MIT Kerberos Documentation

PKINIT certificate authorization interface (certauth)ΒΆ

The certauth interface allows customization of the X.509 certificate extension and attribute requirements placed on X.509 certificates used by PKINIT enabled clients, as part of the kdcpreauth PKINIT server module. For a detailed description of the certauth interface, see the header file <krb5/certauth_plugin.h>

A certauth module implements the authorize method to determine if a client’s certificate is authorized to authenticate a client principal. authorize receives the DER encoded certificate, client request principal, and a pointer to the client’s krb5_db_entry (for modules that link against libkdb5). It returns the authorization status and optionally outputs a list of authentication indicator strings that are added to the ticket. A module must use its own internal or library-provided ASN.1 certificate decoder.

A module can optionally create and destroy its module data with the init and fini methods. Module data has the abstract type krb5_certauth_moddata.

If a module allocates and returns a list of authentication indicators from authorize, it should also implement the free_ind method to free the list.

Three builtin modules are provided with the certauth interface. * The pkinitsrv_san module implements the subjectAltName

requirements outlined in PKINIT configuration, obeying the kdc.conf pkinit_allow_upn option.
  • The pkinitsrv_eku module implements the Extended Key Usage requirements outlined in PKINIT configuration, obeying the kdc.conf pkinit_eku_checking option.
  • The dbmatch builtin module reads the pkinit_cert_match principal attribute string for an expression in the same format used for the krb5.conf pkinit_cert_match option.