Red Hat SummitDieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.
Chapter 15. Kerberos PKINIT authentication in IdM
Use Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) to authenticate to Identity Management (IdM) using certificates instead of passwords. PKINIT provides stronger authentication by using public key cryptography for Kerberos preauthentication.
15.1. Default PKINIT configuration
Understand how the default PKINIT configuration in Identity Management (IdM) varies based on your certificate authority setup. PKINIT configuration determines how servers and clients authenticate using public key cryptography.
| CA configuration | PKINIT configuration |
|---|---|
| Without a CA, no external PKINIT certificate provided | Local PKINIT: IdM only uses PKINIT for internal purposes on servers. |
| Without a CA, external PKINIT certificate provided to IdM | IdM configures PKINIT by using the external Kerberos key distribution center (KDC) certificate and CA certificate. |
| With an Integrated CA | IdM configures PKINIT by using the certificate signed by the IdM CA. |
15.2. Displaying the current PKINIT configuration
Display PKINIT configuration settings in Identity Management (IdM) to verify that certificate-based authentication is properly configured. Checking PKINIT status helps troubleshoot authentication issues and validate security policies.
Procedure
To determine the PKINIT status in your domain, use the
ipa pkinit-statuscommand:$ ipa pkinit-status Server name: server1.example.com PKINIT status: enabled [...output truncated...] Server name: server2.example.com PKINIT status: disabled [...output truncated...]The command displays the PKINIT configuration status as
enabledordisabled:-
enabled: PKINIT is configured using a certificate signed by the integrated IdM CA or an external PKINIT certificate. -
disabled: IdM only uses PKINIT for internal purposes on IdM servers.
-
To list the IdM servers with active Kerberos key distribution centers (KDCs) that support PKINIT for IdM clients, use the
ipa config-showcommand on any server:$ ipa config-show Maximum username length: 32 Home directory base: /home Default shell: /bin/sh Default users group: ipausers [...output truncated...] IPA masters capable of PKINIT: server1.example.com [...output truncated...]
15.3. Configuring PKINIT in IdM
Enable PKINIT on Identity Management (IdM) servers to allow certificate-based Kerberos authentication. PKINIT strengthens security by using public key cryptography for initial authentication instead of passwords alone.
Prerequisites
- Ensure that all IdM servers with a certificate authority (CA) installed are running on the same domain level.
Procedure
Check if PKINIT is enabled on the server:
# kinit admin Password for admin@IDM.EXAMPLE.COM: # ipa pkinit-status --server=server.idm.example.com 1 server matched ---------------- Server name: server.idm.example.com PKINIT status:enabled ---------------------------- Number of entries returned 1 ----------------------------If PKINIT is disabled, you will see the following output:
# ipa pkinit-status --server server.idm.example.com ----------------- 0 servers matched ----------------- ---------------------------- Number of entries returned 0 ----------------------------You can also use the command to find all the servers where PKINIT is enabled if you omit the
--server <server_fqdn>parameter.If you are using IdM without CA:
On the IdM server, install the CA certificate that signed the Kerberos key distribution center (KDC) certificate:
# ipa-cacert-manage install -t CT,C,C ca.pemTo update all IPA hosts, repeat the
ipa-certupdatecommand on all replicas and clients:# ipa-certupdateCheck if the CA certificate has already been added using the
ipa-cacert-manage listcommand. For example:# ipa-cacert-manage list CN=CA,O=Example Organization The ipa-cacert-manage command was successfulUse the
ipa-server-certinstallutility to install an external KDC certificate. The KDC certificate must meet the following conditions:-
It is issued with the common name
CN=fully_qualified_domain_name,certificate_subject_base. -
It includes the Kerberos principal
krbtgt/REALM_NAME@REALM_NAME. It contains the Object Identifier (OID) for KDC authentication:
1.3.6.1.5.2.3.5.# ipa-server-certinstall --kdc kdc.pem kdc.key # systemctl restart krb5kdc.service
-
It is issued with the common name
See your PKINIT status:
# ipa pkinit-status Server name: server1.example.com PKINIT status: enabled [...output truncated...] Server name: server2.example.com PKINIT status: disabled [...output truncated...]
If you are using IdM with a CA certificate, enable PKINIT as follows:
# ipa-pkinit-manage enable Configuring Kerberos KDC (krb5kdc) [1/1]: installing X509 Certificate for PKINIT Done configuring Kerberos KDC (krb5kdc). The ipa-pkinit-manage command was successfulIf you are using an IdM CA, the command requests a PKINIT KDC certificate from the CA.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}