def test_external_ca(self):
# Step 1 of ipa-server-install.
install_server_external_ca_step1(self.master)
# Sign CA, transport it to the host and get ipa a root ca paths.
root_ca_fname, ipa_ca_fname = tasks.sign_ca_and_transport(
self.master, paths.ROOT_IPA_CSR, ROOT_CA, IPA_CA)
# Step 2 of ipa-server-install.
install_server_external_ca_step2(self.master, ipa_ca_fname,
root_ca_fname)
self.master.run_command([paths.IPA_CACERT_MANAGE, 'renew',
'--external-ca'])
result = self.master.run_command(['grep', '-v', 'CERTIFICATE',
ipa_ca_fname])
contents = result.stdout_text
BAD_CERT = 'bad_ca.crt'
invalid_cert = os.path.join(self.master.config.test_dir, BAD_CERT)
self.master.put_file_contents(invalid_cert, contents)
# Sign CA, transport it to the host and get ipa a root ca paths.
root_ca_fname, ipa_ca_fname = tasks.sign_ca_and_transport(
self.master, paths.IPA_CA_CSR, ROOT_CA, IPA_CA)
# renew CA with invalid cert
cmd = [paths.IPA_CACERT_MANAGE, 'renew', '--external-cert-file',
invalid_cert, '--external-cert-file', root_ca_fname]
result = self.master.run_command(cmd, raiseonerr=False)
assert result.returncode == 1
def test_external_ca(self):
# Step 1 of ipa-server-install.
install_server_external_ca_step1(self.master)
# Sign CA, transport it to the host and get ipa a root ca paths.
root_ca_fname, ipa_ca_fname = tasks.sign_ca_and_transport(
self.master, paths.ROOT_IPA_CSR, ROOT_CA, IPA_CA)
# Step 2 of ipa-server-install.
install_server_external_ca_step2(self.master, ipa_ca_fname,
root_ca_fname)
self.master.run_command(
[paths.IPA_CACERT_MANAGE, 'renew', '--external-ca'])
result = self.master.run_command(
['grep', '-v', 'CERTIFICATE', ipa_ca_fname])
contents = result.stdout_text
BAD_CERT = 'bad_ca.crt'
invalid_cert = os.path.join(self.master.config.test_dir, BAD_CERT)
self.master.put_file_contents(invalid_cert, contents)
# Sign CA, transport it to the host and get ipa a root ca paths.
root_ca_fname, ipa_ca_fname = tasks.sign_ca_and_transport(
self.master, paths.IPA_CA_CSR, ROOT_CA, IPA_CA)
# renew CA with invalid cert
cmd = [
paths.IPA_CACERT_MANAGE, 'renew', '--external-cert-file',
invalid_cert, '--external-cert-file', root_ca_fname
]
result = self.master.run_command(cmd, raiseonerr=False)
assert result.returncode == 1
def test_switch_to_external_ca(self):
result = self.master.run_command(
[paths.IPA_CACERT_MANAGE, 'renew', '--external-ca'])
assert result.returncode == 0
# Sign CA, transport it to the host and get ipa a root ca paths.
root_ca_fname, ipa_ca_fname = tasks.sign_ca_and_transport(
self.master, paths.IPA_CA_CSR, ROOT_CA, IPA_CA)
# renew CA with externally signed one
result = self.master.run_command([
paths.IPA_CACERT_MANAGE, 'renew',
'--external-cert-file={}'.format(ipa_ca_fname),
'--external-cert-file={}'.format(root_ca_fname)
])
assert result.returncode == 0
# update IPA certificate databases
result = self.master.run_command([paths.IPA_CERTUPDATE])
assert result.returncode == 0
# Check if external CA have "C" flag after the switch
result = check_CA_flag(self.master)
assert bool(result), ('External CA does not have "C" flag')
def test_external_ca(self):
# Step 1 of ipa-server-install.
result = install_server_external_ca_step1(self.master)
assert result.returncode == 0
# Sign CA, transport it to the host and get ipa a root ca paths.
root_ca_fname, ipa_ca_fname = tasks.sign_ca_and_transport(
self.master, paths.ROOT_IPA_CSR, ROOT_CA, IPA_CA)
# Step 2 of ipa-server-install.
result = install_server_external_ca_step2(self.master, ipa_ca_fname,
root_ca_fname)
assert result.returncode == 0
# Make sure IPA server is working properly
tasks.kinit_admin(self.master)
result = self.master.run_command(['ipa', 'user-show', 'admin'])
assert 'User login: admin' in result.stdout_text
# check that we can also install replica
tasks.install_replica(self.master, self.replicas[0])
# check that nsds5ReplicaReleaseTimeout option was set
result = self.master.run_command([
'ldapsearch', '-x', '-D', 'cn=directory manager', '-w',
self.master.config.dirman_password, '-b',
'cn=mapping tree,cn=config', '(cn=replica)', '-LLL', '-o',
'ldif-wrap=no'
])
# case insensitive match
text = result.stdout_text.lower()
# see ipaserver.install.replication.REPLICA_FINAL_SETTINGS
assert 'nsds5ReplicaReleaseTimeout: 60'.lower() in text
assert 'nsDS5ReplicaBindDnGroupCheckInterval: 60'.lower() in text
def test_switch_to_external_ca(self):
result = self.master.run_command([paths.IPA_CACERT_MANAGE, 'renew',
'--external-ca'])
