|
 |
71e593 |
From ad3c2c6f89d3d07c5e901706c796de41d160d3bb Mon Sep 17 00:00:00 2001
|
|
|
71e593 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
71e593 |
Date: Mon, 3 Sep 2018 18:38:42 +0200
|
|
|
71e593 |
Subject: [PATCH 13/19] doc: add certificate mapping section to man page
|
|
|
71e593 |
|
|
|
71e593 |
Related to https://pagure.io/SSSD/sssd/issue/3500
|
|
|
71e593 |
|
|
|
71e593 |
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
71e593 |
(cherry picked from commit 0c739e969a617bdb4c06cdfd63772bf6d283c518)
|
|
|
71e593 |
---
|
|
|
71e593 |
src/man/sssd.conf.5.xml | 149 ++++++++++++++++++++++++++++++++++++++++++++++++
|
|
|
71e593 |
1 file changed, 149 insertions(+)
|
|
|
71e593 |
|
|
|
71e593 |
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
|
|
|
71e593 |
index 881ffc6ab389fec2b85d675f43b951ca5fa0f2fc..04143f199685b7703abe1b5bb82b6c33230e6c72 100644
|
|
|
71e593 |
--- a/src/man/sssd.conf.5.xml
|
|
|
71e593 |
+++ b/src/man/sssd.conf.5.xml
|
|
|
71e593 |
@@ -3299,6 +3299,135 @@ ldap_user_extra_attrs = phone:telephoneNumber
|
|
|
71e593 |
</para>
|
|
|
71e593 |
</refsect1>
|
|
|
71e593 |
|
|
|
71e593 |
+ <refsect1 id='certmap'>
|
|
|
71e593 |
+ <title>CERTIFICATE MAPPING SECTION</title>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ To allow authentication with Smartcards and certificates SSSD must
|
|
|
71e593 |
+ be able to map certificates to users. This can be done by adding the
|
|
|
71e593 |
+ full certificate to the LDAP object of the user or to a local
|
|
|
71e593 |
+ override. While using the full certificate is required to use the
|
|
|
71e593 |
+ Smartcard authentication feature of SSH (see
|
|
|
71e593 |
+ <citerefentry>
|
|
|
71e593 |
+ <refentrytitle>sss_ssh_authorizedkeys</refentrytitle>
|
|
|
71e593 |
+ <manvolnum>8</manvolnum>
|
|
|
71e593 |
+ </citerefentry>
|
|
|
71e593 |
+ for details) it might be cumbersome or not even possible to do this
|
|
|
71e593 |
+ for the general case where local services use PAM for
|
|
|
71e593 |
+ authentication.
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ To make the mapping more flexible mapping and matching rules were
|
|
|
71e593 |
+ added to SSSD (see
|
|
|
71e593 |
+ <citerefentry>
|
|
|
71e593 |
+ <refentrytitle>sss-certmap</refentrytitle>
|
|
|
71e593 |
+ <manvolnum>5</manvolnum>
|
|
|
71e593 |
+ </citerefentry>
|
|
|
71e593 |
+ for details).
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ A mapping and matching rule can be added to the SSSD configuration
|
|
|
71e593 |
+ in a section on its own with a name like
|
|
|
71e593 |
+ <quote>[certmap/<replaceable>DOMAIN_NAME</replaceable>/<replaceable>RULE_NAME</replaceable>]</quote>.
|
|
|
71e593 |
+ In this section the following options are allowed:
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ <variablelist>
|
|
|
71e593 |
+ <varlistentry>
|
|
|
71e593 |
+ <term>matchrule (string)</term>
|
|
|
71e593 |
+ <listitem>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ Only certificates from the Smartcard which matches this
|
|
|
71e593 |
+ rule will be processed, all others are ignored.
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ Default: KRB5:<EKU>clientAuth, i.e. only
|
|
|
71e593 |
+ certificates which have the Extended Key Usage
|
|
|
71e593 |
+ <quote>clientAuth</quote>
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ </listitem>
|
|
|
71e593 |
+ </varlistentry>
|
|
|
71e593 |
+ <varlistentry>
|
|
|
71e593 |
+ <term>maprule (string)</term>
|
|
|
71e593 |
+ <listitem>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ Defines how the user is found for a given certificate.
