Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

Debug is human, de-fix divine.


devel / comp.protocols.kerberos / Stateless PKINIT?

SubjectAuthor
o Stateless PKINIT?Yoann Gini

1
Stateless PKINIT?

<mailman.53.1710357044.2322.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=505&group=comp.protocols.kerberos#505

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!news.quux.org!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: yoann.g...@gmail.com (Yoann Gini)
Newsgroups: comp.protocols.kerberos
Subject: Stateless PKINIT?
Date: Wed, 13 Mar 2024 20:10:22 +0100
Organization: TNet Consulting
Lines: 18
Message-ID: <mailman.53.1710357044.2322.kerberos@mit.edu>
References: <8D20D248-822B-47F1-ABAA-9C46B4E99F2F@gmail.com>
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.500.171.1.1\))
Content-Type: text/plain;
charset=utf-8
Content-Transfer-Encoding: 8bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="9234"; mail-complaints-to="newsmaster@tnetconsulting.net"
To: kerberos@mit.edu
DKIM-Filter: OpenDKIM Filter v2.11.0 unknown-host (unknown-jobid)
Authentication-Results: mailman.mit.edu;
dkim=pass (1024-bit key, unprotected) header.d=mitprod.onmicrosoft.com
header.i=@mitprod.onmicrosoft.com header.a=rsa-sha256
header.s=selector2-mitprod-onmicrosoft-com header.b=m+hE0maq;
dkim=pass (2048-bit key,
unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256
header.s=20230601 header.b=H94jgyCQ
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=DjTGt4Z273ydwdLaqhx6XMR2ag0b5yMDezEyL1Yy1ItwJ0OBgXOpXh+VivvHwbZFb7qStpIs7i1ZjBVdM8pqgo5UF4Ts1/PFMnYAHX+rsJ4/IvvpLnj7uEEsVeo9sMYfzhe3V2e12MzmCkb1go/7I33hjBRHfPipPYphpXsF7hoEm1gOw0dmkhPMz0G5oca6uHi2aTyMOxIHxHAELtdv1c1vUuwBQBtdHeG+JwxHrE4uCZXif35sCzt5r5sD1wKkMatxGNptpJZ+ghil2T/UD2KWOa+iMaJyhqdABJWfIc1Y7Wg+ThBRKnqHttmoWsJr4lZQYxpv8AoXcl+dv78w1A==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=TUlCqXxY1Fvm+fVFmvgH16hIwxSOxI6Ay2tdcqopLM8=;
b=gC+urZaXFyjJLmXPg+8frXud159xFJGmMrTmpMLY/wnWu6QLAKY0x4ojgrR4y3oiYNyzFowHlTtlAhdfdsa+AvdlL9zW53Em9ihbbUDnlr5Q6iriIvDW4e5uP5p46+3jCCMm+ZCEWPH7Q5hqGebIFCsM6+z4CflITroGbkOI44fXaYu5TIziy4bvTILN652lIHwnxFBb6e39q6utl0jDocFO9Wpg6WiibXcgdt2MB2HslwqCC4XPM6dLWjabZOX6E65xxkrcJ7rJIU0dZarrbkAkGTzDYHLn62wjIayw7nMBo2hGWFzMMgpqqur9Fa82+Ed4XIwcMCHUB49zjKCFoQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
209.85.128.46) smtp.rcpttodomain=mit.edu smtp.mailfrom=gmail.com; dmarc=pass
(p=none sp=quarantine pct=100) action=none header.from=gmail.com; dkim=pass
(signature was verified) header.d=gmail.com; arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=TUlCqXxY1Fvm+fVFmvgH16hIwxSOxI6Ay2tdcqopLM8=;
b=m+hE0maqJNtwhELqL11BBwZ1RMrc3p6mwZBi1X+8bX+kR5n5s4sWvFzfEZdenWZ9JP3EljTWP8r9YPnhULpYdHrKBL7KHiXYuqkMaTH3w31Er28PTLJ1QZKmLa2rkSq8WLNAz5pGP2MBljQFRBH9KKNhqBY/AH8lgkEvFrcsdVU=
Authentication-Results: spf=pass (sender IP is 209.85.128.46)
smtp.mailfrom=gmail.com; dkim=pass (signature was verified)
header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;
Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates
209.85.128.46 as permitted sender) receiver=protection.outlook.com;
client-ip=209.85.128.46; helo=mail-wm1-f46.google.com; pr=C
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1710357034; x=1710961834; darn=mit.edu;
h=to:date:message-id:subject:mime-version:content-transfer-encoding
:from:from:to:cc:subject:date:message-id:reply-to;
bh=TUlCqXxY1Fvm+fVFmvgH16hIwxSOxI6Ay2tdcqopLM8=;
b=H94jgyCQ8IJs5Gw6Xfk1vB1zlD8CWeFK8aIDmpp+WilZMgJs7Y2Ag5sUMUjRN73Hks
rYoa/2h/cj9YRFHgoW4NYBcDkL7mMX21mVPmk2eUwYfNt3tAyFF02xO/ATEDj+17cDg1
t2mZz8B+W6CuIbkDefTZgEilkRcD9C3VrpbBASHZM8TAvWIt82DWVKA0iwhItQARF0V1
gbkylio6njIgjlRZRj3QAUSXkw5hMOpR1a1MjPGDdftYhXWZ2YbuPeB85/ljGpOchLiK
fxoA1H6Vb9mY3OtTGmW/kS18Lc3pIGqXeDN9J/+wwl3uKegEqUdRXEW8oG2LmuOxEWeF
zG6Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1710357034; x=1710961834;
