Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Certificate autoenrollment POC #743

Closed
wants to merge 2 commits into from
Closed

Certificate autoenrollment POC #743

wants to merge 2 commits into from

Commits on Jul 17, 2023

  1. Certificate autoenrollment POC 

    This is a POC that leverages the samba implementation of certificate
autoenrollment. It contains a few patches and fixes on top of the
samba#master version of the `gp_cert_auto_enroll_ext.py` file, that will
ultimately be upstreamed.

Autoenrollment is performed via a separate policy manager that runs a
helper Python script (`cert-autoenroll`) which communicates with the
Windows CEP/CES services through Samba. For better control and to avoid
unexpected behavior we vendor the required Samba files, which are
confirmed to work on all Ubuntu versions starting with (and including)
Jammy (22.04).

Samba has its own cache mechanism which stores information concerning
the applied GPOs which we are using in order to ensure idempotency.

This is a crude implementation in the sense that we let Samba directly
parse the freshly downloaded `Registry.pol` files from the DC. This
operation is unreliable and prone to races since the cached pol files
can be overwritten by subsequent runs of adsys (e.g. another user
applies their policies), so the ulimate goal is to perform the GPO
parsing process within adsys (using the mmapped files) and defer to
Samba for the CA download and certificate request processes.

This work will remain unmerged, to reflect its proof-of-concept
status, and subsequent work will take place in separate PRs.

Fixes UDENG-850
    @GabrielNagy
    GabrielNagy committed Jul 17, 2023
    Configuration menu
    Copy the full SHA
    308a3cd View commit details
    Browse the repository at this point in the history

  2. Add CLI command to dump certificate enroll script 

    Similar to the adsys-gpolist, provide a way for users to dump the
certificate autoenrollment script for debugging purposes.
    @GabrielNagy
    GabrielNagy committed Jul 17, 2023
    Configuration menu
    Copy the full SHA
    6637f93 View commit details
    Browse the repository at this point in the history