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ Default:
|
|
|
71e593 |
+ <itemizedlist>
|
|
|
71e593 |
+ <listitem>
|
|
|
71e593 |
+ <para>LDAP:(userCertificate;binary={cert!bin})
|
|
|
71e593 |
+ for LDAP based providers like
|
|
|
71e593 |
+ <quote>ldap</quote>, <quote>AD</quote> or
|
|
|
71e593 |
+ <quote>ipa</quote>.</para>
|
|
|
71e593 |
+ </listitem>
|
|
|
71e593 |
+ <listitem>
|
|
|
71e593 |
+ <para>The RULE_NAME for the <quote>files</quote>
|
|
|
71e593 |
+ provider which tries to find a user with the
|
|
|
71e593 |
+ same name.</para>
|
|
|
71e593 |
+ </listitem>
|
|
|
71e593 |
+ </itemizedlist>
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ </listitem>
|
|
|
71e593 |
+ </varlistentry>
|
|
|
71e593 |
+ <varlistentry>
|
|
|
71e593 |
+ <term>domains (string)</term>
|
|
|
71e593 |
+ <listitem>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ Comma separated list of domain names the rule should be
|
|
|
71e593 |
+ applied. By default a rule is only valid in the domain
|
|
|
71e593 |
+ configured in sssd.conf. If the provider supports
|
|
|
71e593 |
+ subdomains this option can be used to add the rule to
|
|
|
71e593 |
+ subdomains as well.
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ Default: the configured domain in sssd.conf
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ </listitem>
|
|
|
71e593 |
+ </varlistentry>
|
|
|
71e593 |
+ <varlistentry>
|
|
|
71e593 |
+ <term>priority (integer)</term>
|
|
|
71e593 |
+ <listitem>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ Unsigned integer value defining the priority of the
|
|
|
71e593 |
+ rule. The higher the number the lower the priority.
|
|
|
71e593 |
+ <quote>0</quote> stands for the highest priority while
|
|
|
71e593 |
+ <quote>4294967295</quote> is the lowest.
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ Default: the lowest priority
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ </listitem>
|
|
|
71e593 |
+ </varlistentry>
|
|
|
71e593 |
+ </variablelist>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ To make the configuration simple and reduce the amount of
|
|
|
71e593 |
+ configuration options the <quote>files</quote> provider has some
|
|
|
71e593 |
+ special properties:
|
|
|
71e593 |
+ <itemizedlist>
|
|
|
71e593 |
+ <listitem>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ if maprule is not set the RULE_NAME name is assumed to
|
|
|
71e593 |
+ be the name of the matching user
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ </listitem>
|
|
|
71e593 |
+ <listitem>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ if a maprule is used both a single user name or a
|
|
|
71e593 |
+ template like
|
|
|
71e593 |
+ <quote>{subject_rfc822_name.short_name}</quote> must
|
|
|
71e593 |
+ be in braces like e.g. <quote>(username)</quote> or
|
|
|
71e593 |
+ <quote>({subject_rfc822_name.short_name})</quote>
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ </listitem>
|
|
|
71e593 |
+ <listitem>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ the <quote>domains</quote> option is ignored
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ </listitem>
|
|
|
71e593 |
+ </itemizedlist>
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ </refsect1>
|
|
|
71e593 |
+
|
|
|
71e593 |
<refsect1 id='example'>
|
|
|
71e593 |
<title>EXAMPLES</title>
|
|
|
71e593 |
<para>
|
|
|
71e593 |
@@ -3341,6 +3470,26 @@ enumerate = False
|
|
|
71e593 |
<programlisting>
|
|
|
71e593 |
[domain/ipa.com/child.ad.com]
|
|
|
71e593 |
use_fully_qualified_names = false
|
|
|
71e593 |
+</programlisting>
|
|
|
71e593 |
+ </para>
|
|
|
71e593 |
+ <para>
|
|
|
71e593 |
+ 3. The following example shows the configuration for two certificate
|
|
|
71e593 |
+ mapping rules. The first is valid for the configured domain
|
|
|
71e593 |
+ <quote>my.domain</quote> and additionally for the subdomains
|
|
|
71e593 |
+ <quote>your.domain</quote> and uses the full certificate in the
|
|
|
71e593 |
+ search filter. The second example is valid for the domain
|
|
|
71e593 |
+ <quote>files</quote> where it is assumed the files provider is used
|
|
|
71e593 |
+ for this domain and contains a matching rule for the local user
|
|
|
71e593 |
+ <quote>myname</quote>.
|
|
|
71e593 |
+<programlisting>
|
|
|
71e593 |
+[certmap/my.domain/rule_name]
|
|
|
71e593 |
+matchrule = <ISSUER>^CN=My-CA,DC=MY,DC=DOMAIN$
|
|
|
71e593 |
+maprule = (userCertificate;binary={cert!bin})
|
|
|
71e593 |
+domains = my.domain, your.domain
|
|
|
71e593 |
+priority = 10
|
|
|
71e593 |
+
|
|
|
71e593 |
+[certmap/files/myname]
|
|
|
71e593 |
+matchrule = <ISSUER>^CN=My-CA,DC=MY,DC=DOMAIN$<SUBJECT>^CN=User.Name,DC=MY,DC=DOMAIN$
|
|
|
71e593 |
</programlisting>
|
|
|
71e593 |
</para>
|
|
|
71e593 |
</refsect1>
|
|
|
71e593 |
--
|
|
|
71e593 |
2.14.4
|
|
|
71e593 |
|