August 2016 - Pki-users - Dogtag PKI List Archives

Change OCSP URI in certificates
by Leonardo Bacha Abrantes 24 Aug '16

24 Aug '16

Hi guys, I created my Root-cA using standard tomcat ports (8080 and 8443) and it's workig very well, so, the certificates are being created with URIName point to 'http://server02.example.com:8080/ca/ocsp' and I want to change it to ' http://server02.example.com/ca/ocsp', because I'll keep tomcat working in standard ports and I'll redirect the traffic in port 80 to 8080 via iptables. I'm creating a subordinate CA and I configured in Root-CA 'policyset.caCertSet.10.default.params.authInfoAccessADLocationType_0= http://root-ca.cnfcp.gov.br/ca/ocsp' in /var/lib/pki/pki-RootCA/ca/profiles/ca/caInstallCACert.cfg, however the certificate are being created but it is not appearing in certificate. Can you give me some help please ? Many thanks!

1 0

Authorize Sub-CA to be created
by Leonardo Bacha Abrantes 23 Aug '16

23 Aug '16

Hi guys, I'm trying to configure a subordinate CA, but am receiving the message "ERROR: Unable to access security domain: 401 Client Error: Unauthorized". I follow these steps: ===>> On Server01 (root-ca): setup-ds.pl --silent General.FullMachineName=root-ca.xxx.xxx.xx \ General.SuiteSpotUserID=nobody General.SuiteSpotGroup=nobody \ slapd.ServerPort=389 slapd.ServerIdentifier=pki-RootCA \ slapd.Suffix=dc=EXAMPLE,dc=xxx,dc=xx \ slapd.RootDN="cn=ldapadmin" slapd.RootDNPwd=PASSWORD > myconfig.txt [DEFAULT] pki_admin_password=Root-CA_pwd pki_client_database_password=Root-CA_pwd pki_client_pkcs12_password=Root-CA_pwd pki_ds_password=Root-CA_pwd pki_security_domain_password=Root-CA_pwd pki_admin_password=Root-CA_pwd pki_client_database_password=Root-CA_pwd pki_client_pkcs12_password=Root-CA_pwd pki_ds_bind_dn=cn=ldapadmin pki_ds_password=Root-CA_pwd pki_security_domain_password=Root-CA_pwd pki_instance_name=pki-RootCA [CA] pki_ca_signing_subject_dn=cn=EXAMLE Root Certification Authority,o=XXXXXXXXXXX,c=BR pki_admin_nickname=PKI Administrator for EXAMPLE pki_admin_subject_dn=cn=PKI Administrator Root CA,e=admin(a)XXXXX.XXX.xx ,o=XXXXXXXXXX,c=BR pki_admin_email=admin(a)XXXXXX.xxx.xx ===>> On Server02 (Sub-ca): setup-ds.pl --silent General.FullMachineName=sub-ca.xxx.xxx.xx \ General.SuiteSpotUserID=nobody General.SuiteSpotGroup=nobody \ slapd.ServerPort=389 slapd.ServerIdentifier=pki-SubCA \ slapd.Suffix=dc=EXAMPLE,dc=xxx,dc=xx \ slapd.RootDN="cn=ldapadmin" slapd.RootDNPwd=OTHER_PASSWORD > myconfig.txt [DEFAULT] pki_admin_password=SUB-CA_Passord pki_client_database_password=SUB-CA_Passord pki_client_pkcs12_password=SUB-CA_Passord pki_ds_password=SUB-CA_Passord pki_security_domain_password=SUB-CA_Passord pki_admin_password=SUB-CA_Passord pki_client_database_password=SUB-CA_Passord pki_client_pkcs12_password=SUB-CA_Passord pki_ds_bind_dn=cn=ldapadmin pki_ds_password=SUB-CA_Passord pki_security_domain_password=SUB-CA_Passord pki_instance_name=pki-SubCA pki_security_domain_hostname=root-ca.xxxx.xxx.xx pki_security_domain_https_port=8443 pki_security_domain_user=caadmin [CA] pki_subordinate=True pki_issuing_ca=https://root-ca.xxxx.xxxv.xx:8443 pki_ca_signing_subject_dn=cn=EXAMPLE Certification Authority L2,o=XXXXXXXXXXX,c=BR pki_subordinate_create_new_security_domain=True pki_subordinate_security_domain_name=EXAMPLE Certification Authority L2 pki_admin_nickname=PKI Administrator for Example Sub-CA L2 pki_admin_subject_dn=cn=PKI Administrator CA L2,e=admin(a)xxxxx.xxx.xx ,o=XXXXXXXXXXX,c=BR pki_admin_email=admin(a)xxxx.xxx.xx when I run pkispawn -v -s CA -f myconfig.txt on Server02: ERROR: Unable to access security domain: 401 Client Error: Unauthorized === I tried to use the same passwords on myconfig.txt in both servers just to test, but I receive the same message. Can you help me please ? many thanks!

