def test_26_is_previous_otp(self):
# check if the OTP was used prebiously
serial = "previous"
db_token = Token(serial, tokentype="hotp")
db_token.save()
token = HotpTokenClass(db_token)
token.set_otpkey(self.otpkey)
token.set_otplen(6)
token.save()
"""
Truncated
Count Hexadecimal Decimal HOTP
0 4c93cf18 1284755224 755224
1 41397eea 1094287082 287082
2 82fef30 137359152 359152
3 66ef7655 1726969429 969429
4 61c5938a 1640338314 338314
5 33c083d4 868254676 254676
6 7256c032 1918287922 287922
7 4e5b397 82162583 162583
8 2823443f 673399871 399871
9 2679dc69 645520489 520489
10 403154
"""
r = token.check_otp("969429")
self.assertEqual(r, 3)
r = token.is_previous_otp("755224")
self.assertEqual(r, True)
r = token.is_previous_otp("254676")
self.assertEqual(r, False)
r = token.check_otp("254676")
self.assertEqual(r, 5)
def test_04_failure(self):
db_token = Token(self.serial2, tokentype="vasco")
db_token.save()
token = VascoTokenClass(db_token)
token.update({
"otpkey": hexlify(b"X" * 248).decode("utf-8"),
"pin": self.otppin
})
r = token.authenticate("{}123456".format(self.otppin))
self.assertEqual(r[0], True)
self.assertEqual(r[1], -1)
# failure, but the token secret has been updated nonetheless
key = token.token.get_otpkey().getKey()
self.assertEqual(key, b"X" * 24 + b"Y" * 224)
# wrong PIN, the token secret has not been updated
r = token.authenticate("WRONG123456".format(self.otppin))
self.assertEqual(r[0], False)
self.assertEqual(r[1], -1)
key = token.token.get_otpkey().getKey()
self.assertEqual(key, b"X" * 24 + b"Y" * 224)
# another failure, but the token secret has been updated again!
r = token.authenticate("{}234567".format(self.otppin))
self.assertEqual(r[0], True)
self.assertEqual(r[1], -1)
key = token.token.get_otpkey().getKey()
self.assertEqual(key, b"X" * 24 + b"Z" * 224)
token.delete_token()
def test_04_failure(self):
db_token = Token(self.serial2, tokentype="vasco")
db_token.save()
token = VascoTokenClass(db_token)
token.update({"otpkey": hexlify("X"*248),
"pin": self.otppin})
r = token.authenticate("{}123456".format(self.otppin))
self.assertEqual(r[0], True)
self.assertEqual(r[1], -1)
# failure, but the token secret has been updated nonetheless
key = token.token.get_otpkey().getKey()
self.assertEqual(key, "X"*24 + "Y"*224)
# wrong PIN, the token secret has not been updated
r = token.authenticate("WRONG123456".format(self.otppin))
self.assertEqual(r[0], False)
self.assertEqual(r[1], -1)
key = token.token.get_otpkey().getKey()
self.assertEqual(key, "X"*24 + "Y"*224)
# another failure, but the token secret has been updated again!
r = token.authenticate("{}234567".format(self.otppin))
self.assertEqual(r[0], True)
self.assertEqual(r[1], -1)
key = token.token.get_otpkey().getKey()
self.assertEqual(key, "X"*24 + "Z"*224)
token.delete_token()
def test_07_failures(self):
db_token = Token(self.serial2, tokentype="vasco")
db_token.save()
token = VascoTokenClass(db_token)
token.update({"otpkey": hexlify("X"*248),
"pin": self.otppin})
@mock_verification(create_mock_failure(123))
def _step1():
return token.authenticate("{}123456".format(self.otppin))
r = _step1()
self.assertEqual(r[0], True)
self.assertEqual(r[1], -1)
# failure, but the token secret has been updated nonetheless
key = token.token.get_otpkey().getKey()
self.assertEqual(key, "X"*24 + "Y"*224)
@mock_verification(create_mock_failure(202))
def _step2():
return token.authenticate("{}123456".format(self.otppin))
r = _step2()
self.assertEqual(r[0], True)
self.assertEqual(r[1], -1)
# failure, but the token secret has been updated nonetheless
key = token.token.get_otpkey().getKey()
self.assertEqual(key, "X"*24 + "Z"*224)
token.delete_token()
def test_07_failures(self):
db_token = Token(self.serial2, tokentype="vasco")
db_token.save()
token = VascoTokenClass(db_token)
token.update({"otpkey": hexlify("X" * 248), "pin": self.otppin})
@mock_verification(create_mock_failure(123))
def _step1():
return token.authenticate("{}123456".format(self.otppin))
r = _step1()
self.assertEqual(r[0], True)
self.assertEqual(r[1], -1)
# failure, but the token secret has been updated nonetheless
key = token.token.get_otpkey().getKey()
self.assertEqual(key, "X" * 24 + "Y" * 224)
@mock_verification(create_mock_failure(202))
def _step2():
return token.authenticate("{}123456".format(self.otppin))
r = _step2()
self.assertEqual(r[0], True)
self.assertEqual(r[1], -1)
# failure, but the token secret has been updated nonetheless
key = token.token.get_otpkey().getKey()
self.assertEqual(key, "X" * 24 + "Z" * 224)
token.delete_token()
def test_39_generate_sym_key(self):
db_token = Token("symkey", tokentype="no_matter", userid=1000)
db_token.save()
token_obj = TokenClass(db_token)
key = token_obj.generate_symmetric_key("1234567890", "abc")
self.assertEqual(key, "1234567abc")
self.assertRaises(Exception, token_obj.generate_symmetric_key,
"1234", "1234")
self.assertRaises(Exception, token_obj.generate_symmetric_key,
"1234", "12345")
# Now run the init/update process
# 1. step
token_obj.update({"2stepinit": "1",
"genkey": "1"
})
self.assertEqual(db_token.rollout_state, "clientwait")
self.assertEqual(db_token.active, False)
serial = db_token.serial
details = token_obj.init_details
server_component = details.get("otpkey")
# 2. step
client_component = "AAAAAA"
token_obj.update({"serial": serial,
"otpkey": client_component
})
self.assertEqual(db_token.rollout_state, "")
self.assertEqual(db_token.active, True)
token_obj.delete_token()
def test_01_enroll_yubikey_and_auth(self):
db_token = Token(self.serial1, tokentype="yubikey")
db_token.save()
token = YubikeyTokenClass(db_token)
token.set_otpkey(self.otpkey)
token.set_otplen(48)
token.set_pin(self.pin)
token.save()
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "yubikey", token.token)
self.assertTrue(token.type == "yubikey", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "UBAM", class_prefix)
self.assertTrue(token.get_class_type() == "yubikey", token)
# Test a bunch of otp values
old_r = 0
for otp in self.valid_otps:
r = token.check_otp(otp)
# check if the newly returned counter is bigger than the old one
self.assertTrue(r > old_r, (r, old_r))
old_r = r
# test otp_exist
r = token.check_otp_exist(self.further_otps[0])
self.assertTrue(r > old_r, (r, old_r))
def test_38_last_auth(self):
db_token = Token("lastauth001", tokentype="spass", userid=1000)
db_token.save()
token_obj = TokenClass(db_token)
tdelta = datetime.timedelta(days=1)
token_obj.add_tokeninfo(ACTION.LASTAUTH,
datetime.datetime.now(tzlocal()) - tdelta)
r = token_obj.check_last_auth_newer("10h")
self.assertFalse(r)
r = token_obj.check_last_auth_newer("2d")
self.assertTrue(r)
# Old time format
# lastauth_alt = datetime.datetime.utcnow().isoformat()
token_obj.add_tokeninfo(ACTION.LASTAUTH,
datetime.datetime.utcnow() - tdelta)
r = token_obj.check_last_auth_newer("10h")
self.assertFalse(r)
r = token_obj.check_last_auth_newer("2d")
self.assertTrue(r)
# Test a fault last_auth entry does not computer to True
token_obj.add_tokeninfo(ACTION.LASTAUTH, "faulty format")
r = token_obj.check_last_auth_newer("10h")
self.assertFalse(r)
token_obj.delete_token()
def test_39_generate_sym_key(self):
db_token = Token("symkey", tokentype="no_matter", userid=1000)
db_token.save()
token_obj = TokenClass(db_token)
key = token_obj.generate_symmetric_key("1234567890", "abc")
self.assertEqual(key, "1234567abc")
self.assertRaises(Exception, token_obj.generate_symmetric_key, "1234",
"1234")
self.assertRaises(Exception, token_obj.generate_symmetric_key, "1234",
"12345")
# Now run the init/update process
# 1. step
token_obj.update({"2stepinit": "1", "genkey": "1"})
self.assertEqual(db_token.rollout_state, "clientwait")
self.assertEqual(db_token.active, False)
serial = db_token.serial
details = token_obj.init_details
# 2. step
client_component = "AAAAAA"
token_obj.update({"serial": serial, "otpkey": client_component})
self.assertEqual(db_token.rollout_state, "")
self.assertEqual(db_token.active, True)
# Given a client component of K bytes, the base algorithm
# simply replaces the last K bytes of the server component
# with the client component.
server_component = details.get("otpkey")[:-len(client_component)]
expected_otpkey = server_component + client_component
self.assertEqual(db_token.get_otpkey().getKey(), expected_otpkey)
token_obj.delete_token()
def test_26_is_previous_otp(self):
# check if the OTP was used previously
serial = "previous"
db_token = Token(serial, tokentype="totp")
db_token.save()
token = TotpTokenClass(db_token)
token.set_otpkey(self.otpkey)
token.set_hashlib("sha1")
token.set_otplen(6)
# Authenticate with the current OTP value
counter = token._time2counter(time.time(), timeStepping=30)
otp_now = token._calc_otp(counter)
r = token.check_otp(otp_now, window=180)
self.assertEqual(r, counter)
# Now we try several is_previous_otp and the timeShift must stay the same!
ts0 = float(token.get_tokeninfo("timeShift"))
self.assertTrue(-181 < ts0 < 181)
# Too old
r = token.is_previous_otp(token._calc_otp(counter - 3))
self.assertEqual(r, False)
ts = float(token.get_tokeninfo("timeShift"))
self.assertEqual(ts, ts0)
# The same OTP value
r = token.is_previous_otp(otp_now)
self.assertEqual(r, True)
ts = float(token.get_tokeninfo("timeShift"))
self.assertEqual(ts, ts0)
# Future value
r = token.is_previous_otp(token._calc_otp(counter + 8))
self.assertEqual(r, False)
ts = float(token.get_tokeninfo("timeShift"))
self.assertEqual(ts, ts0)
def test_26_is_previous_otp(self):
# check if the OTP was used prebiously
serial = "previous"
db_token = Token(serial, tokentype="hotp")
db_token.save()
token = HotpTokenClass(db_token)
token.set_otpkey(self.otpkey)
token.set_otplen(6)
token.save()
"""
Truncated
Count Hexadecimal Decimal HOTP
0 4c93cf18 1284755224 755224
1 41397eea 1094287082 287082
2 82fef30 137359152 359152
3 66ef7655 1726969429 969429
4 61c5938a 1640338314 338314
5 33c083d4 868254676 254676
6 7256c032 1918287922 287922
7 4e5b397 82162583 162583
8 2823443f 673399871 399871
9 2679dc69 645520489 520489
10 403154
"""
r = token.check_otp("969429")
self.assertEqual(r, 3)
r = token.is_previous_otp("755224")
self.assertEqual(r, True)
r = token.is_previous_otp("254676")
self.assertEqual(r, False)
r = token.check_otp("254676")
self.assertEqual(r, 5)
def test_05_success(self):
db_token = Token(self.serial2, tokentype="vasco")
db_token.save()
token = VascoTokenClass(db_token)
token.update({"otpkey": hexlify("X"*248),
"pin": self.otppin})
# wrong PIN, the token secret has not been updated
r = token.authenticate("WRONG123456".format(self.otppin))
self.assertEqual(r[0], False)
self.assertEqual(r[1], -1)
key = token.token.get_otpkey().getKey()
self.assertEqual(key, "X"*24 + "X"*224)
# correct PIN + OTP
r = token.authenticate("{}123456".format(self.otppin))
self.assertEqual(r[0], True)
self.assertEqual(r[1], 0) # TODO: that is success?
key = token.token.get_otpkey().getKey()
self.assertEqual(key, "X"*24 + "Y"*224)
# another success
r = token.authenticate("{}234567".format(self.otppin))
self.assertEqual(r[0], True)
self.assertEqual(r[1], 0) # TODO: that is success?
key = token.token.get_otpkey().getKey()
self.assertEqual(key, "X"*24 + "Z"*224)
token.delete_token()
def test_39_generate_sym_key(self):
db_token = Token("symkey", tokentype="no_matter", userid=1000)
db_token.save()
token_obj = TokenClass(db_token)
key = token_obj.generate_symmetric_key("1234567890", "abc")
self.assertEqual(key, "1234567abc")
self.assertRaises(Exception, token_obj.generate_symmetric_key,
"1234", "1234")
self.assertRaises(Exception, token_obj.generate_symmetric_key,
"1234", "12345")
# Now run the init/update process
# 1. step
token_obj.update({"2stepinit": "1",
"genkey": "1"
})
self.assertEqual(db_token.rollout_state, "clientwait")
self.assertEqual(db_token.active, False)
serial = db_token.serial
details = token_obj.init_details
server_component = details.get("otpkey")
# 2. step
client_component = "AAAAAA"
token_obj.update({"serial": serial,
"otpkey": client_component
})
self.assertEqual(db_token.rollout_state, "")
self.assertEqual(db_token.active, True)
token_obj.delete_token()
def test_02a_fail_request_with_attestation(self):
cwd = os.getcwd()
# setup ca connector
r = save_caconnector({
"cakey": CAKEY,
"cacert": CACERT,
"type": "local",
"caconnector": "localCA",
"openssl.cnf": OPENSSLCNF,
"CSRDir": "",
"CertificateDir": "",
"WorkingDir": cwd + "/" + WORKINGDIR
})
db_token = Token(self.serial2, tokentype="certificate")
db_token.save()
token = CertificateTokenClass(db_token)
# A cert request will fail, since the attestation certificate does not match
self.assertRaises(privacyIDEAError, token.update, {
"ca": "localCA",
"attestation": BOGUS_ATTESTATION,
"request": REQUEST
})
remove_token(self.serial2)
def test_05_success(self):
db_token = Token(self.serial2, tokentype="vasco")
db_token.save()
token = VascoTokenClass(db_token)
token.update({
"otpkey": hexlify(b"X" * 248).decode("utf-8"),
"pin": self.otppin
})
# wrong PIN, the token secret has not been updated
r = token.authenticate("WRONG123456".format(self.otppin))
self.assertEqual(r[0], False)
self.assertEqual(r[1], -1)
key = token.token.get_otpkey().getKey()
self.assertEqual(key, b"X" * 24 + b"X" * 224)
# correct PIN + OTP
r = token.authenticate("{}123456".format(self.otppin))
self.assertEqual(r[0], True)
self.assertEqual(r[1], 0) # TODO: that is success?
key = token.token.get_otpkey().getKey()
self.assertEqual(key, b"X" * 24 + b"Y" * 224)
# another success
r = token.authenticate("{}234567".format(self.otppin))
self.assertEqual(r[0], True)
self.assertEqual(r[1], 0) # TODO: that is success?
key = token.token.get_otpkey().getKey()
self.assertEqual(key, b"X" * 24 + b"Z" * 224)
token.delete_token()
def test_03_no_vasco_library(self):
db_token = Token(self.serial2, tokentype="vasco")
db_token.save()
token = VascoTokenClass(db_token)
token.update({"otpkey": hexlify("X"*248),
"pin": self.otppin})
self.assertRaises(RuntimeError, token.authenticate, "{}123456".format(self.otppin))
token.delete_token()
def test_16_add_and_delete_tokeninfo_password(self):
t1 = Token("serialTI2")
t1.set_info({"key1": "value1", "key1.type": "password"})
t2 = Token.query.filter_by(serial="serialTI2").first()
t2info = t2.get_info()
self.assertTrue(t2info.get("key1.type") == "password", t2info)
def test_03_no_vasco_library(self):
db_token = Token(self.serial2, tokentype="vasco")
db_token.save()
token = VascoTokenClass(db_token)
token.update({"otpkey": hexlify("X" * 248), "pin": self.otppin})
self.assertRaises(RuntimeError, token.authenticate,
"{}123456".format(self.otppin))
token.delete_token()
def test_31_user_is_not_allowed_for_some_api_calls(self):
self.authenticate_selfserive_user()
serial = "serial0001"
tok = Token(serial)
tok.save()
# Can not set things
with self.app.test_request_context(
'/token/set',
method="POST",
data={
"serial": serial,
"pin": "test"
},
headers={'Authorization': self.at_user}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 401, res)
# Can not set token realm
with self.app.test_request_context(
'/token/realm/{0!s}'.format(serial),
method="POST",
data={"realms": "realm1"},
headers={'Authorization': self.at_user}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 401, res)
# Can not call get_serial token
with self.app.test_request_context(
'/token/getserial/12345',
method="GET",
headers={'Authorization': self.at_user}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 401, res)
# Can not copy pin
with self.app.test_request_context(
'/token/copypin',
method="POST",
headers={'Authorization': self.at_user}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 401, res)
# Can not copy user
with self.app.test_request_context(
'/token/copyuser',
method="POST",
headers={'Authorization': self.at_user}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 401, res)
# Can not load tokens
with self.app.test_request_context(
'/token/load/test.xml',
method="POST",
headers={'Authorization': self.at_user}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 401, res)
def test_11_challenge_response_hotp(self):
# set a chalresp policy for HOTP
with self.app.test_request_context('/policy/pol_chal_resp',
data={'action':
"challenge_response=hotp",
'scope': "authentication",
'realm': '',
'active': True},
method='POST',
headers={'Authorization': self.at}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 200, res)
result = json.loads(res.data).get("result")
self.assertTrue(result["status"] is True, result)
self.assertTrue('"setPolicy pol_chal_resp": 1' in res.data,
res.data)
serial = "CHALRESP1"
pin = "chalresp1"
# create a token and assign to the user
db_token = Token(serial, tokentype="hotp")
db_token.update_otpkey(self.otpkey)
db_token.save()
token = HotpTokenClass(db_token)
token.set_user(User("cornelius", self.realm1))
token.set_pin(pin)
# Set the failcounter
token.set_failcount(5)
# create the challenge by authenticating with the OTP PIN
with self.app.test_request_context('/validate/check',
method='POST',
data={"user": "******",
"pass": pin}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 200, res)
result = json.loads(res.data).get("result")
detail = json.loads(res.data).get("detail")
self.assertFalse(result.get("value"))
self.assertEqual(detail.get("message"), "please enter otp: ")
transaction_id = detail.get("transaction_id")
self.assertEqual(token.get_failcount(), 5)
# send the OTP value
with self.app.test_request_context('/validate/check',
method='POST',
data={"user": "******",
"transaction_id":
transaction_id,
"pass": "******"}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 200, res)
result = json.loads(res.data).get("result")
detail = json.loads(res.data).get("detail")
self.assertTrue(result.get("value"))
self.assertEqual(token.get_failcount(), 0)
# delete the token
remove_token(serial=serial)
def test_04_create_token_on_server(self):
self.setUp_user_realms()
cwd = os.getcwd()
# setup ca connector
r = save_caconnector({"cakey": CAKEY,
"cacert": CACERT,
"type": "local",
"caconnector": "localCA",
"openssl.cnf": OPENSSLCNF,
"CSRDir": "",
"CertificateDir": "",
"WorkingDir": cwd + "/" + WORKINGDIR})
db_token = Token(self.serial3, tokentype="certificate")
db_token.save()
token = CertificateTokenClass(db_token)
# missing user
self.assertRaises(ParameterError,
token.update, {"ca": "localCA","genkey": 1})
token.update({"ca": "localCA", "genkey": 1,
"user": "******"})
self.assertEqual(token.token.serial, self.serial3)
self.assertEqual(token.token.tokentype, "certificate")
self.assertEqual(token.type, "certificate")
detail = token.get_init_detail()
certificate = detail.get("certificate")
# At each testrun, the certificate might get another serial number!
x509obj = crypto.load_certificate(crypto.FILETYPE_PEM, certificate)
self.assertEqual("{0!r}".format(x509obj.get_issuer()),
"<X509Name object '/C=DE/ST=Hessen"
"/O=privacyidea/CN=CA001'>")
self.assertEqual("{0!r}".format(x509obj.get_subject()),
"<X509Name object '/OU=realm1/CN=cornelius/[email protected]'>")
# Test, if the certificate is also completely stored in the tokeninfo
# and if we can retrieve it from the tokeninfo
token = get_tokens(serial=self.serial3)[0]
certificate = token.get_tokeninfo("certificate")
x509obj = crypto.load_certificate(crypto.FILETYPE_PEM, certificate)
self.assertEqual("{0!r}".format(x509obj.get_issuer()),
"<X509Name object '/C=DE/ST=Hessen"
"/O=privacyidea/CN=CA001'>")
self.assertEqual("{0!r}".format(x509obj.get_subject()),
"<X509Name object '/OU=realm1/CN=cornelius/[email protected]'>")
privatekey = token.get_tokeninfo("privatekey")
self.assertTrue(privatekey.startswith("-----BEGIN PRIVATE KEY-----"))
# check for pkcs12
self.assertTrue(detail.get("pkcs12"))
# revoke the token
r = token.revoke()
self.assertEqual(r, int_to_hex(x509obj.get_serial_number()))
def test_08_invalid_otpkey(self):
db_token = Token(self.serial2, tokentype="vasco")
db_token.save()
token = VascoTokenClass(db_token)
self.assertRaises(ParameterError, token.update,
{"otpkey": hexlify("X" * 250)}) # wrong length
self.assertRaises(TypeError, token.update,
{"otpkey": "X" * 496}) # not a hex-string
token.delete_token()
def test_05_get_set_realm(self):
t1 = Token(serial="serial1123")
t1.save()
realms = t1.get_realms()
self.assertTrue(len(realms) == 0)
t1.set_realms(["realm1"])
t1.save()
realms = t1.get_realms()
self.assertTrue(len(realms) == 1)
def setUp(self):
"""
For each test we need to initialize the self.at and the self.at_user
members.
"""
self.setUp_user_realms()
Token(self.my_serial, tokentype="hotp", userid="1004",
resolver="resolver1", realm="realm1").save()
Token(self.foreign_serial, tokentype="hotp").save()
def test_31_user_is_not_allowed_for_some_api_calls(self):
self.authenticate_selfserive_user()
serial = "serial0001"
tok = Token(serial)
tok.save()
# Can not set things
with self.app.test_request_context('/token/set',
method="POST",
data={"serial": serial,
"pin": "test"},
headers={'Authorization':
self.at_user}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 401, res)
# Can not set token realm
with self.app.test_request_context('/token/realm/%s' % serial,
method="POST",
data={"realms": "realm1"},
headers={'Authorization':
self.at_user}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 401, res)
# Can not call get_serial token
with self.app.test_request_context('/token/getserial/12345',
method="GET",
headers={'Authorization':
self.at_user}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 401, res)
# Can not copy pin
with self.app.test_request_context('/token/copypin',
method="POST",
headers={'Authorization':
self.at_user}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 401, res)
# Can not copy user
with self.app.test_request_context('/token/copyuser',
method="POST",
headers={'Authorization':
self.at_user}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 401, res)
# Can not load tokens
with self.app.test_request_context('/token/load/test.xml',
method="POST",
headers={'Authorization':
self.at_user}):
res = self.app.full_dispatch_request()
self.assertTrue(res.status_code == 401, res)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="totp")
db_token.save()
token = TotpTokenClass(db_token)
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "totp", token.token.tokentype)
self.assertTrue(token.type == "totp", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "TOTP", class_prefix)
self.assertTrue(token.get_class_type() == "totp", token)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="hotp")
db_token.save()
token = HotpTokenClass(db_token)
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "hotp", token.token)
self.assertTrue(token.type == "hotp", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "OATH", class_prefix)
self.assertTrue(token.get_class_type() == "hotp", token)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="daplug")
db_token.save()
token = DaplugTokenClass(db_token)
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "daplug", token.token.tokentype)
self.assertTrue(token.type == "daplug", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "DPLG", class_prefix)
self.assertTrue(token.get_class_type() == "daplug", token)
def test_16_add_and_delete_tokeninfo_password(self):
t1 = Token("serialTI2")
t1.set_info({"key1": "value1",
"key1.type": "password"})
t2 = Token.query.filter_by(serial="serialTI2").first()
t2info = t2.get_info()
self.assertTrue(t2info.get("key1.type") == "password",
t2info)
def test_02_create_token_from_request(self):
cwd = os.getcwd()
# setup ca connector
r = save_caconnector({
"cakey": CAKEY,
"cacert": CACERT,
"type": "local",
"caconnector": "localCA",
"openssl.cnf": OPENSSLCNF,
"CSRDir": "",
"CertificateDir": "",
"WorkingDir": cwd + "/" + WORKINGDIR
})
db_token = Token(self.serial2, tokentype="certificate")
db_token.save()
token = CertificateTokenClass(db_token)
# just upload a ready certificate
token.update({"ca": "localCA", "request": REQUEST})
self.assertTrue(token.token.serial == self.serial2, token)
self.assertTrue(token.token.tokentype == "certificate",
token.token.tokentype)
self.assertTrue(token.type == "certificate", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "CRT", class_prefix)
self.assertTrue(token.get_class_type() == "certificate", token)
detail = token.get_init_detail()
certificate = detail.get("certificate")
# At each testrun, the certificate might get another serial number!
x509obj = crypto.load_certificate(crypto.FILETYPE_PEM, certificate)
self.assertEqual(
"{0!r}".format(x509obj.get_issuer()),
"<X509Name object '/C=DE/ST=Hessen"
"/O=privacyidea/CN=CA001'>")
self.assertEqual(
"{0!r}".format(x509obj.get_subject()),
"<X509Name object '/C=DE/ST=Hessen"
"/O=privacyidea/CN=requester.localdomain'>")
# Test, if the certificate is also completely stored in the tokeninfo
# and if we can retrieve it from the tokeninfo
token = get_tokens(serial=self.serial2)[0]
certificate = token.get_tokeninfo("certificate")
x509obj = crypto.load_certificate(crypto.FILETYPE_PEM, certificate)
self.assertEqual(
"{0!r}".format(x509obj.get_issuer()),
"<X509Name object '/C=DE/ST=Hessen"
"/O=privacyidea/CN=CA001'>")
self.assertEqual(
"{0!r}".format(x509obj.get_subject()),
"<X509Name object '/C=DE/ST=Hessen"
"/O=privacyidea/CN=requester.localdomain'>")
remove_token(self.serial2)
def test_30_2step_otpkeyformat(self):
serial = "2step3"
db_token = Token(serial, tokentype="hotp")
db_token.save()
token = HotpTokenClass(db_token)
token.update({
"2stepinit": "1",
"2step_clientsize": "12",
"hashlib": "sha512",
})
self.assertEqual(token.token.rollout_state, "clientwait")
self.assertEqual(token.get_tokeninfo("2step_clientsize"), "12")
# fetch the server component for later tests
server_component = binascii.unhexlify(
token.token.get_otpkey().getKey())
# generate a 12-byte client component
client_component = b'abcdefghijkl'
checksum = hashlib.sha1(client_component).digest()[:4]
# wrong checksum
with warnings.catch_warnings():
warnings.simplefilter('ignore', category=DeprecationWarning)
self.assertRaisesRegexp(
ParameterError, "Incorrect checksum", token.update, {
"otpkey":
b32encode_and_unicode(b"\x37" + checksum[1:] +
client_component).strip("="),
"otpkeyformat":
"base32check",
})
# construct a secret
token.update({
"otpkey":
b32encode_and_unicode(checksum + client_component).strip("="),
"otpkeyformat":
"base32check",
# the following values are ignored
"2step_serversize":
"23",
"2step_difficulty":
"666666",
"2step_clientsize":
"13"
})
# check the generated secret
secret = binascii.unhexlify(token.token.get_otpkey().getKey())
# check the correct lengths
self.assertEqual(len(server_component), 64) # because of SHA-512
self.assertEqual(len(client_component), 12)
self.assertEqual(len(secret), 64) # because of SHA-512
# check the secret has been generated according to the specification
expected_secret = pbkdf2_hmac('sha1',
binascii.hexlify(server_component),
client_component, 10000, len(secret))
self.assertEqual(secret, expected_secret)
self.assertTrue(token.token.active)
def test_01_create_token(self):
db_token = Token(self.serial3, tokentype="radius")
db_token.save()
token = RadiusTokenClass(db_token)
# Missing radius.user parameter
self.assertRaises(ParameterError, token.update, self.params3)
db_token = Token(self.serial2, tokentype="radius")
db_token.save()
token = RadiusTokenClass(db_token)
token.update(self.params2)
token.set_pin(self.otppin)
db_token = Token(self.serial1, tokentype="radius")
db_token.save()
token = RadiusTokenClass(db_token)
token.update(self.params1)
token.set_pin(self.otppin)
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "radius",
token.token.tokentype)
self.assertTrue(token.type == "radius", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "PIRA", class_prefix)
self.assertTrue(token.get_class_type() == "radius", token)
def test_01_create_token(self):
db_token = Token(self.serial3, tokentype="remote")
db_token.save()
token = RemoteTokenClass(db_token)
token.update(self.params3)
token.set_pin(self.otppin)
db_token = Token(self.serial2, tokentype="remote")
db_token.save()
token = RemoteTokenClass(db_token)
token.update(self.params2)
token.set_pin(self.otppin)
db_token = Token(self.serial1, tokentype="remote")
db_token.save()
token = RemoteTokenClass(db_token)
token.update(self.params1)
token.set_pin(self.otppin)
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "remote",
token.token.tokentype)
self.assertTrue(token.type == "remote", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "PIRE", class_prefix)
self.assertTrue(token.get_class_type() == "remote", token)
def test_08_invalid_otpkey(self):
db_token = Token(self.serial2, tokentype="vasco")
db_token.save()
token = VascoTokenClass(db_token)
self.assertRaises(ParameterError,
token.update,
{"otpkey": hexlify("X"*250)}) # wrong length
self.assertRaises(TypeError,
token.update,
{"otpkey": "X"*496}) # not a hex-string
token.delete_token()
def test_04_create_token_on_server(self):
self.setUp_user_realms()
cwd = os.getcwd()
# setup ca connector
r = save_caconnector({"cakey": CAKEY,
"cacert": CACERT,
"type": "local",
"caconnector": "localCA",
"openssl.cnf": OPENSSLCNF,
"CSRDir": "",
"CertificateDir": "",
"WorkingDir": cwd + "/" + WORKINGDIR})
db_token = Token(self.serial3, tokentype="certificate")
db_token.save()
token = CertificateTokenClass(db_token)
# missing user
self.assertRaises(ParameterError,
token.update, {"ca": "localCA","genkey": 1})
token.update({"ca": "localCA", "genkey": 1,
"user": "******"})
self.assertEqual(token.token.serial, self.serial3)
self.assertEqual(token.token.tokentype, "certificate")
self.assertEqual(token.type, "certificate")
detail = token.get_init_detail()
certificate = detail.get("certificate")
# At each testrun, the certificate might get another serial number!
x509obj = crypto.load_certificate(crypto.FILETYPE_PEM, certificate)
self.assertEqual("{0!r}".format(x509obj.get_issuer()),
"<X509Name object '/C=DE/ST=Hessen"
"/O=privacyidea/CN=CA001'>")
self.assertEqual("{0!r}".format(x509obj.get_subject()),
"<X509Name object '/OU=realm1/CN=cornelius/[email protected]'>")
# Test, if the certificate is also completely stored in the tokeninfo
# and if we can retrieve it from the tokeninfo
token = get_tokens(serial=self.serial3)[0]
certificate = token.get_tokeninfo("certificate")
x509obj = crypto.load_certificate(crypto.FILETYPE_PEM, certificate)
self.assertEqual("{0!r}".format(x509obj.get_issuer()),
"<X509Name object '/C=DE/ST=Hessen"
"/O=privacyidea/CN=CA001'>")
self.assertEqual("{0!r}".format(x509obj.get_subject()),
"<X509Name object '/OU=realm1/CN=cornelius/[email protected]'>")
privatekey = token.get_tokeninfo("privatekey")
self.assertTrue(privatekey.startswith("-----BEGIN PRIVATE KEY-----"))
# check for pkcs12
self.assertTrue(detail.get("pkcs12"))
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="spass")
db_token.save()
token = SpassTokenClass(db_token)
token.update({})
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "spass", token.token.tokentype)
self.assertTrue(token.type == "spass", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "PISP", class_prefix)
self.assertTrue(token.get_class_type() == "spass", token)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="spass")
db_token.save()
token = SpassTokenClass(db_token)
token.update({})
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "spass", token.token.tokentype)
self.assertTrue(token.type == "spass", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "PISP", class_prefix)
self.assertTrue(token.get_class_type() == "spass", token)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="daplug")
db_token.save()
token = DaplugTokenClass(db_token)
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "daplug",
token.token.tokentype)
self.assertTrue(token.type == "daplug", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "DPLG", class_prefix)
self.assertTrue(token.get_class_type() == "daplug", token)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="pw")
db_token.save()
token = PasswordTokenClass(db_token)
token.update({"otpkey": self.password})
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "pw", token.token.tokentype)
self.assertTrue(token.type == "pw", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "PW", class_prefix)
self.assertTrue(token.get_class_type() == "pw", token)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="paper")
db_token.save()
token = PaperTokenClass(db_token)
token.update({})
self.assertEqual(token.token.serial, self.serial1)
self.assertEqual(token.token.tokentype, "paper")
self.assertEqual(token.type, "paper")
class_prefix = token.get_class_prefix()
self.assertEqual(class_prefix, "PPR")
self.assertEqual(token.get_class_type(), "paper")
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="paper")
db_token.save()
token = PaperTokenClass(db_token)
token.update({})
self.assertEqual(token.token.serial, self.serial1)
self.assertEqual(token.token.tokentype, "paper")
self.assertEqual(token.type, "paper")
class_prefix = token.get_class_prefix()
self.assertEqual(class_prefix, "PPR")
self.assertEqual(token.get_class_type(), "paper")
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="pw")
db_token.save()
token = PasswordTokenClass(db_token)
token.update({"otpkey": self.password})
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "pw", token.token.tokentype)
self.assertTrue(token.type == "pw", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "PW", class_prefix)
self.assertTrue(token.get_class_type() == "pw", token)
def test_00_create_realms(self):
self.setUp_user_realms()
# create a token and assign it to the user
db_token = Token(self.serials[0], tokentype="hotp")
db_token.update_otpkey(self.otpkey)
db_token.save()
token = HotpTokenClass(db_token)
self.assertTrue(token.token.serial == self.serials[0], token)
token.set_user(User("cornelius", self.realm1))
token.set_pin("pin")
self.assertTrue(token.token.user_id == "1000", token.token.user_id)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="sms")
db_token.save()
token = SmsTokenClass(db_token)
token.update({"phone": self.phone1})
token.save()
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "sms", token.token)
self.assertTrue(token.type == "sms", token.type)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "PISM", class_prefix)
self.assertTrue(token.get_class_type() == "sms", token)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="vasco")
db_token.save()
token = VascoTokenClass(db_token)
token.update({"otpkey": hexlify("X" * 248), "pin": self.otppin})
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "vasco",
token.token.tokentype)
self.assertTrue(token.type == "vasco", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "VASC", class_prefix)
self.assertTrue(token.get_class_type() == "vasco", token)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="registration")
db_token.save()
token = RegistrationTokenClass(db_token)
token.update({})
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "registration",
token.token.tokentype)
self.assertTrue(token.type == "registration", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "REG", class_prefix)
self.assertTrue(token.get_class_type() == "registration", token)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="vasco")
db_token.save()
token = VascoTokenClass(db_token)
token.update({"otpkey": hexlify("X" * 248),
"pin": self.otppin})
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "vasco", token.token.tokentype)
self.assertTrue(token.type == "vasco", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "VASC", class_prefix)
self.assertTrue(token.get_class_type() == "vasco", token)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="email")
db_token.save()
token = EmailTokenClass(db_token)
token.update({"email": self.email})
token.save()
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "email", token.token)
self.assertTrue(token.type == "email", token.type)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "PIEM", class_prefix)
self.assertTrue(token.get_class_type() == "email", token)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="sms")
db_token.save()
token = SmsTokenClass(db_token)
token.update({"phone": self.phone1})
token.save()
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "sms", token.token)
self.assertTrue(token.type == "sms", token.type)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "PISM", class_prefix)
self.assertTrue(token.get_class_type() == "sms", token)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="email")
db_token.save()
token = EmailTokenClass(db_token)
token.update({"email": self.email})
token.save()
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "email", token.token)
self.assertTrue(token.type == "email", token.type)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "PIEM", class_prefix)
self.assertTrue(token.get_class_type() == "email", token)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="registration")
db_token.save()
token = RegistrationTokenClass(db_token)
token.update({})
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "registration",
token.token.tokentype)
self.assertTrue(token.type == "registration", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "REG", class_prefix)
self.assertTrue(token.get_class_type() == "registration", token)
def test_09_failcount(self):
db_token = Token(self.serial2, tokentype="vasco")
db_token.save()
token = VascoTokenClass(db_token)
token.update({
"otpkey": hexlify(b"A" * 248).decode("utf-8"),
"pin": self.otppin
})
@mock_verification(create_mock_failure(1))
def _step1():
# correct PIN, wrong OTP
return check_serial_pass(self.serial2,
"{}123456".format(self.otppin))
self.assertTrue(token.check_failcount())
# fail 10 times
for _ in range(10 + 1):
r = _step1()
self.assertEqual(r[0], False)
self.assertEqual(r[1].get('message'), 'wrong otp value')
key = token.token.get_otpkey().getKey()
self.assertEqual(key, b"A" * 24 + b"L" * 224)
# fail counter has been exceeded
self.assertFalse(token.check_failcount())
@mock_verification(mock_success)
def _step2():
# correct PIN, wrong OTP
return check_serial_pass(self.serial2,
"{}123456".format(self.otppin))
# subsequent authentication attempt fails due to fail counter
r = _step2()
self.assertEqual(r[0], False)
self.assertEqual(r[1].get('message'),
'matching 1 tokens, Failcounter exceeded')
# this actually does update the OTP key
key = token.token.get_otpkey().getKey()
self.assertEqual(key, b"A" * 24 + b"M" * 224)
# reset the failcounter
token.reset()
# now, authentication works again
r = _step2()
self.assertEqual(r[0], True)
self.assertEqual(r[1].get('message'), 'matching 1 tokens')
key = token.token.get_otpkey().getKey()
self.assertEqual(key, b"A" * 24 + b"N" * 224)
token.delete_token()
def test_05_get_set_realm(self):
t1 = Token(serial="serial1123")
t1.save()
realms = t1.get_realms()
self.assertTrue(len(realms) == 0)
t1.set_realms(["realm1"])
t1.save()
realms = t1.get_realms()
self.assertTrue(len(realms) == 1)
def test_03_enroll_genkey(self):
db_token = Token(self.serial2, tokentype="motp")
db_token.save()
token = MotpTokenClass(db_token)
token.update({"genkey": "1",
"motppin": self.motppin,
"pin": self.otppin})
db_token = Token.query.filter(Token.serial == self.serial2).first()
token = MotpTokenClass(db_token)
# check that the userpin is set
self.assertTrue(token.token.user_pin, token.token.user_pin)
# check that the otp value is set
self.assertTrue(token.token.key_enc, token.token.key_enc)
def test_01_create_token(self):
db_token = Token(self.serial1, tokentype="motp")
db_token.save()
token = MotpTokenClass(db_token)
token.update({"otpkey": "909a4d4ba980b2c6",
"motppin": self.motppin,
"pin": self.otppin})
self.assertTrue(token.token.serial == self.serial1, token)
self.assertTrue(token.token.tokentype == "motp", token.token.tokentype)
self.assertTrue(token.type == "motp", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "PIMO", class_prefix)
self.assertTrue(token.get_class_type() == "motp", token)
def test_03_enroll_genkey(self):
db_token = Token(self.serial2, tokentype="motp")
db_token.save()
token = MotpTokenClass(db_token)
token.update({"genkey": "1",
"motppin": self.motppin,
"pin": self.otppin})
db_token = Token.query.filter(Token.serial == self.serial2).first()
token = MotpTokenClass(db_token)
# check that the userpin is set
self.assertTrue(token.token.user_pin, token.token.user_pin)
# check that the otp value is set
self.assertTrue(token.token.key_enc, token.token.key_enc)
def test_02_get_tokens(self):
# get All tokens
tokenobject_list = get_tokens()
# Check if these are valid tokentypes
self.assertTrue(len(tokenobject_list) > 0, tokenobject_list)
for token_object in tokenobject_list:
self.assertTrue(token_object.type in get_token_types(),
token_object.type)
# get assigned tokens
tokenobject_list = get_tokens(assigned=True)
self.assertTrue(len(tokenobject_list) == 0, tokenobject_list)
# get unassigned tokens
tokenobject_list = get_tokens(assigned=False)
self.assertTrue(len(tokenobject_list) > 0, tokenobject_list)
