Description of problem: Large organizations have to use HSM boxes for CA certs. Due to company policy or regulatory. Upstream Dogtag comes with HSM support. Version-Release number of selected component (if applicable): 4.4.x How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Support for HSM Boxes Additional info:
Upstream ticket: https://fedorahosted.org/freeipa/ticket/5608
We are working on this feature upstream. At this point there are needs to improve code in several components IdM relies on. We are not planning yet to bring the work back to RHEL 7 as upstream work is not completed yet.
The first set of patches is adding an option to override some PKI spawn settings. Fixed upstream master: https://pagure.io/freeipa/c/8c4d75fd2e2972495a0693f1f86a64f09fc929f2 https://pagure.io/freeipa/c/0a2b02fc620ef16af87be5ec2ba47cd6831059f5 https://pagure.io/freeipa/c/70beccada2e439b9d8d32dbeab369cdb7f0a8383 https://pagure.io/freeipa/c/f847d7756f8d15e47930a709374cf3d95e4b4d8a https://pagure.io/freeipa/c/dd47cfc75a69618f486abefb70f2649ebf8264e7 https://pagure.io/freeipa/c/94937424b12da3e7294ebbcb256b9423ee2d150e https://pagure.io/freeipa/c/dba89712c6a67390c616d5950efab39a73dd8c16 https://pagure.io/freeipa/c/42efdc7bb1c208ac02d45865d68df959f87d5148 https://pagure.io/freeipa/c/2b2c5d6c931660e73cc1c9e75aa3055ab20f386b
Moving to RHEL 8.
Additional upstream ticket: https://pagure.io/freeipa/issue/9273
Fixed upstream master: https://pagure.io/freeipa/c/83161913fb19e1e04286eb93c73c44b19d948325
Fixed upstream ipa-4-10: https://pagure.io/freeipa/c/1de3f6c5580dfe57e39c72268dc54b9dfeb17e69
Design doc Fixed upstream master: https://pagure.io/freeipa/c/a7b58b3c07576cbea21b4528b9d703a63ebc78b2
Design doc Fixed upstream ipa-4-10: https://pagure.io/freeipa/c/2aa8ec1df1468ef2ed8e54ec76f53b858ce0d241