8:52 a.m.
Hey All,
I want to authenticate with an external app to ldap ipa.
So I've created a user for the bind:
dn: uid=sysaccount,cn=sysaccounts,cn=etc,dc=example,dc=com
changetype: add
objectclass: account
objectclass: simplesecurityobject
uid: system
userPassword: somepass123
passwordExpirationTime: 20380119031407Z
nsIdleTimeout: 0
The external app runs the LDAP check successfully and can see the users
that belong to the group that's allowed to login.
Problem:
I can not login with the default "admin" account but I can not login with
any other account that's in the dn into the app.
Response is: "Invalid credentials"
base: 'cn=users,cn=accounts,dc=example,dc=com'
user_filter:
'(memberOf=cn=gitlab-users,cn=groups,cn=accounts,dc=example,dc=com)'
Any ideas?
Thank You!
--
Best regards
Maciej Drobniuch
Network Security Engineer
Collective-Sense,LLC
9:22 a.m.
So, It looks like tokens are working on LDAP too.
Is there any way to disable 2FA on LDAP?
Thanks
On Thu, Feb 22, 2018 at 3:52 PM, Maciej Drobniuch <md(a)collective-sense.com>
wrote:
Hey All,
I want to authenticate with an external app to ldap ipa.
So I've created a user for the bind:
dn: uid=sysaccount,cn=sysaccounts,cn=etc,dc=example,dc=com
changetype: add
objectclass: account
objectclass: simplesecurityobject
uid: system
userPassword: somepass123
passwordExpirationTime: 20380119031407Z
nsIdleTimeout: 0
The external app runs the LDAP check successfully and can see the users
that belong to the group that's allowed to login.
Problem:
I can not login with the default "admin" account but I can not login with
any other account that's in the dn into the app.
Response is: "Invalid credentials"
base: 'cn=users,cn=accounts,dc=example,dc=com'
user_filter: '(memberOf=cn=gitlab-users,cn=groups,cn=accounts,dc=example,
dc=com)'
Any ideas?
Thank You!
--
Best regards
Maciej Drobniuch
Network Security Engineer
Collective-Sense,LLC
--
Best regards
Maciej Drobniuch
Network Security Engineer
Collective-Sense,LLC
10:07 a.m.
On to, 22 helmi 2018, Maciej Drobniuch via FreeIPA-users wrote:
So, It looks like tokens are working on LDAP too.
Is there any way to disable 2FA on LDAP?
2FA policy applies to both Kerberos and
LDAP authentication. If you
enable password-only logon in addition to 2FA, users will be able to use
both password-only and 2FA-enhanced logons.
There is no way to differ in that policy between Kerberos and LDAP auth.
I suggest you to connect gitlab via OpenID Connect -- using either
Ipsilon or Keycloak Identity Providers. Both have integration with
FreeIPA and will supply required details to OmniAuth connector (use
https://github.com/m0n9oose/omniauth_openid_connect). In both cases SSSD
would be used to perform actual authentication and data retrieval behind
the scenes, so HBAC rules can be used to control who can login and both
Kerberos and direct password/2FA would be accepted.
On Thu, Feb 22, 2018 at 3:52 PM, Maciej Drobniuch
<md(a)collective-sense.com>
wrote:
> Hey All,
>
> I want to authenticate with an external app to ldap ipa.
>
> So I've created a user for the bind:
> dn: uid=sysaccount,cn=sysaccounts,cn=etc,dc=example,dc=com
> changetype: add
> objectclass: account
> objectclass: simplesecurityobject
> uid: system
> userPassword: somepass123
> passwordExpirationTime: 20380119031407Z
> nsIdleTimeout: 0
>
> The external app runs the LDAP check successfully and can see the users
> that belong to the group that's allowed to login.
>
> Problem:
> I can not login with the default "admin" account but I can not login with
> any other account that's in the dn into the app.
