Current Series Release Notes¶

23.0.0-24¶

Refactored the mapping of Barbican Secrets to KMIP Objects when using the KMIP Secret Store backend.

The SimpleCrypto plugin now supports Elliptic Curve (EC) asymmetric key generation in addition to RSA and DSA. Supported EC curves are SECP256R1 (P-256), SECP384R1 (P-384), and SECP521R1 (P-521), selected by the bit_length parameter in the API request (256, 384, or 521 respectively).

Refactored the mapping of Barbican Secrets to KMIP Objects. The KMIP Object used to store Opqaue Secrets was changed from OpaqueObject to SecretData for better compatibility and adherance to the KMIP standard.

Added barbican-manage secret migrate, an operator subcommand that discovers secrets from the Barbican database and moves them onto another configured secret store by calling plugin.resources.rewrap_secret in-process. It can migrate every payload secret in a specified Keystone project, or every payload secret currently stored on a specified backend (all projects). Failures are recorded and the command continues; a non-zero exit status is returned if any secret fails. Payloads are never printed.

Asymmetric key generation requests that do not specify an algorithm parameter will now be rejected with an error. Previously, these requests defaulted to RSA. To avoid disruption, ensure all Order and key generation API calls include an explicit algorithm value (RSA, DSA, or EC).

The pkcs11-key-generation console script has been removed. This script was deprecated in the Mitaka release (2016) and has been broken since the PKCS#11 plugin constructor was updated to require hmac_mechanism and key_wrap_mechanism parameters. Use barbican-manage hsm gen_mkek and barbican-manage hsm gen_hmac instead.

Deprecated KMIP option [kmip_plugin] pkcs1_only. The option was split into two new options in the same group: public_key_format and private_key_format. This gives deployers more flexibility in choosing the format used to store each asymmetric key type in its own format. For backwards-compatibility, setting pkcs1_only=True overrides both new options to use public_key_format=pkcs1 and private_key_format=pkcs1.

Bug #2165913: The container-consumer and secret-consumer GET endpoints now verify that the requested consumer actually belongs to the container or secret named in the URL before returning it. Previously a consumer was looked up only by its own id while authorization was checked against the URL’s container/secret, allowing an authenticated user to read another tenant’s consumer metadata by pairing their own container/secret id with an arbitrary consumer id. A mismatch now returns 404.

Bug #2165908: The barbican-manage db command no longer prepends the current working directory to sys.path. Previously, a Python module placed in the invocation directory could shadow a module that barbican or one of its transitive dependencies imports, causing it to be imported and executed with the privileges of the operator running the command. Removing the sys.path insertion closes this module-shadowing path.

Fixed barbican-manage calling logging.setup() before CONF was populated from the configuration files, causing logging to be configured with default settings instead of the ones from barbican.conf. logging.setup() is now called after config parsing.

Asymmetric key pair generation now passes generated names and usage masks to the KMIP CreateKeyPair operation. PyKMIP only emits the PublicKeyTemplateAttribute/PrivateKeyTemplateAttribute structures when a name or usage mask is provided for each key, and some KMIP appliances (e.g. Fortanix SDKMS) reject CreateKeyPair requests that lack a PrivateKeyTemplateAttribute. Usage masks are also needed because some appliances deny Get requests for private keys created without an export usage mask, which would leave the generated private key unretrievable through barbican.

Serialized KMIP secret store operations behind a lock. PyKMIP’s ProxyKmipClient is not thread-safe: when barbican-worker processes orders concurrently, the shared client’s connection-open flag makes one thread fail with ClientConnectionFailure('client connection already open').

Secret-store migrate now records leftover plugin objects in secret_store_cleanup_tasks. The retry scheduler enqueues barbican-worker to delete them, with further retries on failure. Plugin payload bytes are never placed on the queue. Exhausted rows remain in ERROR status for operator inspection.