# pass the wrong parameter
# This will ignore the filter!
tokenobject_list = get_tokens(assigned="True")
self.assertTrue(len(tokenobject_list) > 0, tokenobject_list)
# get tokens of type HOTP
tokenobject_list = get_tokens(tokentype="hotp")
self.assertTrue(len(tokenobject_list) == 0, tokenobject_list)
# get tokens of type TOTP
tokenobject_list = get_tokens(tokentype="totp")
self.assertTrue(len(tokenobject_list) > 0, tokenobject_list)
# Search for tokens in realm
db_token = Token("hotptoken",
tokentype="hotp",
userid=1000,
resolver=self.resolvername1,
realm=self.realm1)
db_token.update_otpkey(self.otpkey)
db_token.save()
tokenobject_list = get_tokens(realm=self.realm1)
self.assertTrue(len(tokenobject_list) == 1, tokenobject_list)
self.assertTrue(tokenobject_list[0].type == "hotp",
tokenobject_list[0].type)
# get tokens for a given serial number
tokenobject_list = get_tokens(serial="hotptoken")
self.assertTrue(len(tokenobject_list) == 1, tokenobject_list)
# ...but not in an unassigned state!
tokenobject_list = get_tokens(serial="hotptoken", assigned=False)
self.assertTrue(len(tokenobject_list) == 0, tokenobject_list)
# get the tokens for the given user
tokenobject_list = get_tokens(user=User(login="******",
realm=self.realm1))
self.assertTrue(len(tokenobject_list) == 1, tokenobject_list)
def test_15_add_and_delete_tokeninfo(self):
t1 = Token("serialTI")
t1.save()
t1.set_info({"key1": "value1",
"key2": "value2",
"key3": "value3"})
t2 = Token.query.filter_by(serial="serialTI").first()
t2info = t2.get_info()
self.assertTrue(t2info.get("key2") == "value2", t2info)
t2.del_info("key2")
t2info = t2.get_info()
self.assertTrue(t2info.get("key2") is None, t2info)
def test_02_create_token_from_request(self):
cwd = os.getcwd()
# setup ca connector
r = save_caconnector({"cakey": CAKEY,
"cacert": CACERT,
"type": "local",
"caconnector": "localCA",
"openssl.cnf": OPENSSLCNF,
"CSRDir": "",
"CertificateDir": "",
"WorkingDir": cwd + "/" + WORKINGDIR})
db_token = Token(self.serial2, tokentype="certificate")
db_token.save()
token = CertificateTokenClass(db_token)
# just upload a ready certificate
token.update({"ca": "localCA",
"request": REQUEST})
self.assertTrue(token.token.serial == self.serial2, token)
self.assertTrue(token.token.tokentype == "certificate",
token.token.tokentype)
self.assertTrue(token.type == "certificate", token)
class_prefix = token.get_class_prefix()
self.assertTrue(class_prefix == "CRT", class_prefix)
self.assertTrue(token.get_class_type() == "certificate", token)
detail = token.get_init_detail()
certificate = detail.get("certificate")
# At each testrun, the certificate might get another serial number!
x509obj = crypto.load_certificate(crypto.FILETYPE_PEM, certificate)
self.assertEqual("{0!r}".format(x509obj.get_issuer()),
"<X509Name object '/C=DE/ST=Hessen"
"/O=privacyidea/CN=CA001'>")
self.assertEqual("{0!r}".format(x509obj.get_subject()),
"<X509Name object '/C=DE/ST=Hessen"
"/O=privacyidea/CN=requester.localdomain'>")
# Test, if the certificate is also completely stored in the tokeninfo
# and if we can retrieve it from the tokeninfo
token = get_tokens(serial=self.serial2)[0]
certificate = token.get_tokeninfo("certificate")
x509obj = crypto.load_certificate(crypto.FILETYPE_PEM, certificate)
self.assertEqual("{0!r}".format(x509obj.get_issuer()),
"<X509Name object '/C=DE/ST=Hessen"
"/O=privacyidea/CN=CA001'>")
self.assertEqual("{0!r}".format(x509obj.get_subject()),
"<X509Name object '/C=DE/ST=Hessen"
"/O=privacyidea/CN=requester.localdomain'>")