CINXE.COM

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="shortcut icon" href="/htdocs/favicon.ico"> <script type="text/javascript" src="/htdocs/bugstatus.js"></script> <meta http-equiv="Content-Type" content="text/html;charset=utf-8"> <meta name="robots" content="index,nofollow"> <title>DebianSingleSignOn - Debian Wiki</title> <script type="text/javascript" src="/htdocs/common/js/common.js"></script> <script type="text/javascript">  </script> <link rel="stylesheet" type="text/css" charset="utf-8" media="all" href="/htdocs/debwiki/css/common.css"> <link rel="stylesheet" type="text/css" charset="utf-8" media="screen" href="/htdocs/debwiki/css/screen.css"> <link rel="stylesheet" type="text/css" charset="utf-8" media="print" href="/htdocs/debwiki/css/print.css"> <link rel="stylesheet" type="text/css" charset="utf-8" media="projection" href="/htdocs/debwiki/css/projection.css"> <link rel="stylesheet" type="text/css" charset="utf-8" media="all" href="/htdocs/debian-wiki-1.0.css">   <link rel="alternate" title="Debian Wiki: DebianSingleSignOn" href="/DebianSingleSignOn?diffs=1&show_att=1&action=rss_rc&unique=0&page=DebianSingleSignOn&ddiffs=1" type="application/rss+xml"> <link rel="Start" href="/FrontPage"> <link rel="Alternate" title="Wiki Markup" href="/DebianSingleSignOn?action=raw"> <link rel="Alternate" media="print" title="Print View" href="/DebianSingleSignOn?action=print"> <link rel="Search" href="/FindPage"> <link rel="Index" href="/TitleIndex"> <link rel="Glossary" href="/WordIndex"> <link rel="Help" href="/HelpOnFormatting"> </head> <body lang="en" dir="ltr"> <div id="logo"><a href="https://www.debian.org" title="Debian Homepage"><img src="https://www.debian.org/Pics/openlogo-50.png" alt="Debian" width="50" height="61"></a></div> <div id="header"> <div id="wikisection"> <a href="/FrontPage" title="Debian Wiki Homepage">Wiki</a> <div id="username"><a href="/DebianSingleSignOn?action=login" id="login" rel="nofollow">Login</a></div> </div> <div id="navbar"> <ul id="navibar"> <li class="wikilink"><a href="/FrontPage">FrontPage</a></li><li class="wikilink"><a href="/RecentChanges">RecentChanges</a></li><li class="wikilink"><a href="/FindPage">FindPage</a></li><li class="wikilink"><a href="/HelpContents">HelpContents</a></li><li class="current"><a href="/DebianSingleSignOn">DebianSingleSignOn</a></li> </ul> </div> <form id="searchform" method="get" action="/DebianSingleSignOn"> <div> <input type="hidden" name="action" value="fullsearch"> <input type="hidden" name="context" value="180"> <label for="searchinput">Search:</label> <input id="searchinput" type="text" name="value" value="" size="20" onfocus="searchFocus(this)" onblur="searchBlur(this)" onkeyup="searchChange(this)" onchange="searchChange(this)" alt="Search"> <input id="titlesearch" name="titlesearch" type="submit" value="Titles" alt="Search Titles"> <input id="fullsearch" name="fullsearch" type="submit" value="Text" alt="Search Full Text"> </div> </form> <script type="text/javascript">  </script> <div id="logo"><a href="https://www.debian.org" title="Debian Homepage"><img src="https://www.debian.org/Pics/openlogo-50.png" alt="Debian" width="50" height="61"></a></div> <div id="breadcrumbs"><a href="/FrontPage" title="Debian Wiki Homepage">Wiki</a>/ </div> <ul class="editbar"><li><a href="/DebianSingleSignOn?action=login" id="login-1" rel="nofollow">Login</a></li><li class="toggleCommentsButton" style="display:none;"><a href="#" class="nbcomment" onClick="toggleComments();return false;">Comments</a></li><li><a class="nbinfo" href="/DebianSingleSignOn?action=info" rel="nofollow">Info</a></li><li><a class="nbattachments" href="/DebianSingleSignOn?action=AttachFile" rel="nofollow">Attachments</a></li><li> <form class="actionsmenu" method="GET" action="/DebianSingleSignOn"> <div> <label>More Actions:</label> <select name="action" onchange="if ((this.selectedIndex != 0) && (this.options[this.selectedIndex].disabled == false)) { this.form.submit(); } this.selectedIndex = 0;"> <option value="raw">Raw Text</option> <option value="print">Print View</option> <option value="RenderAsDocbook">Render as Docbook</option> <option value="refresh">Delete Cache</option> <option value="show" disabled class="disabled">------------------------</option> <option value="SpellCheck">Check Spelling</option> <option value="LikePages">Like Pages</option> <option value="LocalSiteMap">Local Site Map</option> <option value="show" disabled class="disabled">------------------------</option> <option value="RenamePage" disabled class="disabled">Rename Page</option> <option value="DeletePage" disabled class="disabled">Delete Page</option> <option value="show" disabled class="disabled">------------------------</option> <option value="show" disabled class="disabled">Subscribe User</option> <option value="show" disabled class="disabled">------------------------</option> <option value="show" disabled class="disabled">Remove Spam</option> <option value="show" disabled class="disabled">Revert to this revision</option> <option value="PackagePages">Package Pages</option> <option value="show" disabled class="disabled">------------------------</option> <option value="Load">Load</option> <option value="Save">Save</option> <option value="SlideShow">SlideShow</option> </select> <input type="submit" value="Do"> </div> <script type="text/javascript">  </script> </form> </li></ul> <h1 id="locationline"> <ul id="pagelocation"> <li><a href="/DebianSingleSignOn">DebianSingleSignOn</a></li> </ul> </h1> </div> <div id="page" lang="en" dir="ltr"> <div dir="ltr" id="content" lang="en"> <div class="caution">The Debian SSO service is deprecated. If you are a service admin please look into using <a href="/Salsa/SSO">Salsa for this purpose</a>. </div><div class="table-of-contents">Contents<ol><li> <a href="#Debian_SSO_documentation">Debian SSO documentation</a><ol><li> <a href="#If_you_ARE_a_Debian_Developer">If you ARE a Debian Developer</a></li><li> <a href="#If_you_ARE_NOT_.28yet.29_a_Debian_Developer">If you ARE NOT (yet) a Debian Developer</a></li><li> <a href="#Browser_support">Browser support</a><ol><li> <a href="#firefox">firefox</a></li><li> <a href="#chromium_.2F_chrome">chromium / chrome</a></li><li> <a href="#curl">curl</a></li><li> <a href="#elinks">elinks</a></li><li> <a href="#links2">links2</a></li><li> <a href="#lynx">lynx</a></li><li> <a href="#wget">wget</a></li><li> <a href="#konqueror.2C_rekonq">konqueror, rekonq</a></li><li> <a href="#xombrero">xombrero</a></li><li> <a href="#Tor_Browser">Tor Browser</a></li><li> <a href="#Netsurf">Netsurf</a></li><li> <a href="#Internet_Explorer">Internet Explorer</a></li><li> <a href="#Use_with_a_Yubikey_in_PIV_mode">Use with a Yubikey in PIV mode</a></li><li> <a href="#iOS_Safari">iOS Safari</a></li></ol></li><li> <a href="#Documentation_for_Users">Documentation for Users</a><ol><li> <a href="#Getting_a_certificate">Getting a certificate</a></li><li> <a href="#Using_certificates">Using certificates</a></li><li> <a href="#Creating_certificates_manually">Creating certificates manually</a></li><li> <a href="#SSO-enabled_sites">SSO-enabled sites</a></li></ol></li></ol></li><li> <a href="#Sustainability">Sustainability</a><ol><li> <a href="#Providing_feedback">Providing feedback</a></li><li> <a href="#People_behind_this_service">People behind this service</a></li></ol></li></ol></div> <h1 id="Debian_SSO_documentation">Debian SSO documentation</h1> Debian has a Single Sign-On system for authenticating on web services at <a class="https" href="https://sso.debian.org/">https://sso.debian.org/</a> , based on Client Certificates. Those certificates can usually be looked up in the browser (e.g. firefox) settings via the menu. In contrast, this very wiki itself cannot handle SSO. The certificates are separate from the OpenPGP e-mail key which Debian members need to have. The SSO certs are web