** Also affects: python-requests-gssapi (Ubuntu Stonking)
Importance: Undecided
Status: New
** Also affects: python-cepces (Ubuntu Stonking)
Importance: Undecided
Status: New
** Also affects: python-requests-gssapi (Ubuntu Tenacious)
Importance: Wishlist
Status: Confirmed
** Also affects: python-cepces (Ubuntu Tenacious)
Importance: Wishlist
Status: Confirmed
** Changed in: python-cepces (Ubuntu Tenacious)
Status: Confirmed => In Progress
** Changed in: python-cepces (Ubuntu Stonking)
Status: New => In Progress
** Changed in: python-cepces (Ubuntu Stonking)
Assignee: (unassigned) => Dariusz Gadomski (dgadomski)
** Changed in: python-cepces (Ubuntu Tenacious)
Assignee: (unassigned) => Dariusz Gadomski (dgadomski)
** Also affects: python-requests-gssapi (Ubuntu Jammy)
Importance: Undecided
Status: New
** Also affects: python-cepces (Ubuntu Jammy)
Importance: Undecided
Status: New
** Also affects: python-requests-gssapi (Ubuntu Noble)
Importance: Undecided
Status: New
** Also affects: python-cepces (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: python-cepces (Ubuntu Jammy)
Status: New => In Progress
** Changed in: python-cepces (Ubuntu Noble)
Status: New => In Progress
** Description changed:
+ [ Impact ]
+
+ python3-cepces is the certmonger helper that Ubuntu's Active Directory
+ integration uses for certificate auto-enrollment (through adsys). It
+ requests certificates from AD CS using the Certificate Enrollment Policy
+ (CEP) and Certificate Enrollment Services (CES) web services.
+
+ Windows Server 2025 turns on Extended Protection for Authentication (EPA)
+ by default on the AD CS web enrollment endpoints. Microsoft did this to
+ stop NTLM relay attacks:
+
https://msrc.microsoft.com/blog/2024/12/mitigating-ntlm-relay-attacks-by-default/
+ Admins can also enable EPA by hand on older Windows Server releases. With
+ EPA on, IIS only accepts Negotiate/Kerberos authentication if it is bound
+ to the TLS channel, using tls-server-end-point channel bindings
+ (RFC 5929).
+
+ cepces 0.3.7 in Ubuntu sends no channel bindings, so the server rejects
+ every request with HTTP 401. Ubuntu clients cannot enroll or renew
+ certificates from current Microsoft PKI deployments, and AD certificate
+ auto-enrollment is broken for these users.
+
+ Upstream fixed this in cepces 0.3.8 and 0.3.10. The fix makes cepces use
+ the SPNEGO mechanism explicitly and send TLS channel bindings. Upstream's
+ version depends on the channel_bindings support added in requests_gssapi
+ 1.4.0. Ubuntu ships 1.2.3 in all affected series, so the backport adds a
+ small HTTPSPNEGOAuth subclass inside cepces. It provides the same
+ channel_bindings="tls-server-end-point" option on top of requests_gssapi
+ 1.2.x. Neither requests_gssapi nor any other dependency needs a change.
+
+ [ Test Plan ]
+
+ Environment:
+ - An AD domain with an Enterprise CA on Windows Server 2025, with the CEP
+ and CES roles installed and set up for Kerberos authentication
+ (ADPolicyProvider_CEP_Kerberos / ..._CES_Kerberos). Leave EPA at its
+ 2025 default ("Required" in IIS -> Authentication -> Windows
+ Authentication -> Advanced Settings -> Extended Protection).
+ - A certificate template the computer account is allowed to enroll from.
+ - An Ubuntu Noble client joined to the domain (realm join) with a valid
+ machine keytab, and with certmonger and python3-cepces installed.
+
+ Reproducer:
+ 1. Register the CA with certmonger:
+ sudo getcert add-ca -c cepces -e '/usr/libexec/certmonger/cepces-submit
--server=<ca-fqdn> --keytab=/etc/krb5.keytab --principals=<HOST>$@<REALM>'
+ (Or apply a certificate auto-enrollment GPO through adsys:
+ adsysctl update -m -v)
+ 2. Ask for a certificate:
+ sudo getcert request -c cepces -T <template> -I test -k /tmp/test.key
-f /tmp/test.crt -w
+ sudo getcert list -i test
+ 3. Current package: the request stays in CA_UNREACHABLE or CA_REJECTED.
+ cepces-submit and /var/log/cepces/cepces.log show "401 Unauthorized"
+ from the CEP endpoint, and IIS logs a 401 status.
