{"action":"created","comment":{"url":"https://api.github.com/repos/inverse-inc/packetfence/pulls/comments/35642879","id":35642879,"diff_hunk":"@@ -0,0 +1,313 @@\n+Microsoft PKI (MSPKI) Quick Installation Guide\n+==============================================\n+:encoding: UTF-8\n+:lang: en\n+:doctype: book\n+\n+include::includes/global-attributes.asciidoc[]\n+\n+About this Guide\n+----------------\n+\n+This guide has been created to give a quick start to configure the Microsoft PKI with PacketFence 5.4+. This guide does not include advanced troubleshooting of EAP-TLS connections. Refer to the relevant documentation of EAP-TLS, RADIUS and OpenSSL for advanced features.\n+\n+Assumptions\n+-----------\n+\n+* You have at least one server with PacketFence 5.4 or later.\n+* The server already has a properly configured switch with 802.1X support.\n+* The PacketFence RADIUS server is working in your environment.\n+* You have an Active Directory server or another Microsoft Windows 2008 R2 server installed.\n+* The PacketFence management IP will be 192.168.1.5.\n+* The RADIUS shared secret is \"useStrongerSecret\".\n+\n+Installation\n+------------\n+\n+Step 1: Install Active Directory Certificate Service (ADCS)\n+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n+\n+NOTE: This will cover the configuration for Active Directory Certificate Services (ADCS) on Microsoft Windows 2008 R2. This configuration has been tested to be integreted with PacketFence. The installation of ADCS is not cover by this guide see the Microsoft white paper about it for more information (http://social.technet.microsoft.com/wiki/contents/articles/9063.network-device-enrollment-service-ndes-in-active-directory-certificate-services-ad-cs.aspx).\n+\n+Communication between MSPKI and PacketFence will be using port 80 or 443 depending on your configuration.\n+\n+Configuring Network Device Enrollement Service (NDES)\n+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n+\n+Our main activity in the deployment of ADCS is to configure Network Enrollement Device Service (NDES) which will allow us to exchange certificate with the MS PKI server via the protocol Simple Certificate Exchange Protocol (SCEP).\n+\n+Every configuration change has to be done by an account with administrative privileges.\n+\n+To allow the use of NDES as a Pki-Provider in BOYD deployement there is multiple changes.\n+\n+Challenge Password\n+^^^^^^^^^^^^^^^^^^\n+\n+MSCEP include by default a challenge password, which is unique and dynamically generated for each device which want to enroll on the system. The issue here while using the challenge password is that it is necessary for an administrator to connect to the NDES server from the user's device. This a barrier to BOYD deployement for instance, where you want the user to be able to register himself his device. Since we use NDES with PacketFence, our security to obtain a certificate would be the credetials necessary to access the enrollement system.\n+\n+To disable the challenge password you need to modifiy the following key in the Windows registry. \n+\n+Click `Start` and enter `regedit`.\n+\n+Navigate to `Computer` > `HKEY_LOCAL_MACHINE` > `SOFTWARE` > `Microsoft` > `Cryptography` > `MSCEP` > `EnforcePassword`.\n+\n+Change the value of `EnforcePassword` to `0` (default is `1`).\n+\n+Extend URL length for the request\n+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n+\n+Best practices from Cisco recommand to extend the URL length to avoid issue with longer request. \n+\n+To do so, enter the following command in the CLI on the NDES server:\n+\n+ %systemroot%\\system32\\inetsrv\\appcmd.exe set config /section:system.webServer/\n+ security/requestFiltering /requestLimits.maxQueryString:\"8192\" /commit:apphost\n+\n+Certificate template \n+^^^^^^^^^^^^^^^^^^^^\n+\n+NOTE: Remember that the validity of your CA can impact your whole certificate architecture.\n+\n+The main goal is to deliver certificate for either `user Authentication` or `machine Authentication`, this mean we have to setup a specific template.