Debugging PKINIT

[Douglas E. Engert]

On 5/4/2011 8:56 AM, Bram Cymet wrote:
> Hi,
>
> I am having some trouble trying to kinit using certificates. I can see
> through an strace that the certificate, key, and ca cert files are being
> read but then kinit still asks me for my password.
>
> Is there anyway I can tell (either on the client or the server) why
> there is a problem with the cert or if kinit is doing anything with the
> certs other then reading them?
>

The way your krb5.conf is setup, it will only work for one user. You may
want to look at the kinit -X X509_user_identity= option.


> This is my krb5.conf on my client:
>
> TESTLDAP.CBN = {
>
>                 pkinit_anchors=FILE:/home/bcymet/Downloads/crltest-cacert.pem
>                 pkinit_identities =
> FILE:/home/bcymet/Downloads/bcymet-cert.pem,/home/bcymet/Downloads/bcymet-privkey.pem
>                 X509_user_identity =
> FILE:/home/bcymet/Downloads/bcymet-cert.pem,/home/bcymet/Downloads/bcymet-privkey.pem

The above two should not be needed if the kinit -X option is used.

>
>
>                 pkinit_eku_checking = kpKDC

Is this key useage in the /etc/krb5/cbnca-auriga-prod-cert.pem cert?

>
>                 pkinit_kdc_hostname = cbnca-auriga-prod

Should this be a FQDN? The string has to match what is in
the KDC certificate, and is case sensitive.

>
>                 pkinit_cert_match =<SUBJECT>O=cbn,OU=jrz,CN=bcymet$

Usually a certificate is in revers order,and has CN=...,OU=...O=...
Also this is a regular expression, is the $ meant to be part of the name
or the regular expression?

>                 kdc = cbnca-auriga-prod.jrz.cbn
>                 master_kdc = cbnca-auriga-prod
>                 default_domain = test.cbn
>
>
>                 X509_anchors=FILE:/home/bcymet/Downloads/crltest-cacert.pem

This looks redundant, as you have pkinit_anchors= above

>                 admin_server = cbnca-auriga-prod
>                 pkinit_require_crl_checking = false
>                 pkinit_revoke = DIR:/etc/krb5/
>         }

KDC names are usually FQDN, I see you have some as FQDN and not
not.

>
> and on the server:
>
>   TESTLDAP.CBN = {
>                  kdc = cbnca-auriga-prod
>                  admin_server = cbnca-auriga-prod
>                  master_kdc = cbnca-auriga-prod
>                  default_domain = testLDAP.cbn
>                  enable-pkinit = true
>                  pkinit_identity =
> FILE:/etc/krb5/cbnca-auriga-prod-cert.pem,/etc/krb5/cbnca-auriga-prod-privkey.pem
>                  pkinit_anchors = FILE:/etc/krb5/crltest-cacert.pem
>                  pkinit_eku_checking = kpClientAuth

Does the client cert have this key usage defined?

>                  pkinit_allow_proxy_certificate = false
>                  pkinit_allow_upn = false
>                  #pkinit_revoke = DIR:/etc/krb5/
>                  #pkinit_require_crl_checking = false
>
>                  database_module = openldap_ldapconf
>
>                  key_stash_file = /usr/local/var/krb5kdc/.k5.TESTLDAP.CBN
>                  #auth_to_local = RULE:[1:$1]
>                  #auth_to_local = RULE:[2:$1]
>                  #auth_to_local = DEFAULT
>
>
>          }
>
>
>
> Thanks,
>

You can build the pkinit with debugging look at the plugins/preauth/pkinit/pkinit.h
for pkiDebug and also grep for DEBUG.


-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444