1*7f2fe78bSCy Schubert 2*7f2fe78bSCy Schubert<!DOCTYPE html> 3*7f2fe78bSCy Schubert 4*7f2fe78bSCy Schubert<html> 5*7f2fe78bSCy Schubert <head> 6*7f2fe78bSCy Schubert <meta charset="utf-8" /> 7*7f2fe78bSCy Schubert <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" /> 8*7f2fe78bSCy Schubert 9*7f2fe78bSCy Schubert <title>Authentication indicators — MIT Kerberos Documentation</title> 10*7f2fe78bSCy Schubert <link rel="stylesheet" type="text/css" href="../_static/pygments.css" /> 11*7f2fe78bSCy Schubert <link rel="stylesheet" type="text/css" href="../_static/agogo.css" /> 12*7f2fe78bSCy Schubert <link rel="stylesheet" type="text/css" href="../_static/kerb.css" /> 13*7f2fe78bSCy Schubert <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script> 14*7f2fe78bSCy Schubert <script src="../_static/jquery.js"></script> 15*7f2fe78bSCy Schubert <script src="../_static/underscore.js"></script> 16*7f2fe78bSCy Schubert <script src="../_static/doctools.js"></script> 17*7f2fe78bSCy Schubert <link rel="author" title="About these documents" href="../about.html" /> 18*7f2fe78bSCy Schubert <link rel="index" title="Index" href="../genindex.html" /> 19*7f2fe78bSCy Schubert <link rel="search" title="Search" href="../search.html" /> 20*7f2fe78bSCy Schubert <link rel="copyright" title="Copyright" href="../copyright.html" /> 21*7f2fe78bSCy Schubert <link rel="next" title="Administration programs" href="admin_commands/index.html" /> 22*7f2fe78bSCy Schubert <link rel="prev" title="HTTPS proxy configuration" href="https.html" /> 23*7f2fe78bSCy Schubert </head><body> 24*7f2fe78bSCy Schubert <div class="header-wrapper"> 25*7f2fe78bSCy Schubert <div class="header"> 26*7f2fe78bSCy Schubert 27*7f2fe78bSCy Schubert 28*7f2fe78bSCy Schubert <h1><a href="../index.html">MIT Kerberos Documentation</a></h1> 29*7f2fe78bSCy Schubert 30*7f2fe78bSCy Schubert <div class="rel"> 31*7f2fe78bSCy Schubert 32*7f2fe78bSCy Schubert <a href="../index.html" title="Full Table of Contents" 33*7f2fe78bSCy Schubert accesskey="C">Contents</a> | 34*7f2fe78bSCy Schubert <a href="https.html" title="HTTPS proxy configuration" 35*7f2fe78bSCy Schubert accesskey="P">previous</a> | 36*7f2fe78bSCy Schubert <a href="admin_commands/index.html" title="Administration programs" 37*7f2fe78bSCy Schubert accesskey="N">next</a> | 38*7f2fe78bSCy Schubert <a href="../genindex.html" title="General Index" 39*7f2fe78bSCy Schubert accesskey="I">index</a> | 40*7f2fe78bSCy Schubert <a href="../search.html" title="Enter search criteria" 41*7f2fe78bSCy Schubert accesskey="S">Search</a> | 42*7f2fe78bSCy Schubert <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__Authentication indicators">feedback</a> 43*7f2fe78bSCy Schubert </div> 44*7f2fe78bSCy Schubert </div> 45*7f2fe78bSCy Schubert </div> 46*7f2fe78bSCy Schubert 47*7f2fe78bSCy Schubert <div class="content-wrapper"> 48*7f2fe78bSCy Schubert <div class="content"> 49*7f2fe78bSCy Schubert <div class="document"> 50*7f2fe78bSCy Schubert 51*7f2fe78bSCy Schubert <div class="documentwrapper"> 52*7f2fe78bSCy Schubert <div class="bodywrapper"> 53*7f2fe78bSCy Schubert <div class="body" role="main"> 54*7f2fe78bSCy Schubert 55*7f2fe78bSCy Schubert <section id="authentication-indicators"> 56*7f2fe78bSCy Schubert<span id="auth-indicator"></span><h1>Authentication indicators<a class="headerlink" href="#authentication-indicators" title="Permalink to this headline">¶</a></h1> 57*7f2fe78bSCy Schubert<p>As of release 1.14, the KDC can be configured to annotate tickets if 58*7f2fe78bSCy Schubertthe client authenticated using a stronger preauthentication mechanism 59*7f2fe78bSCy Schubertsuch as <a class="reference internal" href="pkinit.html#pkinit"><span class="std std-ref">PKINIT</span></a> or <a class="reference internal" href="otp.html#otp-preauth"><span class="std std-ref">OTP</span></a>. These 60*7f2fe78bSCy Schubertannotations are called “authentication indicators.” Service 61*7f2fe78bSCy Schubertprincipals can be configured to require particular authentication 62*7f2fe78bSCy Schubertindicators in order to authenticate to that service. An 63*7f2fe78bSCy Schubertauthentication indicator value can be any string chosen by the KDC 64*7f2fe78bSCy Schubertadministrator; there are no pre-set values.</p> 65*7f2fe78bSCy Schubert<p>To use authentication indicators with PKINIT or OTP, first configure 66*7f2fe78bSCy Schubertthe KDC to include an indicator when that preauthentication mechanism 67*7f2fe78bSCy Schubertis used. For PKINIT, use the <strong>pkinit_indicator</strong> variable in 68*7f2fe78bSCy Schubert<a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>. For OTP, use the <strong>indicator</strong> variable in the 69*7f2fe78bSCy Schuberttoken type definition, or specify the indicators in the <strong>otp</strong> user 70*7f2fe78bSCy Schubertstring as described in <a class="reference internal" href="otp.html#otp-preauth"><span class="std std-ref">OTP Preauthentication</span></a>.