\n+\n+First, indepandent of which type of authentication you will use, the certificate template need at least the following `Enhanced Key Usage`:\n+\n+* Client Authentication\n+\n+and the following `Key Usage`:\n+\n+* Digital signature\n+* Key encipherment\n+\n+Then if you want to use machineAuth you should duplicate the template `Computer` and change the settings that suits your use of certificate. To force a template to deliver Machine certificates, go to the tab `Subject Name` and select `Type of subject` > `Computer or other device`.","path":"docs/PacketFence_MSPKI_Quick_Install_Guide.asciidoc","position":82,"original_position":82,"commit_id":"bbdadcfba60256bf3958dd350033e751de8359f6","original_commit_id":"bbdadcfba60256bf3958dd350033e751de8359f6","user":{"login":"fdurand","id":1553962,"avatar_url":"https://avatars.githubusercontent.com/u/1553962?v=3","gravatar_id":"","url":"https://api.github.com/users/fdurand","html_url":"https://github.com/fdurand","followers_url":"https://api.github.com/users/fdurand/followers","following_url":"https://api.github.com/users/fdurand/following{/other_user}","gists_url":"https://api.github.com/users/fdurand/gists{/gist_id}","starred_url":"https://api.github.com/users/fdurand/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fdurand/subscriptions","organizations_url":"https://api.github.com/users/fdurand/orgs","repos_url":"https://api.github.com/users/fdurand/repos","events_url":"https://api.github.com/users/fdurand/events{/privacy}","received_events_url":"https://api.github.com/users/fdurand/received_events","type":"User","site_admin":false},"body":"An example , like duplicate the template Computer and name it machineAuth","created_at":"2015-07-28T12:54:00Z","updated_at":"2015-07-28T12:54:00Z","html_url":"https://github.com/inverse-inc/packetfence/pull/810#discussion_r35642879","pull_request_url":"https://api.github.com/repos/inverse-inc/packetfence/pulls/810","_links":{"self":{"href":"https://api.github.com/repos/inverse-inc/packetfence/pulls/comments/35642879"},"html":{"href":"https://github.com/inverse-inc/packetfence/pull/810#discussion_r35642879"},"pull_request":{"href":"https://api.github.com/repos/inverse-inc/packetfence/pulls/810"}}},"pull_request":{"url":"https://api.github.com/repos/inverse-inc/packetfence/pulls/810","id":40949046,"html_url":"https://github.com/inverse-inc/packetfence/pull/810","diff_url":"https://github.com/inverse-inc/packetfence/pull/810.diff","patch_url":"https://github.com/inverse-inc/packetfence/pull/810.patch","issue_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/810","number":810,"state":"open","locked":false,"title":"Added MSPKI guide (WIP)","user":{"login":"whitx","id":9321079,"avatar_url":"https://avatars.githubusercontent.com/u/9321079?v=3","gravatar_id":"","url":"https://api.github.com/users/whitx","html_url":"https://github.com/whitx","followers_url":"https://api.github.com/users/whitx/followers","following_url":"https://api.github.com/users/whitx/following{/other_user}","gists_url":"https://api.github.com/users/whitx/gists{/gist_id}","starred_url":"https://api.github.com/users/whitx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whitx/subscriptions","organizations_url":"https://api.github.com/users/whitx/orgs","repos_url":"https://api.github.com/users/whitx/repos","events_url":"https://api.github.com/users/whitx/events{/privacy}","received_events_url":"https://api.github.com/users/whitx/received_events","type":"User","site_admin":false},"body":"# Description\r\nDocumentation for MSPKI integration with PacketFence\r\n\r\n# Impacts\r\nNone\r\n\r\n# Dependencies\r\nbranch feature/scep-pki to be merged\r\n\r\n# Delete branch after merge\r\nYES\r\n\r\n# NEWS file entries\r\n* Documentation for the inegration of MSPKI with PacketFence","created_at":"2015-07-27T21:03:04Z","updated_at":"2015-07-28T12:54:00Z","closed_at":null,"merged_at":null,"merge_commit_sha":"f69b4baa423dba7709f5eb8a27078c54d3b4e5ee","assignee":null,"milestone":{"url":"https://api.github.com/repos/inverse-inc/packetfence/milestones/9","html_url":"https://github.com/inverse-inc/packetfence/milestones/PacketFence-5.4","labels_url":"https://api.github.com/repos/inverse-inc/packetfence/milestones/9/labels","id":1185948,"number":9,"title":"PacketFence-5.4","description":"","creator":{"login":"louismunro","id":193997,"avatar_url":"https://avatars.githubusercontent.com/u/193997?v=3","gravatar_id":"","url":"https://api.github.com/users/louismunro","html_url":"https://github.com/louismunro","followers_url":"https://api.github.com/users/louismunro/followers","following_url":"https://api.github.com/users/louismunro/following{/other_user}","gists_url":"https://api.github.com/users/louismunro/gists{/gist_id}","starred_url":"https://api.github.com/users/louismunro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/louismunro/subscriptions","organizations_url