From d7c1ba0672fc8964f7674a526f3019429a551372 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Mar 06 2024 08:34:57 +0000 Subject: Vault: add additional fallback to RSA-OAEP wrapping algo There is a fallback when creating the wrapping key but one was missing when trying to use the cached transport_cert. This allows, along with forcing keyWrap.useOAEP=true, vault creation on an nCipher HSM. This can be seen in HSMs where the device doesn't support the PKCS#1 v1.5 mechanism. It will error out with either "invalid algorithm" or CKR_FUNCTION_FAILED. Related: https://pagure.io/freeipa/issue/9191 Signed-off-by: Rob Crittenden Reviewed-By: Florence Blanc-Renaud --- diff --git a/ipaclient/plugins/vault.py b/ipaclient/plugins/vault.py index ed16c73..1523187 100644 --- a/ipaclient/plugins/vault.py +++ b/ipaclient/plugins/vault.py @@ -757,8 +757,12 @@ class ModVaultData(Local): Calls the internal counterpart of the command. """ # try call with cached transport certificate - result = self._do_internal(algo, transport_cert, False, - False, *args, **options) + try: + result = self._do_internal(algo, transport_cert, False, + False, *args, **options) + except errors.EncodingError: + result = self._do_internal(algo, transport_cert, False, + True, *args, **options) if result is not None: return result