Bug 1436714 - [vault] cache KRA transport cert
Summary: [vault] cache KRA transport cert
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.4
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Abhijeet Kasurde
URL:
Whiteboard:
: 1436715 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-03-28 13:39 UTC by Petr Vobornik
Modified: 2017-08-01 09:47 UTC (History)
6 users (show)

Fixed In Version: ipa-4.5.0-3.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-08-01 09:47:49 UTC
Target Upstream Version:


Attachments (Terms of Use)
console.log (18.28 KB, text/plain)
2017-06-05 08:29 UTC, Abhijeet Kasurde
no flags Details
console.log (3.66 KB, text/plain)
2017-06-05 08:30 UTC, Abhijeet Kasurde
no flags Details


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2304 normal SHIPPED_LIVE ipa bug fix and enhancement update 2017-08-01 12:41:35 UTC

Description Petr Vobornik 2017-03-28 13:39:09 UTC
Cloned from upstream: https://pagure.io/freeipa/issue/6652

To improve performance of the vault, we should consider to cache the transport cert. The transport cert is used to wrap the session key for vault payload with the public RSA key of the KRA's transport cert.

## client

ipaclient.plugin.vault


            # retrieve transport certificate
            config = self.api.Command.vaultconfig_show()['result']
            transport_cert_der = config['transport_cert']
            nss_transport_cert = nss.Certificate(transport_cert_der)


## server

```ipaserver.plugins.vault```


            kra_client = self.api.Backend.kra.get_client()
            transport_cert = kra_client.system_certs.get_transport_cert()
            config = {'transport_cert': transport_cert.binary}


The method ```get_transport_cert``` performs another HTTPS connection to retrieve the KRA transport cert from Dogtag.

## Caching

The KRA transport cert should be cached on both server side and client side, but at least on the client side. Perhaps it is possible to use certmonger to track the cert and have it automatically reloaded when it is renewed?

Comment 2 Petr Vobornik 2017-03-28 13:39:30 UTC
Upstream ticket:
https://pagure.io/freeipa/issue/6652

Comment 3 Petr Vobornik 2017-03-28 13:41:31 UTC
Upstream ticket:
https://pagure.io/freeipa/issue/6787

Comment 4 Petr Vobornik 2017-03-28 13:43:43 UTC
*** Bug 1436715 has been marked as a duplicate of this bug. ***

Comment 5 Petr Vobornik 2017-03-28 13:46:19 UTC
master:
    98bb5397c535e5e1a6c5ade9f0fb918be1d282c3 vault: cache the transport certificate on client

master:
    abefb64bea8ea1b8487ad87716e4a335555d19dc Simplify KRA transport cert cache

ipa-4-5:
    2723b5fa5edc75901c8fbaf110a37c87df0aec87 Simplify KRA transport cert cache

Comment 10 Abhijeet Kasurde 2017-06-05 08:29:25 UTC
Verified using IPA version :: ipa-server-4.5.0-13.el7.x86_64

Verified using basic sanity tests and integration tests.

Marking BZ as verified. See console.log for sanity tests.

Comment 11 Abhijeet Kasurde 2017-06-05 08:29:49 UTC
Created attachment 1284998 [details]
console.log

Comment 12 Abhijeet Kasurde 2017-06-05 08:30:35 UTC
Created attachment 1284999 [details]
console.log

Comment 13 errata-xmlrpc 2017-08-01 09:47:49 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2304


Note You need to log in before you can comment on or make changes to this bug.