Bug 2144737

Summary:	vault interoperability with older RHEL systems is broken
Product:	Red Hat Enterprise Linux 8	Reporter:	Florence Blanc-Renaud <frenaud>
Component:	ipa	Assignee:	Trivino <ftrivino>
Status:	CLOSED ERRATA	QA Contact:	ipa-qe <ipa-qe>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.8	CC:	mjurasek, myusuf, orion, pasik, rcritten, rjeffman, sumenon, tscherf
Target Milestone:	rc	Keywords:	Triaged, ZStream
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-4.9.10-8.module+el8.8.0+17351+9a3fb056	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	2148255 (view as bug list)		Environment:
Last Closed:	2023-05-16 08:29:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2144736, 2148255

Description Florence Blanc-Renaud 2022-11-22 07:25:28 UTC

Cloned from upstream: https://pagure.io/freeipa/issue/9259

### Issue
AES-128-CBC was recently enabled as default wrapping algorithm for transport of secrets.

This change was done in favor of FIPS as crypto-policies disabled 3DES in RHEL9, but
setting AES as default ended-up breaking backwards compatibility with older RHEL systems.

#### Steps to Reproduce
1. spawn a topology with a rhel7.9 server, and a rhel8.7 client
2. add a vault from the client: "ipa vault-add vault"

#### Actual behavior
Client fails with: "ipa: ERROR: an internal error has occurred", for other combinations you could see: "ipa: ERROR: Unknown option: wrapping_algo"

Without FIPS:

oldServer + newReplica + newClient

    client fails with: "ipa: ERROR: Unknown option: wrapping_algo"
    replica works
    master works
    newServer + oldClient:
    client fails with: "ipa: ERROR: an internal error has occurred"
    server works

with FIPS:

oldServer + newReplica + newClient:

    client fails with: "ipa: ERROR: Unknown option: wrapping_algo"
    replica works
    master works
    newServer + oldClient:
    client fails with: "ipa: ERROR: an internal error has occurred"
    server works

where old is RHEL7 and new is RHEL8

#### Expected behavior
ipa vaults work when running in mixed topologies.


#### Additional info:
The new wrapping algo implementation:

40c362e1eeb000867d0e6244ce03b66b6a35e913
"Support AES for KRA archival wrapping"

introduced a new option "--wrapping-algorithm" for "ipa vault-[retrieve/archive]" that is supposed to be internal only, actually it doesn't work. It should be hidden.

Comment 1 Florence Blanc-Renaud 2022-11-22 07:26:57 UTC

Upstream ticket:
https://pagure.io/freeipa/issue/9259

Comment 2 Florence Blanc-Renaud 2022-11-22 07:30:31 UTC

Fixed upstream:
master:
    https://pagure.io/freeipa/c/93548f2569e11a49ffbb5d0f5957be420820f501 Vault: fix interoperability issues with older RHEL systems

ipa-4-10:
    https://pagure.io/freeipa/c/ba962632cd008edd057f61e7e6fadbf464ff94f2 Vault: fix interoperability issues with older RHEL systems

ipa-4-9:
    https://pagure.io/freeipa/c/c643e56e4c45b7cb61aa53989657143627c23e04 Vault: fix interoperability issues with older RHEL systems

Comment 3 Florence Blanc-Renaud 2022-11-22 07:39:29 UTC

The patch is also needed on RHEL 8.7z (8.7 contains 4.9.10 which embeds the fix adding the new option "--wrapping-algorithm")

Comment 6 Florence Blanc-Renaud 2022-11-25 12:57:49 UTC

Additional commit fixing the generated API doc:

Fixed upstream
master:
https://pagure.io/freeipa/c/35876b4e11e2696b260fb7ee02d8943226d98e96

ipa-4-10:
https://pagure.io/freeipa/c/42957f9e7819ad76394b20337e65c7bee828dd8f

ipa-4-9:
https://pagure.io/freeipa/c/4d6eabd3caf629a14c801ced4ad50dd9faa8147e

Comment 14 errata-xmlrpc 2023-05-16 08:29:08 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (idm:client and idm:DL1 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2794