Metadata-Version: 2.0
Name: custodia.ipa
Version: 0.1.0
Summary: FreeIPA Vault plugin for Custodia
Home-page: https://github.com/latchset/custodia.ipa
Author: Custodia project Contributors
Author-email: cheimes@redhat.com
License: GPLv3+
Platform: UNKNOWN
Classifier: Development Status :: 4 - Beta
Classifier: Programming Language :: Python :: 2.7
Classifier: Programming Language :: Python :: 3.4
Classifier: Programming Language :: Python :: 3.5
Classifier: Programming Language :: Python :: 3.6
Classifier: Intended Audience :: Developers
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Dist: custodia (>=0.3.1)
Requires-Dist: ipalib (>=4.5.0)
Requires-Dist: ipaclient (>=4.5.0)
Requires-Dist: six
Provides-Extra: test
Requires-Dist: coverage; extra == 'test'
Requires-Dist: pytest; extra == 'test'
Requires-Dist: mock; extra == 'test'
Provides-Extra: test_docs
Requires-Dist: docutils; extra == 'test_docs'
Requires-Dist: markdown; extra == 'test_docs'
Provides-Extra: test_pep8
Requires-Dist: flake8; extra == 'test_pep8'
Requires-Dist: flake8-import-order; extra == 'test_pep8'
Requires-Dist: pep8-naming; extra == 'test_pep8'
Provides-Extra: test_pylint
Requires-Dist: pylint; extra == 'test_pylint'
Requires-Dist: coverage; extra == 'test_pylint'
Requires-Dist: pytest; extra == 'test_pylint'
Requires-Dist: mock; extra == 'test_pylint'

.. WARNING: AUTO-GENERATED FILE. DO NOT EDIT.

custodia.ipa — IPA vault plugin for Custodia
============================================

**WARNING** *custodia.ipa is a tech preview with a provisional API.*

custodia.ipa is a storage plugin for
`Custodia <https://custodia.readthedocs.io/>`__. It provides integration
with `FreeIPA <http://www.freeipa.org>`__'s
`vault <https://www.freeipa.org/page/V4/Password_Vault>`__ facility.
Secrets are encrypted and stored in
`Dogtag <http://www.dogtagpki.org>`__'s Key Recovery Agent.

Requirements
------------

Installation
~~~~~~~~~~~~

-  pip
-  setuptools >= 18.0

Runtime
~~~~~~~

-  custodia >= 0.3.1
-  ipalib >= 4.5.0
-  ipaclient >= 4.5.0
-  Python 2.7 (Python 3 support in IPA vault is unstable.)

custodia.ipa requires an IPA-enrolled host and a Kerberos TGT for
authentication. It is recommended to provide credentials with a keytab
file or GSS-Proxy.

Testing and development
~~~~~~~~~~~~~~~~~~~~~~~

-  wheel
-  tox

virtualenv requirements
~~~~~~~~~~~~~~~~~~~~~~~

custodia.ipa depends on several binary extensions and shared libraries
for e.g. python-cryptography, python-gssapi, python-ldap, and
python-nss. For installation in a virtual environment, a C compiler and
several development packages are required.

::

    $ virtualenv venv
    $ venv/bin/pip install --upgrade custodia.ipa

Fedora
^^^^^^

::

    $ sudo dnf install python2 python-pip python-virtualenv python-devel \
        gcc redhat-rpm-config krb5-workstation krb5-devel libffi-devel \
        nss-devel openldap-devel cyrus-sasl-devel openssl-devel

Debian / Ubuntu
^^^^^^^^^^^^^^^

::

    $ sudo apt-get update
    $ sudo apt-get install -y python2.7 python-pip python-virtualenv python-dev \
        gcc krb5-user libkrb5-dev libffi-dev libnss3-dev libldap2-dev \
        libsasl2-dev libssl-dev

--------------

Example configuration
---------------------

Create directories

::

    $ sudo mkdir /etc/custodia /var/lib/custodia /var/log/custodia /var/run/custodia
    $ sudo chown USER:GROUP /var/lib/custodia /var/log/custodia /var/run/custodia
    $ sudo chmod 750 /var/lib/custodia /var/log/custodia

Create service account and keytab

::

    $ kinit admin
    $ ipa service-add custodia/client1.ipa.example
    $ ipa service-allow-create-keytab custodia/client1.ipa.example --users=admin
    $ mkdir -p /etc/custodia
    $ ipa-getkeytab -p custodia/client1.ipa.example -k /etc/custodia/custodia.keytab

Create ``/etc/custodia/custodia.conf``

::

    [DEFAULT]
    confdir = /etc/custodia
    libdir = /var/lib/custodia
    logdir = /var/log/custodia
    rundir = /var/run/custodia

    [global]
    debug = true
    server_socket = ${rundir}/custodia.sock
    auditlog = ${logdir}/audit.log

    [store:vault]
    handler = IPAVault
    keytab = {confdir}/custodia.keytab
    ccache = FILE:{rundir}/ccache

    [auth:creds]
    handler = SimpleCredsAuth
    uid = root
    gid = root

    [authz:paths]
    handler = SimplePathAuthz
    paths = /. /secrets

    [/]
    handler = Root

    [/secrets]
    handler = Secrets
    store = vault

Run Custodia server

::

    $ custodia /etc/custodia/custodia.conf