</p> 71*7f2fe78bSCy Schubert<p>To require an indicator to be present in order to authenticate to a 72*7f2fe78bSCy Schubertservice principal, set the <strong>require_auth</strong> string attribute on the 73*7f2fe78bSCy Schubertprincipal to the indicator value to be required. If you wish to allow 74*7f2fe78bSCy Schubertone of several indicators to be accepted, you can specify multiple 75*7f2fe78bSCy Schubertindicator values separated by spaces.</p> 76*7f2fe78bSCy Schubert<p>For example, a realm could be configured to set the authentication 77*7f2fe78bSCy Schubertindicator value “strong” when PKINIT is used to authenticate, using a 78*7f2fe78bSCy Schubertsetting in the <a class="reference internal" href="conf_files/kdc_conf.html#kdc-realms"><span class="std std-ref">[realms]</span></a> subsection:</p> 79*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_indicator</span> <span class="o">=</span> <span class="n">strong</span> 80*7f2fe78bSCy Schubert</pre></div> 81*7f2fe78bSCy Schubert</div> 82*7f2fe78bSCy Schubert<p>A service principal could be configured to require the “strong” 83*7f2fe78bSCy Schubertauthentication indicator value:</p> 84*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kadmin setstr host/high.value.server require_auth strong 85*7f2fe78bSCy SchubertPassword for user/admin@KRBTEST.COM: 86*7f2fe78bSCy Schubert</pre></div> 87*7f2fe78bSCy Schubert</div> 88*7f2fe78bSCy Schubert<p>A user who authenticates with PKINIT would be able to obtain a ticket 89*7f2fe78bSCy Schubertfor the service principal:</p> 90*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kinit -X X509_user_identity=FILE:/my/cert.pem,/my/key.pem user 91*7f2fe78bSCy Schubert$ kvno host/high.value.server 92*7f2fe78bSCy Schuberthost/high.value.server@KRBTEST.COM: kvno = 1 93*7f2fe78bSCy Schubert</pre></div> 94*7f2fe78bSCy Schubert</div> 95*7f2fe78bSCy Schubert<p>but a user who authenticates with a password would not:</p> 96*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kinit user 97*7f2fe78bSCy SchubertPassword for user@KRBTEST.COM: 98*7f2fe78bSCy Schubert$ kvno host/high.value.server 99*7f2fe78bSCy Schubertkvno: KDC policy rejects request while getting credentials for 100*7f2fe78bSCy Schubert host/high.value.server@KRBTEST.COM 101*7f2fe78bSCy Schubert</pre></div> 102*7f2fe78bSCy Schubert</div> 103*7f2fe78bSCy Schubert<p>GSSAPI server applications can inspect authentication indicators 104*7f2fe78bSCy Schubertthrough the <a class="reference internal" href="../appdev/gssapi.html#gssapi-authind-attr"><span class="std std-ref">auth-indicators</span></a> name 105*7f2fe78bSCy Schubertattribute.</p> 106*7f2fe78bSCy Schubert</section> 107*7f2fe78bSCy Schubert 108*7f2fe78bSCy Schubert 109*7f2fe78bSCy Schubert <div class="clearer"></div> 110*7f2fe78bSCy Schubert </div> 111*7f2fe78bSCy Schubert </div> 112*7f2fe78bSCy Schubert </div> 113*7f2fe78bSCy Schubert </div> 114*7f2fe78bSCy Schubert <div class="sidebar"> 115*7f2fe78bSCy Schubert 116*7f2fe78bSCy Schubert <h2>On this page</h2> 117*7f2fe78bSCy Schubert <ul> 118*7f2fe78bSCy Schubert<li><a class="reference internal" href="#">Authentication indicators</a></li> 119*7f2fe78bSCy Schubert</ul> 120*7f2fe78bSCy Schubert 121*7f2fe78bSCy Schubert <br/> 122*7f2fe78bSCy Schubert <h2>Table of contents</h2> 123*7f2fe78bSCy Schubert <ul class="current"> 124*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../user/index.html">For users</a></li> 125*7f2fe78bSCy Schubert<li class="toctree-l1 current"><a class="reference internal" href="index.html">For administrators</a><ul class="current"> 126*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="install.html">Installation guide</a></li> 127*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="conf_files/index.html">Configuration Files</a></li> 128*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="realm_config.html">Realm configuration decisions</a></li> 129*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="database.html">Database administration</a></li> 130*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="dbtypes.html">Database types</a></li> 131*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="lockout.html">Account lockout</a></li> 132*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="conf_ldap.html">Configuring Kerberos with OpenLDAP back-end</a></li> 133*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="appl_servers.html">Application servers</a></li> 134*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="host_config.html">Host configuration</a></li> 135*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="backup_host.html">Backups