I don't think that host keytab can be used now because vault API currently doesn't support setting host as a vault member(escrow use case). Support for it might be added or it can be worked around with service keytab.

It will be slow now. But AFAIK Ade and Endi has been working on improving vault performance so it will change.

There needs to be something which will set the jump host/service as a vault member of user's vault (specific?). Alternatively an ACI which would allow creation of user vault by the host/service - but this seems rather dangerous to me, so it would have to be properly limited.

Maybe something else..

Here is my thought process:

- The bridging to SSH keys is the only option to work around the renaming of the hosts, we know that
- Option introduces overhead to manage the SSH keys
- If we can provide a solution that would manage keys automatically we effectively create an end-to-end solution that works around the limitations related to renaming hosts without adding extra administrative overhead.

Of cause the solution needs to be properly designed and be secure and performant. It seems it is just a gap that we need to close at some point. I wonder if it can be closed in a simple way with what we already have or it requires a lot of extra work on the components to tie things together.

This ticket is an example of what people would like to try to do with the vault so if Vault is not capable we need to fix it.

Thank you taking time to submit this request for FreeIPA. Unfortunately this bug was not given priority and the team lacks the capacity to work on it at this time.

Given that we are unable to fulfil this request I am closing the issue as wontfix. To request re-consideration of this decision please reopen this issue and provide additional technical details about its importance to you.