#!/bin/bash

# This is a simple bash wrapper for CentOS SIG and using fasjson-client with some values

# Goal is to retrieve signed TLS cert for user accounts, using kerberos ticket and then using the fasjson endpoint

function usage() {

cat << EOF

You need to call the script like this : $0 -arguments

 -u : username ([REQUIRED] : your existing ACO/FAS username)

 -v : just validates the existing TLS certificate ([OPTIONAL])

 -r : REALM to use for kerberos ([OPTIONAL] : defaults to FEDORAPROJECT.ORG)

 -f : fasjson url ([OPTIONAL]: defaults to https://fasjson.fedoraproject.org)

 -h : display this help

EOF

}

function varcheck() {

if [ -z "$1" ] ; then

        usage

        exit 1

fi

}

function f_log() {

   echo "[+] $(date +%Y%m%d-%H:%M) centos-cert -> $*" 

}

function verify_cert() {

  echo ""

  f_log "Verifying if TLS cert is still valid ..."

  if [ ! -e ~/.centos-server-ca.cert ] ; then

    f_log "[ERROR] No CA cert found to validate your TLS cert"

    f_log "Please retrieve it first with [$0 -u]"

    exit 1

  fi

  if [ -e ~/.centos.cert ] ; then

    f_log "Validating TLS cert against ~/.centos-server-ca.cert ..."

    openssl verify -CAfile ~/.centos-server-ca.cert ~/.centos.cert

    if [ "$?" -ne "0" ] ; then

      f_log "[ERROR] your TLS cert is not signed by correct CA"

      exit 1

    else

      f_log "[SUCCESS] ~/.centos.cert TLS cert verified by ~/.centos-server-ca.cert CA crt"   

    fi

    end_date=$(openssl x509 -in ~/.centos.cert -noout -text|sed -n 's/ *Not After : *//p')

    end_date_seconds=$(date '+%s' --date "$end_date")

    now_seconds=$(date '+%s')

    remaining_days=$(echo "($end_date_seconds-$now_seconds)/24/3600" | bc)

    if [ "${remaining_days}" -gt "0" ] ; then

      f_log "[SUCCESS] Your TLS cert is still valid for [${remaining_days}] days"

      echo ""

      exit 0

    else

      f_log "[ERROR] Your TLS cert has expired : [${remaining_days}] days"

      echo ""

      exit 1

    fi

  else

    f_log "[WARNING] : no TLS cert found so running this script to first get one"

    echo ""

  fi

}

function check_url() {

  echo ""

  f_log Validating user [${fasjson_user}] with realm [${fasjson_realm}] against ${fasjson_url}

  curl --fail --negotiate -u : ${fasjson_url}/v1/me/ --silent >/dev/null 

  if [ "$?" -ne "0" ] ; then

    f_log "Not able to negotiate kerberos with ${fasjson_url} ..."

    f_log "Forcing kinit to obtain valid kerberos ticket :"

    kinit ${fasjson_user}@${fasjson_realm} || (f_log "Not able to get kerberos ticket .." ; exit 1)

  else

    f_log "We can reach [${fasjson_url}] with realm [${fasjson_user}@${fasjson_realm}], so now asking for TLS cert ..." 

  fi

}

function get_cert(){

  fasjson-client --verbose --url ${fasjson_url} get-cert -u ${fasjson_user} -p ~/.centos-${fasjson_user}.key -s ~/.centos-${fasjson_user}.crt --overwrite

  if [ "$?" -ne "0" ] ; then

    f_log "[ISSUE] : Unable to retrieve TLS cert"

    exit 1

  else

    f_log "Concatenating cert to ~/.centos.cert"

    cat ~/.centos-${fasjson_user}.key ~/.centos-${fasjson_user}.crt > ~/.centos.cert

  fi

  f_log "Downloading correct CA cert .."

  curl --fail --silent ${ca_url} > ~/.centos-server-ca.cert CA crt

  echo ""

}

while getopts "hu:r:vf:" option

do

  case ${option} in

    h)

      usage

      exit 1

      ;;

    u)

      opt_user=${OPTARG}

      ;;

    r)

      opt_realm=${OPTARG}

      ;;

    v)

      verify_cert

      exit

      ;;

    f)

      opt_fasjson_url=${OPTARG}

      ;;

    ?)

      usage

      exit

      ;;

  esac

done

# Parsing and assigning default values if needed

fasjson_user=${opt_user:-$USER}

fasjson_realm=${opt_realm:-FEDORAPROJECT.ORG}

fasjson_url=${opt_fasjson_url:-https://fasjson.fedoraproject.org}

if [[ "$fasjson_url" =~ "fasjson.stg*" ]] ; then

  ca_url="https://id.stg.fedoraproject.org/ipa/config/ca.crt"

else

  ca_url="https://id.fedoraproject.org/ipa/config/ca.crt"

fi

# Now the real work and calling functions

if [ "$#" -eq "0" ] ;then

  usage

  exit 1

fi

check_url

get_cert

verify_cert