Re: [Pki-devel] Dogtag sub-CA design proposal; work-in-progress
On Wed, Jun 18, 2014 at 04:32:11PM -0400, Dmitri Pal wrote:
On 06/18/2014 03:15 PM, Ade Lee wrote:
>Added my comments to the etherpad.
I've fleshed out and formatted the design proposal (though it is
still far from complete) and put it up on the wiki:
http://pki.fedoraproject.org/wiki/Lightweight_sub-CAs
And also the LDAP Profile Storage design proposal, which is in a
similar state of incompleteness. I hope to nail down the LDAP
schema, finalise the design and begin implementing next week:
http://pki.fedoraproject.org/wiki/LDAP_Profile_Storage
On the bright side, I think that there are no dependencies between
these design proposals. In FreeIPA there might or might not be a
conceptual association between the two, but that could exist only on
the FreeIPA side, and shouldn't affect the implementation of these
changes.
On the Solution 1 vs Solution 2 debate, from a cleanliness of
implementation view, I think Solution 1 is better, however the fact
that the creation of a new sub-CA must be effected on all replicas
lends much weight to Solution 2.
Anyhow, have a nice weekend and I look forward to continuing the
design process next week.
Cheers,
Fraser
I added couple comments but have to go so I will resume on Monday.
Sorry.
>Ade
>
>On Tue, 2014-06-17 at 14:19 -0400, Dmitri Pal wrote:
>>On 06/17/2014 08:11 AM, Ade Lee wrote:
>>>I can't access this etherpad. It says it needs an account/password.
>>>How do I get an account?
>>>
>>>My guess also will be that others in the dogtag group will have trouble
>>>getting to this account too. I would suggest putting this on a more
>>>accessible etherpad - like http://etherpad.corp.redhat.com perhaps or
>>>even a public etherpad.
>>I changed access. Ade you should be able to see it now.
>>I also added my comments.
>>
>>Fraser it is OK to create a design page on the IPA or Dogtag wiki and
>>discuss this on the public list.
>>
>>>Ade
>>>
>>>On Tue, 2014-06-17 at 17:14 +1000, Fraser Tweedale wrote:
>>>>Hi Ade,
>>>>
>>>>Have been working on the design document and comprehending the
>>>>subsystem/SigningUnit implementation today. The document so far is
>>>>at http://idm.etherpad.corp.redhat.com/dogtag-sub-ca-design. Please
>>>>pass along to / copy in anyone else whose feedback would be valuable
>>>>at this stage of design.
>>>>
>>>>Dmitri, could you please provide input on the whether no-restart of
>>>>Dogtag is a requirement w.r.t. FreeIPA's use of Dogtag sub-CAs?
>>>>Insights regarding the impact of replication on the proposed design
>>>>approach would also be appreciated.
>>>>
>>>>Cheers,
>>>>
>>>>Fraser
>>
>
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.