freeipa

#8319 Support server referrals for enterprise principals
Closed: fixed by abbra. Opened by abbra.

Closed: fixed
Reopen Issue

When S4U2Self is requested by a service from IPA realm utilizing enterprise principal, impersonated user might actually come from a trusted forest. In such case the target service will not receive PAC of the user in the current implementation of FreeIPA KDB driver.

PAC record in the S4U2Self can be used by the service to obtain most up to date information about user's group membership as seen by the client's realm KDC. There are applications which utilize this: Microsoft SQL Server is one of those, but https://github.com/SSSD/sssd/issues/5043 suggests we want it to be supported for SSSD as well.

The purpose of this ticket is to track initial S4U2Self over cross-realm support for enterprise princpials. While there are limits of what could be supported in MIT Kerberos before 1.18, we probably can make the path of 'service in IPA realm, client in AD forest' supported.

Metadata Update from @abbra:
- Issue assigned to abbra
- Issue set to the milestone: FreeIPA 4.8

PR: https://github.com/freeipa/freeipa/pull/4677

master:

  • 0317255b5329e4ff3e1aa4a86b52b60d30f4614b ipa-kdb: add UPN_DNS_INFO PAC structure
  • 23a49538f1d4e5cd01cc867bcfede73f3008aa74 ipa-print-pac: acquire and print PAC record for a user
  • 0f881ca0f2545b9dea9214f796beb478a1662bbb ipa-tests: add a test to make sure MS-PAC is produced by KDC
  • 44a255d423e5c097c5de83b3c0f754ab61c5b96e kdb: add minimal server referrals support for enterprise principals
  • 015ae275981c0b4214d5f1fb86b7f2ee61f63229 ipa-kdb: add asserted identity SIDs
  • 3e20a96c3091f9216cd2bcb1c5853593ed5de88c ipa-kdb: Always allow services to get PAC if needed
  • 3611fc5043fbde808e4307c596d8994c60bc1cc5 ipa-kdb: add primary group to list of groups in MS-PAC
  • ef59cb845254e2bc278d3e3f2705b6b11ba7d04d ipa-kdb: cache local TGS in the driver context
  • b5876f30d4000424cc8122498c411f812b3a0959 ipa-kdb: refactor principal lookup to support S4U2Self correctly
  • 52da0d6a287e3b78fbed033a48e7302715227e1c test_smb: test S4U2Self operation by IPA service
  • 4ff972c23f16f371ca578bfd105a85c3ffdb4f8b azure: do not run test_commands due to failures in low memory cases

ipa-4-8:

  • 4723100791663b8eb6053c6b9f17b8c34e362891 ipa-kdb: add UPN_DNS_INFO PAC structure
  • 1a01e46aa0cd7e3cfd53b380b0ab3975ae1dc524 ipa-print-pac: acquire and print PAC record for a user
  • ca99bf2abc793d77e889c91d2a436c3de96eb36e ipa-tests: add a test to make sure MS-PAC is produced by KDC
  • 1990e3954b3c566a52697e38569ad472a62a7895 kdb: add minimal server referrals support for enterprise principals
  • 110812b43b202c83d4a90d01aab1cf7610b2de41 ipa-kdb: add asserted identity SIDs
  • 741f64f4b5428ccfa8105c61a91de8e0fab37bc3 ipa-kdb: Always allow services to get PAC if needed
  • 6c844c704d4f7ca8837f0d034325a379ec9294af ipa-kdb: add primary group to list of groups in MS-PAC
  • 68a0790b9da12ccb9f3a9f211f6d806ca604a861 ipa-kdb: cache local TGS in the driver context
  • 601151e7c6e99d67723af9e20e80252e71e9c49e ipa-kdb: refactor principal lookup to support S4U2Self correctly
  • eeb70047c9849fcc59686bdd3edd2923ee1be134 test_smb: test S4U2Self operation by IPA service
  • 5f292b2953460a7ae6b7784fd7dfb63d2994a28c azure: do not run test_commands due to failures in low memory cases

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 676774d3fb8a0921afd678d5b0bbe30bcb082420 kdb: handle enterprise principal lookup in AS_REQ
  • 28389fe8af3fb2f36e18864668fb167aa8daca99 Add design page for managing IPA resources as a user from a trusted Active Directory forest
  • ecc0a96d161717960058e22eecad43754de06f11 support using trust-related operations in the server console
  • 973e0c04e460c99f601b0292ff9c64dd0882432e idviews: handle unqualified ID override lookups from Web UI
  • bee4204039dac9cd858e823b839183ba2cdbd216 Support adding user ID overrides as group and role members
  • 306304bb7fb35c88d987e8460aacad6cad0ae888 tests: account for ID overrides as members of groups and roles
  • 0ba64b1ac3fa1709c09b30754138946ddc9c2839 Web UI: allow users from trusted Active Directory forest manage IPA
  • 9248d23ae8e8573b6877851c1d1b31878a7bd1d4 ipatests: test that adding Active Directory user to a role makes it an administrator

ipa-4-8:

  • 6abade3f8daed8dfa024936114209d19319c4f12 kdb: handle enterprise principal lookup in AS_REQ
  • afe9191f99e034bcf52475b57996d81609de6837 support using trust-related operations in the server console
  • 2ffb4fd18fceb509773951ce4f02aa0c5e2f851a idviews: handle unqualified ID override lookups from Web UI
  • 8cce2bb31ab96f6ce6edba95f54575576f2b1a40 Support adding user ID overrides as group and role members
  • 5e8df37e4cca155bf58aa4e61b9fa3f28eddd526 tests: account for ID overrides as members of groups and roles
  • 99e613e478f7925d0f470a04d4de5a2f93385b7a Web UI: allow users from trusted Active Directory forest manage IPA
  • 6b0f8f3617378da41ead8640e194e5b9415a38b1 ipatests: test that adding Active Directory user to a role makes it an administrator
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.