":"https://api.github.com/users/louismunro/orgs","repos_url":"https://api.github.com/users/louismunro/repos","events_url":"https://api.github.com/users/louismunro/events{/privacy}","received_events_url":"https://api.github.com/users/louismunro/received_events","type":"User","site_admin":false},"open_issues":50,"closed_issues":3,"state":"open","created_at":"2015-06-29T19:23:15Z","updated_at":"2015-07-27T21:03:16Z","due_on":"2015-09-14T04:00:00Z","closed_at":null},"commits_url":"https://api.github.com/repos/inverse-inc/packetfence/pulls/810/commits","review_comments_url":"https://api.github.com/repos/inverse-inc/packetfence/pulls/810/comments","review_comment_url":"https://api.github.com/repos/inverse-inc/packetfence/pulls/comments{/number}","comments_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/810/comments","statuses_url":"https://api.github.com/repos/inverse-inc/packetfence/statuses/bbdadcfba60256bf3958dd350033e751de8359f6","head":{"label":"inverse-inc:feature/doc-mspki","ref":"feature/doc-mspki","sha":"bbdadcfba60256bf3958dd350033e751de8359f6","user":{"login":"inverse-inc","id":1203154,"avatar_url":"https://avatars.githubusercontent.com/u/1203154?v=3","gravatar_id":"","url":"https://api.github.com/users/inverse-inc","html_url":"https://github.com/inverse-inc","followers_url":"https://api.github.com/users/inverse-inc/followers","following_url":"https://api.github.com/users/inverse-inc/following{/other_user}","gists_url":"https://api.github.com/users/inverse-inc/gists{/gist_id}","starred_url":"https://api.github.com/users/inverse-inc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/inverse-inc/subscriptions","organizations_url":"https://api.github.com/users/inverse-inc/orgs","repos_url":"https://api.github.com/users/inverse-inc/repos","events_url":"https://api.github.com/users/inverse-inc/events{/privacy}","received_events_url":"https://api.github.com/users/inverse-inc/received_events","type":"Organization","site_admin":false},"repo":{"id":3595658,"name":"packetfence","full_name":"inverse-inc/packetfence","owner":{"login":"inverse-inc","id":1203154,"avatar_url":"https://avatars.githubusercontent.com/u/1203154?v=3","gravatar_id":"","url":"https://api.github.com/users/inverse-inc","html_url":"https://github.com/inverse-inc","followers_url":"https://api.github.com/users/inverse-inc/followers","following_url":"https://api.github.com/users/inverse-inc/following{/other_user}","gists_url":"https://api.github.com/users/inverse-inc/gists{/gist_id}","starred_url":"https://api.github.com/users/inverse-inc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/inverse-inc/subscriptions","organizations_url":"https://api.github.com/users/inverse-inc/orgs","repos_url":"https://api.github.com/users/inverse-inc/repos","events_url":"https://api.github.com/users/inverse-inc/events{/privacy}","received_events_url":"https://api.github.com/users/inverse-inc/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/inverse-inc/packetfence","description":"PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, powerful guest management options, 802.1X support, layer-2 isolation of problematic devices; PacketFence can be used to effectively secure networks small to very large heterogeneous networks.","fork":false,"url":"https://api.github.com/repos/inverse-inc/packetfence","forks_url":"https://api.github.com/repos/inverse-inc/packetfence/forks","keys_url":"https://api.github.com/repos/inverse-inc/packetfence/keys{/key_id}","collaborators_url":"https://api.github.com/repos/inverse-inc/packetfence/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/inverse-inc/packetfence/teams","hooks_url":"https://api.github.com/repos/inverse-inc/packetfence/hooks","issue_events_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/events{/number}","events_url":"https://api.github.com/repos/inverse-inc/packetfence/events","assignees_url":"https://api.github.com/repos/inverse-inc/packetfence/assignees{/user}","branches_url":"https://api.github.com/repos/inverse-inc/packetfence/branches{/branch}","tags_url":"https://api.github.com/repos/inverse-inc/packetfence/tags","blobs_url":"https://api.github.com/repos/inverse-inc/packetfence/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/inverse-inc/packetfence/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/inverse-inc/packetfence/git/refs{/sha}","trees_url":"https://api.github.com/repos/inverse-inc/packetfence/git/trees{/sha}","statuses_url":"https://api.github.com/repos/inverse-inc/packetfence/statuses/{sha}","languages_url":"https://api.github.com/repos/inverse-inc/packetfence/languages","stargazers_url":"https://api.github.com/repos/inverse-inc/packetfence/stargazers","contributors_url":"https://api.github.com/repos/inverse-inc/packetfence/contributors","subscribers_url":"https://api.github.com/repos/inverse-inc/packetfence/subscribers","subscription_url":"https://api.github.com/repos/inverse-inc/packetfence/subscription","commits_url":"https://api.github.com/repos/inverse-inc/packetfence/commits{/sha}","git_commits_url":"https://api.github.com/repos/inverse-inc/packetfence/git/commits{/sha}","comments_url":"https://api.github.com/repos/inverse-inc/packetfence/comments{/number}","issue_comment_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/comments{/number}","contents_url":"https://api.github.com/repos/inverse-inc/packetfence/contents/{+path}","compare_url":"https://api.github.com/repos/inverse-inc/packetfence/compare/{base}...{head}","merges_url":"https://api.github.com/repos/inverse-inc/packetfence/merges","archive_url":"https://api.github.com/repos/inverse-inc/packetfence/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/inverse-inc/packetfence/downloads","issues_url":"https://api.github.com/repos/inverse-inc/packetfence/issues{/number}","pulls_url":"https://api.github.com/repos/inverse-inc/packetfence/pulls{/number}","milestones_url":"https://api.github.com/repos/inverse-inc/packetfence/milestones{/number}","notifications_url":"https://api.github.com/repos/inverse-inc/packetfence/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/inverse-inc/packetfence/labels{/name}","releases_url":"https://api.github.com/repos/inverse-inc/packetfence/releases{/id}","created_at":"2012-03-01T20:21:13Z","updated_at":"2015-07-27T17:55:26Z","pushed_at":"2015-07-27T21:03:04Z","git_url":"git://github.com/inverse-inc/packetfence.git","ssh_url":"git@github.com:inverse-inc/packetfence.git","clone_url":"https://github.com/inverse-inc/packetfence.git","svn_url":"https://github.com/inverse-inc/packetfence","homepage":"http://www.packetfence.org","size":163487,"stargazers_count":127,"watchers_count":127,"language":"Perl","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":66,"mirror_url":null,"open_issues_count":161,"forks":66,"open_issues":161,"watchers":127,"default_branch":"devel"}},"base":{"label":"inverse-inc:devel","ref":"devel","sha":"e9a223927fe2508b8366929e267a5173564e939b","user":{"login":"inverse-inc","id":1203154,"avatar_url":"https://avatars.githubusercontent.com/u/1203154?v=3","gravatar_id":"","url":"https://api.github.com/users/inverse-inc","html_url":"https://github.com/inverse-inc","followers_url":"https://api.github.com/users/inverse-inc/followers","following_url":"https://api.github.com/users/inverse-inc/following{/other_user}","gists_url":"https://api.github.com/users/inverse-inc/gists{/gist_id}","starred_url":"https://api.github.com/users/inverse-inc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/inverse-inc/subscriptions","organizations_url":"https://api.github.com/users/inverse-inc/orgs","repos_url":"https://api.github.com/users/inverse-inc/repos","events_url":"https://api.github.com/users/inverse-inc/events{/privacy}","received_events_url":"https://api.github.com/users/inverse-inc/received_events","type":"Organization","site_admin":false},"repo":{"id":3595658,"name":"packetfence","full_name":"inverse-inc/packetfence","owner":{"login":"inverse-inc","id":1203154,"avatar_url":"https://avatars.githubusercontent.com/u/1203154?v=3","gravatar_id":"","url":"https://api.github.com/users/inverse-inc","html_url":"https://github.com/inverse-inc","followers_url":"https://api.github.com/users/inverse-inc/followers","following_url":"https://api.github.com/users/inverse-inc/following{/other_user}","gists_url":"https://api.github.com/users/inverse-inc/gists{/gist_id}","starred_url":"https://api.github.com/users/inverse-inc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/inverse-inc/subscriptions","organizations_url":"https://api.github.com/users/inverse-inc/orgs","repos_url":"https://api.github.com/users/inverse-inc/repos","events_url":"https://api.github.com/users/inverse-inc/events{/privacy}","received_events_url":"https://api.github.com/users/inverse-inc/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/inverse-inc/packetfence","description":"PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, powerful guest management options, 802.1X