freeipa

#8995 Integrate SID configuration into base IPA installers
Closed: fixed by frenaud. Opened by abbra.

Closed: fixed
Reopen Issue

Introduction

MS-PAC is a specification that defines how Kerberos KDC and clients should handle privilege attribute certificate (PAC) data. PAC record is generated by Active Directory KDCs to allow AD clients to receive most important details about a Kerberos principal they’d need to make decisions on access control or login details for the user.

Windows systems typically do not allow access to their services when PAC is not present in the Kerberos ticket presented to the server application. There are few cases where a lack of a PAC is considered to be anonymous access.

FreeIPA by default does not issue PAC in the Kerberos tickets. Content of PAC is built around Active Directory security concepts which are based on being able to address every resource and object through use of Security Identifiers (SIDs). Linux environments do not have SIDs associated with each user or group. SIDs are used extensively in SMB protocol and Active Directory-related activities. At the same time, use of PAC structure improves caching capabilities and allows to communicate more efficiently and securely a large set of user-specific details to identity clients.

When FreeIPA is configured to establish forest trust to Active Directory, it starts to associate SIDs with IPA users and groups. This information is used by IPA KDC to create the PAC record in Kerberos tickets for IPA users. When users from trusted AD domains are used to request service tickets to services in IPA domain, PAC records from their cross-realm tickets validated and re-issued, including local IPA group membership information and filtering unwanted SIDs.

In Active Directory a trust between domains requires the presence of a PAC in the cross-realm referral. This can be inferred from MS-KILE section 3.3.5.7.2 "TGT without a PAC" as cross-realm krbtgt principal does not have AuthenticationDataNotRequired field set. Since IPA-IPA trust support would be built on top of existing trust to Active Directory support, trusted IPA domains must have PAC generated and required by both sides.

Requested changes

Currently the configuration to enable IPA KDC to issue PAC records is only added when ipa-adtrust-install is run. We want to move this part of the configuration to the normal installers (ipa-server-install, ipa-replica-install) and make it possible to issue PACs in IPA environment by default. This way when IPA-IPA trust is added, we would be able to rely on PAC structure in trusted users' tickets similar to trust to Active Directory.

Metadata Update from @abbra:
- Issue assigned to frenaud

master:

  • bacddb8288a284385e2864127a451b79c3469c93 Design: Integrate SID configuration into base IPA installers

master:

  • f9e95ce51e586232497c1d4a9a4a2967a0105f9d SID generation: define SIDInstallInterface
  • 5541b9d69fdba0df86277756b6ef835b2748d20a Installers: configure sid generation in server/replica installer
  • b0545326580fa31df6896c29ab2741277b2c775b adtrust install: define constants for rid bases
  • ed001c97eec092d814ff9ecc57fafffe2d03657e ipa config: add --enable-sid option
  • 8dc064c2e3011b78f76659e60f47185edca0d64e ipatests: add test ensuring SIDs are generated for new installs
  • 2d468fa49f1d5b99cc27004c417cbc47602cf719 ipatests: interactive install prompts for netbios name
  • fdfde9ce52e87309acdd1ad394dc79c0ee3b901f ipatests: adapt expected output with SID
  • fd53ed14b0e43c6d3020ed54907011cbacb6716f User lifecycle: ignore SID when moving from preserved to staged
  • c99b8bb4abbbfc9611185adc1b1168cce2c79cf3 ipatests: backup-reinstall-restore needs to clear sssd cache
  • 02b4241e19967e4b27fc0bf73ad38a1f4ac87497 Webui tests: new idrange now requires base RID
  • bede62bf199544dc91cc33e74adccb2b0166ef60 User plugin: do not return the SID on user creation
  • cc8a0bc24c50abfb609bc3767b4a550e1f72e1f6 ipatests: update the expected output of user-add cmd

ipa-4-9:

  • dd07db29eec92b421569a194a1d2294852cd6a5c SID generation: define SIDInstallInterface
  • e527857d000e558b3288a7a210400abaf2171237 Installers: configure sid generation in server/replica installer
  • a91e6712e80a19070cb9f201b2d2f15ac8b28ff4 adtrust install: define constants for rid bases
  • b98ecabba196107c692825e081fd1c7a6123c2aa ipa config: add --enable-sid option
  • 5bb56f910c39b3db762b6802a6dfaa25a0e77c76 ipatests: add test ensuring SIDs are generated for new installs
  • 31d095eac1aa7158761de29aa4f3c42604e83f17 ipatests: interactive install prompts for netbios name
  • efc9df086725a151e15fc93b7550bc01df8d1151 ipatests: adapt expected output with SID
  • 86d1683e0966a5d33e570b9cc2bb032e9af98bf0 User lifecycle: ignore SID when moving from preserved to staged
  • c6fd0d00bacf56f1c3bffb2674042058a4608f10 ipatests: backup-reinstall-restore needs to clear sssd cache
  • 9c7e8c669740528812a06f9af73fe927313270c9 Webui tests: new idrange now requires base RID
  • 61f42aefe35d60432d5542ed5fa3f546e6d71f0b User plugin: do not return the SID on user creation
  • 009a8cdfcba78ab6153e132ef653792018e1662b ipatests: update the expected output of user-add cmd

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 2e7396b0e2869e1c5025903cf752e7d90e163a0a ipatests: fix get_user_result method

ipa-4-9:

  • 421e12468d3ebaf8e259789bdba173a785c9e5d4 ipatests: fix get_user_result method

Metadata Update from @frenaud:
- Custom field changelog adjusted to New installations of IPA now configure the server to generate SIDs by default. Previously, this setup was executed as part the the ipa-adtrust-install command.

Metadata Update from @frenaud:
- Custom field changelog adjusted to New installations of IPA now configure the server to generate SIDs by default. Previously, this setup was executed as part of the ipa-adtrust-install command. (was: New installations of IPA now configure the server to generate SIDs by default. Previously, this setup was executed as part the the ipa-adtrust-install command.)

Metadata Update from @abbra:
- Issue tagged with: rfe
Metadata

rfe

None
None
None
New installations of IPA now configure the server to generate SIDs by default. Previously, this setup was executed as part of the ipa-adtrust-install command.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.