Francisco Trivino 305fcc25b4 kra: set RSA-OAEP as default wrapping algo when FIPS is enabled ...

Vault uses PKCS1v15 as default padding wrapping algo, which is not an approved
FIPS algorithm. This commit ensures that KRA is installed with RSA-OAEP if FIPS
is enabled. It also handles upgrade path.

Fixes: https://pagure.io/freeipa/issue/9191

Signed-off-by: Francisco Trivino <ftrivino@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>

2024-01-30 10:18:02 -05:00

..

plugins

ipasam: make krbtgt TDO principal canonical

2024-01-23 13:19:37 +01:00

server

kra: set RSA-OAEP as default wrapping algo when FIPS is enabled

2024-01-30 10:18:02 -05:00

__init__.py

Remove __all__ specifications in ipaclient and ipaserver.install

2013-09-06 15:42:33 +02:00

adtrust.py

adtrust install: define constants for rid bases

2021-11-02 10:11:28 +01:00

adtrustinstance.py

adtrustinstance: make sure NetBIOS name defaults are set properly

2024-01-17 19:32:47 +01:00

bindinstance.py

LDAP autobind authenticateAsDN for BIND named

2021-06-15 14:13:16 +03:00

ca.py

Server affinity: call ca.install() if there is a CA in the topology

2024-01-23 16:32:58 +01:00

cainstance.py

Enable LWCA monitor explicitly

2023-10-19 07:42:28 +02:00

certs.py

pylint: fix errors

2024-01-09 08:40:47 +01:00

conncheck.py

install: introduce installer class hierarchy

2016-11-11 12:17:25 +01:00

custodiainstance.py

pylint: Fix unused-private-member

2022-03-11 13:37:08 -05:00

dns.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

dnskeysyncinstance.py

dnskeysyncinstance: use late binding for UID/GID resolution

2020-12-22 14:05:13 +02:00

dogtag.py

Verify pki ini override early

2019-04-10 13:43:23 +02:00

dogtaginstance.py

kra: set RSA-OAEP as default wrapping algo when FIPS is enabled

2024-01-30 10:18:02 -05:00

dsinstance.py

BDB tuning should be applied only when BDB backend is used

2023-09-01 13:16:15 -04:00

httpinstance.py

pylint: Replace deprecated pipes

2023-01-10 08:30:58 +01:00

installutils.py

pylint: Fix used-before-assignment

2023-01-10 08:30:58 +01:00

ipa_acme_manage.py

ACME: Don't treat pki-server ca-config-show failures as fatal

2024-01-10 13:35:51 -05:00

ipa_backup.py

BIND: Setup logging

2021-05-25 10:45:49 +03:00

ipa_cacert_manage.py

Compatibility fix for PyCA cryptography 42.0.0

2024-01-24 14:54:24 +01:00

ipa_cert_fix.py

Compatibility fix for PyCA cryptography 42.0.0

2024-01-24 14:54:24 +01:00

ipa_crlgen_manage.py

CRL generation master: new utility to enable|disable

2019-03-14 09:39:55 +01:00

ipa_kra_install.py

Change FreeIPA references to IPA and Identity Management

2021-01-21 13:51:45 +01:00

ipa_ldap_updater.py

Remove -s option from ipa-ldap-updater usage

2021-05-20 14:45:27 -04:00

ipa_otptoken_import.py

pylint: Fix useless-object-inheritance

2023-01-10 08:30:58 +01:00

ipa_pkinit_manage.py

Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server

2021-06-17 17:28:48 -04:00

ipa_replica_install.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

ipa_restore.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

ipa_server_certinstall.py

Require an ipa-ca SAN on 3rd party certs if ACME is enabled

2020-11-02 14:01:05 -05:00

ipa_server_install.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

ipa_server_upgrade.py

ipa commands: print 'IPA is not configured' when ipa is not setup

2018-08-23 12:08:45 +02:00

ipa_subids.py

pylint: Fix arguments-renamed

2022-03-11 13:37:08 -05:00

ipa_trust_enable_agent.py

ipa-adtrust-install: run remote configuration for new agents

2020-03-05 14:40:58 +01:00

ipa_winsync_migrate.py

ipa commands: print 'IPA is not configured' when ipa is not setup

2018-08-23 12:08:45 +02:00

ipactl.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

kra.py

Uninstaller: uninstall PKI before shutting down services

2023-06-21 21:08:17 +02:00

krainstance.py

kra: set RSA-OAEP as default wrapping algo when FIPS is enabled

2024-01-30 10:18:02 -05:00

krbinstance.py

Tolerate absence of PAC ticket signature depending of server capabilities

2023-05-24 13:20:38 +02:00

ldapupdate.py

pylint: remove useless suppression

2023-01-10 08:30:58 +01:00

odsexporterinstance.py

odsexporterinstance: use late binding for UID/GID resolution

2020-12-22 14:05:13 +02:00

opendnssecinstance.py

opendnssecinstance: use late binding for UID/GID resolution

2020-12-22 14:05:13 +02:00

otpdinstance.py

Enable pylint missing-final-newline check

2015-12-23 07:59:22 +01:00

replication.py

check_repl_update: in progress is a boolean

2022-08-16 08:39:06 +02:00

schemaupdate.py

Unify access to FQDN

2020-10-26 17:11:19 +11:00

service.py

LDAP autobind authenticateAsDN for BIND named

2021-06-15 14:13:16 +03:00

sysupgrade.py

Add absolute_import future imports

2018-04-20 09:43:37 +02:00

upgradeinstance.py

Use get_replication_plugin_name in LDAP updater

2021-06-21 10:58:02 +02:00