freeipa

#9371 Tolerate absence of PAC ticket signature depending of domain and servers capabilities
Closed: fixed by frenaud. Opened by jrische.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 9): Bug 2182683

We are working on backporting the upstream implementation[1] of PAC extended KDC signature to RHEL9/8 and Fedora Rawhide/38/37. The function that is being used to generate this signature is also meant to generate the PAC ticket signature. This implementation also require the PAC ticket signature to be present in constrained delegation requests for the PAC to be accepted.
However, the signature generation function cannot be used by prior to 1.20 versions of krb5 because of API limitations. This is why we are backporting a slightly modified version of the extended PAC signature support. It allows generating the PAC extended KDC signature without the ticket signature, and tolerate the absence of the ticket signature.
When the version of krb5 is 1.20 or newer, this is not a problem. However, in case of gradual upgrade environments (including both 1.20+ and 1.19- servers), 1.20 servers will reject a PAC generated by a 1.19- server, because it does not contain any ticket signature.
In order to keep supporting constrained delegation in this kind of setup, we are adding support for a "optional_pac_full_chksum" string attribute for KDB entries. It will allow to tolerate the absence of PAC ticket signature for a certain realm.
IPA should be able to set this attribute according to the state of the domain:
  * Set "optional_pac_full_chksum" to "true" if RHEL8 or RHEL9.1- or Fedora 36/37 servers are present
  * Set "optional_pac_full_chksum" to "false" (or unset) if all servers are RHEL9.2+ or Fedora 38+
[1] https://github.com/krb5/krb5/pull/1284

Metadata Update from @jrische:
- Issue assigned to jrische

Metadata Update from @jrische:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=2182683

Issue linked to bug 2182683

master:

  • 9cd5f49c74f28dbe070b072b394747a039cef463 kdb: Use krb5_pac_full_sign_compat() when available
  • 3f1b373cb2028416e40a26e3dd99b0f4c82525c7 Tolerate absence of PAC ticket signature depending of server capabilities
  • 545a363dd2f7f551fa3ec3fed66c80b30ae3c1e1 Filter out constrained delegation ACL from KDB entry

ipa-4-10:

  • 630cda5c06428825dd5604493621b9cbdab70073 kdb: Use krb5_pac_full_sign_compat() when available
  • bbe545ff9feb972e549c743025e4a26b14ef8f89 Tolerate absence of PAC ticket signature depending of server capabilities
  • 7ea3b86696f5451f1d227d365018ab7dc53024af Filter out constrained delegation ACL from KDB entry

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • e00f457f755e78d384beb8cc7ac312e9741b56af ipa-kdb: hint KDC to use aes256-sha1 for forest trust TGT
  • 4ef8258d58046ee905c929c0e889653a8b86d383 ipa-kdb: protect against context corruption
  • 03897d8a6899691b7218428b296f6d22ccadcfb2 ipa-kdb: postpone ticket checksum configuration
  • d551e853fc4e213cf384bc983d0e76d8568ee954 ipa-kdb: process out of realm server lookup during S4U
  • 9cdf010ca6c8b03d9f7cc338e8253219e0e877b0 ipa-kdb: skip verification of PAC full checksum
  • 18bf495ce88fbb032f23f7db7f941458ecf55c7a ipalib/x509.py: Add signature_algorithm_parameters

ipa-4-10:

  • 3d0decd9efc4883328e95f9ff89002aec32462ec ipa-kdb: hint KDC to use aes256-sha1 for forest trust TGT
  • 803a44777f901217d634f8fd7feed8b66ece352a ipa-kdb: protect against context corruption
  • fefa0248296413b6ee5ad2543d8feb1b31840aee ipa-kdb: postpone ticket checksum configuration
  • bd8fcd6f5bc62a4bfc544b69c0d960291be05d37 ipa-kdb: process out of realm server lookup during S4U
  • 1b55e9b1cb4f192635878b0b7242104d58a37d2b ipa-kdb: skip verification of PAC full checksum
  • 11ce2b2133364916de06f4c42d8a19ce438bd41c ipalib/x509.py: Add signature_algorithm_parameters

master:

  • 3a706e86200dd3ab9d317fb6f71ba80d3ae2f642 ipa-kdb: be compatible with krb5 1.19 when checking for server referral
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.