The Master KEK rotation (MasterKeyRotator) targets a single key id read from pdv.settings:master_key_id for every subject, regardless of tenant.

Since the multi-tenant feature (#3593589), a subject key belongs to a (tenant, owner) pair and is wrapped under that tenant's Master KEK (pdv_tenant.master_key_id, falling back to the site key when empty). A rotation run on a multi-tenant site therefore:

  • re-wraps every tenant's subject keys onto the site-wide key, undoing the per-tenant cryptographic isolation;
  • never converges, because subjects legitimately on a tenant key are always counted as not on the target and re-wrapped on every pass.

Proposed fix:

  • resolve the rotation target per tenant: pdv_tenant.master_key_id, falling back to the site key when empty;
  • iterate tenants (or scope the convergence queries by tenant) so each tenant's subjects converge toward that tenant's own key;
  • scope countNotOnMasterKey() and ownersNotOnMasterKey() by tenant;
  • add kernel coverage: a two-tenant fixture where rotation converges each tenant to its own key and leaves the other untouched.

Single-tenant installs are unaffected. Until this lands, operators on a multi-tenant install should not run a Master KEK rotation.

Issue fork pdv-3593719

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

mably created an issue. See original summary.

mably opened merge request !7

  • mably committed e1c6656e on 1.x 
    fix: #3593719 Master KEK rotation is not tenant-aware and collapses per-...
mably’s picture

mably commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.