20
Unfortunately the SAN present isn=92t a id-pkinit-san, these cards are =
only issued with the NT-Principal type SAN, so that is what I have to =
work with.
I=92ll revert my build and try disabling the plugin to see if that still =
works. Thanks for the context.
=97Craig
--Apple-Mail=_09996D2B-58C9-487A-96BD-BC2A13A39D3A
Content-Disposition: attachment;
filename=smime.p7s
Content-Type: application/pkcs7-signature;
name=smime.p7s
Content-Transfer-Encoding: base64
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIEsTCCBK0w
ggOVoAMCAQICAwGY/jANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJVUzEYMBYGA1UEChMPVS5T
LiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNEb0QxDDAKBgNVBAsTA1BLSTEYMBYGA1UEAxMPRE9EIElE
IFNXIENBLTM4MB4XDTE3MDQxODEyMDQ1M1oXDTIwMDQxODEyMDQ1M1owdzELMAkGA1UEBhMCVVMx
GDAWBgNVBAoTD1UuUy4gR292ZXJubWVudDEMMAoGA1UECxMDRG9EMQwwCgYDVQQLEwNQS0kxDDAK
BgNVBAsTA1VTTjEkMCIGA1UEAxMbSFVDS0FCRUUuREFSWUwuQy4xMjQ5MzUzNTYyMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqyUPtaILBJCZufwFTQScISrbcIUQyJx9kK4vKyTCxujo
IkLHe/hnrPgZBrZIxx1mhy0+g1vGGIpJV2PHjVTBAY8ultmi/7+O6JT0mCM/zxVZP4yXqJXuzeGb
vQUEJUROJlYSkleORTmidKmZlk3fSIsXJ7+eQmOv71fkm1kNwonwzBxO3m/BnL7IteWbalQ3hSSp
/QAT3yn0UjMYfDHszTZBR6KgJU3FqXiqWABm00086QOTdKeWpxCQgWg1t4tPGv4p77+uH9GJOPx1
ZgGGwxZxKjuZYMIrmqo02A8wy8XjW6GSx9xf3SQJ98ebNvKHQ/kPd6OipxLEkL559vyjPQIDAQAB
o4IBWjCCAVYwHwYDVR0jBBgwFoAUjsW5zPzOjlO0Ks7oESrPmylsZ8owOQYDVR0fBDIwMDAuoCyg
KoYoaHR0cDovL2NybC5kaXNhLm1pbC9jcmwvRE9ESURTV0NBXzM4LmNybDAOBgNVHQ8BAf8EBAMC
B4AwFgYDVR0gBA8wDTALBglghkgBZQIBCycwHQYDVR0OBBYEFPVBl8LA3XVPDh3jVnP/Gfq+Dgv4
MGcGCCsGAQUFBwEBBFswWTA1BggrBgEFBQcwAoYpaHR0cDovL2NybC5kaXNhLm1pbC9zaWduL0RP
RElEU1dDQV8zOC5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6Ly9vY3NwLmRpc2EubWlsMCkGA1UdEQQi
MCCBHmNyYWlnLmh1Y2thYmVlQHNwYXdhci5uYXZ5Lm1pbDAdBgNVHSUEFjAUBggrBgEFBQcDAgYI
KwYBBQUHAwQwDQYJKoZIhvcNAQELBQADggEBAG3pY2ZSLujikcJO3KuQuzk/BUtswBr4kCXeiZV3
2yWD4iTy8vt+Dlra8nZS/H6QNb5AK0rBAfPKMHo8gblNO6YYVstJPvQDLl9m9+npUzBTbejGV0Ls
DJWNUHDRpoLfgQuP87Xh4G2HjxvzBm/fvd7UyrmDoZ81uK4RDHs2B/ecNK/qJGf5T2rplTLMOwWw
/lIBiss4FEPQtTFucP7drmgSvhO5QSPab/ymRw03hghS5aqlKZFBgBKGlrdj+7Yjx5z6MW42xmWU
G2/hpQItx9HIv1bR3amkKADLST4NahWB4iNzZrHDZMPHGpEPulYM9JxT39d/w5W6hTA6fVQUIUAx
ggHqMIIB5gIBATBkMF0xCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdvdmVybm1lbnQxDDAK
BgNVBAsTA0RvRDEMMAoGA1UECxMDUEtJMRgwFgYDVQQDEw9ET0QgSUQgU1cgQ0EtMzgCAwGY/jAJ
BgUrDgMCGgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcw
ODI0MTkwOTE2WjAjBgkqhkiG9w0BCQQxFgQUSuzVFDvHpmCQIKnqXTSDU6ebZWcwDQYJKoZIhvcN
AQEBBQAEggEAkivF6ZxAZXr2RcdVcDfC0O0XNjy/vyP2i+dDvtniFlpjB7F4qSFaa5zEIiSIkwXb
FAP/t5DOGDEpTbywbu/pcRzvQ+TPMSneIWySV2mOXk/7nQSBEI8jIPZn93+9Edyar/9lt14+0s4B
rulsQrGsfoFeELCpHTtWrOaMBKTHspxlfrp4k9Bg5/6yoDdroNw0p6MSaWKQPZ4t6ZxwkLWiX2pc
bzlin22o2VNhVmfzj2qAX4I9MNcx0IeVplSjOqZfUUQdi6Y9DC9jqEKBNozepYUtXA1LiwOvttJL
WjbaPx0qFtHXgcvwuzH8ETrEaxlHzZ7wX4s5BqMz6rF0JRxiggAAAAAAAA==
--Apple-Mail=_09996D2B-58C9-487A-96BD-BC2A13A39D3A--
--===============3775608140903934043==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
--===============3775608140903934043==--
