<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>No, it does not require IPA.</p>
<p>It does require something as Keycloak or equivalent (an OpenID
Connect Provider).</p>
<p>Generally those OPs provide features such as MFA or Identity
Federation.</p>
<p>And there are valves that provide OIDC support on the application
side.</p>
<p>Best</p>
<p>P<br>
</p>
<div class="moz-cite-prefix">Le 02/07/2020 à 17:18, Dinesh Prasanth
Moluguwan Krishnamoorthy a écrit :<br>
</div>
<blockquote type="cite"
cite="mid:CAMiVupGpQE=1xT9aJsAxWHWgOY+TpWuM65Q1tVLLnVXtHvhBOg@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div>Pascal,</div>
<div><br>
</div>
<div>I don't think Dogtag Web UI supports it. The feature you
are suggesting (sounds to me like it) requires a full fledged
IDM deployment. You can look at FreeIPA, if you are looking
for MFA.</div>
<div><br>
</div>
<div><a href="https://www.freeipa.org/page/About"
moz-do-not-send="true">FreeIPA</a> uses Dogtag CA as its
backend to issue certs and also combines several other
components to offer a full-fledged IDM deployment.<br>
</div>
<div><br>
</div>
<div>Nonetheless, I'm CC'ing pki-devel to see if other
developers have any thoughts.</div>
<div><br>
</div>
<div>Regards,</div>
<div>--Dinesh<br>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Mon, Jun 29, 2020 at 4:47
PM Pascal Jakobi <<a href="mailto:pascal.jakobi@gmail.com"
moz-do-not-send="true">pascal.jakobi@gmail.com</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>Dinesh</p>
<p>In fact all I am doing here is in order to offer a GUI
that may be used with OpenId Connect (ie Keycloak or
so...). The value of this is that it is much more flexible
than certificate based authentication. You can have MFA,
etc....</p>
<p>So my question : is there a way to remove the certificate
based access control in Dogtag's UI ? I would replace it
with a tomcat valve that provides OIDC support.</p>
<p>Best<br>
</p>
<div>-- <br>
<b>Pascal Jakobi</b> 116 rue de Stalingrad 93100
Montreuil, France<br>
<a href="mailto:pascal.jakobi@gmail.com" target="_blank"
moz-do-not-send="true">pascal.jakobi@gmail.com</a> - +33
6 87 47 58 19</div>
</div>
</blockquote>
</div>
</blockquote>
<div class="moz-signature">-- <br>
<b>Pascal Jakobi</b>
116 rue de Stalingrad 93100 Montreuil, France<br>
<a class="moz-txt-link-abbreviated" href="mailto:pascal.jakobi@gmail.com">pascal.jakobi@gmail.com</a> - +33 6 87 47 58 19</div>
</body>
</html>