h=to:date:message-id:subject:mime-version:content-transfer-encoding
:from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=TUlCqXxY1Fvm+fVFmvgH16hIwxSOxI6Ay2tdcqopLM8=;
b=TFsdMT0hKVzCsUfS5dCRvAsNjBxj0hgk4nmWC4JLdt7zCCQplQ5EVREYvXgjxFrnkz
R8RMF6ixg43/1gujRZvnikjWiYLmwcnuALWJuO5WW/tn2rlEiXhaVxquCmXCGTwDVm2C
YcYhE4sR5d2thjxN7ywe1RPSETusDcnl5JJd++gXfSYwebXfxEUk5Ofp5tAFTmPe6UBD
9jEo7BgN8N/n+jl4zFXyi1I6A9W5H/eqQ9gj+KKUC7+uPQ2P0Lpg7l/Q5ANYEItQdveT
71PQVUTqSoXAWaUuT/IaTwZ9k1T/zx5IFj3AUx2yGUSoTtviFpqD42ZPwEEaz92W7VJC
hkzA==
X-Gm-Message-State: AOJu0YywCGxNTGxxTwwQIvhZXLqZ+WDBuHO/FWcGMOHEfWswGO4Wi6V2
ADegYdT/74ugr0rnNMZjgV1EbPYoHF63O6luEFyhnPt0HYQqzyR83LQ4eJ1eKts=
X-Google-Smtp-Source: AGHT+IEHcgXJbhYSBVQX76QKej5IcuUUT96nkL4FeUTRn7JNUBqcrGdmjP9GZozKD78FB9e8CCNvkw==
X-Received: by 2002:a05:600c:4507:b0:413:812:ce7b with SMTP id
t7-20020a05600c450700b004130812ce7bmr613540wmo.24.1710357033874;
Wed, 13 Mar 2024 12:10:33 -0700 (PDT)
X-Mailer: Apple Mail (2.3774.500.171.1.1)
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: BL02EPF0001A0FF:EE_|DS0PR01MB7962:EE_
X-MS-Office365-Filtering-Correlation-Id: 4a560fb9-276e-412c-5cd0-08dc439142d6
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: eg4Kfti0GSg0BslYNgGOSWS6gFINuNBRXLdaCFKdXwyvepYcZ/8tsRZ6Kqtlbe8pj/TyFVRbxv2bSSy7OqsNJQAV7coAhBfxL7D6fWxsZUsoss9RwubfEBklY6zVrGQJplNf6/lMeD3vF6x7QKG2HuTmr137N46VygyMG3bv1+vGYvSSrMm6AawAGFhDLSAlMkHX6cuaQYwFcLmV7/mxpr6doXZ91yFE07oPMRKoCUA6SKG8AhwGJVFLgqlHb6F0IfosTh6MPuLws8e4oPnq3g6o2jUyk1cOb1cg8w13X6arZCdOQ/fjp0ShZ57AkOymUcIpLsdFXiv9NCpa2z4IMMZn3TmoQRZ4M6Dahp3gz/g2FHNKv2arpMpz1uph8Bquae4WXBUaITasikzd4DxUuUwGTLY0+Pci9hV2PB3UPqsF8LWuDafztC+rAKoFhCq3OFTT2U3k5FBslgi50aspvJEqE0PkGgLLi+ZQelYFXxGfBisx5zD32bJkIxLpIfptb29kG2qW/Lcdp82Qu7JSll6s3PqMAeiBUVm1QWznb5FF83njyxz/XZBHdJP9T3sUCs2LInU3Q+o2qV4sNJOEIVqJJ7pHeF5OawDMYVFZNFzFY1TvvKCzMCxwQPXtefS8ZIQrsy4yd7bUD+bvuKW6u+0dcTVYqoLzWuTr5egUK2mtvh/q4wX7NI2C2muTw0uZuG5r4lboEnJT3E+3vmFWN0AZaBTRKyrCEcLwYttlcDOCUmkPFRDHc3rWN42RUMPf
X-Forefront-Antispam-Report: CIP:209.85.128.46; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:mail-wm1-f46.google.com; PTR:mail-wm1-f46.google.com;
CAT:NONE; SFS:(13230031)(61400799018)(376005); DIR:OUT; SFP:1102;
X-ExternalRecipientOutboundConnectors: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-OriginatorOrg: mitprod.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Mar 2024 19:10:35.0431 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 4a560fb9-276e-412c-5cd0-08dc439142d6
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: BL02EPF0001A0FF.namprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR01MB7962
X-MIME-Autoconverted: from quoted-printable to 8bit by mailman.mit.edu id
42DJAhvv1495789
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <8D20D248-822B-47F1-ABAA-9C46B4E99F2F@gmail.com>
 by: Yoann Gini - Wed, 13 Mar 2024 19:10 UTC

Hello,

I'm trying to achieve a deployment of Kerberos and PKINIT as some sort of authentication proxy. I'm working for an IDP startup.

Is there a way when using PKINIT to not need any internal list of principals but to rely on the validity of the certificate to proxy the certificate identity into the Kerberos ticket?

Here is the schema:
— the PKI issue a certificate for someone and maintain a CRL
— the IDP require SP NEGO for some route
— the KDC need to issue the needed TGT then TGS based on the identity in the certificate if CRL is OK
— IDP will then check information collected during SP NEGO to get the identity of the user and continue its work

In that context, the Kerberos realm is used only as some kind of protocolar authentication proxy that just need to convert an authenticated identity coming from a certificate intro a Kerberos ticket.

Is there a way to configure a KDC to behave like that?

Best regards
Yoann

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor