From 6bfb11f2110f5fbaecc2d6a27d89289c58edc171 Mon Sep 17 00:00:00 2001

From: Martin Babinsky <mbabinsk@redhat.com>

Date: Thu, 22 Jun 2017 10:06:21 +0200

Subject: [PATCH] Allow to pass in multiple CA cert paths to the smart card

 advises

If the user has a series of CA certificates required to verify smart

card certs (e.g. intermediary CAs and root CA) it is convenient to allow

for passing them to the advise scripts as a series of PEM files.

https://pagure.io/freeipa/issue/7036

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

---

 ipaserver/advise/plugins/smart_card_auth.py | 69 +++++++++++++++++++----------

 1 file changed, 46 insertions(+), 23 deletions(-)

diff --git a/ipaserver/advise/plugins/smart_card_auth.py b/ipaserver/advise/plugins/smart_card_auth.py

index 0217bd190778f1235981a49e7b0764b8b9cdf582..16c01204444883ed949db73b2314ba5c404124df 100644

--- a/ipaserver/advise/plugins/smart_card_auth.py

+++ b/ipaserver/advise/plugins/smart_card_auth.py

@@ -18,7 +18,8 @@ class common_smart_card_auth_config(Advice):

     """

     systemwide_nssdb = paths.NSS_DB_DIR

-    smart_card_ca_cert_variable_name = "SC_CA_CERT"

+    smart_card_ca_certs_variable_name = "SC_CA_CERTS"

+    single_ca_cert_variable_name = 'ca_cert'

     def check_ccache_not_empty(self):

         self.log.comment('Check whether the credential cache is not empty')

@@ -29,35 +30,58 @@ class common_smart_card_auth_config(Advice):

                 'Use kinit as privileged user to obtain Kerberos credentials'

             ])

+    def check_and_set_ca_cert_paths(self):

+        ca_paths_variable = self.smart_card_ca_certs_variable_name

+        single_ca_path_variable = self.single_ca_cert_variable_name

-    def check_and_set_ca_cert_path(self):

-        ca_path_variable = self.smart_card_ca_cert_variable_name

-        self.log.command("{}=$1".format(ca_path_variable))

+        self.log.command("{}=$@".format(ca_paths_variable))

         self.log.exit_on_predicate(

-            '[ -z "${}" ]'.format(ca_path_variable),

-            ['You need to provide the path to the PEM file containing CA '

-             'signing the Smart Cards']

+            '[ -z "${}" ]'.format(ca_paths_variable),

+            ['You need to provide one or more paths to the PEM files '

+             'containing CAs signing the Smart Cards']

         )

+        self.log.command(

+            "for {} in ${}".format(

+                single_ca_path_variable, ca_paths_variable))

+        self.log.command("do")

         self.log.exit_on_predicate(

-            '[ ! -f "${}" ]'.format(ca_path_variable),

-            ['Invalid CA certificate filename: ${}'.format(ca_path_variable),

-             'Please check that the path exists and is a valid file']

+            '[ ! -f "${}" ]'.format(single_ca_path_variable),

+            ['Invalid CA certificate filename: ${}'.format(

+                single_ca_path_variable),

+             'Please check that the path exists and is a valid file'],

+            indent_spaces=2

         )

+        self.log.command("done")

-    def upload_smartcard_ca_certificate_to_systemwide_db(self):

+    def upload_smartcard_ca_certificates_to_systemwide_db(self):

+        self.log.command(

+            "for {} in ${}".format(

+                self.single_ca_cert_variable_name,

+                self.smart_card_ca_certs_variable_name))

+        self.log.command("do")

         self.log.command(

-            'certutil -d {} -A -i ${} -n "Smart Card CA" -t CT,C,C'.format(

-                self.systemwide_nssdb, self.smart_card_ca_cert_variable_name

-            )

+            'certutil -d {} -A -i ${} -n "Smart Card CA $(uuidgen)" '

+            '-t CT,C,C'.format(

+                self.systemwide_nssdb, self.single_ca_cert_variable_name

+            ),

+            indent_spaces=2

         )

+        self.log.command("done")

-    def install_smart_card_signing_ca_cert(self):

+    def install_smart_card_signing_ca_certs(self):

+        self.log.command(

+            "for {} in ${}".format(

+                self.single_ca_cert_variable_name,

+                self.smart_card_ca_certs_variable_name))

+        self.log.command("do")

         self.log.exit_on_failed_command(

             'ipa-cacert-manage install ${} -t CT,C,C'.format(

-                self.smart_card_ca_cert_variable_name

+                self.single_ca_cert_variable_name

             ),

-            ['Failed to install external CA certificate to IPA']

+            ['Failed to install external CA certificate to IPA'],

+            indent_spaces=2

         )

+        self.log.command("done")

     def update_ipa_ca_certificate_store(self):

         self.log.exit_on_failed_command(

@@ -85,7 +109,7 @@ class config_server_for_smart_card_auth(common_smart_card_auth_config):

     def get_info(self):

         self.log.exit_on_nonroot_euid()

-        self.check_and_set_ca_cert_path()

+        self.check_and_set_ca_cert_paths()

         self.check_ccache_not_empty()

         self.check_hostname_is_in_masters()

         self.resolve_ipaca_records()

@@ -95,7 +119,8 @@ class config_server_for_smart_card_auth(common_smart_card_auth_config):

         self.record_httpd_ocsp_status()

         self.check_and_enable_pkinit()

         self.enable_ok_to_auth_as_delegate_on_http_principal()

-        self.upload_smartcard_ca_certificate_to_systemwide_db()

+        self.upload_smartcard_ca_certificates_to_systemwide_db()

+        self.install_smart_card_signing_ca_certs()

         self.update_ipa_ca_certificate_store()

         self.restart_kdc()

@@ -234,18 +259,16 @@ class config_client_for_smart_card_auth(common_smart_card_auth_config):

     pkcs11_shared_lib = '/usr/lib64/opensc-pkcs11.so'

     smart_card_service_file = 'pcscd.service'

     smart_card_socket = 'pcscd.socket'

-    systemwide_nssdb = paths.NSS_DB_DIR

     def get_info(self):

         self.log.exit_on_nonroot_euid()

-        self.check_and_set_ca_cert_path()

+        self.check_and_set_ca_cert_paths()

         self.check_ccache_not_empty()

         self.check_and_remove_pam_pkcs11()

         self.install_opensc_and_dconf_packages()

         self.start_enable_smartcard_daemon()

         self.add_pkcs11_module_to_systemwide_db()

-        self.upload_smartcard_ca_certificate_to_systemwide_db()

-        self.install_smart_card_signing_ca_cert()

+        self.upload_smartcard_ca_certificates_to_systemwide_db()

         self.update_ipa_ca_certificate_store()

         self.run_authconfig_to_configure_smart_card_auth()

         self.restart_sssd()

-- 

2.9.4