<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word"> <div class="WordSection1"> Hi Christian,<o:p></o:p> <o:p> </o:p> Thanks for following up.<o:p></o:p> <o:p> </o:p> You are correct, I have testing UID/PWD auth with SCEP and that is working fine. <o:p></o:p> <o:p> </o:p> As mentioned the only reason I am not able to use this method, is because the UID/IP address is using the DHCP assigned uplink IP address. For my solution we need a more deterministic UID, as such I was attempting to use the CN/PWD auth with SCEP.<o:p></o:p> <o:p> </o:p> The way I setup the CN/PWD auth with SCEP is first get a working UID/PWD auth with SCEP setup.<o:p></o:p> Then edit the “…/ca/CS.cfg”:<o:p></o:p> auths.instance.flatFileAuth.authAttributes=PWD<o:p></o:p> auths.instance.flatFileAuth.deferOnFailure=true<o:p></o:p> auths.instance.flatFileAuth.fileName=/var/lib/pki/pki-tomcat/conf/ca/flatfile.txt<o:p></o:p> auths.instance.flatFileAuth.keyAttributes=CN<o:p></o:p> auths.instance.flatFileAuth.pluginName=FlatFileAuth<o:p></o:p> <o:p> </o:p> Then edit the “…/ca/flatfile.txt”:<o:p></o:p> <o:p> </o:p> CN:dev-sec-a-2.example.com<o:p></o:p> PWD:password<o:p></o:p> <o:p> </o:p> Then I restart the service and test.<o:p></o:p> <o:p> </o:p> Cheers,<o:p></o:p> Rohan<o:p></o:p> <o:p> </o:p> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Christina Fu <cfu@redhat.com> Date: Wednesday, December 9, 2020 at 6:16 PM To: Rohan Raymore (rraymore) <rraymore@cisco.com> Cc: pki-users@redhat.com <pki-users@redhat.com> Subject: Re: [Pki-users] Dogtag PKI CA not enrolling router with CN or when IP specified in Trustpoint confg<o:p></o:p> </div> <div> <div> Hi Rohan,<o:p></o:p> </div> <div> I have only played with IP UID/PWD auth with SCEP, which I just tried and seems to be working.<o:p></o:p> </div> <div> Could you maybe give me info on how you set up CN/PWD and I could look into that.<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> thanks,<o:p></o:p> </div> <div> Christina<o:p></o:p> </div> </div> <o:p> </o:p> <div> <div> On Sun, Nov 29, 2020 at 11:57 PM Rohan Raymore (rraymore) <<a href="mailto:rraymore@cisco.com">rraymore@cisco.com</a>> wrote:<o:p></o:p> </div> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt"> <div> <div> Hello,<o:p></o:p> <o:p></o:p> I am looking for some guidance/assistance with a dogtag-pki CA server setup that I am testing.<o:p></o:p> <o:p></o:p> Environment:<o:p></o:p> Cisco ASR router<o:p></o:p> CentOS 7 vm<o:p></o:p> PKI version 10.5.18-7.e17 installed<o:p></o:p> Configured to use flatfile to authenticate Cisco router using UID/PWD via SCEP<o:p></o:p> I am able to successfully authenticate and enroll the router via SCEP using UID/PWD in flatfile<o:p></o:p> <o:p></o:p> Issue:<o:p></o:p> The UID=IP-address of the router interface toward the CA server, this IP is assigned via DHCP, thus not deterministic.<o:p></o:p> When I configured an IP address of a Loopback interface under the Trustpoint configuration of the router I can see that it seen by the CA in the logs but it is not used for authentication/enroll<o:p></o:p> I tried to change the CS.cfg file to use the CN/PWD to authenticate, however it appears I may have missed something as it fails with a password null.<o:p></o:p> <o:p></o:p> Can you please assist with providing one of two options:<o:p></o:p> <ol style="margin-top:0in;font-variant-caps:normal;text-align:start;word-spacing:0px" start="1" type="1"> <li class="gmail-m2246783088893613138msolistparagraph" style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l1 level1 lfo3"> How to authenticate/enroll router via Loopback interface IP address that is specified in the Trustpoint configuration of the router?