Re: Setting up PK-INIT

13 okt 2011 kl. 11:10 skrev Ali Gholami:

> Thanks Henry and Love for your replies. 
> 
> However the documentation is elaborated with a great amount of details but generally speaking, for a basic user might not be of much help. For instance, 
> as Henry suggests, I installed a password-based Kerberos initially and came to the point to enable the PK-INIT but the document does not deal or express concrete examples to explain how PK-INIT concepts and terms should be accustomed for a standard scenario. The following section and sub-sections are ambiguous for me at least: 
> 
> 4.19 :
> Paragraph 2, line 2: "You should first read the whole chapter of the document to see the requirements imposed on the CA software." It does not specify which chapter should be read first.  

The current one.

> 4.20:
> "This section documents the requirements on the KDC and client certificates and the format used in the id-pkinit-san OtherName extention." Is "id-pkinit-san OtherName" mentioned somewhere else earlier? If yes, a reference could be good to have.

Its documented in the following sub sections. If the language in unclear, please proposal alternative.


> 4.20.1 
> 
> In this section an example certificate which address the requirements can be helpful so a user knows what the "EKU"

The text reads "Extended Key Usage (EKU)", I don't know how to make that clearer, do you ?

> or "id-pkkdcekuoid" "subjectAltName otherName"

You need to know some PKIX to understand this.

> "OID id-pkinit-san (1.3.6.1.5.2.2)" "DER encoded KRB5PrincipalName" are. In addition, it's not clear how to create or get such a certificate.

How about reading the section "@section Use OpenSSL to create certificates"

> As a user, I dont know whether I can use a x509 host certificate issued by a CA from a community (i.e. NorduGrid: http://ca.nordugrid.org/) which I have already or I must use a Heimdal specific certificate. 

It depend on how you configure the KDC.

> 4.23
> 
> This section doesn't clarify what the "trust-anchors.pem" is and how to get it. If it's mentioned somewhere else it would be very helpful to have a reference. 
> 
>   [appdefaults]
>     	pkinit_anchors = FILE:/path/to/trust-anchors.pem

Google for "PEM file format", its you commonly store certificates and private key in text format..

> 4.24 
> 
> This section contains could contain some comments about the parameters.

This page have more information since I have updated with more text based on your previous feedback, http://www.h5l.org/manual/HEAD/info/heimdal/Setting-up-PK_002dINIT.html#Setting-up-PK_002dINIT

> Which ones are mandatory or optional and where to set these values

Added

> . I guess, the author means "kdc.conf" but I think [kdc] has conflict with [kdcdefaults] which is a legacy password-based Kerberos set up option.    

Its [kdc] that you adde them in, and its a configuration file the kdc reads, it reads both kdc.conf and krb5.conf on the kdc.

> 4.24.2 Using the Kerberos database
> 
> This subsection is empty and simply discourages the user to implement this option. 

It was written before the code exists.

@subsection Using the Kerberos database

You can also store the subject of the certificate in the principal
entry in the kerberos database.

@example
kadmin modify --pkinit-acl="CN=baz,DC=test,DC=h5l,DC=se" user@@REALM
@end example




> 4.26 
> This section also doesn't clarify what the test-cases exactly are. How they are supposed to be compiled and run. Nevertheless, some typos makes it difficult to understand the purpose of test-cases, for instance in: "The certicates it creates are used to test the PK-INIT functionality in tests/kdc/check-kdc.in."

Please propose alternative.

> Moreover, writing few lines about compiling and running the test cases could be helpful.

type "make check" in the top level directory.

Thanks for the feedback, I've update the documentation to more clear.

Love




> 
> 
> 
> Best regards
> Ali
> 
> 
> 
> ________________________________________
> From: Henry B. Hotz [[email protected]]
> Sent: Thursday, October 13, 2011 9:26 AM
> To: [email protected] discuss; Ali Gholami
> Subject: Re: Setting up PK-INIT
> 
> For starters, do you have a working password-based Kerberos set up?  Since you said you were a beginner, I'd start with the basics.
> 
> Be glad to answer questions if you can be more specific.
> 
> On Oct 12, 2011, at 6:27 AM, Love Hörnquist Åstrand wrote:
> 
>> 
>> 12 okt 2011 kl. 14:00 skrev Ali Gholami:
>> 
>>> Deat All,
>>> 
>>> I would like to set up a KDC enabaled PK-INIT but as a Heimdal begginer user I couldn't get much help from the documentation. Do anyone have a successful scenario with this feature of Hemidal who can share?
>> 
>> What part of http://www.h5l.org/manual/heimdal-1-5-branch/info/heimdal/Setting-up-PK_002dINIT.html#Setting-up-PK_002dINIT do you dont lacking ?
>> 
>> Put differently, if you tell us what problem you are running into, you might get answers that will more be to your liking, and you can help us improve the documentation.
>> 
>> Test cases in tests/kdc/check-kdc.in uses pkinit everytime "make check" is ran, that will partly explain how it setup.
>> 
>> Love
> 
> ------------------------------------------------------
> The opinions expressed in this message are mine,
> not those of Caltech, JPL, NASA, or the US Government.
> [email protected], or [email protected]
> 
> 
>