Bug 1436714 - [vault] cache KRA transport cert
Summary: [vault] cache KRA transport cert
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.4
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Abhijeet Kasurde
: 1436715 (view as bug list)
Depends On:
TreeView+ depends on / blocked
Reported: 2017-03-28 13:39 UTC by Petr Vobornik
Modified: 2017-08-01 09:47 UTC (History)
6 users (show)

Fixed In Version: ipa-4.5.0-3.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-08-01 09:47:49 UTC
Target Upstream Version:

Attachments (Terms of Use)
console.log (18.28 KB, text/plain)
2017-06-05 08:29 UTC, Abhijeet Kasurde
no flags Details
console.log (3.66 KB, text/plain)
2017-06-05 08:30 UTC, Abhijeet Kasurde
no flags Details

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2304 normal SHIPPED_LIVE ipa bug fix and enhancement update 2017-08-01 12:41:35 UTC

Description Petr Vobornik 2017-03-28 13:39:09 UTC
Cloned from upstream: https://pagure.io/freeipa/issue/6652

To improve performance of the vault, we should consider to cache the transport cert. The transport cert is used to wrap the session key for vault payload with the public RSA key of the KRA's transport cert.

## client


            # retrieve transport certificate
            config = self.api.Command.vaultconfig_show()['result']
            transport_cert_der = config['transport_cert']
            nss_transport_cert = nss.Certificate(transport_cert_der)

## server


            kra_client = self.api.Backend.kra.get_client()
            transport_cert = kra_client.system_certs.get_transport_cert()
            config = {'transport_cert': transport_cert.binary}

The method ```get_transport_cert``` performs another HTTPS connection to retrieve the KRA transport cert from Dogtag.

## Caching

The KRA transport cert should be cached on both server side and client side, but at least on the client side. Perhaps it is possible to use certmonger to track the cert and have it automatically reloaded when it is renewed?

Comment 2 Petr Vobornik 2017-03-28 13:39:30 UTC
Upstream ticket:

Comment 3 Petr Vobornik 2017-03-28 13:41:31 UTC
Upstream ticket:

Comment 4 Petr Vobornik 2017-03-28 13:43:43 UTC
*** Bug 1436715 has been marked as a duplicate of this bug. ***

Comment 5 Petr Vobornik 2017-03-28 13:46:19 UTC
    98bb5397c535e5e1a6c5ade9f0fb918be1d282c3 vault: cache the transport certificate on client

    abefb64bea8ea1b8487ad87716e4a335555d19dc Simplify KRA transport cert cache

    2723b5fa5edc75901c8fbaf110a37c87df0aec87 Simplify KRA transport cert cache

Comment 10 Abhijeet Kasurde 2017-06-05 08:29:25 UTC
Verified using IPA version :: ipa-server-4.5.0-13.el7.x86_64

Verified using basic sanity tests and integration tests.

Marking BZ as verified. See console.log for sanity tests.

Comment 11 Abhijeet Kasurde 2017-06-05 08:29:49 UTC
Created attachment 1284998 [details]

Comment 12 Abhijeet Kasurde 2017-06-05 08:30:35 UTC
Created attachment 1284999 [details]

Comment 13 errata-xmlrpc 2017-08-01 09:47:49 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.