Ade Lee
0465b85087
This patch adds an initial version of the Dogtag plugin that implements the decrypt(), encrypt() and generate() functions. In this version, we will create and initialize an NSS database on the server to do crypto operations within the Dogtag DRM python client. This allows us to decrypt() and encrypt() secrets without passing in wrapping keys. When the barbican-client and the Barbican server API have been changed to pass through the wrapping keys, this plugin will need to enhanced to make the relevant DRM client calls. This plugin has been tested by running the barbican server within a virtual environment. There are several steps needed to get things configured, which are detailed in the blueprint. Added unit tests. These unit tests will be skipped if the dogtag dependencies are not present to import. Change-Id: Ib53bf3df5a65af7ac602ec7f7895e9c723c36c06 Implements: blueprint dogtag-plugin
165 lines
5.2 KiB
Plaintext
165 lines
5.2 KiB
Plaintext
[DEFAULT]
|
|
# Show more verbose log output (sets INFO log level output)
|
|
verbose = True
|
|
|
|
# Show debugging output in logs (sets DEBUG log level output)
|
|
debug = True
|
|
|
|
# Address to bind the API server
|
|
bind_host = 0.0.0.0
|
|
|
|
# Port to bind the API server to
|
|
bind_port = 9311
|
|
|
|
# Host name, for use in HATEOS-style references
|
|
# Note: Typically this would be the load balanced endpoint that clients would use
|
|
# communicate back with this service.
|
|
host_href = http://localhost:9311
|
|
|
|
# Log to this file. Make sure you do not set the same log
|
|
# file for both the API and registry servers!
|
|
#log_file = /var/log/barbican/api.log
|
|
|
|
# Backlog requests when creating socket
|
|
backlog = 4096
|
|
|
|
# TCP_KEEPIDLE value in seconds when creating socket.
|
|
# Not supported on OS X.
|
|
#tcp_keepidle = 600
|
|
|
|
# Maximum allowed http request size against the barbican-api
|
|
max_allowed_secret_in_bytes = 15000
|
|
|
|
# SQLAlchemy connection string for the reference implementation
|
|
# registry server. Any valid SQLAlchemy connection string is fine.
|
|
# See: http://www.sqlalchemy.org/docs/05/reference/sqlalchemy/connections.html#sqlalchemy.create_engine
|
|
# Uncomment this for local dev, putting db in project directory:
|
|
#sql_connection = sqlite:///barbican.sqlite
|
|
# Note: For absolute addresses, use '////' slashes after 'sqlite:'
|
|
# Uncomment for a more global development environment
|
|
sql_connection = sqlite:////var/lib/barbican/barbican.sqlite
|
|
|
|
# Period in seconds after which SQLAlchemy should reestablish its connection
|
|
# to the database.
|
|
#
|
|
# MySQL uses a default `wait_timeout` of 8 hours, after which it will drop
|
|
# idle connections. This can result in 'MySQL Gone Away' exceptions. If you
|
|
# notice this, you can lower this value to ensure that SQLAlchemy reconnects
|
|
# before MySQL can drop the connection.
|
|
sql_idle_timeout = 3600
|
|
|
|
# Default page size for the 'limit' paging URL parameter.
|
|
default_limit_paging = 10
|
|
|
|
# Maximum page size for the 'limit' paging URL parameter.
|
|
max_limit_paging = 100
|
|
|
|
# Number of Barbican API worker processes to start.
|
|
# On machines with more than one CPU increasing this value
|
|
# may improve performance (especially if using SSL with
|
|
# compression turned on). It is typically recommended to set
|
|
# this value to the number of CPUs present on your machine.
|
|
workers = 1
|
|
|
|
# Role used to identify an authenticated user as administrator
|
|
#admin_role = admin
|
|
|
|
# Allow unauthenticated users to access the API with read-only
|
|
# privileges. This only applies when using ContextMiddleware.
|
|
#allow_anonymous_access = False
|
|
|
|
# Allow access to version 1 of barbican api
|
|
#enable_v1_api = True
|
|
|
|
# Allow access to version 2 of barbican api
|
|
#enable_v2_api = True
|
|
|
|
# ================= SSL Options ===============================
|
|
|
|
# Certificate file to use when starting API server securely
|
|
#cert_file = /path/to/certfile
|
|
|
|
# Private key file to use when starting API server securely
|
|
#key_file = /path/to/keyfile
|
|
|
|
# CA certificate file to use to verify connecting clients
|
|
#ca_file = /path/to/cafile
|
|
|
|
# ================= Security Options ==========================
|
|
|
|
# AES key for encrypting store 'location' metadata, including
|
|
# -- if used -- Swift or S3 credentials
|
|
# Should be set to a random string of length 16, 24 or 32 bytes
|
|
#metadata_encryption_key = <16, 24 or 32 char registry metadata key>
|
|
|
|
# ============ Delayed Delete Options =============================
|
|
|
|
# Turn on/off delayed delete
|
|
delayed_delete = False
|
|
|
|
# Delayed delete time in seconds
|
|
scrub_time = 43200
|
|
|
|
# Directory that the scrubber will use to remind itself of what to delete
|
|
# Make sure this is also set in glance-scrubber.conf
|
|
scrubber_datadir = /var/lib/barbican/scrubber
|
|
|
|
# ======== OpenStack policy integration
|
|
# JSON file representing policy (string value)
|
|
policy_file=/etc/barbican/policy.json
|
|
|
|
# Rule checked when requested rule is not found (string value)
|
|
policy_default_rule=default
|
|
|
|
|
|
# ================= Queue Options - oslo.messaging ==========================
|
|
|
|
# Rabbit and HA configuration:
|
|
ampq_durable_queues = True
|
|
rabbit_userid=guest
|
|
rabbit_password=guest
|
|
rabbit_ha_queues = True
|
|
rabbit_port=5672
|
|
|
|
# For HA, specify queue nodes in cluster, comma delimited:
|
|
# For example: rabbit_hosts=192.168.50.8:5672, 192.168.50.9:5672
|
|
rabbit_hosts=localhost:5672
|
|
|
|
# For HA, specify queue nodes in cluster as 'user@host:5672', comma delimited, ending with '/offset':
|
|
# For example: transport_url = rabbit://guest@192.168.50.8:5672,guest@192.168.50.9:5672/
|
|
# DO NOT USE THIS, due to '# FIXME(markmc): support multiple hosts' in oslo/messaging/_drivers/amqpdriver.py
|
|
# transport_url = rabbit://guest@localhost:5672/
|
|
|
|
|
|
# ================= Queue Options - Application ==========================
|
|
|
|
[queue]
|
|
# Enable queuing asynchronous messaging.
|
|
# Set false to invoke worker tasks synchronously (i.e. no-queue standalone mode)
|
|
enable = False
|
|
|
|
# Namespace for the queue
|
|
namespace = 'barbican'
|
|
|
|
# Topic for the queue
|
|
topic = 'barbican.workers'
|
|
|
|
# Version for the task API
|
|
version = '1.1'
|
|
|
|
# Server name for RPC service
|
|
server_name = 'barbican.queue'
|
|
|
|
# ================= Crypto plugin ===================
|
|
#[crypto]
|
|
#namespace = barbican.crypto.plugin
|
|
#enabled_crypto_plugins = dogtag_crypto
|
|
|
|
[dogtag_crypto_plugin]
|
|
pem_path = '/etc/barbican/drm_admin_cert.pem'
|
|
pem_password = 'password123'
|
|
drm_host = localhost
|
|
drm_port = 8443
|
|
nss_db_path = '/etc/barbican/alias'
|
|
nss_password = 'password123'
|