only, while the OpenPGP key is being used to, for example, sign "advocate" statements for new members. How to obtain a certificate to use Debian SSO: <h2 id="If_you_ARE_a_Debian_Developer">If you ARE a Debian Developer</h2> <ol type="1"><li>Set your SSO password via <a class="https" href="https://db.debian.org/">https://db.debian.org/</a> </li><li>Wait a few minutes for propagation, </li><li>Use the Debian icon on the left hand side at <a class="https" href="https://sso.debian.org/">https://sso.debian.org/</a> </li></ol>Be careful, the login here is not your full mail debian.org, but only the part before the @. <h2 id="If_you_ARE_NOT_.28yet.29_a_Debian_Developer">If you ARE NOT (yet) a Debian Developer</h2> No new accounts will be created. Please use <a href="/Salsa">Salsa</a>. <hr /> <h2 id="Browser_support">Browser support</h2> This collects the current status and tips for browsers/http client support for sso.debian.org and client certificates. Please help keeping it up to date by adding your own experience, and tips. <h3 id="firefox">firefox</h3> On Firefox 75.x (successfully tested also in Firefox 91.5.0esr (Debian buster, 2022/01/17) <ul><li>Go to <tt class="backtick">about:config</tt> and set <tt class="backtick">security.tls.enable_post_handshake_auth</tt> to <tt class="backtick">true</tt>. </li><li>Generate a certificate <a href="/DebianSingleSignOn#Creating_certificates_manually">manually</a>, then: </li><li>Navigate to: about:preferences => Privacy & Security => Certificates => View Certificates => Your Certificates => Import (and load the certificate) </li></ul>With Firefox >= 69 only the <a href="/DebianSingleSignOn#Creating_certificates_manually">manual process</a> works (because support for <keygen> was dropped.) With Firefox 63 (TODO: check exact affected release range) due to both Apache, OpenSSL and Firefox updates, it is necessary to go to <tt class="backtick">about:config</tt> and set <tt class="backtick">security.tls.enable_post_handshake_auth</tt> to <tt class="backtick">true</tt>. It's unclear why this isn't enabled by default, but see the upstream <a class="https" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1511989">bug report</a>. After generating a new certificate, either restart the browser or remove active logins (History → Clear Recent History... → "Active Logins" and click "Clear Now") and then try again. You may need to remove the association between the key and the site (see below in Troubleshooting). <ul><li>Firefox Quantum (>= 58 of 2018): Works, but the workflow is still tricky, rest assured, it can be made to work on Quantum. </li></ul>Automatic certificate generation works, certificate selection works. Firefox restart is needed after certificate generation. If you created a certificate using the process defined on this page: <a class="https" href="https://sso.debian.org/debian/certs/enroll_csr/">https://sso.debian.org/debian/certs/enroll_csr/</a>, please make sure you imported the generated certificate in Firefox (about:preferences => certificates => import). Troubleshooting: If you are sure that your SSO browser certificate is working and still valid but the SSO enabled Debian site is not triggering Firefox's "User Identification Request" dialog box, then it may be that you have visited that same site before and told Firefox back then not to use the SSO certificate for login. Firefox remembers this; it will also remember expired keys that you used in the past and won't even open the site. <ul><li>Try again with a private browser session; SSO login should work again, verifying that the key is correctly imported into the browser. </li><li>History → "Clear Recent History" (namely, "Active Logins") of your webbrowser. </li><li>Remove the association of the cert with the site: about:preferences → Privacy & Security → Certificates → View Certificates → Authentication Decisions (and delete the incorrect associations) </li><li>Another solution is closing and restarting all Firefox tabs/windows of the current desktop session. </li></ul>Each or all of the above might be needed. <h3 id="chromium_.2F_chrome">chromium / chrome</h3> <ul><li>Tested with: Chromium 44. </li></ul>Automatic certificate generation works, certificate selection works. If you want to access a site multiple times using a different certificate or no certificates, you can use an Incognito window. <ul><li>Chromium 49-56 needs Key Generation permission </li></ul>Starting from Chromium version 49, websites need to be whitelisted in order to use the Key Generation feature. Just visit Debian SSO, then click on the HTTPS padlock and allow the feature on this website. Once generated, your client certificate will be downloaded but not automatically imported. Clicking on the received file will open chromium certificate manager to import it. <ul><li>Chromium 57+ removed Key Generation support, only the <a href="/DebianSingleSignOn#Creating_certificates_manually">manual approach, below</a>, will work. </li></ul>Alternatively, generate a certificate manually, then: <pre>openssl pkcs12 -export -out name.p12 -inkey name.key -in name.crt -nodes</pre>and import <tt>name.p12</tt> from the certificate dialog at <tt>chrome://settings/certificates</tt> or from the command line with: <pre>pk12util -i name.p12 -d sql:$HOME/.pki/nssdb </pre> <h3 id="curl">curl</h3> You can <a href="/DebianSingleSignOn#Creating_certificates_manually">use local certificates</a> <pre> curl --key $USER.key --cert $USER.crt https://sso.debian.org/ca/test/env</pre> <h3 id="elinks">elinks</h3> From version <tt class="backtick">0.13~20190125-1</tt>, you can use local certificates generated by <a href="/DebianSingleSignOn#Creating_certificates_manually">enrolling manually</a> Concatenate the certificate and key into a single file first: <pre> cat $USER.crt $USER.key > client_cert.pem</pre>configure elinks to use client certificates (usually in ~/.elinks/elinks.conf): <pre> set connection.ssl.client_cert.enable = 1 set connection.ssl.client_cert.file = "client_cert.pem"</pre> <h3 id="links2">links2</h3> From version <tt class="backtick">2.10-2</tt> (see <a class="interwiki" href="https://bugs.debian.org/797066" title="DebianBug">797066</a>) you can use local certificates generated by <a href="/DebianSingleSignOn#Creating_certificates_manually">enrolling manually</a> <pre> links2 -http.client_cert_key $USER.key -http.client_cert_crt $USER.crt https://sso.debian.org/ca/test/env</pre>From version <tt class="backtick">2.11.1-1</tt> on, you can configure local client certificates also permanently via Setup → Network options → SSL options. From this version on, also encrypted keys for client certificates are supported. <h3 id="lynx">lynx</h3> From version <tt class="backtick">2.8.9dev6-4</tt> (see <a class="interwiki" href="https://bugs.debian.org/797901" title="DebianBug">797901</a>) you can use local certificates generated by <a href="/DebianSingleSignOn#Creating_certificates_manually">enrolling manually</a>: <ul><li>Set the configuration options <tt class="backtick">SSL_CLIENT_CERT_FILE</tt> and <tt class="backtick">SSL_CLIENT_KEY_FILE</tt> in <tt class="backtick">/etc/lynx-cur/lynx.cfg</tt> </li><li>Set the environment variables <tt class="backtick">SSL_CLIENT_CERT_FILE</tt> and <tt class="backtick">SSL_CLIENT_KEY_FILE</tt> to their appropriate values </li><li>use the build in Options Menu in Lynx (Key <tt class="backtick">O</tt>, entries SSL client certificate/key) </li></ul> <h3 id="wget">wget</h3> From version <tt class="backtick">1.17-1</tt> (see <a class="interwiki" href="https://bugs.debian.org/797057" title="DebianBug">797057</a>) you can use local certificates generated by <a href="/DebianSingleSignOn#Creating_certificates_manually">enrolling manually</a>. <pre> wget --certificate=$USER.crt --private-key=$USER.key https://sso.debian.org/ca/test/env</pre> <h3 id="konqueror.2C_rekonq">konqueror, rekonq</h3> Client certificate support needs to be implemented. <h3 id="xombrero">xombrero</h3> Cannot currently be used even for manual certificate generation because it lacks basic support for <a class="https" href="https://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly">httponly cookies</a>, see <a class="interwiki" href="https://bugs.debian.org/797171" title="DebianBug">797171</a>. Note that this browser is currently orphaned in Debian. <h3 id="Tor_Browser">Tor Browser</h3> As of Tor Browser 5.0.2, enrolling and using the certificate works as long as "Don't record browsing history or website data" is unchecked in the "Privacy and security settings". Not checked yet if it's indeed preserved across browser restarts, though. <h3 id="Netsurf">Netsurf</h3> netsurf does not currently support client certificate authentication, but <a class="interwiki" href="https://bugs.debian.org/797747" title="DebianBug">797747</a> has a patch to make it load and use certificate files provided via environment variables. <h3 id="Internet_Explorer">Internet Explorer</h3> Not supported. <h3 id="Use_with_a_Yubikey_in_PIV_mode">Use with a Yubikey in PIV mode</h3> First, install and configure the base system for use with your Yubikey. Please be sure you've got one that works with the PIV applet. A NEO or NEO-N should work. After that's working, install the needed Yubikey and OpenSC software <pre>sudo apt install yubico-piv-tool opensc-pkcs11 opensc</pre>Next, export your Certificate into PKCS#12 format. This can be found in Iceweasel under Preferences, Advanced, Certificates, View Certificates, click on your <tt>@debian.org</tt> certificate, and click Backup. Now, lets configure your PIV card. Lets first set the PIN and PUK code. If you've not done this before, the default PIN is 123456, and PUK is 12345678. <pre>yubico-piv-tool -a change-pin -P 123456 -N ${PIN_HERE} yubico-piv-tool -a change-puk -P 12345678 -N ${PUK_HERE}</pre>Finally, let's load the Cert <pre>yubico-piv-tool -s 9a -i DebianSSOKey.p12 -K PKCS12 -a set-chuid -a import-key -a import-cert</pre>Verify it's working by going to Preferences, Advanced, Certificates, Security Devices. There should be one under OpenSC with a Description of Yubikey NEO-N. If you don't see this, you might have to tell Firefox about the PKCS#11 <tt>.so</tt> -- click on "Load" under the Security Devices menu, and add <tt>/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so</tt> into the browser. The interface should surface. <h3 id="iOS_Safari">iOS Safari</h3> Safari does not support generating client certificates, and as user don't have command line access to iOS (unless you jailbreak), you need a computer that can manually generate a certificate. After generating certificate via manual approach, you need to pack them into PKCS#12 format, note that iOS requires PKCS#12 certificate to have a password, so do NOT leave the password empty. <pre>openssl pkcs12 -export -out name.p12 -inkey name.key -in name.crt</pre>On iOS, download the certificate via http server (one of the common servers is <tt class="backtick">python3 -m http.server</tt>), open the certificate, then go to Settings -> General -> Profiles, and find the certificate to install. <h2 id="Documentation_for_Users">Documentation for Users</h2> If you have a Debian member's account (i.e. LDAP), you can log into sso.debian.org using your Debian Web Password; otherwise, you can log in using your Alioth account credentials. The <a class="https" href="https://sso.debian.org/">SSO front page</a> will let you choose the appropriate option. Once you are logged in , you will see a list of certificates you have already generated, and can create new ones or revoke existing ones. <h3 id="Getting_a_certificate">Getting a certificate</h3> Check <a class="https" href="https://wiki.debian.org/DebianSingleSignOn#Browser_support">above</a> if your browser is supported. Click on <a