2:56 p.m.
I'm trying to setup smart card login into an AD user account using an ID Override on
RHEL 7.8. I have been looking through Red Hat's documentation and its a bit
confusing. I was wondering what is the proper way to export a certificate from my CAC
PIV card ? I have been just exporting the certificate in PEM format from the ESC tool
and importing it into IDM web GUI. But SSSD isn't able to associate the smart card
with the AD user. When I run the ipa certmap-match command, it will match to the AD
account that I configured with the ID Override. I was also wondering if I need
pam_pkcs11 and pam_krb5 installed anymore ? When I uninstall pam_pkcs11, GDM
doesn't prompt me for my smart card PIN. I was looking at the
"config-client-for-smart-card-auth" script and it removes the pam_pkcs11 RPM,
that's why I am asking.
12:51 a.m.
On Mon, May 11, 2020 at 07:56:02PM -0000, David Woods via FreeIPA-users wrote:
I'm trying to setup smart card login into an AD user account
using an
ID Override on RHEL 7.8. I have been looking through Red Hat's
documentation and its a bit confusing. I was wondering what is the
proper way to export a certificate from my CAC PIV card ? I have
been just exporting the certificate in PEM format from the ESC tool
and importing it into IDM web GUI. But SSSD isn't able to associate
the smart card with the AD user. When I run the ipa certmap-match
command, it will match to the AD account that I configured with the
ID Override. I was also wondering if I need pam_pkcs11 and pam_krb5
Hi,
a working 'ipa certmap-match' is a good first step, since this command
will reach out to SSSD to do the mapping.
installed anymore ? When I uninstall pam_pkcs11, GDM doesn't
pam_pkcs11 and pam_krb5 are not needed anymore.
prompt me for my smart card PIN. I was looking at the
"config-client-for-smart-card-auth" script and it removes the
pam_pkcs11 RPM, that's why I am asking.
Did you run the script as well on the IPA client where you want to use
Smartcard authentication? Besides removing pam_pkcs11 and pam_krb5 there
are other important steps like adding CA certificate to /etc/pki/nssdb,
reconfiguring PAM to use pam_sss instead of the other 2 pam modules,
configuring SSSD to allow Smartcard authentication etc. So please run
the script or, if you prefer, do the steps in the script manually.
If this still does not help, please add 'debug_level = 9' to the [pam]
and [domain/...] sections of sssd.conf, restart SSSD, try again and send
the SSSD logs and the pam related content from /var/log/secure from
about the time of the test.
bye,
Sumit
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
3:08 p.m.
I did not run the script, because I had already done most of what is in the script by the
time I found it. I have imported all of the certificates into the /etc/pki/nss database
and I ran this command against my certificate.
Command: certutil -V -n 'mycertificate' -u CSR -l -a -d /etc/pki/nssdb, entered
my PIN and I got the output: certutil: certificate is valid. So, I believe that I added
all of the certificates to the system correctly.
I have removed pam_pkcs11 and installed krb5-pkinit-openssl. I enabled opensc using the
modutil command. When I run the command: modutil -list -dbdir /etc/pki/nssdb, I can see
my card reader and smart card.
I also ran the command: authconfig --enablesssd --enablesssdauth --enablesmartcard
--smartcardmodule=sssd --smartcardaction=1 --updateall, cleared the sss cache and rebooted
the system.
When the system reboots and I get to the GDM screen, I don't get asked for my PIN.
It reads my smart card and then says Sorry, that's didn't work. Please try
again.
Here is the log from sssd_pam:
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found token
name [my_token_name].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found module
name [opensc-pkcs11.so].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found key id
[0001].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found label
[my_ID_Certificate].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found cert
["CERTIFICATE REMOVED"].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x1000): Cert
["CERTIFICATE REMOVED"] does not match matching rules and is ignored.
(Tue May 12 19:28:03 2020) [sssd[pam]] [pam_forwarder_cert_cb] (0x0020): No certificate
found and no logon name given, authentication not possible.
I ran the command "ipa certmap-match mycertificate.pem: and it associated this
certificate with the correct AD account and AD domain.
Here is a copy of my SSSD config file:
[domain/idm.myhome.domain]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = idm.myhome.domain
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = idmsvr01.idm.myhome.domain
chpass_provider = ipa
ipa_server = idmsvr01.idm.myhome.domain
ipa_server_mode = True
ldap_tls_cacert = /etc/ipa/ca.crt
debug_level = 9
krb5_auth_timeout = 60
ldap_user_certificate = userCertificate;binary
[sssd]
services = ifp, nss, sudo, pam, ssh
debug_level = 9
domains = idm.myhome.domain
certificate_verification = no_ocsp
[nss]
memcache_timeout = 600
homedir_substring = /home
debug_level = 9
[pam]
debug_level = 9
p11_child_timeout = 60
pam_cert_auth = True
[sudo]
debug_level = 9
[autofs]
debug_level = 9
[ssh]
debug_level = 9
[pac]
debug_level = 9
[ifp]
debug_level = 9
allowed_uids = ipaapi, root
[secrets]
debug_level = 9
[session_recording]
debug_level = 9
2:12 a.m.
