freeipa

#8655 Allow to establish trust to Active Directory in FIPS mode
Closed: fixed by frenaud. Opened by abbra.

Closed: fixed
Reopen Issue

MIT Kerberos libraries consider RC4 cipher insecure and when system-wide policy disables RC4, they do not allow applications to operate on RC4 at all. At the same time, RC4 is not available in FIPS mode either. Samba 4.14 (and backports to Fedora 33+ and RHEL 8.4+) started to block use of weak crypto as well.

The cipher and hashes using RC4 are essential for two operations in SMB protocol:

  • setting up trust between domains in Active Directory environment: RC4 is used to encrypt trusted domain object credentials as an application-specific material in accordance with MS-LSAD specification;

  • in a secure channel based on AES session key communicating between SMB domain member and domain controller: as an input to set up a secure channel.

Extend FreeIPA code that establishes trust to Active Directory to be able to run in FIPS mode

In technical terms, the use of RC boils down to

  • LSA CreateTrustedDomainEx2. For any AuthInfo type, (0x00000001 (rc4hmac key) and 0x00000002 (plain text password) are the most common ones) the content in AuthenticationInformation is considered an application level payload because it is encrypted with a session key negotiated with the transport. Covered by MS-LSAD section 3.1.4.7.10 and MS-LSAD section 5.1.1

  • ServerAuthenticate3 call needs an AES session key which is calculated based on an rc4hmac of a machine account credential according to MS-NRPC section 3.1.4.3.1

Samba 4.13 and backports to 4.12 in Fedora 33+ and RHEL 8.4+ now provide a helper that wraps LSA RPC call CreateTrustedDomainEx2. This helper ensures that in FIPS mode we first check that LSA session key is AES before allowing RC4 use internally in Samba bindings. Thus, it becomes possible to establish trust to Active Directory forest in FIPS mode.

Adopt FreeIPA code to use the helper provided by Samba when it is available.

Metadata Update from @abbra:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1860129

PR: https://github.com/freeipa/freeipa/pull/5418

master:

  • cf17b7af5a8cd835ae20fe23a57fe656481e27a3 ipaserver/dcerpc: use Samba-provided trust helper to establish trust
  • e157ea1e14edd239c58847957fe0ae7c7fa5c9ab ipaserver/dcerpc.py: use Kerberos authentication for discovery
  • fd15f60216b4098d0423fc39a0ad62293df5d116 ipaserver/dcerpc.py: enforce SMB encryption on LSA pipe if available

ipa-4-9:

  • 753246f4e82af5697ee51bdc7f667959e1824be1 ipaserver/dcerpc: use Samba-provided trust helper to establish trust
  • 8ab9bf68a4d12c8763c1669d0c14b7771a3289da ipaserver/dcerpc.py: use Kerberos authentication for discovery
  • 3fa07a108030265dc89921a37216a1184e1e7516 ipaserver/dcerpc.py: enforce SMB encryption on LSA pipe if available

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 968f8ada650ead218055026d1acfb5d41b87cdf0 ipa-kdb: provide correct logon time in MS-PAC from authentication time
  • e6f8d8bc9bc53fe6947867e4918585654fd4acfb ipasam: implement PASSDB getgrnam call
  • 75882516c4126fde403291357c991917616a5314 ipasam: allow search of users by user principal name (UPN)
  • a1e2fe9c32ca44e4c06aadd6aa75565ccb6910c3 ipasam: free trusted domain context on failure
  • 08d7d90ab0934ecefaaccf7866c73dca8ccf636f ipasam: derive parent domain for subdomains automatically
  • 214aeb724308c91847d4643a9a4f4c2d38d5abfa ipaserver/dcerpc: store forest topology as a blob in ipasam
  • 9d19c08269226ec15a6e99208aff66ca85fe2c51 ipatests: use fully qualified name for AD admin when establishing trust
  • 94242563d52adc0d6c539a78a70b5e486d6047ed Update ipa_sam.c
  • ae7cd4702dcbeb9479a3e4975a44f5e7b17061f5 trust-fetch-domains: use custom krb5.conf overlay for all trust operations
  • 54e5ffc0005d273773618fb0c23f96cc7e4a16c1 use a constant instead of /var/lib/sss/keytabs

ipa-4-9:

  • f8bf37422b7c49a4a39b4704b18158b37ee9ef80 ipa-kdb: provide correct logon time in MS-PAC from authentication time
  • 962052a0567b6878843272b1882d0a0b3b2debd1 ipasam: implement PASSDB getgrnam call
  • 2e8eb0f5fe82be58be88fa0d9b07ee7af69d8829 ipasam: allow search of users by user principal name (UPN)
  • e8f927db7da00d1671f871d3b2e89429aec3beb9 ipasam: free trusted domain context on failure
  • f103172954c259443f0c5b4ac89474e66cf3a1d6 ipasam: derive parent domain for subdomains automatically
  • 3d706b6f57309ec394df617cecb9a73d021fc2f7 ipaserver/dcerpc: store forest topology as a blob in ipasam
  • dc16c2484c1006bc249848383d86ef828abd921a ipatests: use fully qualified name for AD admin when establishing trust
  • b53592492879f87465774eb9a4d6c02a8ba26a5e Update ipa_sam.c
  • c842d4b5c2404d263d56aa0c4ba33fe32b2ca61e trust-fetch-domains: use custom krb5.conf overlay for all trust operations
  • 9f63afb4408e308c2ee972a72875525afefa5d54 use a constant instead of /var/lib/sss/keytabs

Metadata Update from @abbra:
- Custom field changelog adjusted to When IPA is deployed in FIPS mode, it is now possible to establish trust to Active Directory forest.
Metadata

fips trust

None
None
Lowest
When IPA is deployed in FIPS mode, it is now possible to establish trust to Active Directory forest.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.