[Freeipa-devel] DNSSEC design page

[Ludwig Krispenz]

Hi,

yesterday jan asked me about the status of the schema and if it would be 
ready for certificate storage an dthat puzzled me a bit and showed that 
I still do not really understand what you want to store in LDAP.
Two me there are two very different approaches.

1] LDAP as store for high level objects like certs and keys
For certs and related stuff there is rfc4523 and the schema for ldif 
exists. For keys we would decide if the key is stored in PKCS#8 format 
or as bind keypairs and define a key attribute and that's it. we could 
export keys with softhsm, (eventually convert them) and add to ldap, in 
the long term solution the PKCS#11 replacemnt would need to manage these 
high level objects

2] low level replacement for eg the sqlite3 database in softhsm.
That's what I sometimes get the impression what is wanted. SoftHsm has 
one component Softdatabase with an API, which more or less passes sets 
of attributes (attributes defined by PKCS#11) and then stores it as 
records in sql where each record has a keytype and opaque blob of data. 
If that is what is wanted the decision would be how fingrained the pkcs 
objects/attribute types would have to be mapped to ldap: one ldap 
attribute for each possible attribute type ?

Ludwig


On 02/13/2014 06:36 PM, Petr Spacek wrote:
> Hello list,
>
> I would like to point you to design pages for DNSSEC feature:
>
> Zone signing:
> https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC
>
> Automatic key rotation:
> https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC/Keys/Shortterm 
>
>
> https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC/Keys/Longterm 
>
>
>
> You can ignore bind-dyndb-ldap specifics and think about interactions 
> with FreeIPA and SSSD.
>
> - We need to design LDAP schema for key storage (Ludwig is looking 
> into it).
> - We need to write PKCS#11 module on top of LDAP database.
> - We need to design key rotation on client side (SSSD? Certmonger?).
> - We need to design WebUI/CLI
> etc.
>
> Read sections 'External Impact' carefully :-)
>
> Have a nice day!
>