<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 08/02/2011 02:15 PM, Ian Stokes-Rees wrote:
<blockquote cite="mid:4E383ED7.1030506@hkl.hms.harvard.edu"
type="cite">
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
Is there some mechanism to store private keys (e.g. ssh, pgp, gpg,
X.509) in FreeIPA, tied to a user account, so only the user (via
kerb token or with password prompt) can fetch the token?<br>
<br>
If FreeIPA doesn't make this possible, can anyone suggest a good
mechanism to have, effectively, a user keystore that would sync
passwords with FreeIPA nicely. I am thinking, in particular, of
the scenario where users forget their password -- we'd strongly
prefer to just reset it for them (24 hours, one login) in a way
that didn't mean also re-issuing all passphrase-secured identity
tokens.<br>
<br>
</blockquote>
<br>
Not now however:<br>
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/754">https://fedorahosted.org/freeipa/ticket/754</a><br>
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/237">https://fedorahosted.org/freeipa/ticket/237</a><br>
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/521">https://fedorahosted.org/freeipa/ticket/521</a><br>
<br>
There are also some thoughts and ideas about IPA as a secure vault
for other credentials in other systems which is not logged as a
ticket.<br>
<br>
<br>
Would you mind sharing with us your ideas about this functionality
actually should work?<br>
Use cases, examples and design ideas are very welcome. <br>
<br>
<br>
<br>
<blockquote cite="mid:4E383ED7.1030506@hkl.hms.harvard.edu"
type="cite"> Thanks,<br>
<br>
Ian<br>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>