IDP should autogenerate certificate and secret

[wkloucek]

Is your feature request related to a problem? Please describe.

The IDP autogenerates a certificate and secret inmemory to sign sessions. This means a restart yields a new certificate and secret and therefore invalidates all sessions.

Describe the solution you'd like

The IDP should autogenerate and persist the certificate and secret on disk by default.

Describe alternatives you've considered

You can generate a certificate and a secret manually, so that your sessions survive a restart:

openssl rand -out /etc/ocis/idp-encryption.key 32
openssl genpkey -algorithm RSA -out /etc/ocis/idp-private-key.pem -pkeyopt rsa_keygen_bits:4096

Then you need to configure the IDP to use them:

IDP_SIGNING_PRIVATE_KEY_FILES=/etc/ocis/idp-private-key.pem
IDP_ENCRYPTION_SECRET_FILE=/etc/ocis/idp-encryption.key

Additional context

Having the certificate on disk can also prevent a split-brain situation, if you deploy oCIS on two servers. If they share the same data volume (eg. NFS share), they just use the same certificate and secret. If the have it in memory they create sessions only valid for themselves, which is fatal in round robin load balanced situations.

[C0rby]

Having the certificate on disk can also prevent a split-brain situation

But auto generating the certificate could also lead to a split-brain situation when we deploy multiple idp services.
Or should these setups not generate their own certificates.

[wkloucek]

Having the certificate on disk can also prevent a split-brain situation

But auto generating the certificate could also lead to a split-brain situation when we deploy multiple idp services. Or should these setups not generate their own certificates.

If we only generate once and have shared storage (we need that also for the autogenerated ldap ca for the idm and all ldap-consuming services), then we should be fine.

Preferably, distributed systems will not rely on the auto generation. Eg. our oCIS Helm chart will provide external certificates.

[C0rby]

That's true. Ok, let me try to implement something.