freeipa

#9592 Resurrecting PGP integration
Opened by wscullin. Modified

Open
Close Issue

Request for enhancement

We'd like to resurrect the V2 PRD requirement for PGP integration #4147.

As a security and systems administrator who's willing to contribute, we'd like to work with the FreeIPA team to provide:

  • PGP Public Key storage
  • escrow for PGP backup keys and encryption keys
  • support for PGP keys generated by hardware tokens like Yubikeys
  • basic keyserver functionality

in the future:

  • client tools for automatic configuration of system keyrings and user environments
  • automatic key signing
  • Shamir's secret sharing / MxN support for backups and escrowed secrets

This is to help support sites where PGP keys are used for package or code signing, distributed secrets management, and e-mail encryption.

Issue

The GnuPG project has schema for OpenLDAP and AD that we've been using successfully. We were looking at simply extending the FreeIPA / Red Hat IdM schema to make all attributes and object classes optional as not to break things, then began looking at what it would take to do this in a sustainable and upstreamable way.

While x509 has won the battle for e-mail, we keep finding places where our users, DevOps teams, and developers would benefit from a trusted internal keyserver and having a centralized resource for key management.

Before working on anything upstreamable locally, it would be useful to get feedback on:

  • any considerations not covered in the contributor docs - we may not have gone far enough back in determining why the feature was dropped
  • if the schema from the GnuPGP project provides all desired classes and attributes
  • if the GnuPGP organization of key data with a separate OU for keys is acceptable - it seems to align with the way certificates are handled in FreeIPA
  • what tools and UI extensions we should focus on first

Additional info:

We will also be opening a ticket against Red Hat IdM as a customer and cross-reference this ticket.

We are tracking this in Red Hat Case #03817420.

For V2 we tried to boil the ocean. Other features were a priority and we never got around to PGP support. After 10 years and limited inquiries we dropped it.

I'd recommend you write up the design using the template https://github.com/freeipa/freeipa/blob/master/doc/designs/template.md and open a PR on github. This will provide more details on what your plan is and hopefully identify gaps so we catch them in advance rather than during implementation.

It will also answer questions I already have, like what software will run the key server? Is that already packaged for Fedora/RHEL?

Having the keys stored in a separate OU is fine. From an IPA perspective it's just data. But one question likely to come up is "how to associate an IPA user with key(s) so they can manage their own?" This will include add, delete, read and write permissions.

It would be very good if it would also have some kind of app (like bind-dyndb-ldap for dns) to dynamically serve WKD for domain from ldap (for example in WSGI or PHP)

Maybe even integration with openpgp-ca to sign keys with domain key (using gnupg) it also is pretty scalable so should be possible to do on multiple masters
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.