<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>I would be interested into trying this.</p>
<p>1/ Is there a list of the "environment variables" (I guess these
are HTML headers) that dogtag needs ? Did not find it....</p>
<p>2/ If I set an Apache reverse proxy, do I still need to insert an
admin certificate in the browser's wallet ?</p>
<p>Thanks !</p>
<p>P<br>
</p>
<div class="moz-cite-prefix">Le 03/07/2020 à 05:05, Fraser Tweedale
a écrit :<br>
</div>
<blockquote type="cite" cite="mid:20200703030548.GA2874055@T470s">
<pre class="moz-quote-pre" wrap="">On Thu, Jul 02, 2020 at 11:35:22AM -0400, Alex Scheel wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">There's a proposal for GSS-API auth:
<a class="moz-txt-link-freetext" href="https://www.dogtagpki.org/wiki/GSS-API_authentication">https://www.dogtagpki.org/wiki/GSS-API_authentication</a>
<a class="moz-txt-link-freetext" href="https://www.freeipa.org/page/V4/Dogtag_GSS-API_Authentication">https://www.freeipa.org/page/V4/Dogtag_GSS-API_Authentication</a>
However, it isn't implemented yet. This would probably suffice for
SSO though.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">Although the design doc is called GSS-API Authentication, the
feature is actually a more general than that. If you put Dogtag
behind a web frontend (e.g. Apache), you can authenticate users via
SAML or OIDC and convey the appropriate environment variables, and
it will work. Dogtag just sees an external principal and their
groups conveyed via AJP request attributes.
Cheers,
Fraser
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">
My 2c,
- Alex
----- Original Message -----
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">From: "Dinesh Prasanth Moluguwan Krishnamoorthy" <a class="moz-txt-link-rfc2396E" href="mailto:dmoluguw@redhat.com"><dmoluguw@redhat.com></a>
To: "Pascal Jakobi" <a class="moz-txt-link-rfc2396E" href="mailto:pascal.jakobi@gmail.com"><pascal.jakobi@gmail.com></a>
Cc: <a class="moz-txt-link-abbreviated" href="mailto:pki-devel@redhat.com">pki-devel@redhat.com</a>
Sent: Thursday, July 2, 2020 11:18:53 AM
Subject: Re: [Pki-devel] SSO
Pascal,
I don't think Dogtag Web UI supports it. The feature you are suggesting
(sounds to me like it) requires a full fledged IDM deployment. You can look
at FreeIPA, if you are looking for MFA.
FreeIPA <a class="moz-txt-link-rfc2396E" href="https://www.freeipa.org/page/About"><https://www.freeipa.org/page/About></a> uses Dogtag CA as its backend
to issue certs and also combines several other components to offer a
full-fledged IDM deployment.
Nonetheless, I'm CC'ing pki-devel to see if other developers have any
thoughts.
Regards,
--Dinesh
On Mon, Jun 29, 2020 at 4:47 PM Pascal Jakobi <a class="moz-txt-link-rfc2396E" href="mailto:pascal.jakobi@gmail.com"><pascal.jakobi@gmail.com></a>
wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Dinesh
In fact all I am doing here is in order to offer a GUI that may be used
with OpenId Connect (ie Keycloak or so...). The value of this is that it is
much more flexible than certificate based authentication. You can have MFA,
etc....
So my question : is there a way to remove the certificate based access
control in Dogtag's UI ? I would replace it with a tomcat valve that
provides OIDC support.
Best
--
*Pascal Jakobi* 116 rue de Stalingrad 93100 Montreuil, France
<a class="moz-txt-link-abbreviated" href="mailto:pascal.jakobi@gmail.com">pascal.jakobi@gmail.com</a> - +33 6 87 47 58 19
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
_______________________________________________
Pki-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Pki-devel@redhat.com">Pki-devel@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/pki-devel">https://www.redhat.com/mailman/listinfo/pki-devel</a>
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
_______________________________________________
Pki-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Pki-devel@redhat.com">Pki-devel@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/pki-devel">https://www.redhat.com/mailman/listinfo/pki-devel</a>
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
</blockquote>
<div class="moz-signature">-- <br>
<b>Pascal Jakobi</b>
116 rue de Stalingrad 93100 Montreuil, France<br>
<a class="moz-txt-link-abbreviated" href="mailto:pascal.jakobi@gmail.com">pascal.jakobi@gmail.com</a> - +33 6 87 47 58 19</div>
</body>
</html>