[freeipa PR#851][opened] ipa-kdb: add pkinit authentication indicator in case of a successful certauth

[abbra]

   URL: https://github.com/freeipa/freeipa/pull/851
Author: abbra
 Title: #851: ipa-kdb: add pkinit authentication indicator in case of a successful
certauth
Action: opened

PR body:
"""
We automatically add 'otp' and 'radius' authentication indicators when
pre-authentication with OTP or RADIUS did succeed. Do the same for
certauth-based pre-authentication (PKINIT).

A default PKINIT configuration does not add any authentication
indicators unless 'pkinit_indicator = pkinit' is set in kdc.conf.
Unfortunately, modifying kdc.conf automatically is a bit more
complicated than modifying krb5.conf. Given that we have 'otp' and
'radius' authentication indicators also defined in the code not in the
kdc.conf, this change is following an established trend.

SSSD certauth interface does not provide additional information about
which rule(s) succeeded in matching the incoming certificate. Thus,
there is not much information we can automatically provide in the
indicator. It would be good to generate indicators that include some
information from the certmapping rules in future but for now a single
'pkinit' indicator is enough.

Fixes https://pagure.io/freeipa/issue/6736
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/851/head:pr851
git checkout pr851

[freeipa PR#851][+ack] ipa-kdb: add pkinit authentication indicator in case of a successful certauth

[simo5]

  URL: https://github.com/freeipa/freeipa/pull/851
Title: #851: ipa-kdb: add pkinit authentication indicator in case of a successful
certauth

Label: +ack

[freeipa PR#851][+pushed] ipa-kdb: add pkinit authentication indicator in case of a successful certauth

[martbab]

  URL: https://github.com/freeipa/freeipa/pull/851
Title: #851: ipa-kdb: add pkinit authentication indicator in case of a successful
certauth

Label: +pushed

[freeipa PR#851][comment] ipa-kdb: add pkinit authentication indicator in case of a successful certauth

[martbab]

  URL: https://github.com/freeipa/freeipa/pull/851
Title: #851: ipa-kdb: add pkinit authentication indicator in case of a successful
certauth

martbab commented:
"""
master:

* e8a7e2e38ad7cea2964305247430e964d2b785b1 ipa-kdb: add pkinit authentication indicator in
case of a successful certauth


ipa-4-5:

* ca02cea8dfd63290e4821833fc2ac7d457290e9f ipa-kdb: add pkinit authentication indicator in
case of a successful certauth


"""

See the full comment at
https://github.com/freeipa/freeipa/pull/851#issuecomment-306237025

[freeipa PR#851][closed] ipa-kdb: add pkinit authentication indicator in case of a successful certauth

[martbab]

   URL: https://github.com/freeipa/freeipa/pull/851
Author: abbra
 Title: #851: ipa-kdb: add pkinit authentication indicator in case of a successful
certauth
Action: closed

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/851/head:pr851
git checkout pr851