Mrogers at 17:14, 1 May 2017

2017-05-01T17:14:22Z

Mrogers: Created page with "{{project-early}} This project implements a plugin interface for the KDC to enable modifying server ticket attributes based on the Pre-authentication indicator. ==Problem== ..."

2017-04-24T22:09:01Z

Created page with "{{project-early}} This project implements a plugin interface for the KDC to enable modifying server ticket attributes based on the Pre-authentication indicator. ==Problem== ..."

New page

{{project-early}}

This project implements a plugin interface for the KDC to enable modifying server ticket attributes based on the Pre-authentication indicator.

==Problem==

As an administrator I would like to be able to define the lifetime or other attributes of a service ticket based on the strength of the pre-authentication used. We have high value services that require 2FA and as an added precaution we want to ensure that these service tickets have a shorter lifetime/renew time, or a stronger session key type than the standard Kerberos ticket policy.

For example:
* User A got TGT with password authentication, asks for a TGS for service fileserver@REALM; returned ticket has a 30 minute lifetime
* User B got TGT with 2FA authentication, asks for a TGS for service fileserver@REALM; returned ticket has a 2 hour lifetime
* User C got TGT with PKINIT, asks for a TGS for service fileserver@REALM; returned ticket has a 8 hour lifetime

==Design==

A plugin interface used during process_tgs_req(), separately from the KDB check_policy_tgs, that will accept an indicator and server entry and output a ticket lifetime (renew time?) and/or session key etype. The resulting ticket lifetime can be no longer than the entry max_life (or header ticket lifetime) and the etype can be no weaker than the normally allowed etype.

==Open questions and Misc==
- http://mailman.mit.edu/pipermail/krbdev/2016-September/012664.html

@@ Line 1: / Line 1: @@
 {{project-early}}
-This project implements a plugin interface for the KDC to enable modifying server ticket attributes based on the Pre-authentication indicator.
+This project implements a plugin interface for the KDC to enable modification of service ticket attributes based on the Pre-authentication indicator.
 ==Problem==
-As an administrator I would like to be able to define the lifetime or other attributes of a service ticket based on the strength of the pre-authentication used. We have high value services that require 2FA and as an added precaution we want to ensure that these service tickets have a shorter lifetime/renew time, or a stronger session key type than the standard Kerberos ticket policy.
+As an administrator I would like to be able to define the lifetime or other attributes of a service ticket based on the strength of the pre-authentication used. We have high value services that require 2FA and as an added precaution we want to ensure that these service tickets have a shorter lifetime/renew time.
-For example:
+For example, it would be possible to configure:
-* User A got TGT with password authentication, asks for a TGS for service fileserver@REALM; returned ticket has a 30 minute lifetime
+* Client obtains a TGT using a password, sends TGS_REQ for service fileserver@REALM; returned ticket has a 8 hour lifetime
-* User B got TGT with 2FA authentication, asks for a TGS for service fileserver@REALM; returned ticket has a 2 hour lifetime
+* Client obtains a TGT with PKINIT, sends TGS_REQ for service fileserver@REALM; returned ticket has a 2 hour lifetime
 ==Design==

Projects/KDC TGS Policy plugin - Revision history

Mrogers at 17:14, 1 May 2017

Mrogers: Created page with "{{project-early}} This project implements a plugin interface for the KDC to enable modifying server ticket attributes based on the Pre-authentication indicator. ==Problem== ..."