> Response is: "Invalid credentials"
>
> base: 'cn=users,cn=accounts,dc=example,dc=com'
> user_filter: '(memberOf=cn=gitlab-users,cn=groups,cn=accounts,dc=example,
> dc=com)'
>
> Any ideas?
>
> Thank You!
>
> --
> Best regards
>
> Maciej Drobniuch
> Network Security Engineer
> Collective-Sense,LLC
>
--
Best regards
Maciej Drobniuch
Network Security Engineer
Collective-Sense,LLC
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
--
/ Alexander Bokovoy
1:17 p.m.
Okay, Thank you Alex,
I will give it a shot.
Best
Maciej
On Thu, Feb 22, 2018 at 5:07 PM, Alexander Bokovoy <abokovoy(a)redhat.com>
wrote:
On to, 22 helmi 2018, Maciej Drobniuch via FreeIPA-users wrote:
> So, It looks like tokens are working on LDAP too.
>
> Is there any way to disable 2FA on LDAP?
>
2FA policy applies to both Kerberos and LDAP authentication. If you
enable password-only logon in addition to 2FA, users will be able to use
both password-only and 2FA-enhanced logons.
There is no way to differ in that policy between Kerberos and LDAP auth.
I suggest you to connect gitlab via OpenID Connect -- using either
Ipsilon or Keycloak Identity Providers. Both have integration with
FreeIPA and will supply required details to OmniAuth connector (use
https://github.com/m0n9oose/omniauth_openid_connect). In both cases SSSD
would be used to perform actual authentication and data retrieval behind
the scenes, so HBAC rules can be used to control who can login and both
Kerberos and direct password/2FA would be accepted.
On Thu, Feb 22, 2018 at 3:52 PM, Maciej Drobniuch <md(a)collective-sense.com
> >
> wrote:
>
> Hey All,
>>
>> I want to authenticate with an external app to ldap ipa.
>>
>> So I've created a user for the bind:
>> dn: uid=sysaccount,cn=sysaccounts,cn=etc,dc=example,dc=com
>> changetype: add
>> objectclass: account
>> objectclass: simplesecurityobject
>> uid: system
>> userPassword: somepass123
>> passwordExpirationTime: 20380119031407Z
>> nsIdleTimeout: 0
>>
>> The external app runs the LDAP check successfully and can see the users
>> that belong to the group that's allowed to login.
>>
>> Problem:
>> I can not login with the default "admin" account but I can not login
with
>> any other account that's in the dn into the app.
>> Response is: "Invalid credentials"
>>
>> base: 'cn=users,cn=accounts,dc=example,dc=com'
>> user_filter: '(memberOf=cn=gitlab-users,cn=
>> groups,cn=accounts,dc=example,
>> dc=com)'
>>
>> Any ideas?
>>
>> Thank You!
>>
>> --
>> Best regards
>>
>> Maciej Drobniuch
>> Network Security Engineer
>> Collective-Sense,LLC
>>
>>
>
>
> --
> Best regards
>
> Maciej Drobniuch
> Network Security Engineer
> Collective-Sense,LLC
>
_______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedo
> rahosted.org
>
--
/ Alexander Bokovoy
--
Best regards
Maciej Drobniuch
Network Security Engineer
Collective-Sense,LLC
8:54 a.m.
New subject: OTP for specific services only
On pe, 23 helmi 2018, Winfried de Heiden via FreeIPA-users wrote:
Hi al,
OTP using IPA 4.5 on CentOS seems to work well. However: I can force a user to
use OTP and/or a host.
Selecting a user, ALL authentication needs OTP. Since sudo in this case will
ask for OTP also, this turn out quite inconvenient. Is is possible to select
only certain services for OTP. for example:
login using SSH --> OTP
login ftp --> OTP
console --> password only
sudo --> password only
Not possible right now, sorry.
--
/ Alexander Bokovoy
2:35 a.m.
