From: Gary Lockyer Date: Thu, 28 Aug 2025 01:07:01 +0000 (+1200) Subject: config: add strong certificate binding enforcement X-Git-Tag: tdb-1.4.15~573 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=470ccdb340e716b8baa69049997a0d8b2432dffa;p=thirdparty%2Fsamba.git config: add strong certificate binding enforcement This parameter controls the enforcement of Windows Certificate bindings as outlined in "KB5014754: Certificate-based authentication changes on Windows domain controllers", when preforming certificate based kerberos authentication (PKINIT) Signed-off-by: Gary Lockyer Reviewed-by: Jennifer Sutton --- diff --git a/docs-xml/smbdotconf/security/kdccertbindingenforcement.xml b/docs-xml/smbdotconf/security/kdccertbindingenforcement.xml new file mode 100644 index 00000000000..fa1fab40ee8 --- /dev/null +++ b/docs-xml/smbdotconf/security/kdccertbindingenforcement.xml @@ -0,0 +1,109 @@ + + + This parameter controls the enforcement of Windows Certificate + bindings as outlined in + + KB5014754: Certificate-based authentication changes on + Windows domain controllers + , when performing certificate based kerberos authentication + (PKINIT) + + + The possible values are: + + + none + + No validation of the certificate mappings is performed + + + + compatibility + + Weak certificate mappings are permitted. + + + In compatibility mode for WEAK mappings the date the + certificate was issued must be after the date that the user + was created. + + + Unless + + has a value. In that case the certificate may have been + issued no more that number of minutes before the user + was created. + + + + full + + Only strong certificate mappings are + permitted. This is the default. + + + + + + + Certificate mappings are configured in the users + altSecurityIdentities + attribute and may be any of: + + + X509 Issuer and subject + Example: "X509:<I>IssuerName<S>SubjectName" + + The values provided for the issuer name and subject name + must match those in the users certificate exactly. + + WEAK + + + X509 Subject only + Example: "X509:<S>SubjectName" + + The value provided for the issuer subject name + must match that in the users certificate exactly. + + WEAK + + + X509 RFC822 + Example: "X509:<RFC822>test@example.com" + + Email address + + WEAK + + + X509 Issuer and serial number + Example: "X509:<I>IssuerName<SR>123456789" + + Certificate issuer and serial number + + STRONG + + + X509 Subject Key Identifier + Example: "<SKI>01234xxxxx" + STRONG + + + X509 public key SHA1 + Example: "X509:<SHA1-PUKEY>1234567890abcdef" + + The SHA1 hash of the certificates public key + + STRONG + + + + + +full + diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c index 4af9638ffd7..98dafbd25de 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -2957,6 +2957,7 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) lpcfg_do_global_parameter_var(lp_ctx, "dns port", "%d", DNS_SERVICE_PORT); lpcfg_do_global_parameter(lp_ctx, "kdc enable fast", "True"); + lpcfg_do_global_parameter(lp_ctx, "strong certificate binding enforcement", "full"); lpcfg_do_global_parameter(lp_ctx, "nt status support", "True"); diff --git a/lib/param/loadparm.h b/lib/param/loadparm.h index 32788e37391..a979a8ac8f6 100644 --- a/lib/param/loadparm.h +++ b/lib/param/loadparm.h @@ -183,6 +183,10 @@ struct file_lists { #define KERBEROS_ETYPES_STRONG 1 #define KERBEROS_ETYPES_LEGACY 2 +#define KDC_CERT_BINDING_NONE 0 +#define KDC_CERT_BINDING_COMPAT 1 +#define KDC_CERT_BINDING_FULL 2 + /* ACL compatibility */ enum acl_compatibility {ACL_COMPAT_AUTO, ACL_COMPAT_WINNT, ACL_COMPAT_WIN2K}; diff --git a/lib/param/param_table.c b/lib/param/param_table.c index 0283569882a..04d4d1dac84 100644 --- a/lib/param/param_table.c +++ b/lib/param/param_table.c @@ -294,6 +294,15 @@ static const struct enum_list enum_kerberos_encryption_types_vals[] = { {-1, NULL} }; +/* KDC Windows KB5014754 certificate binding enforcement modes */ + +static const struct enum_list enum_strong_cert_binding_enforcement_vals[] = { + {KDC_CERT_BINDING_NONE, "none"}, + {KDC_CERT_BINDING_COMPAT, "compatibility"}, + {KDC_CERT_BINDING_FULL, "full"}, + {-1, NULL} +}; + static const struct enum_list enum_printing[] = { {PRINT_SYSV, "sysv"}, {PRINT_AIX, "aix"}, diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index 1be550d9ad3..59ccbf99b81 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -960,6 +960,8 @@ void loadparm_s3_init_globals(struct loadparm_context *lp_ctx, Globals.kpasswd_port = 464; Globals.kdc_enable_fast = true; + Globals.strong_certificate_binding_enforcement + = KDC_CERT_BINDING_FULL; Globals.winbind_debug_traceid = true;