From 6bfb11f2110f5fbaecc2d6a27d89289c58edc171 Mon Sep 17 00:00:00 2001
From: Martin Babinsky <mbabinsk@redhat.com>
Date: Thu, 22 Jun 2017 10:06:21 +0200
Subject: [PATCH] Allow to pass in multiple CA cert paths to the smart card
advises
If the user has a series of CA certificates required to verify smart
card certs (e.g. intermediary CAs and root CA) it is convenient to allow
for passing them to the advise scripts as a series of PEM files.
https://pagure.io/freeipa/issue/7036
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
---
ipaserver/advise/plugins/smart_card_auth.py | 69 +++++++++++++++++++----------
1 file changed, 46 insertions(+), 23 deletions(-)
diff --git a/ipaserver/advise/plugins/smart_card_auth.py b/ipaserver/advise/plugins/smart_card_auth.py
index 0217bd190778f1235981a49e7b0764b8b9cdf582..16c01204444883ed949db73b2314ba5c404124df 100644
--- a/ipaserver/advise/plugins/smart_card_auth.py
+++ b/ipaserver/advise/plugins/smart_card_auth.py
@@ -18,7 +18,8 @@ class common_smart_card_auth_config(Advice):
"""
systemwide_nssdb = paths.NSS_DB_DIR
- smart_card_ca_cert_variable_name = "SC_CA_CERT"
+ smart_card_ca_certs_variable_name = "SC_CA_CERTS"
+ single_ca_cert_variable_name = 'ca_cert'
def check_ccache_not_empty(self):
self.log.comment('Check whether the credential cache is not empty')
@@ -29,35 +30,58 @@ class common_smart_card_auth_config(Advice):
'Use kinit as privileged user to obtain Kerberos credentials'
])
+ def check_and_set_ca_cert_paths(self):
+ ca_paths_variable = self.smart_card_ca_certs_variable_name
+ single_ca_path_variable = self.single_ca_cert_variable_name
- def check_and_set_ca_cert_path(self):
- ca_path_variable = self.smart_card_ca_cert_variable_name
- self.log.command("{}=$1".format(ca_path_variable))
+ self.log.command("{}=$@".format(ca_paths_variable))
self.log.exit_on_predicate(
- '[ -z "${}" ]'.format(ca_path_variable),
- ['You need to provide the path to the PEM file containing CA '
- 'signing the Smart Cards']
+ '[ -z "${}" ]'.format(ca_paths_variable),
+ ['You need to provide one or more paths to the PEM files '
+ 'containing CAs signing the Smart Cards']
)
+ self.log.command(
+ "for {} in ${}".format(
+ single_ca_path_variable, ca_paths_variable))
+ self.log.command("do")
self.log.exit_on_predicate(
- '[ ! -f "${}" ]'.format(ca_path_variable),
- ['Invalid CA certificate filename: ${}'.format(ca_path_variable),
- 'Please check that the path exists and is a valid file']
+ '[ ! -f "${}" ]'.format(single_ca_path_variable),
+ ['Invalid CA certificate filename: ${}'.format(
+ single_ca_path_variable),
+ 'Please check that the path exists and is a valid file'],
+ indent_spaces=2
)
+ self.log.command("done")
- def upload_smartcard_ca_certificate_to_systemwide_db(self):
+ def upload_smartcard_ca_certificates_to_systemwide_db(self):
+ self.log.command(
+ "for {} in ${}".format(
+ self.single_ca_cert_variable_name,
+ self.smart_card_ca_certs_variable_name))
+ self.log.command("do")
self.log.command(
- 'certutil -d {} -A -i ${} -n "Smart Card CA" -t CT,C,C'.format(
- self.systemwide_nssdb, self.smart_card_ca_cert_variable_name
- )
+ 'certutil -d {} -A -i ${} -n "Smart Card CA $(uuidgen)" '
+ '-t CT,C,C'.format(
+ self.systemwide_nssdb, self.single_ca_cert_variable_name
+ ),
+ indent_spaces=2
)
+ self.log.command("done")
- def install_smart_card_signing_ca_cert(self):
+ def install_smart_card_signing_ca_certs(self):
+ self.log.command(
+ "for {} in ${}".format(
+ self.single_ca_cert_variable_name,
+ self.smart_card_ca_certs_variable_name))
+ self.log.command("do")
self.log.exit_on_failed_command(
'ipa-cacert-manage install ${} -t CT,C,C'.format(
- self.smart_card_ca_cert_variable_name
+ self.single_ca_cert_variable_name
),
- ['Failed to install external CA certificate to IPA']
+ ['Failed to install external CA certificate to IPA'],
+ indent_spaces=2
)
+ self.log.command("done")
def update_ipa_ca_certificate_store(self):
self.log.exit_on_failed_command(
@@ -85,7 +109,7 @@ class config_server_for_smart_card_auth(common_smart_card_auth_config):
def get_info(self):
self.log.exit_on_nonroot_euid()
- self.check_and_set_ca_cert_path()
+ self.check_and_set_ca_cert_paths()
self.check_ccache_not_empty()
self.check_hostname_is_in_masters()
self.resolve_ipaca_records()
@@ -95,7 +119,8 @@ class config_server_for_smart_card_auth(common_smart_card_auth_config):
self.record_httpd_ocsp_status()
self.check_and_enable_pkinit()
self.enable_ok_to_auth_as_delegate_on_http_principal()
- self.upload_smartcard_ca_certificate_to_systemwide_db()
+ self.upload_smartcard_ca_certificates_to_systemwide_db()
+ self.install_smart_card_signing_ca_certs()
self.update_ipa_ca_certificate_store()
self.restart_kdc()
@@ -234,18 +259,16 @@ class config_client_for_smart_card_auth(common_smart_card_auth_config):
pkcs11_shared_lib = '/usr/lib64/opensc-pkcs11.so'
smart_card_service_file = 'pcscd.service'
smart_card_socket = 'pcscd.socket'
- systemwide_nssdb = paths.NSS_DB_DIR
def get_info(self):
self.log.exit_on_nonroot_euid()
- self.check_and_set_ca_cert_path()
+ self.check_and_set_ca_cert_paths()
self.check_ccache_not_empty()
self.check_and_remove_pam_pkcs11()
self.install_opensc_and_dconf_packages()
self.start_enable_smartcard_daemon()
self.add_pkcs11_module_to_systemwide_db()
- self.upload_smartcard_ca_certificate_to_systemwide_db()
- self.install_smart_card_signing_ca_cert()
+ self.upload_smartcard_ca_certificates_to_systemwide_db()
self.update_ipa_ca_certificate_store()
self.run_authconfig_to_configure_smart_card_auth()
self.restart_sssd()
--
2.9.4