https://fedoraproject.org/wiki/Changes/Passkey_authentication_centrally_managed_users This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee. == Summary == For centrally managed users on Fedora systems enrolled into Active Directory, FreeIPA, or LDAP, enable capability to log-in to desktop or a console terminal with a FIDO2-compatible device supported by the libfido2 library. For FreeIPA, additionally, once user has been authenticated with the FIDO2-compatible device, allow to issue a Kerberos ticket. Note: for the purpose of this feature, passkey is a FIDO2 compatible device supported by the libfido2 library. If a hardware token implements other authentication mechanisms aside from FIDO2, these aren't considered by this feature. == Owner == * Name: [[User:ipedrosa| Iker Pedrosa]], [[User:Abbra| Alexander Bokovoy]] * Email: <ipedrosa@xxxxxxxxxx>, <abokovoy@xxxxxxxxxx> == Detailed Description == Passwordless authentication methods to log into Linux systems became a hot topic in the past few years. Various organizations started to mandate more secure methods of authentication, including governments and regulated industries. FIDO2 tokens, along with smartcards, represent two passwordless authentication methods mandated by the US government in their Zero Trust architecture, for example. While Fedora Project already provides a smartcard-based authentication method for all centrally-managed user accounts (LDAP, Active Directory, FreeIPA), support for FIDO2 tokens is rudimentary: only `pam_u2f` method is provided which currently only allows to define FIDO2 tokens associated with the users locally on the machine. No centralized storage of enrolled tokens is provided. SSSD and FreeIPA upstream projects have already implemented a way to authenticate a user with the help of the passkey and issue a Kerberos ticket. This change will make sure that this feature is enabled in Fedora, and that it works. == Feedback == == Benefit to Fedora == Integration of a passkey support in SSSD and FreeIPA to Fedora enables the possibility to configure a fully passwordless login experience in Fedora. While this will require few iterations to enable a complete passwordless deployment, allowing admins to start with centralized user accounts with passkeys will give a wider base to iterate from. The passkey authentication is in line with the modernization of the technology and security practices, as it enables stronger identity and access controls, including multi-factor authentication (MFA). This method of authentication protects the user and the organization against phishing attacks by providing a strong cryptography tied to an external hardware authenticator. In the future we expect to add support for increasingly popular passkey implementations on mobile devices. This, however, is not a focus of the initial release. FreeIPA extension to issue Kerberos tickets based on the passkey authentication allows to solve usability issues in accessing network resources in a passwordless way. This extension also provides Kerberos authentication indicator support, making passkey authentication visible to Kerberos services. This can be used, for example, for passwordless SUDO access with `pam_sss_gss` module when a Kerberos ticket was obtained with a specific (passkey) authentication mechanism. == Scope == * Proposal owners: # Enable passkey feature in SSSD # Enable passkey feature in FreeIPA # Adjust SELinux policies to allow access to USB-enabled passkeys through libfido2 * Other developers: N/A * Release engineering: N/A * Policies and guidelines: N/A * Trademark approval: N/A * Alignment with Community Initiatives: N/A == Upgrade/compatibility impact == No impact is expected. sssd provides a new subpackage (`sssd-passkey`) that includes the new functionality. For FreeIPA environments the new subpackage will be automatically pulled in by the `freeipa-client` package as a dependency. == How To Test == The following instructions assume that you are using a SSSD and FreeIPA to manage users. # Install the `sssd-passkey` subpackage, and update the FreeIPA client and server. # Enable passkey authentication for the user, remember to replace the username where applicable. <pre> $ ipa user-mod USERNAME --user-auth-type=passkey </pre> # Connect the passkey to the system and register it. <pre> $ ipa user-add-passkey USERNAME --register </pre> # Log in. <pre> $ su - USERNAME@DOMAIN Insert your passkey device, then press ENTER. Enter PIN: ... </pre> If you are able to log in, then everything worked correctly. If it didn't work and you'd like to debug it, or you'd like to use another LDAP-like server, or you'd like to know more, then check [https://ikerexxe.github.io/idm/2022/12/19/passkey-central-auth.html| the blog post] I wrote about how to test this feature. == User Experience == A centrally managed user will be able to log in using the passkey authentication mechanism, and if they are using FreeIPA they will get a Kerberos ticket alongside the authentication. For those using the graphical interface and passkeys for log-in you will notice that the messages aren't completely visible. We are working with GNOME developers to improve overall login experience with passwordless authentication methods. This work is expected to land in Fedora once ready. == Dependencies == N/A == Contingency Plan == * Contingency mechanism: N/A * Contingency deadline: N/A * Blocks release? No == Documentation == # [https://sssd.io/design-pages/passkey_authentication.html SSSD design page for local passkey authentication] # [https://sssd.io/design-pages/passkey_kerberos.html SSSD design page for passkey Kerberos integration] # [https://freeipa.readthedocs.io/en/latest/designs/passkeys.html FreeIPA design page for passkey authentication] == Release Notes == Passkey authentication for centrally managed users. For FreeIPA users a Kerberos ticket is also issued. -- Aoife Moloney Product Owner Community Platform Engineering Team Red Hat EMEA Communications House Cork Road Waterford _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
