Refactor Barbican Secret to KMIP Object mapping
This patch refactors the mapping function used to convert Barbican Secrets into KMIP Objects. The KMIP Object used to store Opaque Secrets was changed from
OpaqueObjecttoSecretDatafor better compatibility and adherance to the KMIP standard.
OpaqueObjectwas problematic becausepykmiprequires a value for the data type that is undefined in the KMIP spec. Additionally, some vendors don’t support Opaque objects at all, e.g. Fortanix DSM KMIP.With this change, both Passphrase and Opaque Secrets are stored in the KMIP server using
SecretDataobjects. This pach makes use of Application Specific Information to annotate the KMIP object with the Barbican Secret type it is storing. However, this annotation is purely informational. It may be useful when looking at objects in the KMIP device directly, but the deserialization of KMIP Objects continues to use the type information stored in the Barbican database.This patch also deprecates the KMIP option
[kmip_plugin] pkcs1_onlyin favor of two separate options in the same group:public_key_formatandprivate_key_format. For backwards-compatibility, settingpkcs1_only=Trueoverrides the values of both new options to usepublic_key_format=pkcs1andprivate_key_format=pkcs1.Signed-off-by: Douglas Mendizábal dmendiza@redhat.com Change-Id: Iaf6e6075e436d75c79f54408ebbdeb7f4a589246
版权所有:中国计算机学会技术支持:开源发展技术委员会
京ICP备13000930号-9
京公网安备 11010802047560号