I have installed a FreeIPA master server including Kerberos. Furthermore I have one client server, enrolled in FreeIPA, to test the PKINIT feature of Kerberos. All servers run on CentOS7.
A testuser exists in FreeIPA and this user is also listed in the one and only existing realm, when using list_principals in kadmin as testuser@REALMNAME.
getprinc testuser also gives Attributes: REQUIRES_PRE_AUTH.
I have created kdc and client certificates strictly following the documentation: https://web.mit.edu/kerberos/www/krb5-latest/doc/admin/pkinit.html. They have been signed by my own CA, whose certificate is also present on the client and the master.
The [realm] config on the master is as follows:
[realms]
TEST.INTERN = {
kdc = XXX:88
master_kdc = XXX:88
admin_server = XXX:749
default_domain = test.intern
pkinit_anchors = FILE:/etc/krb/ca.pem
pkinit_identity = FILE:/etc/krb/kdc.pem,/etc/krb/kdckey.pem
allow_pkinit = yes
module = pkinit:/usr/lib64/krb5/plugins/preauth/pkinit.so
}
with XXX being the master servers FQDN. Furthermore, the client is configured as follows:
[realms]
TEST.INTERN = {
kdc = XXX:88
master_kdc = XXX:88
admin_server = XXX:749
kpasswd_server = XXX:464
default_domain = test.intern
pkinit_anchors = FILE:/etc/krb/ca.pem
pkinit_identities = FILE:/etc/krb/client.pem,/etc/krb/clientkey.pem
}
AFAIK I should be able to perform kinit testuser on the client to get a Kerberos Ticket without entering a password.
Unfortunately, executing env KRB5_TRACE=/dev/stdout kinit -V testuser yields:
[2988] 1614772826.172614: Getting initial credentials for [email protected]
[2988] 1614772826.172616: Sending unauthenticated request
[2988] 1614772826.172617: Sending request (170 bytes) to TEST.INTERN
[2988] 1614772826.172618: Resolving hostname XXX
[2988] 1614772826.172619: Initiating TCP connection to stream XXX_IP:88
[2988] 1614772826.172620: Sending TCP request to stream XXX_IP:88
[2988] 1614772826.172621: Received answer (298 bytes) from stream XXX_IP:88
[2988] 1614772826.172622: Terminating TCP connection to stream XXX_IP:88
[2988] 1614772826.172623: Response was from master KDC
[2988] 1614772826.172624: Received error from KDC: -1765328359/Additional pre-authentication required
[2988] 1614772826.172627: Preauthenticating using KDC method data
[2988] 1614772826.172628: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-PK-AS-REQ_OLD (14), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENC-TIMESTAMP (2), PA-FX-C
OKIE (133)
[2988] 1614772826.172629: Selected etype info: etype aes256-cts, salt ""@0.X)+A92ZBJ*5T", params ""
[2988] 1614772826.172630: Received cookie: MIT
[2988] 1614772826.172631: Preauth module pkinit (147) (info) returned: 0/Success
[2988] 1614772826.172632: PKINIT loading CA certs and CRLs from FILE
[2988] 1614772826.172633: PKINIT client computed kdc-req-body checksum 9/80ADD1F631A328C4895D0B822F96608C303E6743
[2988] 1614772826.172635: PKINIT client making DH request
[2988] 1614772826.172636: Preauth module pkinit (16) (real) returned: 0/Success
[2988] 1614772826.172637: Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16)
[2988] 1614772826.172638: Sending request (3475 bytes) to TEST.INTERN
[2988] 1614772826.172639: Resolving hostname XXX
[2988] 1614772826.172640: Initiating TCP connection to stream XXX_IP:88
[2988] 1614772826.172641: Sending TCP request to stream XXX_IP:88
[2988] 1614772826.172642: Received answer (167 bytes) from stream XXX_IP:88
[2988] 1614772826.172643: Terminating TCP connection to stream XXX_IP:88
[2988] 1614772826.172644: Response was from master KDC
[2988] 1614772826.172645: Received error from KDC: -1765328318/Certificate mismatch
kinit: Certificate mismatch while getting initial credentials
The master server confirms this. The /var/log/krb5kdc.log yields:
Mar 03 13:01:10 XXX krb5kdc[80746](info): Doing certauth authorize for [[email protected]]
Mar 03 13:01:10 XXX krb5kdc[80746](info): Got cert filter [(userCertificate;binary=...
