4.2. Storing an IdM service secret in an asymmetric vault

Procedure

1. Log in as the administrator:

   $ kinit admin

2. Obtain the public key of the service instance. For example, using the openssl utility:

   1. Generate the service-private.pem private key.

      $ openssl genrsa -out service-private.pem 2048
      Generating RSA private key, 2048 bit long modulus
      .+++
      ...........................................+++
      e is 65537 (0x10001)

   2. Generate the service-public.pem public key based on the private key.

      $ openssl rsa -in service-private.pem -out service-public.pem -pubout
      writing RSA key

3. Create an asymmetric vault as the service instance vault, and provide the public key:

   $ ipa vault-add secret_vault --service HTTP/webserver.idm.example.com --type asymmetric --public-key-file service-public.pem
   ----------------------------
   Added vault "secret_vault"
   ----------------------------
   Vault name: secret_vault
   Type: asymmetric
   Public key: LS0tLS1C...S0tLS0tCg==
   Owner users: admin
   Vault service: HTTP/webserver.idm.example.com@IDM.EXAMPLE.COM

   The password archived into the vault will be protected with the key.

4. Archive the service secret into the service vault:

   $ ipa vault-archive secret_vault --service HTTP/webserver.idm.example.com --in private-key-to-an-externally-signed-certificate.pem
   -----------------------------------
   Archived data into vault "secret_vault"
   -----------------------------------

   This encrypts the secret with the service instance public key.

5. Repeat these steps for every service instance that requires the secret. Create a new asymmetric vault for each service instance.