From d542a23f1eb0b0f9a98261f62e9fcb1d86c2b40b Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Feb 13 2024 06:27:42 +0000 Subject: ipa-kdb: when applying ticket policy, do not deny PKINIT PKINIT differs from other pre-authentication methods by the fact that it can be matched indepedently of the user authentication types via certmap plugin in KDC. Since PKINIT is a strong authentication method, allow its authentication indicator and only apply the ticket policy. Fixes: https://pagure.io/freeipa/issue/9485 Signed-off-by: Alexander Bokovoy Reviewed-By: Francisco Trivino --- diff --git a/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c b/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c index 44959f3..d6d618d 100644 --- a/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c +++ b/daemons/ipa-kdb/ipa_kdb_kdcpolicy.c @@ -119,11 +119,8 @@ ipa_kdcpolicy_check_as(krb5_context context, krb5_kdcpolicy_moddata moddata, pol_limits = &(ied->pol_limits[IPADB_USER_AUTH_IDX_RADIUS]); } else if (strcmp(auth_indicator, "pkinit") == 0) { valid_auth_indicators++; - if (!(ua & IPADB_USER_AUTH_PKINIT)) { - *status = "PKINIT pre-authentication not allowed for this user."; - kerr = KRB5KDC_ERR_POLICY; - goto done; - } + /* allow PKINIT unconditionally -- it has passed already at this + * point so some certificate was useful, only apply the limits */ pol_limits = &(ied->pol_limits[IPADB_USER_AUTH_IDX_PKINIT]); } else if (strcmp(auth_indicator, "hardened") == 0) { valid_auth_indicators++;