Issue

AES-128-CBC was recently enabled as default wrapping algorithm for transport of secrets.

This change was done in favor of FIPS as crypto-policies disabled 3DES in RHEL9, but
setting AES as default ended-up breaking backwards compatibility with older RHEL systems.

Steps to Reproduce

1. spawn a topology with a rhel7.9 server, and a rhel8.7 client
2. add a vault from the client: "ipa vault-add vault"

Actual behavior

Client fails with: "ipa: ERROR: an internal error has occurred", for other combinations you could see: "ipa: ERROR: Unknown option: wrapping_algo"

Without FIPS:

oldServer + newReplica + newClient

client fails with: "ipa: ERROR: Unknown option: wrapping_algo"
replica works
master works
newServer + oldClient:
client fails with: "ipa: ERROR: an internal error has occurred"
server works

with FIPS:

oldServer + newReplica + newClient:

client fails with: "ipa: ERROR: Unknown option: wrapping_algo"
replica works
master works
newServer + oldClient:
client fails with: "ipa: ERROR: an internal error has occurred"
server works

where old is RHEL7 and new is RHEL8

Expected behavior

ipa vaults work when running in mixed topologies.

Additional info:

The new wrapping algo implementation:

40c362e
"Support AES for KRA archival wrapping"

introduced a new option "--wrapping-algorithm" for "ipa vault-[retrieve/archive]" that is supposed to be internal only, actually it doesn't work. It should be hidden.