6a7e7eace6
This commit adds support for kx509 in libkrb5, and revamps the KDC's
kx509 service (fixing bugs, adding features).
Of note is that kx509 is attempted optimistically by the client, with
the certificate and private key stored in the ccache, and optionally in
an external PEM or DER file.
NOTE: We do not optimistically use kx509 in krb5_cc_store_cred() if the
ccache is a MEMORY ccache so we don't generate a key when
accepting a GSS context with a delegated credential.
kx509 protocol issues to be fixed in an upcoming commit:
- no proof of possession (this is mostly not too bad, but we'll want to
fix it by using CSRs)
- no algorithm agility (only plain RSA is supported)
- very limited (no way to request any options in regards to the
requested cert)
- error codes are not very useful
Things we're adding in this commit:
- libkrb5 kx509 client
- automatic kx509 usage hooked in via krb5_cc_store_cred() of start TGT
- per-realm templates on the KDC side
- per-realm issuer certificates
- send error messages on the KDC side
(this is essential to avoid client-side timeouts on error)
- authenticate as many error messages
- add a protocol probe feature so we can avoid generating a
keypair if the service is not enabled
(once we add support for ECC algorithms we won't need this
anymore; the issue is that RSA keygen is slow)
- support for different types of client principals, not just username:
- host-based service and domain-based service, each with its own
template set per-{realm, service} or per-service
(the idea is to support issuance of server certificates too, not
just client/user certs)
- more complete support for SAN types
- tests (including that PKINIT->kx509->PKINIT works, which makes it
possible to have "delegation" of PKIX credentials by just delegating
Kerberos credentials)
- document the protocol in lib/krb5/kx509.c
Future work:
- add option for longer-ticket-lifetime service certs
- add support for ECDSA, and some day for ed25519 and ed448
- reuse private key when running kinit
(this will require rethinking how we trigger optimistic kx509
usage)
- HDB lookup for:
- optional revocation check (not strictly necessary)
- adding to certificates those SANs listed in HDB
- hostname aliases (dNSName SANs)
- rfc822Name (email)
- XMPP SANs
- id-pkinit-san (a user could have aliases too)
- support username wild-card A RRs, ala OSKT/krb5_admin
i.e., if a host/f.q.d.n principal asks for a certificate for
some service at some-label.f.q.d.n, then issue it
(this is not needed at OSKT sites because OSKT already
supports keying such service principals, which means kx509
will issue certificates for them, however, it would be nice
to be able to have this independent of OSKT)
(a better way to do this would be to integrate more of OSKT
into Heimdal proper)
- a kx509 command, or heimtools kx509 subcommand for explicitly
attempting use of the kx509 protocol (as opposed to implicit, as is
done in kinit via krb5_cc_store_cred() magic right now)
Issues:
- optimistically trying kx509 on start realm TGT store -> timeout issues!
- newer KDCs will return errors because of this commit; older ones
will not, which causes timouts
- need a separate timeout setting for kx509 for optimistic case
- need a [realm] config item and DNS SRV RR lookup for whether a
realm is expected to support kx509 service
40 lines
1.7 KiB
Plaintext
40 lines
1.7 KiB
Plaintext
#
|
|
# Error messages for the krb5 library
|
|
#
|
|
# This might look like a com_err file, but is not
|
|
#
|
|
|
|
# RFC6171 says:
|
|
#
|
|
# +------------+-----------------------------+------------------------+
|
|
# | error-code | Condition | Example |
|
|
# +------------+-----------------------------+------------------------+
|
|
# | 1 | Permanent problem with | Incompatible version |
|
|
# | | client request | |
|
|
# | 2 | Solvable problem with | Expired Kerberos |
|
|
# | | client request | credentials |
|
|
# | 3 | Temporary problem with | Packet loss |
|
|
# | | client request | |
|
|
# | 4 | Permanent problem with the | Internal |
|
|
# | | server | misconfiguration |
|
|
# | 5 | Temporary problem with the | Server overloaded |
|
|
# | | server | |
|
|
# +------------+-----------------------------+------------------------+
|
|
#
|
|
# Error 3 makes no sense on the wire, and in the library it only makes sense as
|
|
# a timeout, so we'll name it KX509_ERR_TIMEOUT.
|
|
|
|
# Error table names must be no more than four characters...
|
|
error_table kx59
|
|
|
|
prefix KX509_ERR
|
|
|
|
error_code NONE, "Kx509 success"
|
|
error_code CLNT_FATAL, "Kx509 request error, possibly unsupported version"
|
|
error_code CLNT_SOLVABLE, "Kx509 request error such as expired credentials"
|
|
error_code TIMEOUT, "Kx509 request timed out"
|
|
error_code SRV_FATAL, "Permanent server problem"
|
|
error_code SRV_OVERLOADED, "Kx509 server is overloaded"
|
|
|
|
end
|