Chapter 14. Managing Kerberos ticket policies

Identity Management (IdM) authentication relies on the Kerberos Key Distribution Center (KDC), the trusted authority that issues and validates tickets for all users, services, and hosts in the IdM network.

Each IdM user, service, and host acts as a Kerberos client and is identified by a unique Kerberos principal:

The following image is a simplification of the communication between a Kerberos client, the KDC, and a Kerberized application that the client wants to communicate with.

Learn about Identity Management (IdM) Kerberos ticket policy types to understand how to enforce authentication requirements and control ticket lifecycles across your deployment.

Kerberos authentication indicators identify which pre-authentication mechanism a client used to obtain a ticket-granting ticket (TGT). Services can require specific authentication indicators to enforce security policies like smart card or two-factor authentication.

The indicators are:

The KDC then attaches the authentication indicators from the TGT to any service ticket requests that stem from it. The KDC enforces policies such as service access control, maximum ticket lifetime, and maximum renewable age based on the authentication indicators.

If a service or a host has no authentication indicators assigned to it, it will accept tickets authenticated by any mechanism.

Enforce authentication indicators for an Identity Management (IdM) service to require specific pre-authentication methods for access. This ensures that only users who authenticated with stronger methods, such as one-time passwords, can access security-critical services.

Authentication mechanisms in IdM vary in their security strength. For example, obtaining a ticket-granting ticket (TGT) using a one-time password (OTP) combined with a password is more secure than using only a password. By associating authentication indicators with a particular IdM service, you can configure the service so that only users who used specific pre-authentication mechanisms to obtain their initial TGT will be able to access it.

In this way, you can configure different IdM services so that:

Figure 14.1. Example of authenticating using different technologies

This procedure describes creating an IdM service and configuring it to require particular Kerberos authentication indicators from incoming service ticket requests.

host/server.example.com@EXAMPLE.COM
HTTP/server.example.com@EXAMPLE.COM
ldap/server.example.com@EXAMPLE.COM
DNS/server.example.com@EXAMPLE.COM
cifs/server.example.com@EXAMPLE.COM

Adjust the global Kerberos ticket policy in Identity Management (IdM) to set baseline security requirements for all users and services. Global policies help maintain consistent authentication security across your entire environment.

The global ticket policy applies to all service tickets and to users that do not have any per-user ticket policies defined.

While using the ipa krbtpolicy-mod command, specify at least one of the following arguments:

Set different Kerberos ticket lifetimes in Identity Management (IdM) based on authentication method to enforce stronger security policies for weaker authentication. With this, IdM can require more frequent re-authentication for password-only logins while permitting longer sessions for two-factor or smart card authentication.

These global settings apply to all users who do not have individual ticket policies configured. Use the ipa krbtpolicy-mod command to set maximum lifetime and maximum renewable age values for each authentication indicator.

Define custom Kerberos ticket policies for individual users in Identity Management (IdM) to enforce specific security requirements. Per-user policies override global settings and ensure that the maximum ticket lifetime and renewal periods match a user’s specific role or risk level.

Use the ipa krbtpolicy-mod username command, and specify at least one of the following arguments:

Configure per-authentication indicator Kerberos ticket policies for users in Identity Management (IdM) to apply different ticket lifetime and renewal rules based on authentication method.

For example, you can configure a policy to allow the IdM admin user to renew a ticket for two days if it was obtained with OTP authentication, and a week if it was obtained with smart card authentication.

These per-authentication indicator settings will override the user’s default ticket policy, the global default ticket policy, and any global authentication indicator ticket policy.

Use the ipa krbtpolicy-mod username command to set custom maximum lifetime and maximum renewable age values for a user’s Kerberos tickets depending on the authentication indicators attached to them.

Configure different Kerberos ticket lifetime policies for each authentication method in Identity Management (IdM) using the krbtpolicy-mod command. With this, you can set stricter expiration policies for weaker authentication methods and more permissive policies for stronger ones.