external ocsp ?

[veer Schlansky]

My company's PIV/AD credintial is [e-mail]. We set up our IPA
credintial as [e-mail]

example.com and linux.example.com are completedly seperated domain/realms,
no trust or interaction whatsoever.

I took the user and CA certs on the PIV card and put them into ipa. I was
able to authenticate to ipa webui with my PIV card.

My question is does ipa do online certificate status protocol check for the
[e-mail] cert? Any way to verify that?

Thanks.

[Fraser Tweedale]

On Mon, Oct 01, 2018 at 06:05:42PM -0400, veer Schlansky via FreeIPA-users wrote:
> My company's PIV/AD credintial is [e-mail]. We set up our IPA
> credintial as [e-mail]
>
> example.com and linux.example.com are completedly seperated domain/realms,
> no trust or interaction whatsoever.
>
> I took the user and CA certs on the PIV card and put them into ipa. I was
> able to authenticate to ipa webui with my PIV card.
>
> My question is does ipa do online certificate status protocol check for the
> [e-mail] cert? Any way to verify that?
>
> Thanks.

For HTTP smart card authentication, the script output by `ipa-advise
config-server-for-smart-card-auth` enables OCSP checking.  If you
didn't use that script, then set `SSLOCSPEnable on` in
/etc/httpd/conf.d/ssl.conf.

For smart card login via SSSD, OCSP checking is performed by default
(and can be suppressed via the `certificate_verification` setting;
see sssd.conf(5)).

Cheers,
Fraser

[Rob Crittenden]

Fraser Tweedale via FreeIPA-users wrote:
> On Mon, Oct 01, 2018 at 06:05:42PM -0400, veer Schlansky via FreeIPA-users wrote:
> > My company's PIV/AD credintial is [e-mail]. We set up our IPA
> > credintial as [e-mail]
> >
> > example.com and linux.example.com are completedly seperated domain/realms,
> > no trust or interaction whatsoever.
> >
> > I took the user and CA certs on the PIV card and put them into ipa. I was
> > able to authenticate to ipa webui with my PIV card.
> >
> > My question is does ipa do online certificate status protocol check for the
> > [e-mail] cert? Any way to verify that?
> >
> > Thanks.
>
> For HTTP smart card authentication, the script output by `ipa-advise
> config-server-for-smart-card-auth` enables OCSP checking.  If you
> didn't use that script, then set `SSLOCSPEnable on` in
> /etc/httpd/conf.d/ssl.conf.

Or use ipa-advise to generate the script to see what needs to be enabled
for your version of IPA (it varies). For versions pre 4.7 the option you
want is NSSOCSP but there are other things to set as well.

rob
> For smart card login via SSSD, OCSP checking is performed by default
> (and can be suppressed via the `certificate_verification` setting;
> see sssd.conf(5)).

[veer Schlansky]

Thanks a lot to both of you.

On Mon, Oct 1, 2018 at 10:54 PM Rob Crittenden  wrote:
> Fraser Tweedale via FreeIPA-users wrote:
> > On Mon, Oct 01, 2018 at 06:05:42PM -0400, veer Schlansky via
>
> FreeIPA-users wrote:
> > > My company's PIV/AD credintial is [e-mail]. We set up our IPA
> > > credintial as [e-mail]
> > >
> > > example.com and linux.example.com are completedly seperated
>
> domain/realms,
> > > no trust or interaction whatsoever.
> > >
> > > I took the user and CA certs on the PIV card and put them into ipa. I
>
> was
> > > able to authenticate to ipa webui with my PIV card.
> > >
> > > My question is does ipa do online certificate status protocol check for
>
> the
> > > [e-mail] cert? Any way to verify that?
> > >
> > > Thanks.
> >
> > For HTTP smart card authentication, the script output by `ipa-advise
> > config-server-for-smart-card-auth` enables OCSP checking.  If you
> > didn't use that script, then set `SSLOCSPEnable on` in
> > /etc/httpd/conf.d/ssl.conf.
>
> Or use ipa-advise to generate the script to see what needs to be enabled
> for your version of IPA (it varies). For versions pre 4.7 the option you
> want is NSSOCSP but there are other things to set as well.
>
> rob
> > For smart card login via SSSD, OCSP checking is performed by default
> > (and can be suppressed via the `certificate_verification` setting;
> > see sssd.conf(5)).

[Jessie Floyd]

I've deployed a pre-production IPA environment which is similar to the example domains above.  I have a user signed smart-card which does not share a CA with the IPA domain.  I want to configure SSSD to fail closed if the OCSP responder (identified on the card) is not available.  I see in the sssd.conf file where I can enable OCSP to an alternate URL, but I don't find an option to set to OCSP as 'required'.  I've ran a network capture and see the OCSP responder replying to my request when authenticating via SmartCard, I now want to force authentication to require OCSP validation and not default 'open' or 'success' when OCSP is unavailable.  Is there a method of setting either sssd.conf or an attribute in ipa to force this type of configuration?

[Sumit Bose]

On Thu, Jan 31, 2019 at 03:20:04PM -0000, Jessie Floyd via FreeIPA-users wrote:
> I've deployed a pre-production IPA environment which is similar to the
> example domains above.  I have a user signed smart-card which does not
> share a CA with the IPA domain.  I want to configure SSSD to fail
> closed if the OCSP responder (identified on the card) is not
> available.  I see in the sssd.conf file where I can enable OCSP to an
> alternate URL, but I don't find an option to set to OCSP as
> 'required'.  I've ran a network capture and see the OCSP responder
> replying to my request when authenticating via SmartCard, I now want
> to force authentication to require OCSP validation and not default
> 'open' or 'success' when OCSP is unavailable.  Is there a method of
> setting either sssd.conf or an attribute in ipa to force this type of
> configuration?

If the certificate includes the OCSP extension SSSD will use OCSP to
validate the certificate, you can disable this by setting
'certificate_verification=no_ocsp'.

Or do you want that only certificates which have the OCSP extension are
allowed at all?

bye,
Sumit
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

[Jessie Floyd]

I want to prevent user access if the OCSP responder does not return a valid/successful result.  Only those users with a confirmed OCSP response will be allowed access to the systems.  I don't find a flag in sssd.confg which would force this type operation.  I've also looked over the IPA/idM installation guide and don't find a reference on how to implement / force an OCSP check for externally signed user certificates.

[Natxo Asenjo]

hello Jessie,

On Mon, Feb 4, 2019 at 5:10 PM Jessie Floyd via FreeIPA-users <
[e-mail]> wrote:
> I want to prevent user access if the OCSP responder does not return a
> valid/successful result.  Only those users with a confirmed OCSP response
> will be allowed access to the systems.  I don't find a flag in sssd.confg
> which would force this type operation.  I've also looked over the IPA/idM
> installation guide and don't find a reference on how to implement / force
> an OCSP check for externally signed user certificates.

Sumit's answer applies, I think. If the certificate includes an ocsp uri,
sssd will use it. So out of the box it will work. This can be problematic
for laptop users without network connectivity and access to the ocsp
responder, by the way.

--
Groeten,
natxo