Mar 03 13:01:10 XXX krb5kdc[80746](info): No matching entry found
Mar 03 13:01:10 XXX krb5kdc[80746](info): preauth (pkinit) verify failure: Certificate mismatch
At this point, I really don't know, why this failure occurs. The certificates have been created striclty following the documentation linked above.
When examining the certificates with openssl asn1parse -in certificate.pem -strparse OFFSET, with the according offset, I get for the SubjectAltName, othername section:
openssl asn1parse -dump -in ../client/client.pem -strparse 815
0:d=0 hl=2 l= 48 cons: SEQUENCE
2:d=1 hl=2 l= 46 cons: cont [ 0 ]
4:d=2 hl=2 l= 6 prim: OBJECT :1.3.6.1.5.2.2
12:d=2 hl=2 l= 36 cons: cont [ 0 ]
14:d=3 hl=2 l= 34 cons: SEQUENCE
16:d=4 hl=2 l= 13 cons: cont [ 0 ]
18:d=5 hl=2 l= 11 prim: GENERALSTRING
0000 - 54 45 53 54 2e 49 4e 54-45 52 4e TEST.INTERN
31:d=4 hl=2 l= 17 cons: cont [ 1 ]
33:d=5 hl=2 l= 15 cons: SEQUENCE
35:d=6 hl=2 l= 3 cons: cont [ 0 ]
37:d=7 hl=2 l= 1 prim: INTEGER :01
40:d=6 hl=2 l= 8 cons: cont [ 1 ]
42:d=7 hl=2 l= 6 cons: SEQUENCE
44:d=8 hl=2 l= 4 prim: GENERALSTRING
0000 - 74 65 73 74 75 73 65 72 testuser
for the client certificate and
openssl asn1parse -dump -in kdc.pem -strparse 832
0:d=0 hl=2 l= 63 cons: SEQUENCE
2:d=1 hl=2 l= 61 cons: cont [ 0 ]
4:d=2 hl=2 l= 6 prim: OBJECT :1.3.6.1.5.2.2
12:d=2 hl=2 l= 51 cons: cont [ 0 ]
14:d=3 hl=2 l= 49 cons: SEQUENCE
16:d=4 hl=2 l= 13 cons: cont [ 0 ]
18:d=5 hl=2 l= 11 prim: GENERALSTRING
0000 - 54 45 53 54 2e 49 4e 54-45 52 4e TEST.INTERN
31:d=4 hl=2 l= 32 cons: cont [ 1 ]
33:d=5 hl=2 l= 30 cons: SEQUENCE
35:d=6 hl=2 l= 3 cons: cont [ 0 ]
37:d=7 hl=2 l= 1 prim: INTEGER :02
40:d=6 hl=2 l= 23 cons: cont [ 1 ]
42:d=7 hl=2 l= 21 cons: SEQUENCE
44:d=8 hl=2 l= 6 prim: GENERALSTRING
0000 - 6b 72 62 74 67 74 krbtgt
52:d=8 hl=2 l= 11 prim: GENERALSTRING
0000 - 54 45 53 54 2e 49 4e 54-45 52 4e TEST.INTERN
for the kdc certificate
Currently I'm quite lost on why this isn't working.
PS: I've reaplced the real master server's FQDN with XXX and it's IP with XXX_IP.
Here is a blog post I put together that should give you an idea how to setup Kerberos PKINIT preauthentication mechanism to authenticate an IPA user with a X.509 certificate: