freeipa

#7518 Improve Custodia client and key distribution handling
Closed: fixed Opened by cheimes.

Closed: fixed
Reopen Issue

Problem description

When a replica is installed, a new set of Custodia keys are create locally. The public keys are uploaded to the local 389-DS instance. Then Custodia waits until it sees the keys on its replication peer. For busy systems, replication can talk a while. In worst case, the installer runs into a timeout.

Further more, the installer creates multiple instances of the Custodia client object. In the replica promotion case with CA setup, some parts talk to a Custodia instance on replica master, other instances to Custodia instance on the CA replica master. Replica and CA replica can be different hosts.

Fix

Installers now pass a single CustodiaInstance object around, instead of creating new instances on demand. In case of replica promotion with CA, the instance gets all secrets from a master with CA present. Before, an installer created multiple instances and may have requested CA key material from a different machine than DM password hash.

In case of Domain Level 1 and replica promotion, the CustodiaInstance no longer adds the keys to the local instance and waits for replication to other replica. Instead the installer directly uploads the new public keys to the remote 389-DS instance.

Without promotion, new Custodia public keys are still added to local 389-DS over LDAPI.

Metadata Update from @cheimes:
- Issue assigned to cheimes

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1860

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.5.5 (was: FreeIPA 4.5)

master:

  • 994f71ac8a1bb7ba6bc9caf0f6e4f59af44ad9c4 Use single Custodia instance in installers

ipa-4-6:

  • a0cdeb68e21a932c9554b8a305e7dcbfcc77cd94 Use single Custodia instance in installers

ipa-4-5:

  • 0e42fb9c0daf05a8bf6dc213b2fdcd1ad05f5a73 Use single Custodia instance in installers

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1577108

Issue linked to bug 1577108

master:

  • 533307382ad8212567337793bd42991885769a58 Use one Custodia peer to retrieve all secrets

ipa-4-6:

  • a3d389095e90706972ec519af53416d83ed4fe82 Use one Custodia peer to retrieve all secrets

ipa-4-5:

  • d3c09a6de06d8ae19d05c0b96cb9c2a5b789b472 Use one Custodia peer to retrieve all secrets

master:

  • dcaa62f6a4e0a57de9d0affda584a27539bc4a36 Test for improved Custodia key distribution

ipa-4-6:

  • 59f31f5a3274333f9160b09fa4ddd808beadd346 Test for improved Custodia key distribution

ipa-4-5:

  • 5eef5b7458148206cb0ad8126ce8eb36b582ae85 Test for improved Custodia key distribution

ipa-4-6:

  • b9beda34886d99374e5892cf50e32a8ff95c09f4 Fix KRA replica installation from CA master

ipa-4-5:

  • fd5f000d1379daf263711f1f34ad97ac75dfcde7 Fix KRA replica installation from CA master

master:

  • 530da69eadf5b73e4ca83252e3a370ed70354a39 Fix KRA replica installation from CA master
Metadata
None
None
None
Lowest
https://github.com/freeipa/freeipa/pull/1860
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.