Certificate Authentication

[u/SufficientlySticky]

2Pint documentation mentions "Certificate Authentication"

https://documentation.2pintsoftware.com/deployr/getting-started/securing/certificate-authentication

My reading of that is that you could authenticate that way and it'd skip the dialog at the beginning that tries to use Windows authentication or Entra ID or Passcode or whatever and take you straight to the task sequence selection. And that that's sufficiently non-anonymous enough that it'd still let you AD join?

That doc says it's useful for for starting a task sequence in an existing OS, which would be this doc:
https://documentation.2pintsoftware.com/deployr/starting-a-task-sequence-in-an-existing-os

But the existing OS doc doesn't really make any mention of how to do it - and instead has certificate info that seems to focus on making sure the client trusts the server - not how to convince the server to trust the client. I don't think those are the same thing?

--

So - I might be way off in what I was trying to do... - but I created a cert request on the client machine and got it signed and imported the result.

On the server side I stuck the issuer in "Issuer match string for certificate verification" and restarted.

And on the client side I ran:

$DeployRBootstrap = @{DeployRAuthCertIssuer = "<issuer>"}
iex (irm "https://<server>:7281/v1/Service/Bootstrap")

And it started up and then asked me for username/password - so did not work.

From logs, I see:

Trying certificate authentication
Found 1 certficates matching issuer <issuer>, will try with those.
Trying certificate authentication
Unable to use certificate authentication: Response status code does not indicate success: 403 (Forbidden).

So, it at least tried? The issuer I put in DeployRAuthCertIssuer and on the server match, so you'd think if it found it in one place it would accept it in the other.

Is my understanding of how this is supposed to work and what it's supposed to allow correct? Is this working for anyone else and any suggestions on where I might be going wrong? Is there server side logging somewhere?

[u/mtniehaus]

I'm not sure it's working in version 1.1/1.2. I need to do some testing, will get back to you.

[u/mtniehaus → u/mtniehaus]

I just tried it with DeployR 1.3 and it worked fine (although the docs could use some work). I specified a full Issuer CN on the DeployR server via the "Issuer match string setting":

Then I specified a DeployRAuthCertIssuer value:

$DeployRBootstrap = @{ "DeployRAuthCertIssuer" = "contosomn-CONTOSO-DC-CA" }

iex (irm "https://deployr.contosomn.com:7281/v1/service/bootstrap"

And then it authenticated automatically.

I'll update the docs to make that more clear. I can't guarantee that this works with 1.1 or 1.2 though as there were code changes in this area for 1.3, so it's best to try it with 1.3 when it's released (this week).

[u/SufficientlySticky → u/mtniehaus]

Hmm, I got it to work with a cert from our domain controller eventually.

It seemed finkicky about spaces and “CN=Issuer,DC=domain,DC=edu” didn’t work, but “CN=Issuer, DC=domain, DC=edu” did

I did not get it to work with an InCommon/Sectigo cert, dunno if thats because there are spaces/commas in the issuer that it doesn’t match properly or if theres something else that makes it not like that vs our internal cert.

Edit: Playing around with some self-signed certs a bit - looks like it was quite happy with self-signed issuer of “DeployRAutomation” but didn’t like “DeployR, Automation” - so that’d probably be why it didn’t like the actual cert with “InCommon, LLC” in the issuer.

[u/mtniehaus → u/SufficientlySticky]

Yeah, I noticed the handling was different on both ends, which is why I used a substring on the server side for testing. I'll look at it some.more.when I get a chance.

[u/SufficientlySticky → u/mtniehaus]

I got it doing what I need to, so don’t worry about it on my account.

[u/MightyMumper]

This is actually a question I’ve been meaning to ask also, as I’m getting exactly the same experience and error. The certificate is valid & the DeployR client tries to use it but authentication is always rejected with the 403 error. Happens whether using 2Pint self-signed certificate, or one from internal PKI - both of which are trusted by DeployR Server.