of secure hosts</a></li> 136*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="pkinit.html">PKINIT configuration</a></li> 137*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="otp.html">OTP Preauthentication</a></li> 138*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="spake.html">SPAKE Preauthentication</a></li> 139*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="dictionary.html">Addressing dictionary attack risks</a></li> 140*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="princ_dns.html">Principal names and DNS</a></li> 141*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="enctypes.html">Encryption types</a></li> 142*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="https.html">HTTPS proxy configuration</a></li> 143*7f2fe78bSCy Schubert<li class="toctree-l2 current"><a class="current reference internal" href="#">Authentication indicators</a></li> 144*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="admin_commands/index.html">Administration programs</a></li> 145*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="../mitK5defaults.html">MIT Kerberos defaults</a></li> 146*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="env_variables.html">Environment variables</a></li> 147*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="troubleshoot.html">Troubleshooting</a></li> 148*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="advanced/index.html">Advanced topics</a></li> 149*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="various_envs.html">Various links</a></li> 150*7f2fe78bSCy Schubert</ul> 151*7f2fe78bSCy Schubert</li> 152*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../appdev/index.html">For application developers</a></li> 153*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../plugindev/index.html">For plugin module developers</a></li> 154*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../build/index.html">Building Kerberos V5</a></li> 155*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../basic/index.html">Kerberos V5 concepts</a></li> 156*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../formats/index.html">Protocols and file formats</a></li> 157*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../mitK5features.html">MIT Kerberos features</a></li> 158*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../build_this.html">How to build this documentation from the source</a></li> 159*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../about.html">Contributing to the MIT Kerberos Documentation</a></li> 160*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../resources.html">Resources</a></li> 161*7f2fe78bSCy Schubert</ul> 162*7f2fe78bSCy Schubert 163*7f2fe78bSCy Schubert <br/> 164*7f2fe78bSCy Schubert <h4><a href="../index.html">Full Table of Contents</a></h4> 165*7f2fe78bSCy Schubert <h4>Search</h4> 166*7f2fe78bSCy Schubert <form class="search" action="../search.html" method="get"> 167*7f2fe78bSCy Schubert <input type="text" name="q" size="18" /> 168*7f2fe78bSCy Schubert <input type="submit" value="Go" /> 169*7f2fe78bSCy Schubert <input type="hidden" name="check_keywords" value="yes" /> 170*7f2fe78bSCy Schubert <input type="hidden" name="area" value="default" /> 171*7f2fe78bSCy Schubert </form> 172*7f2fe78bSCy Schubert 173*7f2fe78bSCy Schubert </div> 174*7f2fe78bSCy Schubert <div class="clearer"></div> 175*7f2fe78bSCy Schubert </div> 176*7f2fe78bSCy Schubert </div> 177*7f2fe78bSCy Schubert 178*7f2fe78bSCy Schubert <div class="footer-wrapper"> 179*7f2fe78bSCy Schubert <div class="footer" > 180*7f2fe78bSCy Schubert <div class="right" ><i>Release: 1.21.3</i><br /> 181*7f2fe78bSCy Schubert © <a href="../copyright.html">Copyright</a> 1985-2024, MIT. 182*7f2fe78bSCy Schubert </div> 183*7f2fe78bSCy Schubert <div class="left"> 184*7f2fe78bSCy Schubert 185*7f2fe78bSCy Schubert <a href="../index.html" title="Full Table of Contents" 186*7f2fe78bSCy Schubert >Contents</a> | 187*7f2fe78bSCy Schubert <a href="https.html" title="HTTPS proxy configuration" 188*7f2fe78bSCy Schubert >previous</a> | 189*7f2fe78bSCy Schubert <a href="admin_commands/index.html" title="Administration programs" 190*7f2fe78bSCy Schubert >next</a> | 191*7f2fe78bSCy Schubert <a href="../genindex.html" title="General Index" 192*7f2fe78bSCy Schubert >index</a> | 193*7f2fe78bSCy Schubert <a href="../search.html" title="Enter search criteria" 194*7f2fe78bSCy Schubert >Search</a> | 195*7f2fe78bSCy Schubert <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__Authentication indicators">feedback</a> 196*7f2fe78bSCy Schubert </div> 197*7f2fe78bSCy Schubert </div> 198*7f2fe78bSCy Schubert </div> 199*7f2fe78bSCy Schubert 200*7f2fe78bSCy Schubert </body> 201*7f2fe78bSCy Schubert</html>