New subject: OTP for specific services only
Hi all,
What about an RFE on this :)
Winfried
-----Oorspronkelijke bericht-----
Datum: Fri, 23 Feb 2018 16:54:45 +0200
Onderwerp: Re: [Freeipa-users] OTP for specific services only
Cc: Winfried de Heiden <wdh(a)dds.nl>
Aan: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
Van: Alexander Bokovoy <abokovoy(a)redhat.com>
On pe, 23 helmi 2018, Winfried de Heiden via FreeIPA-users wrote:
Hi al,
OTP using IPA 4.5 on CentOS seems to work well. However: I can force
a user to
use OTP and/or a host.
Selecting a user, ALL authentication needs OTP. Since sudo in this
case will
ask for OTP also, this turn out quite inconvenient. Is is possible to
select
only certain services for OTP. for example:
login using SSH --> OTP
login ftp --> OTP
console --> password only
sudo --> password only
Not possible right now, sorry.
2:44 a.m.
New subject: OTP for specific services only
On ma, 26 helmi 2018, Winfried de Heiden wrote:
Hi all,
What about an RFE on this :)
See my other response. It isn't done just for fun,
there is a
fundamental issue of authorization made at authentication time
when there is not enough information about a target to authorize.
Winfried
-----Oorspronkelijke bericht-----
Datum: Fri, 23 Feb 2018 16:54:45 +0200
Onderwerp: Re: [Freeipa-users] OTP for specific services only
Cc: Winfried de Heiden <wdh(a)dds.nl>
Aan: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
Van: Alexander Bokovoy <abokovoy(a)redhat.com>
On pe, 23 helmi 2018, Winfried de Heiden via FreeIPA-users wrote:
> Hi al,
>
> OTP using IPA 4.5 on CentOS seems to work well. However: I can force
> a user to
> use OTP and/or a host.
>
> Selecting a user, ALL authentication needs OTP. Since sudo in this
> case will
> ask for OTP also, this turn out quite inconvenient. Is is possible to
> select
> only certain services for OTP. for example:
>
> login using SSH --> OTP
> login ftp --> OTP
> console --> password only
> sudo --> password only
Not possible right now, sorry.
--
/ Alexander Bokovoy
9:02 a.m.
New subject: OTP for specific services only
Hey Winfired,
I've been struggling with this too.
Currently I'm doing a hack (NO PASSWORD) in sudoers to at least workaround
the otp at sudo.
It's as always usability+angry users vs security.
BR
Maciej
On Fri, Feb 23, 2018 at 3:07 PM, Winfried de Heiden via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
Hi al,
OTP using IPA 4.5 on CentOS seems to work well. However: I can force a
user to use OTP and/or a host.
Selecting a user, ALL authentication needs OTP. Since sudo in this case
will ask for OTP also, this turn out quite inconvenient. Is is possible to
select only certain services for OTP. for example:
login using SSH --> OTP
login ftp --> OTP
console --> password only
sudo --> password only
Winfried
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
--
Best regards
Maciej Drobniuch
Network Security Engineer
Collective-Sense,LLC
9:17 a.m.
New subject: OTP for specific services only
On pe, 23 helmi 2018, Maciej Drobniuch via FreeIPA-users wrote:
Hey Winfired,
I've been struggling with this too.
Currently I'm doing a hack (NO PASSWORD) in sudoers to at least workaround
the otp at sudo.
It's as always usability+angry users vs security.
Well, consider that
authentication is a separate step from
authorization. When you do 'sudo foo' you are authenticating first with
your credentials, then authorization step is run after authentication
succeeded.
Authentication means validating your credentials without knowing what
you will be using them for afterwards. Kerberos KDC is authenticating
an SSSD request after 'sudo foo' triggered that one and it doesn't have
any idea what SSSD will be using the result of authentication for,
neither has it a way to trust what SSSD as an authentication client
could tell to KDC for a policy decision to take.
