Support Kerberos-authenticated (ADCS replacement) ?

[sfonteneau]

It would be useful for step-ca to support issuing client certificates to users and machines authenticated via Kerberos.

The goal is to replicate the core functionality of Microsoft ADCS: issuing client certificates based on existing Kerberos identities, without requiring additional tokens or provisioning.

This would allow step-ca to distribute certificates to users and hosts in a Kerberos realm (MIT, Heimdal, FreeIPA, etc.) using their existing authentication, across platforms (Linux, Windows, macOS).

Smallstep already handles certificate issuance well — the missing part is native Kerberos authentication as a trusted identity source.

It exists ?

[tashian]

Hi Simon,

Thanks for the suggestion.
Broadly speaking, step-ca is designed to serve DevOps use cases,
and our commercial products revolve around IT use cases and certificates for endpoints,
with a focus on device and user identities.

So, ADCS replacement is something Smallstep offers commercially.
We currently have an option for dynamic SCEP (using NDES emulation), but we don't have Kerberos support (yet).
It's definitely an interesting area for us.

If you haven't already, feel free to reach out to us if you'd like to learn more.

Thanks,
Carl

[sfonteneau]

Thank you for your message @tashian . Looking online, I didn’t find (or maybe I didn’t search well) any project capable of reproducing the AD CS SOAP CEP interface over Kerberos authentication to perform automatic enrollment.

So, I dissected the protocol and managed to reproduce the frames with a small Python service. I now have a first working version.

If I get my company’s approval, I plan to post this piece of code on GitHub.

I didn’t quite understand what is included in Smallstep’s commercial offering. Can automated enrollment be configured (like this: https://www.chadduffey.com/assets/article_images/test.png) with what you mentioned?

[tashian]

We don't support a drop-in emulation of that specific AD CS workflow (yet).
What we do support commercially is an agent that can automate certificate management on endpoints, using more modern protocols like ACME.
Which, in our view, is part of a migration path away from AD CS.
So, our agent can be used for automatic enrollment in many cases, but it doesn't currently integrate as deeply with Windows and AD CS as you may be looking for.