Closed kwin closed 4 years ago
@kwin would you like to propose a syntax for this feature?
The proposal documentation is outlined in https://github.com/Netcentric/accesscontroltool/pull/401/files#diff-7b182d5ba2fea830f66aca8de9366067. What is still missing is support for PKCS#10 Certificate Requests (https://tools.ietf.org/html/rfc7468#section-7)) which can be used instead of public keys and are used together with Adobe IO (https://docs.adobe.com/content/help/en/experience-manager-learn/foundation/authentication/set-up-public-private-keys-for-use-with-aem-and-adobe-io.html)
@kwin So PR is merged, INHO it would be good to add more documentation to [1]:
@ghenzler The approach on how keys are generated depends on the system for which the keys are used. This is documented for Adobe Launch/IO in https://docs.adobe.com/content/help/en/experience-manager-learn/foundation/authentication/set-up-public-private-keys-for-use-with-aem-and-adobe-io.html. For SAML the approach usually is that you receive a private key from the SAML server administrator (https://helpx.adobe.com/experience-manager/6-5/sites/administering/using/saml-2-0-authenticationhandler.html#AddtheServiceProviderkeyandcertificatechaintotheAEMkeystore). Different master keys per env requires relying on run mode specific configs. But this is not specific to the keystore. The same is true e.g. for regular users with passwords.
@kwin Thanks for improving the documentation via 54179b6aa0ce and 6e69159ce390
Proposal
Support adding x private/public keys pairs to a user's keystore in PKCS#8 format (encrypted, PEM)
The user config object would allow one more complex key named
keys
. Each key consists out of a name = alias and two fields calledkey
andpassphrase
. key will contain the BEM encoded PKCS#8 encrypted key and passphrase the passphrase to decode the encrypted key. The passphrase itself is encrypted with the AEM master key.Implementation
When installing such a user
Private keys are as sensitive as passwords and should therefore never be stored in an unencrypted form in some source code management. PKCS#8 supports multiple encryptions (https://tools.ietf.org/html/rfc5208#page-4).
Background
Right now creating keystores for (system) users is complicated as they are encrypted with a password. This password is stored in an encrypted form in the property
<user>/keystore/keystorePassword
. When leveraging regular content packages, each instance having a dedicated Crypto master key requires a dedicated property. Therefore it would be nice if the run mode support from the actool could be leveraged to ease creating keystores for e.g. system users. This is relevant for the AEM SAML Authentication handler as well as for the Adobe Launch AEM Integration and probably others in the future.