+ 4. Fixed package: the request reaches MONITORING and /tmp/test.crt holds
+ a certificate issued by the CA.
+
+ Regression checks:
+ - Repeat the steps against a Windows Server 2019/2022 CA with EPA "Off"
+ and with EPA "Accept". Enrollment must work in both cases, as it does
+ today.
+ - Run "getcert resubmit -i test" to confirm renewal still works.
+ - Check that adsys certificate auto-enrollment still works end to end
+ (adsysctl update -m).
+ - The package autopkgtest (python3 -m unittest discover) must pass.
+
+ [ Where problems could occur ]
+
+ - Only auth=Kerberos (TransportKerberosAuthentication), the default and
+ the method adsys uses, is changed. Anonymous, username/password and
+ certificate authentication are untouched.
+ - The Kerberos path now asks GSSAPI for the SPNEGO mechanism instead of
+ the default mechanism (raw Kerberos). AD/IIS servers expect Negotiate
+ (SPNEGO), so this matches upstream and Windows clients. A non-Windows
+ CEP/CES server that only accepts raw Kerberos tokens could start
+ rejecting requests.
+ - The client now always sends channel bindings. On servers with EPA
+ "Off", Windows ignores them. With EPA "Accept" or "Required", the
+ server checks them. If something terminates and re-encrypts TLS
+ between client and CA (a TLS-inspecting proxy or a load balancer that
+ offloads TLS), the bindings won't match, and enrollment can fail where
+ it used to succeed when EPA was "Accept". Windows clients behave the
+ same way, and that is the purpose of EPA.
+ - The channel binding value comes from the server certificate, read off
+ the urllib3 socket. If no socket is available (the connection was
+ already released, or authentication is opportunistic/pre-emptive), the
+ backport raises SPNEGOExchangeError and authentication fails. cepces
+ does not use opportunistic authentication.
+ - The certificate hash follows RFC 5929 section 4.1, where MD5 and SHA-1
+ become SHA-256. This matches Windows, but it differs from
+ requests_gssapi 1.4.0, which hashes with SHA-1 for SHA-1-signed
+ certificates.
+ - The new subclass copies HTTPSPNEGOAuth.generate_request_header() from
+ requests_gssapi 1.2.x and imports the private helper
+ requests_gssapi.gssapi_._negotiate_value. A future requests_gssapi
+ update in the same series that changes these internals could break
+ cepces. Anyone changing python-requests-gssapi in stable releases must
+ check this.
+
+ [ Other Info ]
+
+ - Upstream commits:
+
https://github.com/openSUSE/cepces/commit/893ac1a178ef3d18b32609d066bd605ddea16dd7
+ ("Migrate to SPNEGO auth mech", released in 0.3.8)
+
https://github.com/openSUSE/cepces/commit/0ad8651d7fb3b46b44b194ad43fece97fb0d264d
+ ("soap:auth: Add support for channel_bindings", released in 0.3.10;
+ backported)
+ - The bug originally asked to update the package to 0.3.12. That is too
+ large for an SRU, so this update backports only the two changes that
+ fix the connection problem. The newer cepces and requests-gssapi 1.4.x
+ can come through the development release instead.
+ - Current versions: python-cepces 0.3.7-0ubuntu1.24.04.1 in
+ noble-updates, 0.3.7-0ubuntu1~22.04 in jammy-updates, and
+ 0.3.7-0ubuntu2 in stonking and tenacious. python-requests-gssapi is
+ 1.2.3 in every series, so the same backport applies everywhere.
+ - The python-requests-gssapi tasks on the bug are not needed for this fix
+ and can be set to Won't Fix or Invalid for the stable series.
+
+ [ Original bug description ]
+
Hello,
python3-cepces seems be a package made by ubuntu, on the cepces version 0.3.7
.
- This tool is part of Active Directory integration features in Ubuntu added in
22.04.
+ This tool is part of Active Directory integration features in Ubuntu added in
22.04.
Since, Microsoft upgraded their product and on recent Microsoft PKI,
cepces is not able to retrieve certificate on them anymore.
the code has evolved and cepces 3.10 fixed the connection issue, and
cepces 3.12 fixed some stability issues.
Could you please upgrade your python3-cepces from version 0.3.7 to
version 0.3.12, to allow us to integrate our ubuntu's to our internal
microsoft tools ?
Thanks,
Vincent
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2133916
Title:
[needs-packaging] python3-cepces is obsolete and can't connect to
recent microsoft PKI
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python-cepces/+bug/2133916/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
