RE: Setting up PK-INIT

Hi Henry,

Hope you feel well now! The content of my user certificate is:

-------------------------
 hxtool print --content file:usercert.pem 
cert: 0
    friendly name: CN=Ali Gholami,OU=pdc.kth.se,O=NorduGrid,O=Grid
    private key: no
    issuer:  "CN=NorduGrid Certification Authority,O=NorduGrid,O=Grid"
    subject: "CN=Ali Gholami,OU=pdc.kth.se,O=NorduGrid,O=Grid"
    serial: 148A
keyEncipherment, nonRepudiation, digitalSignature
    keyusage: subject name: CN=Ali Gholami,OU=pdc.kth.se,O=NorduGrid,O=Grid
issuer name: CN=NorduGrid Certification Authority,O=NorduGrid,O=Grid
Validity:
	notBefore 2011-05-19 15:20:25
	notAfter  2012-05-18 15:20:25
checking extention: basicConstraints
	is NOT a CA
don't know what 2.16.840.1.113730.1.1 is
checking extention: keyUsage
	Critical not set on SHOULD
checking extention: Netscape cert comment
checking extention: subjectKeyIdentifier
	subject key id: 24313E34ED6D576DDFD290849A35144FC9AB9AC2
checking extention: authorityKeyIdentifier
	authority key id: 1805C0FC0BD1B73AF4659209FB59A15FC788C4F0
checking extention: subjectAltName
rfc822Name: [email protected]

Not a CA nor PROXY and doesn't haveCRL Dist Point
-------------------------

I don't think I should set up my KDC according to this certificate since there will be useres with different x509 certificates from different CAs.


Best regards
Ali


________________________________________
From: Henry B. Hotz [[email protected]]
Sent: Friday, October 14, 2011 9:47 PM
To: Ali Gholami
Cc: [email protected] discuss
Subject: Re: Setting up PK-INIT

Sorry, I'm not being prompt in responding.  (Home sick most of this week.)

Can you tell us anything about the PKI you're using?  For example, can you give us a dump of one of the client certificates you're trying to use?

openssl x509 -in <cert file> -noout -text

You might need an "-inform der" argument if the file is binary instead of text.

Alternatively, there's

hxtool print --content file:<cert file>

which might be more specifically useful.

On Oct 13, 2011, at 2:10 AM, Ali Gholami wrote:

> Thanks Henry and Love for your replies.
>
> However the documentation is elaborated with a great amount of details but generally speaking, for a basic user might not be of much help. For instance,
> as Henry suggests, I installed a password-based Kerberos initially and came to the point to enable the PK-INIT but the document does not deal or express concrete examples to explain how PK-INIT concepts and terms should be accustomed for a standard scenario. The following section and sub-sections are ambiguous for me at least:
>
> 4.19 :
> Paragraph 2, line 2: "You should first read the whole chapter of the document to see the requirements imposed on the CA software." It does not specify which chapter should be read first.
>
> 4.20:
> "This section documents the requirements on the KDC and client certificates and the format used in the id-pkinit-san OtherName extention." Is "id-pkinit-san OtherName" mentioned somewhere else earlier? If yes, a reference could be good to have.
>
> 4.20.1
>
> In this section an example certificate which address the requirements can be helpful so a user knows what the "EKU" or "id-pkkdcekuoid" "subjectAltName otherName" "OID id-pkinit-san (1.3.6.1.5.2.2)" "DER encoded KRB5PrincipalName" are. In addition, it's not clear how to create or get such a certificate. As a user, I dont know whether I can use a x509 host certificate issued by a CA from a community (i.e. NorduGrid: http://ca.nordugrid.org/) which I have already or I must use a Heimdal specific certificate.
>
> 4.23
>
> This section doesn't clarify what the "trust-anchors.pem" is and how to get it. If it's mentioned somewhere else it would be very helpful to have a reference.
>
>   [appdefaults]
>       pkinit_anchors = FILE:/path/to/trust-anchors.pem
>
> 4.24
>
> This section contains could contain some comments about the parameters. Which ones are mandatory or optional and where to set these values. I guess, the author means "kdc.conf" but I think [kdc] has conflict with [kdcdefaults] which is a legacy password-based Kerberos set up option.
>
> 4.24.2 Using the Kerberos database
>
> This subsection is empty and simply discourages the user to implement this option.
>
> 4.26
> This section also doesn't clarify what the test-cases exactly are. How they are supposed to be compiled and run. Nevertheless, some typos makes it difficult to understand the purpose of test-cases, for instance in: "The certicates it creates are used to test the PK-INIT functionality in tests/kdc/check-kdc.in." Moreover, writing few lines about compiling and running the test cases could be helpful.
>
>
>
> Best regards
> Ali
>
>
>
> ________________________________________
> From: Henry B. Hotz [[email protected]]
> Sent: Thursday, October 13, 2011 9:26 AM
> To: [email protected] discuss; Ali Gholami
> Subject: Re: Setting up PK-INIT
>
> For starters, do you have a working password-based Kerberos set up?  Since you said you were a beginner, I'd start with the basics.
>
> Be glad to answer questions if you can be more specific.
>
> On Oct 12, 2011, at 6:27 AM, Love Hörnquist Åstrand wrote:
>
>>
>> 12 okt 2011 kl. 14:00 skrev Ali Gholami:
>>
>>> Deat All,
>>>
>>> I would like to set up a KDC enabaled PK-INIT but as a Heimdal begginer user I couldn't get much help from the documentation. Do anyone have a successful scenario with this feature of Hemidal who can share?
>>
>> What part of http://www.h5l.org/manual/heimdal-1-5-branch/info/heimdal/Setting-up-PK_002dINIT.html#Setting-up-PK_002dINIT do you dont lacking ?
>>
>> Put differently, if you tell us what problem you are running into, you might get answers that will more be to your liking, and you can help us improve the documentation.
>>
>> Test cases in tests/kdc/check-kdc.in uses pkinit everytime "make check" is ran, that will partly explain how it setup.
>>
>> Love
>
> ------------------------------------------------------
> The opinions expressed in this message are mine,
> not those of Caltech, JPL, NASA, or the US Government.
> [email protected], or [email protected]
>
>
>

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email protected], or [email protected]