On 5/12/20 10:08 PM, tom smith via FreeIPA-users wrote:
I did not run the script, because I had already done most of what is
in the script by the time I found it. I have imported all of the certificates into the
/etc/pki/nss database and I ran this command against my certificate.
Command: certutil -V -n 'mycertificate' -u CSR -l -a -d /etc/pki/nssdb, entered
my PIN and I got the output: certutil: certificate is valid. So, I believe that I added
all of the certificates to the system correctly.
I have removed pam_pkcs11 and installed krb5-pkinit-openssl. I enabled opensc using the
modutil command. When I run the command: modutil -list -dbdir /etc/pki/nssdb, I can see
my card reader and smart card.
I also ran the command: authconfig --enablesssd --enablesssdauth --enablesmartcard
--smartcardmodule=sssd --smartcardaction=1 --updateall, cleared the sss cache and rebooted
the system.
When the system reboots and I get to the GDM screen, I don't get asked for my PIN.
It reads my smart card and then says Sorry, that's didn't work. Please try
again.
Here is the log from sssd_pam:
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found token
name [my_token_name].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found module
name [opensc-pkcs11.so].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found key id
[0001].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found label
[my_ID_Certificate].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x4000): Found cert
["CERTIFICATE REMOVED"].
(Tue May 12 19:28:03 2020) [sssd[pam]] [parse_p11_child_response] (0x1000): Cert
["CERTIFICATE REMOVED"] does not match matching rules and is ignored.
Hi,
By default a client certificate needs to contain the Extended Key Usage
"clientAuth" (see the section related to "matchrule" in sssd.conf(5)).
You can check if your user certificate has this extension with:
$ openssl x509 -noout -text -in cert.pem
The output should contain something similar to :
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Client Authentication
HTH,
flo
(Tue May 12 19:28:03 2020) [sssd[pam]] [pam_forwarder_cert_cb]
(0x0020): No certificate found and no logon name given, authentication not possible.
I ran the command "ipa certmap-match mycertificate.pem: and it associated this
certificate with the correct AD account and AD domain.
Here is a copy of my SSSD config file:
[domain/idm.myhome.domain]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = idm.myhome.domain
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = idmsvr01.idm.myhome.domain
chpass_provider = ipa
ipa_server = idmsvr01.idm.myhome.domain
ipa_server_mode = True
ldap_tls_cacert = /etc/ipa/ca.crt
debug_level = 9
krb5_auth_timeout = 60
ldap_user_certificate = userCertificate;binary
[sssd]
services = ifp, nss, sudo, pam, ssh
debug_level = 9
domains = idm.myhome.domain
certificate_verification = no_ocsp
[nss]
memcache_timeout = 600
homedir_substring = /home
debug_level = 9
[pam]
debug_level = 9
p11_child_timeout = 60
pam_cert_auth = True
[sudo]
debug_level = 9
[autofs]
debug_level = 9
[ssh]
debug_level = 9
[pac]
debug_level = 9
[ifp]
debug_level = 9
allowed_uids = ipaapi, root
[secrets]
debug_level = 9
[session_recording]
debug_level = 9
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
8:30 a.m.
I ran the command: openssl x509 -noout -text -in mycertificate.pem
This was the output:
TLS Web Client Authentication, Microsoft Smartcardlogin
1:57 a.m.
On Wed, May 13, 2020 at 01:30:26PM -0000, tom smith via FreeIPA-users wrote:
I ran the command: openssl x509 -noout -text -in mycertificate.pem
This was the output:
TLS Web Client Authentication, Microsoft Smartcardlogin
Hi,
what is the 'key usage' for this certificate?
Do you have defined certificate mapping and matching rules on the IPA
server? Can you send the output of
ipa certmaprule-find
Can you send the full sssd_pam.log and p11_child.log with
'debug_level=9' in the [pam] section of sssd.conf?
bye,
Sumit
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
1445
days inactive
1448
days old
freeipa-users@lists.fedorahosted.org
5 comments
4 participants
participants (4)
-
David Woods -
Florence Blanc-Renaud -
Sumit Bose -
tom smith