freeipa

#5444 [RFE] Support Resource based kerberos constrained delegation
Closed: fixed by frenaud. Opened by simo.

Closed: fixed
Reopen Issue

RBKCD is a new delegation model in Windows AD 2012 that allows cross-forest s4u2proxy to work.
It depends on a new option in the MS-PAC being set.
Documented in:
http://download.microsoft.com/download/9/5/E/95EF66AF-9026-4BB0-A41D-A4F81802D92C/%5BMS-SFU%5D.pdf
in paragraph 2.2.5

Metadata Update from @simo:
- Issue assigned to simo
- Issue set to the milestone: FreeIPA 4.5 backlog

This article discusses the implementation & benefits of the new "resource based constrained delegation" of Windows AD 2012:
http://windowsitpro.com/security/how-windows-server-2012-eases-pain-kerberos-constrained-delegation-part-1

Are there currently plans to implement this in freeipa?

It seems Resource Based Constrained Delegation has now been implemented in upstream mit kerberos: https://krbdev.mit.edu/rt/Ticket/Display.html?id=8479

Yes, it is part of 1.18 release. We need to design quite a bit of things on FreeIPA side before working on this:

  • how to store the access controls for RBCD in LDAP
  • how to manage them from API, CLI, and Web UI
  • what should be default settings for standard IPA services
  • etc

If you have any ideas or use cases, feel free to provide them here in comments.

Metadata Update from @abbra:
- Issue close_status updated to: None
- Issue set to the milestone: None (was: FreeIPA 4.5 backlog)

Taking over now that krb5 1.20 work is done and RBCD interface is exposed to KDB driver.

Metadata Update from @abbra:
- Issue assigned to abbra (was: simo)

master:

  • 68c113f02b789d5478375adb9927c52fdf1ad2dd Ignore empty modification error in case cifs/.. principal already added
  • 9b777390fbb6d4c683bf7d3e5f74d5443209b1d5 test_xmlrpc: adopt to automember plugin message changes in 389-ds
  • adc9609ff32c680b07ecfaa4c88d71898d7829c9 ipa-kdb: search S4U2Proxy ACLs in cn=s4u2proxy,cn=etc,$BASEDN subtree only
  • b035ac8eb948d850bd8883f215b91bbc337d2ec9 doc: add design document for Kerberos constrained delegation
  • 4239b77a6db24a3492f2e8ee4d2aea9a7e676272 IPA API changes to support RBCD
  • f78dc0b16332279c16e0b35fbb71f872746b875c kdb: implement RBCD handling in KDB driver
  • dd5b189a0935586be30b1766b1db2881a3f3f765 RBCD: add basic test for RBCD handling
  • 667b82a87008884ac3c0f30e3ccd5912f92bc8cb doc/designs/rbcd.md: add usage examples
  • 0bf0b2d251c96c7488f82cb8fa77052666068217 doc/designs/rbcd.md: document use of S-1-18-* SIDs

ipa-4-10:

  • e7506403a988b98cc3381d2d986b53aee48448cb Ignore empty modification error in case cifs/.. principal already added
  • 52e6da9056697e2210736d5528826ae424fec9b1 test_xmlrpc: adopt to automember plugin message changes in 389-ds
  • 7a7ba45c10a6da4f9e110f6cc57cfc47e0a16a16 ipa-kdb: search S4U2Proxy ACLs in cn=s4u2proxy,cn=etc,$BASEDN subtree only
  • 18cd909b4ad854147008a1010c97c75640a54177 doc: add design document for Kerberos constrained delegation
  • 5b6ad0e65600a96bb4d6f3b1acf4e16773a03493 IPA API changes to support RBCD
  • 7ac6adfaac30473b14b589a71fac42fe147bc0d9 kdb: implement RBCD handling in KDB driver
  • 7d68f4f08361760adab90ad4b44c6da2c4ea664d RBCD: add basic test for RBCD handling
  • b63e6a257006e846ef5d0a008d9c3c0f935c09bb doc/designs/rbcd.md: add usage examples
  • cb18ca31697320a58ae23a67afbfe7a0ff9a55a5 doc/designs/rbcd.md: document use of S-1-18-* SIDs

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Normal
enhancement
KDC LDAP driver
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.