Authorization happens after this step and here SSSD would know about
HBAC rules to check to allow users to access 'sudo'/'sudo-l' HBAC
service but at this stage it is too late: Kerberos KDC already asked an
authentication client (SSSD) to provide 2FA creds.
If we add a logic on the SSSD side and allow it re-using an existing
Kerberos ticket to cache authentication exchange and go straight to
authorization stage, there could be race conditions. The whole flow
needs to be thought through quite well. There was a PAM module in past
that allowed to use Kerberos ticket to decide whether a certain PAM
service could be accessed based on that and it was retired due to so
many concerns about possible races.
BR
Maciej
On Fri, Feb 23, 2018 at 3:07 PM, Winfried de Heiden via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
> Hi al,
>
> OTP using IPA 4.5 on CentOS seems to work well. However: I can force a
> user to use OTP and/or a host.
>
> Selecting a user, ALL authentication needs OTP. Since sudo in this case
> will ask for OTP also, this turn out quite inconvenient. Is is possible to
> select only certain services for OTP. for example:
>
> login using SSH --> OTP
> login ftp --> OTP
> console --> password only
> sudo --> password only
>
> Winfried
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>
>
--
Best regards
Maciej Drobniuch
Network Security Engineer
Collective-Sense,LLC
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
--
/ Alexander Bokovoy
2:37 a.m.
New subject: OTP for specific services only
Angry users, indeed...:)
NOPASSWD seems like no option, I struggle some more...
Winfried
-----Oorspronkelijke bericht-----
Datum: Fri, 23 Feb 2018 16:02:06 +0100
Onderwerp: Re: [Freeipa-users] OTP for specific services only
Cc: Winfried de Heiden <wdh(a)dds.nl>
Aan: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
Van: Maciej Drobniuch <md(a)collective-sense.com>
Hey Winfired,
I've been struggling with this too.
Currently I'm doing a hack (NO PASSWORD) in sudoers to at least
workaround the otp at sudo.
It's as always usability+angry users vs security.
BR
Maciej
On Fri, Feb 23, 2018 at 3:07 PM, Winfried de Heiden via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
Hi al,
OTP using IPA 4.5 on CentOS seems to work well. However: I can
force a user to use OTP and/or a host.
Selecting a user, ALL authentication needs OTP. Since sudo in
this
case will ask for OTP also, this turn out quite inconvenient.
Is
is possible to select only certain services for OTP. for
example:
login using SSH --> OTP
login ftp --> OTP
console --> password only
sudo --> password only
Winfried
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahoste
d.org
1:11 p.m.
New subject: OTP for specific services only
Winfried de Heiden via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> writes:
OTP using IPA 4.5 on CentOS seems to work well. However: I can force
a user to use OTP and/or a host.
Authentication indicators won't work that way...
Selecting a user, ALL authentication needs OTP. Since sudo in this
case will ask for OTP also, this turn out
quite inconvenient. Is is possible to select only certain services for OTP. for example:
login using SSH --> OTP
login ftp --> OTP
console --> password only
sudo --> password only
Not easily with FreeIPA, but I do something similar with Privacyidea and
Yubikeys. In FreeIPA I authenticate my user with RADIUS (freeradius and
Privacyidea). In Privacyidea my user has a Yubukey token assigned, so I
log on with password+OTP when logging in. When I do sudo I have a
special PAM config: Users with a yubikey authenticate only with OTP
instead of "NOPASSWD" - that way I don't need to type my password, but
still have some authentication going on.
You can't do that with tokens defined in FreeIPA, but looking at PAM
options might help you to get something working. Do you use hardware
tokens or a smartphone app/soft token?
Jochen
--
This space is intentionally left blank.
2265
days inactive
2269
days old
freeipa-users@lists.fedorahosted.org
11 comments
4 participants
participants (4)
-
Alexander Bokovoy -
Jochen Hein -
Maciej Drobniuch -
Winfried de Heiden