class="https" href="https://sso.debian.org/">SSO main page</a> and select the appropriate login method (Debian or Alioth) account to <a class="https" href="https://en.wikipedia.org/wiki/SPKAC">create a new certificate</a> and save it in your browser. You can choose the certificate validity, and optionally add a comment to easily identify the certificate in the certificate list; everything else happens automatically. For privacy, the comment is not stored in the certificates, so it can only be seen by sso.debian.org. You can have as many certificates as you want, with arbitrary durations. Do not worry about certificate expiration, because getting a new certificate just requires two clicks. For example, if you are going on holidays, you are leaving your computer at home and you have some trust in your tablet, you can enroll your tablet with a certificate that expires at the end of your holidays. Feel free to experiment. You can also <a href="/DebianSingleSignOn#Creating_certificates_manually">create a new certificate manually</a>. <h3 id="Using_certificates">Using certificates</h3> You can use <a class="https" href="https://sso.debian.org/ca/test/env">this test page</a> to try your certificates. The browser will ask for confirmation before using it, and if you have more than one it will ask you to choose which one you want to use. <h3 id="Creating_certificates_manually">Creating certificates manually</h3> You can also visit <a class="https" href="https://sso.debian.org/">SSO site</a> to enroll manually (link "getting a certificate manually" at the bottom of the certificate generation page) and obtain a certificate pair on local files that you can then use with curl, links or any other HTTPS client software that supports client certificates. Once you have logged into the site choose the "Get new certificate" option and then choose "getting a certificate manually", which will walk you through generating a key and the appropriate signed challenge for the site to authenticate you. Some browser will need a PKCS12 file to import the locally generated certificates: <pre>openssl pkcs12 -export -out certificate.pfx -inkey your_private_key.key -in certificate_you_downloaded_from_sso.crt</pre> <h3 id="SSO-enabled_sites">SSO-enabled sites</h3> This is a (possibly incomplete) list of sites that only work with sso.debian.org certificates: <ul><li><a class="https" href="https://tracker.debian.org">https://tracker.debian.org</a> </li><li><a class="https" href="https://paste.debian.net">https://paste.debian.net</a> </li><li><a class="https" href="https://debtags.debian.org/">https://debtags.debian.org/</a> </li></ul> <h1 id="Sustainability">Sustainability</h1> Information for the long run. This chapter is work in progress a.k.a. not yet reviewed by those who can really tell. <h2 id="Providing_feedback">Providing feedback</h2> Use <a class="https" href="https://www.debian.org/Bugs/">debian bugtracking system</a> and <a class="https" href="https://www.debian.org/Bugs/pseudo-packages">pseudo package</a> <tt class="backtick">sso.debian.org</tt>. <h2 id="People_behind_this_service">People behind this service</h2> Contact us through .... </div><div id="pagebottom"></div> </div> <div id="footer"> DebianSingleSignOn (<a class="nbinfo" href="/DebianSingleSignOn?action=info" rel="nofollow">last modified 2022-06-18 13:10:29</a>) <ul id="credits"> <li>Debian <a href="https://www.debian.org/legal/privacy">privacy policy</a>, Wiki <a href="/Teams/DebianWiki">team</a>, <a href="https://bugs.debian.org/wiki.debian.org">bugs</a> and <a href="https://salsa.debian.org/debian/wiki.debian.org">config</a>.</li><li>Powered by <a href="https://moinmo.in/" title="This site uses the MoinMoin Wiki software.">MoinMoin</a> and <a href="https://moinmo.in/Python" title="MoinMoin is written in Python.">Python</a>, with hosting provided by <a href="https://www.man-da.de/">Metropolitan Area Network Darmstadt</a>.</li> </ul> </div> </body> </html>