website/docs: add more RADIUS EAP-TLS docs #17419
Conversation
✅ Deploy Preview for authentik-storybook canceled.
|
✅ Deploy Preview for authentik-integrations ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #17419 +/- ##
==========================================
- Coverage 92.98% 92.93% -0.05%
==========================================
Files 868 868
Lines 47841 47906 +65
==========================================
+ Hits 44483 44522 +39
- Misses 3358 3384 +26
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
| :::info Use PKI for certificates | ||
| For certificates, we recommend using Public Key Infrastructure (PKI) with the mTLS stage. The PKI issues digital certificates to authenticate both the user and the server. | ||
| ::: |
There was a problem hiding this comment.
| :::info Use PKI for certificates | |
| For certificates, we recommend using Public Key Infrastructure (PKI) with the mTLS stage. The PKI issues digital certificates to authenticate both the user and the server. | |
| ::: |
I would remove this because it's redundant. All certificates are inherently and fundamentally PKI related. There's no such thing as a non-PKI certificate.
There was a problem hiding this comment.
How about this: "For certificates, ensure that you use a certificate created by a certificate authority, not a self-generated certificate."
There was a problem hiding this comment.
Real certificates are always trusted. For EAP-TLS this means, any client can authenticate with real certificates. This is a security incident.
Therefore, self-generated client and server certificates should be provided via PKI.
There was a problem hiding this comment.
Thanks @cheggerdev I might need you and @BeryJu to hash this out... I thought I understood after talking to him that the requirement is that the two certificates (server and client) are proper CA certificates (not self-generated)... What exactly do you mean by PKI.. isn't, as @dewi-tik says above, practically all CA certs made with PKI? Do you feel we really need to specify PKI?
Maybe you could provide the exact phrasing that you would like to see us add, please?
There was a problem hiding this comment.
:::warning Use of trusted Certificate Authority
For EAP-TLS, note that you should NOT use a globally known CA!
e.g. using a Verisign cert as a "known CA" means that ANYONE who has a certificate signed by them can authenticate via EAP-TLS! This is likely not what you want.
:::
:::info Client Certificate distribution
Using PKI is best practise to distribute client certificates.
:::
There was a problem hiding this comment.
OK @cheggerdev and @BeryJu I used the above suggestion, plus a few key words from marc, and pushed the same note into both the mTLS and the RADIUS docs. Let me know if that works, or if further tweaks are needed.
|
authentik PR Installation instructions Instructions for docker-composeAdd the following block to your AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-813802372e85d41c54c4596c91c0f30437b7de8f
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)sAfterwards, run the upgrade commands from the latest release notes. Instructions for KubernetesAdd the following block to your authentik:
outposts:
container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
image:
repository: ghcr.io/goauthentik/dev-server
tag: gh-813802372e85d41c54c4596c91c0f30437b7de8fAfterwards, run the upgrade commands from the latest release notes. |
BeryJu
changed the title
tanberry
changed the title
Co-authored-by: Dewi Roberts <dewi@goauthentik.io> Signed-off-by: Tana M Berry <tanamarieberry@yahoo.com>
Thanks for your patience with our word-wrangling. ;-) |
4 participants
This PR adds more content to the Docs about EAP PR 15702, adds mention of needing to use a proper CA certificate with EAP-TLS and the mTLS stage. Also a few random cleanups.
make docs)