fedora-packager

#166 Add pkinit config and ipa certs
Merged by mohanboddu. Opened by ryanlerch.
ryanlerch/fedora-packager noggin-pkinit  into  main

Download 166.patch

In the FAS replacement being rolled out in 2021, that uses freeipa and noggin, if a user has 2FA enabled, they need some extra configuration to get kinit working with 2FA.

Note that the commit message has a little more information, and there is also a docs PR in progress that covers for users how to use this. https://github.com/fedora-infra/fedora-accounts-docs/pull/1/files (this will need to be changed to remove the steps that this PR implements)

https://github.com/fedora-infra/fedora-accounts-docs/pull/1 has a bit more information on the reasons for doing this this way too.

2 new commits added

  • Add pkinit config and ipa certs
  • Fix version and specfile

rebased onto 7d806796d098b7e057d73bf3594a89d719abe159

So, with this, what is the process? ie, how much does this automate it? :)

After this the user will have to do an anonymous kinit to get the ticket cache then use that cache to kinit as themselves and enter pass+token. It could even be done in a clunky one liner something like

 kinit user@FEDORAPROJECT.ORG - T $(kinit - n @FEDORAPROJECT.ORG)

The more elegant fleshed out solution is in this PR
Edited by mobrien

I think there are extra spaces provided for the options

kinit user@FEDORAPROJECT.ORG -T $(kinit -n @FEDORAPROJECT.ORG)

Or it should be spaces?

I think there are extra spaces provided for the options

kinit user@FEDORAPROJECT.ORG -T $(kinit -n @FEDORAPROJECT.ORG)

Or it should be spaces?

Yep, you are right :) I typed it on my phone so it got autocorrected

LGTM but two questions:

  1. What happens if people run kinit user@FEDORAPROJECT.ORG before noggin is deployed but newer version with the newer krb config is installed?
  2. What happens if people run kinit user@FEDORAPROJECT.ORG after noggin is deployed either with this newer version is installed or not?

LGTM but two questions:

  1. What happens if people run kinit user@FEDORAPROJECT.ORG before noggin is deployed but newer version with the newer krb config is installed?

Should have no effect as the cert is from ipa currently in prod. This only effects people with 2fa set. I've run kinit in password only mode in stage with this setup and it worked as normal

  1. What happens if people run kinit user@FEDORAPROJECT.ORG after noggin is deployed either with this newer version is installed or not?

If they don't have an OTP token it will work as before. If they do have an OTP token it will error with kinit: Pre-authentication failed: Invalid argument while getting initial credentials

Also I just realised that I never pasted the link to the docs PR I was referring to in my earlier comment. https://github.com/fedora-infra/fedora-accounts-docs/pull/1/files
Edited by mobrien

@mohanboddu @kevin @mobrien is there anything else needed for this one?

Pull-Request has been merged by mohanboddu
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.