Chapter 1. Vaults in IdM
Chapter 1. Vaults in IdM This chapter describes vaults in Identity Management (IdM). It introduces the following topics: The concept of the vault . The different roles associated with a vault . The different types of vaults available in IdM based on the level of security and access control . The different types of vaults available in IdM based on ownership . The concept of vault containers . The basic commands for managing vaults in IdM . Installing the key recovery authority (KRA), which is a prerequisite for using vaults in IdM . 1.1. Vaults and their benefits A vault is a useful feature for those Identity Management (IdM) users who want to keep all their sensitive data stored securely but conveniently in one place. There are various types of vaults and you should choose which vault to use based on your requirements. A vault is a secure location in (IdM) for storing, retrieving, sharing, and recovering a secret. A secret is security-sensitive data, usually authentication credentials, that only a limited group of people or entities can access. For example, secrets include: Passwords PINs Private SSH keys A vault is comparable to a password manager. Just like a password manager, a vault typically requires a user to generate and remember one primary password to unlock and access any information stored in the vault. However, a user can also decide to have a standard vault. A standard vault does not require the user to enter any password to access the secrets stored in the vault. Note The purpose of vaults in IdM is to store authentication credentials that allow you to authenticate to external, non-IdM-related services. Other important characteristics of the IdM vaults are: Vaults are only accessible to the vault owner and those IdM users that the vault owner selects to be the vault members. In addition, the IdM administrator has access to the vault. If a user does not have sufficient privileges to create a vault, an IdM administrator can create the vault and set the user as its owner. Users and services can access the secrets stored in a vault from any machine enrolled in the IdM domain. One vault can only contain one secret, for example, one file. However, the file itself can contain multiple secrets such as passwords, keytabs or certificates. Note Vault is only available from the IdM command line (CLI), not from the IdM Web UI. 1.2. Vault owners, members, and administrators Identity Management (IdM) distinguishes the following vault user types: Vault owner A vault owner is a user or service with basic management privileges on the vault. For example, a vault owner can modify the properties of the vault or add new vault members. Each vault must have at least one owner. A vault can also have multiple owners. Vault member A vault member is a user or service that can access a vault created by another user or service. Vault administrator Vault administrators have unrestricted access to all vaults and are allowed to perform all vault operations. Note Symmetric and asymmetric vaults are protected with a password or key and apply special access control rules (see Vault types ). The administrator must meet these rules to: Access secrets in symmetric and asymmetric vaults. Change or reset the vault password or key. A vault administrator is any user with the Vault Administrators privilege. In the context of the role-based access control (RBAC) in IdM, a privilege is a group of permissions that you can apply to a role. Vault User The vault user represents the user in whose container the vault is located. The Vault user information is displayed in the output of specific commands, such as ipa vault-show : For details on vault containers and user vaults, see Vault containers . Additional resources See Standard, symmetric and asymmetric vaults for details on vault types. 1.3. Standard, symmetric, and asymmetric vaults Based on the level of security and access control, IdM classifies vaults into the following types: Standard vaults Vault owners and vault members can archive and retrieve the secrets without having to use a password or key. Symmetric vaults Secrets in the vault are protected with a symmetric key. Vault owners and members can archive and retrieve the secrets, but they must provide the vault password. Asymmetric vaults Secrets in the vault are protected with an asymmetric key. Users archive the secret using a public key and retrieve it using a private key. Vault members can only archive secrets, while vault owners can do both, archive and retrieve secrets. 1.4. User, service, and shared vaults Based on ownership, IdM classifies vaults into several types. The table below contains information about each type, its owner and use. Table 1.1. IdM vaults based on ownership Type Description Owner Note User vault A private vault for a user A single user Any user can own one or more user vaults if allowed by IdM administrator Service vault A private vault for a service A single service Any service can own one or more user vaults if allowed by IdM administrator Shared vault A vault shared by multiple users and services The vault administrator who created the vault Users and services can own one or more user vaults if allowed by IdM administrator. The vault administrators other than the one that created the vault also have full access to the vault. 1.5. Vault containers A vault container is a collection of vaults. The table below lists the default vault containers that Identity Management (IdM) provides. Table 1.2. Default vault containers in IdM Type Description Purpose User container A private container for a user Stores user vaults for a particular user Service container A private container for a service Stores service vaults for a particular service Shared container A container for multiple users and services Stores vaults that can be shared by multiple users or services IdM creates user and service containers for each user or service automatically when the first private vault for the user or service is created. After the user or service is deleted, IdM removes the container and its contents. 1.6. Basic IdM vault commands You can use the basic commands outlined below to manage Identity Management (IdM) vaults. The table below contains a list of ipa vault-* commands with the explanation of their purpose. Note Before running any ipa vault-* command, install the Key Recovery Authority (KRA) certificate system component on one or more of the servers in your IdM domain. For details, see Installing the Key Recovery Authority in IdM . Table 1.3. Basic IdM vault commands with explanations Command Purpose ipa help vault Displays conceptual information about IdM vaults and sample vault commands. ipa vault-add --help , ipa vault-find --help Adding the --help option to a specific ipa vault-* command displays the options and detailed help available for that command. ipa vault-show user_vault --user idm_user When accessing a vault as a vault member, you must specify the vault owner. If you do not specify the vault owner, IdM informs you that it did not find the vault: ipa vault-show shared_vault --shared When accessing a shared vault, you must specify that the vault you want to access is a shared vault. Otherwise, IdM informs you it did not find the vault: 1.7. Installing the Key Recovery Authority in IdM Follow this procedure to enable vaults in Identity Management (IdM) by installing the Key Recovery Authority (KRA) Certificate System (CS) component on a specific IdM server. Prerequisites You are logged in as root on the IdM server. An IdM certificate authority is installed on the IdM server. You have the Directory Manager credentials. Procedure Install the KRA: Important You can install the first KRA of an IdM cluster on a hidden replica. However, installing additional KRAs requires temporarily activating the hidden replica before you install the KRA clone on a non-hidden replica. Then you can hide the originally hidden replica again. Note To make the vault service highly available and resilient, install the KRA on two IdM servers or more. Maintaining multiple KRA servers prevents data loss. Additional resources See Demoting or promoting hidden replicas . See The hidden replica mode .
ipa vault-show my_vault Vault name: my_vault Type: standard Owner users: user Vault user: user [admin@server ~]USD ipa vault-show user_vault ipa: ERROR: user_vault: vault not found [admin@server ~]USD ipa vault-show shared_vault ipa: ERROR: shared_vault: vault not found ipa-kra-install