freeipa

#9646 Authenticate users with yubikeys without importing the certificate in IPA does not work.
Closed: invalid by abbra. Opened by whidix.

Closed: invalid
Reopen Issue

Issue

Hello,

I'm trying to allow authentication using Yubikeys on clients without importing user's certificates in idM.

I use an external PKI that signs everything, so I have the root CA and one sub CA named piv that signs users' csr (that are stored in yubikeys).

On the server, the output of ipa-advise config-server-for-smart-card-auth is executed and the output of ipa-advise config-client-for-smart-card-auth is also executed on the client.

I added both the certificate mapping rule and the certificate mapping data (Issuer and subject) according to red hat documentation.

Steps to Reproduce

In an internet forbidden environment, using at least three VMs on RHEL9. One for IPA, one as a workstation and one that will be the DHCP, DNS and NTP server.

Once the DNS and DHCP are configured, I generated a root CA and two sub CAs, one for signing users csr (piv) and one for signing everything else (like ipa).

Once ipa is installed with an external ca, I executed the output of ipa-advise config-server-for-smart-card-auth to load and configure ipa for smartcard.

Then I added the Certificate Identity Mapping Rule:
Mapping rule: (ipacertmapdata=X509:<I>{issuer_dn!nss_x500}{subject_dn!nss_x500})
Matching rule: CN=piv,C=FR

Once the client is registered in ipa, I executed the output of ipa-advise config-client-for-smart-card-auth to load and configure the client for smartcard.

Then, I registered a new user, with pkinit enable and I created a Certificate mapping data for him with the good Subject and the same Issuer as the Certificate Identity Mapping Rule.

Finally, I set up the yubikey for the corresponding user using the PKI and signed his certificate with the piv CA.

Actual behavior

If the user certificate is not present in ipa, I'm prompted to enter the PIN CODE (the Yubikey is recognized and the user is automatically selected), but then I have the error "Sorry, smart card authentication didn't work, please try again".

On ipa server, if I use the command ipa certmap-match , no users are found. Furthermore, in sssd I can see that the server is trying to find a user with the certificate stored on the yubikey instead of trying to check if the certificate is valid and signed by the piv sub CA.

Expected behavior

I would expect to be logged in.

Version/Release/Distribution

ipa-server-4.10.1-9.el9_2.x86_64
ipa-client-4.10.1-9.el9_2.x86_64
389-ds-base-2.2.4-5.el9_2.x86_64
krb5-server-1.20.1-9.el9_2.x86_64
sssd-2.8.2-3.el9_2.x86_64

Additional info:

I can provide more logs if necessary but don't know which ones you could want.

This does not look as a bug at all, rather an operational issue with your configuration. We do not use an issue tracker for this purpose. Please post your problem to freeipa-users@ mailing list, along with debug information from SSSD side. See https://sssd.io/troubleshooting/basics.html for details on SSSD troubleshooting.

Metadata Update from @abbra:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.