3 5

Regarding DogTag
by jagadish_yellulla＠tecnics.com 04 Aug '16

04 Aug '16

Hi Support, Could you please help us in installing/setting up Dogtag 10 or Dogtag 9 environment in Redhat linux 6. ->How to configure repo of dogtag in redhat. ->Prerequisites like libraries ->Step by Step Installation guide of each component. ->Administration guide ->High Availability set up of Dogtag. -> API to access from JAVA API based applications. Thanks, Jagadish Yellulla

1 0

Re: [Pki-users] setting up Directory-based authentication
by Sérgio Pereira 02 Aug '16

02 Aug '16

Hi Christina, Worked like a charm. I suggest updating the documentation (http://pki.fedoraproject.org/wiki/Directory-Authenticated_Profiles) mentioning the tag ldapBoundConn=true (there is no reference for it). Also, I've noticed that the authentication is based on uid ldap attribute ... is there any way of changing it to authenticate against sAMAccountName (Microsoft Active Directory attribute)? I didn't find any tag to define the attribute I want to authenticate against. Thank you once more sergio Date: Mon, 1 Aug 2016 14:18:50 -0700 From: Christina Fu <cfu(a)redhat.com> To: pki-users(a)redhat.com Subject: Re: [Pki-users] setting up Directory-based authentication Message-ID: <50d8356b-7507-8c99-db1d-72c7fd4ea2b8(a)redhat.com> Content-Type: text/plain; charset="windows-1252"; Format="flowed" Hi Sergio, I'm not sure if this has ever made it into dogtag document, but here is the instruction I have written for bound LDAP based authentication. I can't say that I remember every detail, but it's what I have written down anyway ;-/ In some environment, one might want to disallow anonymous bind for the ldap server that is used for authentication. To create a bound connection between a CA and the ldap server, you need to make a few configuration changes: * Set up directory-based authentication as following example in CS.cfg: 1. auths.instance.UserDirEnrollment.ldap.ldapBoundConn=true auths.instance.UserDirEnrollment.ldap.ldapauth.authtype=BasicAuth auths.instance.UserDirEnrollment.ldap.ldapauth.bindDN=cn=Directory Manager auths.instance.UserDirEnrollment.ldap.ldapauth.bindPWPrompt=externalLDAP externalLDAP.authPrefix=auths.instance.UserDirEnrollment cms.passwordlist=internaldb,replicationdb,externalLDAP where the bindPWPrompt is the ?tag? or ?prompt? that is used in the password.conf file; It is also the name used under the passwordlist and the authPrefix * Add the ?tag? or ?prompt? from the CS.cfg with its password in the password.conf: o externalLDAP=<your password> Please try it out and let us know if it works or need any clarification. Hope this helps, Christina On 07/26/2016 06:01 AM, S?rgio Pereira wrote: > > Hi there, > > I?m having a hard time setting up the directory-based authentication > for dogtag 10.3.3-1. I did follow the instructions as > http://pki.fedoraproject.org/wiki/Directory-Authenticated_Profiles and > I get an error when trying to bind/authenticate against directory > service (Microsoft AD2008) as follows: > > [26/Jul/2016:08:27:27][http-bio-8443-exec-1]: DirBasedAuthentication: > authenticate: before authenticate() call > > [26/Jul/2016:08:27:27][http-bio-8443-exec-1]: Authenticating > UID=john.luk > > [26/Jul/2016:08:27:27][http-bio-8443-exec-1]: UidPwdDirAuthentication: > Authenticating: Searching for uid=john.luk base > DN=OU=IT,dc=domain,dc=com > > [26/Jul/2016:08:27:27][http-bio-8443-exec-1]: Authenticating: User > authentication failure: netscape.ldap.LDAPException: error result (1); > 000004DC: LdapErr: DSID-0C0906DD, comment: In order to perform this > operation a successful bind must be completed on the connection., data > 0, v1772 > > [26/Jul/2016:08:27:27][http-bio-8443-exec-1]: Authenticating: closing > bad connection > > The directives (bellow) are used to bind the AD2008 and I already > tested the account and it is working. > > auths.instance.UserDirEnrollment.ldap.ldapauth.bindDN=cn=Service > Account,ou=IT,dc=domain,dc=com > > auths.instance.UserDirEnrollment.ldap.ldapauth.bindPWPrompt=password > > John Luk is applying for the certificate using the web enrollment > process (caDirUserCert profile). > > What am I missing? > > Thx, > > sergio > > > > _______________________________________________ > Pki-users mailing list > Pki-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/pki-users

1 0

setting up Directory-based authentication
by Sérgio Pereira 01 Aug '16

01 Aug '16

Hi there, Im having a hard time setting up the directory-based authentication for dogtag 10.3.3-1. I did follow the instructions as http://pki.fedoraproject.org/wiki/Directory-Authenticated_Profiles and I get an error when trying to bind/authenticate against directory service (Microsoft AD2008) as follows: [26/Jul/2016:08:27:27][http-bio-8443-exec-1]: DirBasedAuthentication: authenticate: before authenticate() call [26/Jul/2016:08:27:27][http-bio-8443-exec-1]: Authenticating UID=john.luk [26/Jul/2016:08:27:27][http-bio-8443-exec-1]: UidPwdDirAuthentication: Authenticating: Searching for uid=john.luk base DN=OU=IT,dc=domain,dc=com [26/Jul/2016:08:27:27][http-bio-8443-exec-1]: Authenticating: User authentication failure: netscape.ldap.LDAPException: error result (1); 000004DC: LdapErr: DSID-0C0906DD, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1772 [26/Jul/2016:08:27:27][http-bio-8443-exec-1]: Authenticating: closing bad connection The directives (bellow) are used to bind the AD2008 and I already tested the account and it is working. auths.instance.UserDirEnrollment.ldap.ldapauth.bindDN=cn=Service Account,ou=IT,dc=domain,dc=com auths.instance.UserDirEnrollment.ldap.ldapauth.bindPWPrompt=password John Luk is applying for the certificate using the web enrollment process (caDirUserCert profile). What am I missing? Thx, sergio

2 1