assert result.returncode == 0
# Sign CA, transport it to the host and get ipa a root ca paths.
root_ca_fname, ipa_ca_fname = tasks.sign_ca_and_transport(
self.master, paths.IPA_CA_CSR, ROOT_CA, IPA_CA)
# renew CA with externally signed one
result = self.master.run_command([paths.IPA_CACERT_MANAGE, 'renew',
'--external-cert-file={}'.
format(ipa_ca_fname),
'--external-cert-file={}'.
format(root_ca_fname)])
assert result.returncode == 0
# update IPA certificate databases
result = self.master.run_command([paths.IPA_CERTUPDATE])
assert result.returncode == 0
# Check if external CA have "C" flag after the switch
result = check_CA_flag(self.master)
assert bool(result), ('External CA does not have "C" flag')
def test_external_ca(self):
# Step 1 of ipa-server-install.
result = install_server_external_ca_step1(self.master)
assert result.returncode == 0
# Sign CA, transport it to the host and get ipa a root ca paths.
root_ca_fname, ipa_ca_fname = tasks.sign_ca_and_transport(
self.master, paths.ROOT_IPA_CSR, ROOT_CA, IPA_CA)
# Step 2 of ipa-server-install.
result = install_server_external_ca_step2(
self.master, ipa_ca_fname, root_ca_fname)
assert result.returncode == 0
# Make sure IPA server is working properly
tasks.kinit_admin(self.master)
result = self.master.run_command(['ipa', 'user-show', 'admin'])
assert 'User login: admin' in result.stdout_text
# check that we can also install replica
tasks.install_replica(self.master, self.replicas[0])
# check that nsds5ReplicaReleaseTimeout option was set
result = self.master.run_command([
'ldapsearch',
'-x',
'-D',
'cn=directory manager',
'-w', self.master.config.dirman_password,
'-b', 'cn=mapping tree,cn=config',
'(cn=replica)',
'-LLL',
'-o',
'ldif-wrap=no'])
assert 'nsds5ReplicaReleaseTimeout: 60' in result.stdout_text
def test_external_ca(self):
# Step 1 of ipa-server-install
self.master.run_command([
'ipa-server-install', '-U', '-a',
self.master.config.admin_password, '-p',
self.master.config.dirman_password, '--setup-dns',
'--no-forwarders', '-n', self.master.domain.name, '-r',
self.master.domain.realm,
'--domain-level=%i' % self.master.config.domain_level,
'--external-ca'
])
# Sign CA, transport it to the host and get ipa a root ca paths.
root_ca_fname, ipa_ca_fname = tasks.sign_ca_and_transport(
self.master, paths.ROOT_IPA_CSR, ROOT_CA, IPA_CA)
# Step 2 of ipa-server-install
self.master.run_command([
'ipa-server-install', '-a', self.master.config.admin_password,
'-p', self.master.config.dirman_password, '--external-cert-file',
ipa_ca_fname, '--external-cert-file', root_ca_fname
])
# Make sure IPA server is working properly
tasks.kinit_admin(self.master)
result = self.master.run_command(['ipa', 'user-show', 'admin'])
assert 'User login: admin' in result.stdout_text
def test_external_ca(self):
# Step 1 of ipa-server-install.
result = install_server_external_ca_step1(self.master)
assert result.returncode == 0
# Sign CA, transport it to the host and get ipa a root ca paths.
root_ca_fname, ipa_ca_fname = tasks.sign_ca_and_transport(
self.master, paths.ROOT_IPA_CSR, ROOT_CA, IPA_CA)
# Step 2 of ipa-server-install.
result = install_server_external_ca_step2(self.master, ipa_ca_fname,
root_ca_fname)
assert result.returncode == 0
# Make sure IPA server is working properly
tasks.kinit_admin(self.master)
result = self.master.run_command(['ipa', 'user-show', 'admin'])
assert 'User login: admin' in result.stdout_text
def test_external_ca(self):
# Step 1 of ipa-server-install.
result = install_server_external_ca_step1(self.master)
assert result.returncode == 0
# Sign CA, transport it to the host and get ipa a root ca paths.
root_ca_fname, ipa_ca_fname = tasks.sign_ca_and_transport(
self.master, paths.ROOT_IPA_CSR, ROOT_CA, IPA_CA)
# Step 2 of ipa-server-install.
result = install_server_external_ca_step2(
self.master, ipa_ca_fname, root_ca_fname)
assert result.returncode == 0
# Make sure IPA server is working properly
tasks.kinit_admin(self.master)
result = self.master.run_command(['ipa', 'user-show', 'admin'])
assert 'User login: admin' in result.stdout_text