<o:p></o:p></li><li class="gmail-m2246783088893613138msolistparagraph" style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l1 level1 lfo3"> How to authenticate/enroll the router using the CN/PWD in the flatfile?<o:p></o:p></li></ol> <o:p></o:p> <o:p></o:p> Thanks in advance for your assistance!<o:p></o:p> <o:p></o:p> See below some output from the debug file:<o:p></o:p> <snip><o:p></o:p> [30/Nov/2020:05:49:42][http-bio-8080-exec-21]: Got authenticator=com.netscape.cms.authentication.FlatFileAuth<o:p></o:p> [30/Nov/2020:05:49:42][http-bio-8080-exec-21]: FlatFileAuth: keys.length = 1<o:p></o:p> [30/Nov/2020:05:49:42][http-bio-8080-exec-21]: FlatFileAuth: concatenating: 10.0.1.1<o:p></o:p> [30/Nov/2020:05:49:42][http-bio-8080-exec-21]: FlatFileAuth: putting: key 10.0.1.1 <-------- this is the IP I have configured in flatfile<o:p></o:p> [30/Nov/2020:05:49:42][http-bio-8080-exec-21]: FlatFileAuth: keys.length = 1<o:p></o:p> [30/Nov/2020:05:49:42][http-bio-8080-exec-21]: FlatFileAuth: concatenating: null<o:p></o:p> [30/Nov/2020:05:49:42][http-bio-8080-exec-21]: FlatFileAuth: putting: key<o:p></o:p> [30/Nov/2020:05:49:42][http-bio-8080-exec-21]: FlatFileAuth: concatenating string i=0 keyAttrs[0] = UID<o:p></o:p> [30/Nov/2020:05:49:42][http-bio-8080-exec-21]: FlatFileAuth: authenticating user: finding user from key: 10.1.1.1 <----- this is the router outside interface IP<o:p></o:p> [30/Nov/2020:05:49:42][http-bio-8080-exec-21]: FlatFileAuth: User not found in password file.<o:p></o:p> [30/Nov/2020:05:49:42][http-bio-8080-exec-21]: operation failure - Invalid Credential.<o:p></o:p> <snap><o:p></o:p> <o:p></o:p> <snip><o:p></o:p> [30/Nov/2020:07:24:02][http-bio-8080-exec-4]: Found profile=caRouterCert<o:p></o:p> [30/Nov/2020:07:24:02][http-bio-8080-exec-4]: Retrieving authenticator<o:p></o:p> [30/Nov/2020:07:24:02][http-bio-8080-exec-4]: Got authenticator=com.netscape.cms.authentication.FlatFileAuth<o:p></o:p> [30/Nov/2020:07:24:02][http-bio-8080-exec-4]: FlatFileAuth: keys.length = 1<o:p></o:p> [30/Nov/2020:07:24:02][http-bio-8080-exec-4]: FlatFileAuth: concatenating: <a href="http://dev-sec-a-2.example.com" target="_blank">dev-sec-a-2.example.com</a><o:p></o:p> [30/Nov/2020:07:24:02][http-bio-8080-exec-4]: FlatFileAuth: putting: key <a href="http://dev-sec-a-2.example.com" target="_blank">dev-sec-a-2.example.com</a><o:p></o:p> [30/Nov/2020:07:24:02][http-bio-8080-exec-4]: FlatFileAuth: keys.length = 1<o:p></o:p> [30/Nov/2020:07:24:02][http-bio-8080-exec-4]: FlatFileAuth: concatenating: null<o:p></o:p> [30/Nov/2020:07:24:02][http-bio-8080-exec-4]: FlatFileAuth: putting: key<o:p></o:p> [30/Nov/2020:07:24:02][http-bio-8080-exec-4]: FlatFileAuth: concatenating string i=0 keyAttrs[0] = CN<o:p></o:p> [30/Nov/2020:07:24:02][http-bio-8080-exec-4]: operation failure - Authentication credential for CN is null.<o:p></o:p> <snap><o:p></o:p> <o:p></o:p> Regards,<o:p></o:p> Rohan Raymore <img border="0" width="80" height="43" style="width:.8333in;height:.4479in" id="gmail-m_2246783088893613138Picture_x0020_1" src="cid:image001.png@01D6CED8.0B1A7770" alt="signature_652684385"> <a href="http://directory.cisco.com/dir/details/rraymore" target="_blank">Rohan Raymore</a> </div> </div> _______________________________________________ Pki-users mailing list <a href="mailto:Pki-users@redhat.com" target="_blank">Pki-users@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/pki-users" target="_blank">https://www.redhat.com/mailman/listinfo/pki-users</a><o:p></o:p> </blockquote> </div> </div> </body> </html>