Skip to content

V3.2.x Add handling for Subject Alternative Name (SAN) URIs#5450

Open
ablanken wants to merge 3 commits intoFreeRADIUS:v3.2.xfrom
ablanken:v3.2.x
Open

V3.2.x Add handling for Subject Alternative Name (SAN) URIs#5450
ablanken wants to merge 3 commits intoFreeRADIUS:v3.2.xfrom
ablanken:v3.2.x

Conversation

@ablanken
Copy link
Copy Markdown

@ablanken ablanken commented Oct 18, 2024

Add handling for Subject Alternative Name (SAN) URIs.

These URIs can be used to inform authentication and authorization decisions by leveraging external device management services. For instance, device certificates might include a SAN URI like "IntuneDeviceId://guid" to identify devices within Intune.

Once this is included, we can look at calling the Intune Graph API to query device compliance status & group membership etc.

image

@ablanken
Copy link
Copy Markdown
Author

I have assumed that the cert attributes in the dictionary can't be reordered. Please let me know if this is not the case or if the attribute numbers need to be changed.

ATTRIBUTE TLS-Cert-Subject-Alt-Name-Uri 1934 string
ATTRIBUTE TLS-Client-Cert-Subject-Alt-Name-Uri 1935 string

One thing to be mindful of is 'GEN_URI' already appears in the following method in tls.c: static int ocsp_parse_cert_url
This may or may not be an issue.

@Neustradamus
Copy link
Copy Markdown

@ablanken: Nice PR!

alandekok added a commit that referenced this pull request Dec 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants