Request for enhancement

As an admin, I want to use PKINIT with ipa-client-install so that I can enroll clients with X.509 client certificates. The feature would allow me to register clients with existing host identities like Red Hat subscription manager certificates or other provisioned cert/key pairs.

ipa-client-install requires credentials to authenticate host enrollment. Currently the command supports three ways to authenticate:

• kinit with principal name + password of a privileged user account
• kinit with an existing KRB5 keytab
• OTP enrollment with a one time password

I like to request a forth option that uses PKINIT to acquire a TGT for the host principal. Internally the option would run kinit with cert, key, and trust anchor options like this:

kinit \
    -X X509_user_identity=FILE:/path/to/cert.pem,/path/to/key.pem \
    -X X509_anchors=FILE:/path/to/ipa/ca.crt \
    -X X509_anchors=FILE:/path/to/additional-pem-bundle.pem \
    ...
    host/{hostname}

or provide these options in temp krb5.conf

[realms]
  MY.REALM = {
    pkinit_identities = FILE:/path/to/cert.pem,/path/to/key.pem
    pkinit_anchors = FILE:/path/to/ipa/ca.crt
    pkinit_anchors = FILE:/path/to/additional-pem-bundle.pem
}

The feature is going to need up to three new arguments:

• --pkinit-identity raw argument for pkinit_identities / X509_user_identity

or

• --pkinit-cert path to a PEM file containing the certificate
• --pkinit-key path to a PEM file containing the private key of the certificate

and

• --pkinit-anchors path to a PEM bundle with trust anchors (has to support multiple bundles, either multiple arguments or a single argument with : as path separator). The certs from --ca-cert-file should be used as anchors, too.

--pkinit-identity option may be preferable. MIT KRB5 also supports PKCS12 files and PKCS11 (smartcard / HSM / TPM) options.

NOTES

• pkinit_anchors / X509_anchors can be repeated multiple times
• settings in [libdefaults] are ignored if a realm-specific setting has an option.
• kinit options takes precedence over krb5.conf options
• during testing I noticed that clients and KDC must have access to the full cert chain of the client cert as well as the full cert chain of the KDC server cert.
• PKINIT also needs a certmap rule that maps the host certificate to a host entry.

References

• https://web.mit.edu/kerberos/krb5-1.19/doc/admin/pkinit.html
• https://web.mit.edu/kerberos/krb5-1.19/doc/user/user_commands/kinit.html
• https://web.mit.edu/kerberos/krb5-1.19/doc/admin/conf_files/krb5_conf.html#pkinit-options