Re: Using authentication indicators
Andrew Bartlett via krbdev <[email protected]> Mon, 03 Apr 2023 21:51:24 +1200
| Newsgroups | gmane.comp.encryption.kerberos.devel |
|---|---|
| Message-ID | <[email protected]> |
On Mon, 2023-04-03 at 12:43 +0300, Alexander Bokovoy wrote: > My original goal (not implemented yet) for this was to be able to inject > PKINIT-specific authentication indicators to tickets received over > cross-realm when PAC in the incoming cross-tgt contains indication that > PKINIT was used by domain controller in a trusted AD domain. This would > allow us to bridge smartcard use by AD and a lack of authentication > indicators support by Microsoft -- FreeIPA clients would be able to see > the proper indicator for stronger auth support in pam_sss_gss, for > example. I'm hoping we can somehow use AD claims for some authentication indicator kind of tasks, perhaps with certificate-backed claims to indicate use of PKINIT. It is early days, but that seems to be the space we can put such an indication in within the AD pattern. Andrew Bartlett -- Andrew Bartlett (he/him) https://samba.org/~abartlet/ Samba Team Member (since 2001) https://samba.org Samba Developer, Catalyst IT https://catalyst.net.nz/services/samba _______________________________________________ krbdev mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/krbdev