Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

Chapter 4. Managing IdM service vaults: storing and retrieving secrets

Store service secrets in asymmetric vaults using the Identity Management (IdM) CLI to securely distribute credentials to service instances while maintaining administrator control. The vault used in the example is asymmetric, which means that to use it, the administrator needs to perform the following steps:

  1. Generate a private key using, for example, the openssl utility.
  2. Generate a public key based on the private key.

The service secret is encrypted with the public key when an administrator archives it into the vault. Afterwards, a service instance hosted on a specific machine in the domain retrieves the secret using the private key. Only the service and the administrator are allowed to access the secret.

If the secret is compromised, the administrator can replace it in the service vault and then redistribute it to those individual service instances that have not been compromised.

4.1. Prerequisites
Link kopieren

In the procedures below:

  • The IdM admin user is the administrator who manages the service password.
  • private-key-to-an-externally-signed-certificate.pem is the file containing the service secret, in this case a private key to an externally signed certificate. Do not confuse this private key with the private key used to retrieve the secret from the vault.
  • secret_vault is the vault created for the service.
  • HTTP/webserver.idm.example.com is the service whose secret is being archived.
  • service-public.pem is the service public key used to encrypt the password stored in password_vault.
  • service-private.pem is the service private key used to decrypt the password stored in secret_vault.

4.2. Storing an IdM service secret in an asymmetric vault
Link kopieren

Archive a service secret in an asymmetric vault using the Identity Management (IdM) CLI, encrypting it with the public key for secure storage.

Prerequisites

  • You know the IdM administrator password.

Procedure

  1. Log in as the administrator: 

    $ kinit admin

  2. Obtain the public key of the service instance. For example, using the openssl utility:

    1. Generate the service-private.pem private key. 

      $ openssl genrsa -out service-private.pem 2048
Generating RSA private key, 2048 bit long modulus
.+++
...........................................+++
e is 65537 (0x10001)

    2. Generate the service-public.pem public key based on the private key. 

      $ openssl rsa -in service-private.pem -out service-public.pem -pubout
writing RSA key

  3. Create an asymmetric vault as the service instance vault, and provide the public key: 

    $ ipa vault-add secret_vault --service HTTP/webserver.idm.example.com --type asymmetric --public-key-file service-public.pem
----------------------------
Added vault "secret_vault"
----------------------------
Vault name: secret_vault
Type: asymmetric
Public key: LS0tLS1C...S0tLS0tCg==
Owner users: admin
Vault service: HTTP/webserver.idm.example.com@IDM.EXAMPLE.COM

    The password archived into the vault will be protected with the key.

  4. Archive the service secret into the service vault: 

    $ ipa vault-archive secret_vault --service HTTP/webserver.idm.example.com --in private-key-to-an-externally-signed-certificate.pem
-----------------------------------
Archived data into vault "secret_vault"
-----------------------------------

    This encrypts the secret with the service instance public key.

  5. Repeat these steps for every service instance that requires the secret. Create a new asymmetric vault for each service instance.

4.3. Retrieving a service secret for an IdM service instance
Link kopieren

Use the service’s locally stored private key to retrieve a secret from an asymmetric service vault using the Identity Management (IdM) CLI, allowing an instance of the service to load its stored credentials.

Prerequisites

Procedure

  1. Log in as the administrator: 

    $ kinit admin

  2. Obtain a Kerberos ticket for the service: 

    # kinit HTTP/webserver.idm.example.com -k -t /etc/httpd/conf/ipa.keytab

  3. Retrieve the service vault password: 

    $ ipa vault-retrieve secret_vault --service HTTP/webserver.idm.example.com --private-key-file service-private.pem --out secret.txt
------------------------------------
Retrieved data from vault "secret_vault"
------------------------------------

4.4. Changing an IdM service vault secret when compromised
Link kopieren

Isolate a compromised service instance by replacing a compromised secret in a service vault using the Identity Management (IdM) CLI and redistributing the new secret to unaffected service instances.

Prerequisites

  • You know the IdM administrator password.
  • You have created an asymmetric vault to store the service secret.
  • You have generated the new secret and have access to it, for example in the new-private-key-to-an-externally-signed-certificate.pem file.

Procedure

  1. Archive the new secret into the service instance vault: 

    $ ipa vault-archive secret_vault --service HTTP/webserver.idm.example.com --in new-private-key-to-an-externally-signed-certificate.pem
-----------------------------------
Archived data into vault "secret_vault"
-----------------------------------

    This overwrites the current secret stored in the vault.

  2. Retrieve the new secret on non-compromised service instances only. For details, see Retrieving a service secret for an IdM service instance.
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2026 Red HatNach oben