freeipa

#9354 Implement resource-based constrained delegation
Closed: fixed by frenaud. Opened by abbra.

Closed: fixed
Reopen Issue

RBCD is needed due to Microsoft shutting down cross-forest constrained delegation.

MIT Kerberos added RBCD support on the client side in krb5 1.18.2+, on KDB side in 1.19.2+.

master:

  • 68c113f02b789d5478375adb9927c52fdf1ad2dd Ignore empty modification error in case cifs/.. principal already added
  • 9b777390fbb6d4c683bf7d3e5f74d5443209b1d5 test_xmlrpc: adopt to automember plugin message changes in 389-ds
  • adc9609ff32c680b07ecfaa4c88d71898d7829c9 ipa-kdb: search S4U2Proxy ACLs in cn=s4u2proxy,cn=etc,$BASEDN subtree only
  • b035ac8eb948d850bd8883f215b91bbc337d2ec9 doc: add design document for Kerberos constrained delegation
  • 4239b77a6db24a3492f2e8ee4d2aea9a7e676272 IPA API changes to support RBCD
  • f78dc0b16332279c16e0b35fbb71f872746b875c kdb: implement RBCD handling in KDB driver
  • dd5b189a0935586be30b1766b1db2881a3f3f765 RBCD: add basic test for RBCD handling
  • 667b82a87008884ac3c0f30e3ccd5912f92bc8cb doc/designs/rbcd.md: add usage examples
  • 0bf0b2d251c96c7488f82cb8fa77052666068217 doc/designs/rbcd.md: document use of S-1-18-* SIDs

ipa-4-10:

  • e7506403a988b98cc3381d2d986b53aee48448cb Ignore empty modification error in case cifs/.. principal already added
  • 52e6da9056697e2210736d5528826ae424fec9b1 test_xmlrpc: adopt to automember plugin message changes in 389-ds
  • 7a7ba45c10a6da4f9e110f6cc57cfc47e0a16a16 ipa-kdb: search S4U2Proxy ACLs in cn=s4u2proxy,cn=etc,$BASEDN subtree only
  • 18cd909b4ad854147008a1010c97c75640a54177 doc: add design document for Kerberos constrained delegation
  • 5b6ad0e65600a96bb4d6f3b1acf4e16773a03493 IPA API changes to support RBCD
  • 7ac6adfaac30473b14b589a71fac42fe147bc0d9 kdb: implement RBCD handling in KDB driver
  • 7d68f4f08361760adab90ad4b44c6da2c4ea664d RBCD: add basic test for RBCD handling
  • b63e6a257006e846ef5d0a008d9c3c0f935c09bb doc/designs/rbcd.md: add usage examples
  • cb18ca31697320a58ae23a67afbfe7a0ff9a55a5 doc/designs/rbcd.md: document use of S-1-18-* SIDs

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to FreeIPA provides initial implementation of resource-based constrained delegation (RBCD) for Kerberos services. RBCD and other Kerberos delegation services described in the design document: https://freeipa.readthedocs.io/en/latest/designs/rbcd.html. The initial implementation works for FreeIPA services, work on supporting cross-realm RBCD continues.

master:

  • f123b01d81696c52e9a4008d46e549864e4a8069 updates: add ACIs for RBCD self-management

ipa-4-11:

  • fc9b527dee2652c8056eb99080d9a050a7e648ff updates: add ACIs for RBCD self-management

ipa-4-10:

  • eea9bd0543810cd989597a9f449d8e4e9f6e9504 updates: add ACIs for RBCD self-management
Metadata
None
None
None
None
FreeIPA provides initial implementation of resource-based constrained delegation (RBCD) for Kerberos services. RBCD and other Kerberos delegation services described in the design document: https://freeipa.readthedocs.io/en/latest/designs/rbcd.html. The initial implementation works for FreeIPA services, work on supporting cross-realm RBCD continues.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.