freeipa

#8215 KDC policy: add per-service ticket lifetime enforcement in TGS-REP
Opened by abbra. Modified

Open
Close Issue

With KDC policy checks for AS and TGS requests, it is possible to extend KDC policy to enforce lifetime of a generated service ticket to be shorter than the TGT lifetime.

This is currently not implemented in FreeIPA. Ticket policies currently only applied to user principals and only at the point they obtain their ticket granting tickets.

For own FreeIPA services it might make sense to add a policy that reduces effective lifetime of service tickets towards them according to a configuration defined by the administrators.

It is probably best be achieved by limiting via association of a Kerberos ticket policy with a group and making services a part of the group.

I'm open for the actual implementation design. My current proposal below reflects my current ideas. Following steps need to be done:

  • create group policies for Kerberos tickets that apply the same policy settings to all members of a group (user principals or services),
  • for a group policy, allow to specify whether it applies to a service ticket or to the ticket granting ticket;
  • in KDB driver, add ability to load ticket group policies, like password group policies already handled;
  • in KDB driver, split ticket story ticket policies associated with AS or TGS requests; current policies would all be AS type policies;
  • in KDB driver, add new enforcement logic in ipa_kdcpolicy_check_tgs() (currently does nothing), if a server principal has associated TGS type ticket policy

This is a good summary. If/when we add this capability, it's important to keep in mind that a user/process with a valid TGT can simply request another service ticket when their current one expires and it will be granted. So we need to be clear with what we're trying to achieve.

One of cases to handle is mod_auth_gssapi's use of tickets inside its session cookie. The cookie is valid until the end of the ticket's lifetime, so we need to have a way to limit that. With this capability the limiting of the ticket will make cookie useless once the ticket expires. Setting it down to 30 minutes would be an improvement to a cookie that is valid for 24 hours.

To note that the point here is that these tickets are used for proxying, so by limiting their lifetime we limit the amount of time these are valid to access resources by the proxy. In the FreeIPA case it may be nice to tie a different lifetime based on the fact the ticket is obtained via impersonation rather than via a full blown TGT.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.