support, layer-2 isolation of problematic devices; PacketFence can be used to effectively secure networks small to very large heterogeneous networks.","fork":false,"url":"https://api.github.com/repos/inverse-inc/packetfence","forks_url":"https://api.github.com/repos/inverse-inc/packetfence/forks","keys_url":"https://api.github.com/repos/inverse-inc/packetfence/keys{/key_id}","collaborators_url":"https://api.github.com/repos/inverse-inc/packetfence/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/inverse-inc/packetfence/teams","hooks_url":"https://api.github.com/repos/inverse-inc/packetfence/hooks","issue_events_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/events{/number}","events_url":"https://api.github.com/repos/inverse-inc/packetfence/events","assignees_url":"https://api.github.com/repos/inverse-inc/packetfence/assignees{/user}","branches_url":"https://api.github.com/repos/inverse-inc/packetfence/branches{/branch}","tags_url":"https://api.github.com/repos/inverse-inc/packetfence/tags","blobs_url":"https://api.github.com/repos/inverse-inc/packetfence/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/inverse-inc/packetfence/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/inverse-inc/packetfence/git/refs{/sha}","trees_url":"https://api.github.com/repos/inverse-inc/packetfence/git/trees{/sha}","statuses_url":"https://api.github.com/repos/inverse-inc/packetfence/statuses/{sha}","languages_url":"https://api.github.com/repos/inverse-inc/packetfence/languages","stargazers_url":"https://api.github.com/repos/inverse-inc/packetfence/stargazers","contributors_url":"https://api.github.com/repos/inverse-inc/packetfence/contributors","subscribers_url":"https://api.github.com/repos/inverse-inc/packetfence/subscribers","subscription_url":"https://api.github.com/repos/inverse-inc/packetfence/subscription","commits_url":"https://api.github.com/repos/inverse-inc/packetfence/commits{/sha}","git_commits_url":"https://api.github.com/repos/inverse-inc/packetfence/git/commits{/sha}","comments_url":"https://api.github.com/repos/inverse-inc/packetfence/comments{/number}","issue_comment_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/comments{/number}","contents_url":"https://api.github.com/repos/inverse-inc/packetfence/contents/{+path}","compare_url":"https://api.github.com/repos/inverse-inc/packetfence/compare/{base}...{head}","merges_url":"https://api.github.com/repos/inverse-inc/packetfence/merges","archive_url":"https://api.github.com/repos/inverse-inc/packetfence/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/inverse-inc/packetfence/downloads","issues_url":"https://api.github.com/repos/inverse-inc/packetfence/issues{/number}","pulls_url":"https://api.github.com/repos/inverse-inc/packetfence/pulls{/number}","milestones_url":"https://api.github.com/repos/inverse-inc/packetfence/milestones{/number}","notifications_url":"https://api.github.com/repos/inverse-inc/packetfence/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/inverse-inc/packetfence/labels{/name}","releases_url":"https://api.github.com/repos/inverse-inc/packetfence/releases{/id}","created_at":"2012-03-01T20:21:13Z","updated_at":"2015-07-27T17:55:26Z","pushed_at":"2015-07-27T21:03:04Z","git_url":"git://github.com/inverse-inc/packetfence.git","ssh_url":"git@github.com:inverse-inc/packetfence.git","clone_url":"https://github.com/inverse-inc/packetfence.git","svn_url":"https://github.com/inverse-inc/packetfence","homepage":"http://www.packetfence.org","size":163487,"stargazers_count":127,"watchers_count":127,"language":"Perl","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":66,"mirror_url":null,"open_issues_count":161,"forks":66,"open_issues":161,"watchers":127,"default_branch":"devel"}},"_links":{"self":{"href":"https://api.github.com/repos/inverse-inc/packetfence/pulls/810"},"html":{"href":"https://github.com/inverse-inc/packetfence/pull/810"},"issue":{"href":"https://api.github.com/repos/inverse-inc/packetfence/issues/810"},"comments":{"href":"https://api.github.com/repos/inverse-inc/packetfence/issues/810/comments"},"review_comments":{"href":"https://api.github.com/repos/inverse-inc/packetfence/pulls/810/comments"},"review_comment":{"href":"https://api.github.com/repos/inverse-inc/packetfence/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/inverse-inc/packetfence/pulls/810/commits"},"statuses":{"href":"https://api.github.com/repos/inverse-inc/packetfence/statuses/bbdadcfba60256bf3958dd350033e751de8359f6"}}}}