Projects/OTPOverRADIUS - Revision history

Ghudson at 18:26, 11 October 2013

2013-10-11T18:26:25Z

2013-08-13T17:40:59Z

2013-06-17T18:56:26Z

‎kdc.conf

2013-06-07T20:11:55Z

‎kdc.conf

2013-03-07T20:29:32Z

2013-01-10T20:20:12Z

‎Default Token Type

2013-01-10T20:19:58Z

Undo revision 5025 by Npmccallum (Talk)

2013-01-10T20:19:38Z

Undo revision 5026 by Npmccallum (Talk)

2013-01-02T19:59:50Z

2013-01-02T19:59:27Z

Convert strip_realm to flags

← Older revision		Revision as of 18:26, 11 October 2013
Line 90:		Line 90:
	== OTP Preauth Challenge Optional Fields ==		== OTP Preauth Challenge Optional Fields ==
	According to RFC 6560, there are many optional fields. We currently do not have any plan to fill these in.		According to RFC 6560, there are many optional fields. We currently do not have any plan to fill these in.
		+
		+	= Testing =
		+
		+	libkrad will be tested with C test programs located in lib/krad. Some of the programs will spawn a Python daemon which uses pyrad to provide a simple RADIUS server to test against.
		+
		+	The OTP module will be tested by a new script tests/t_otp.py, which also uses pyrad to provide a RADIUS server to test against.
		+
		+	= Documentation =
		+
		+	A new page admin/otp.rst will describe KDC configuration for OTP.
		+
		+	= Mailing list discussions =
		+
		+	* http://mailman.mit.edu/pipermail/krbdev/2012-December/011300.html
		+	* http://mailman.mit.edu/pipermail/krbdev/2013-May/011528.html
		+
		+	= Commits =
		+
		+	8b8f031c6e64360a26c484b548d2158944e09087 Add libkrad
		+	4b5dd8bcfb10af254fb9efbe4cf39befe5b1e6ac Add server-side otp preauth plugin
		+	f6cb089daed2615d0b1594d7ccc20d617eb374eb Fix skip logic in t_otp.py
		+	acb490bd01235511294ecb6b23750e648e48f7dc Fix OTP KDC module get_string error handling
		+
		+	Completed in {{bug\|7678}}.
		+
		+	= Release notes =
		+
		+	Administrator experience:
		+
		+	* Add a FAST OTP preauthentication module for the KDC which uses RADIUS to validate OTP token values.

@@ Line 12: / Line 12: @@
 == Token Type Configuration ==
-=== kdc.conf ===
+=== krb5.conf or kdc.conf ===
-Configuration should go into kdc.conf as it may contain secrets that shouldn't be world readable. The configuration is defined as follows:
+The configuration is defined as follows:
 <code>
  [otp]

@@ Line 30: / Line 30: @@
  | otp.<name>.server || $KDCDIR/<name>.socket || host, host:port or /path/to/unix.socket
  |-
- | otp.<name>.secret || "" (RoUS mode) or '''secret''' MUST be specified! || String
+ | otp.<name>.secret || N/A (RoUS mode) or '''secret''' MUST be specified! || /path/to/secret.file
  |-
  | otp.<name>.timeout || 5 || Integer (seconds)

@@ Line 66: / Line 66: @@
 If '''type''' is not specified then it refers to the '''DEFAULT''' token type as defined above. The '''username''' field overrides the default User-Name attribute sent in the RADIUS packet.
-All values above are optional. If the user string is not set (i.e. NULL) or is an empty string or is an empty list, then a user string of "[{}]" will be assumed.
+All values above are optional. If the user string is an empty string or is an empty list, then a user string of "[{}]" will be assumed.
 == OTP Enablement ==
 == Workflow ==
-In the first pass (no PA-OTP-REQUEST present), the '''otp''' plugin will look up the '''REQUIRES_HW_AUTH''' flag on the given principal. If the flag is set, a generic PA-OTP-CHALLENGE will be sent to the client (no optional fields will be filled in).
+In the first pass (no PA-OTP-REQUEST present), the '''otp''' plugin will look up the '''otp''' user string on the given principal. If the string is set (i.e. non-NULL), a generic PA-OTP-CHALLENGE will be sent to the client (no optional fields will be filled in).
 Upon receipt of a PA-OTP-REQUEST, the KDC will look up the RADIUS servers using the '''otp''' user string and kdc.conf configuration. All RADIUS servers will be used for validation, in the order they were specified in the '''otp''' user string, stopping after the first Access-Accept response is received.

@@ Line 48: / Line 48: @@
  [otp]
   DEFAULT = {
    strip_realm = false
+  }

@@ Line 17: / Line 17: @@
  [otp]
   <name> = {
    server = <string>
    secret = <string>
    timeout = <integer>
    retries = <integer>
+  }
 </code>
 {| class="wikitable" style="width: 100%"
  ! Name || Default Value || Format
  |-
  | otp.<name>.server || $KDCDIR/<name>.socket || host, host:port or /path/to/unix.socket
@@ Line 46: / Line 35: @@
  |-
  | otp.<name>.retries || 3 || Integer
  |}
@@ Line 57: / Line 48: @@
  [otp]
   DEFAULT = {
+  }
 </code>
@@ Line 87: / Line 79: @@
 === RADIUS Packet ===
 The packet sent to the configured RADIUS server will contain:
-* User-Name (default: user principal; overridden by '''username''')
+* User-Name (default: user principal, realm stripped per config; overridden by '''username''')
 * User-Password (otp-value from PA-OTP-REQUEST)
 * NAS-Identifier (gethostname())

@@ Line 32: / Line 32: @@
  | strip_realm || Discard the '@' symbol and everything that follows it ||
  |}
 {| class="wikitable" style="width: 100%"