Ben Lipton
10ef594786
Adds a library that uses jinja2 to format a script that, when run, will build a CSR. Also adds a CLI command, 'cert-get-requestdata', that uses this library and builds the script for a given principal. The rules are read from json files in /usr/share/ipa/csr, but the rule provider is a separate class so that it can be replaced easily. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
115 lines
3.0 KiB
Python
115 lines
3.0 KiB
Python
#
|
|
# Copyright (C) 2016 FreeIPA Contributors see COPYING for license
|
|
#
|
|
|
|
import six
|
|
|
|
from ipaclient.csrgen import CSRGenerator, FileRuleProvider
|
|
from ipalib import api
|
|
from ipalib import errors
|
|
from ipalib import output
|
|
from ipalib import util
|
|
from ipalib.frontend import Local, Str
|
|
from ipalib.parameters import Principal
|
|
from ipalib.plugable import Registry
|
|
from ipalib.text import _
|
|
|
|
if six.PY3:
|
|
unicode = str
|
|
|
|
register = Registry()
|
|
|
|
__doc__ = _("""
|
|
Commands to build certificate requests automatically
|
|
""")
|
|
|
|
|
|
@register()
|
|
class cert_get_requestdata(Local):
|
|
__doc__ = _('Gather data for a certificate signing request.')
|
|
|
|
takes_options = (
|
|
Principal(
|
|
'principal',
|
|
label=_('Principal'),
|
|
doc=_('Principal for this certificate (e.g.'
|
|
' HTTP/test.example.com)'),
|
|
),
|
|
Str(
|
|
'profile_id',
|
|
label=_('Profile ID'),
|
|
doc=_('CSR Generation Profile to use'),
|
|
),
|
|
Str(
|
|
'helper',
|
|
label=_('Name of CSR generation tool'),
|
|
doc=_('Name of tool (e.g. openssl, certutil) that will be used to'
|
|
' create CSR'),
|
|
),
|
|
Str(
|
|
'out?',
|
|
doc=_('Write CSR generation script to file'),
|
|
),
|
|
)
|
|
|
|
has_output = (
|
|
output.Output(
|
|
'result',
|
|
type=dict,
|
|
doc=_('Dictionary mapping variable name to value'),
|
|
),
|
|
)
|
|
|
|
has_output_params = (
|
|
Str(
|
|
'script',
|
|
label=_('Generation script'),
|
|
)
|
|
)
|
|
|
|
def execute(self, *args, **options):
|
|
if 'out' in options:
|
|
util.check_writable_file(options['out'])
|
|
|
|
principal = options.get('principal')
|
|
profile_id = options.get('profile_id')
|
|
helper = options.get('helper')
|
|
|
|
if self.api.env.in_server:
|
|
backend = self.api.Backend.ldap2
|
|
else:
|
|
backend = self.api.Backend.rpcclient
|
|
if not backend.isconnected():
|
|
backend.connect()
|
|
|
|
try:
|
|
if principal.is_host:
|
|
principal_obj = api.Command.host_show(
|
|
principal.hostname, all=True)
|
|
elif principal.is_service:
|
|
principal_obj = api.Command.service_show(
|
|
unicode(principal), all=True)
|
|
elif principal.is_user:
|
|
principal_obj = api.Command.user_show(
|
|
principal.username, all=True)
|
|
except errors.NotFound:
|
|
raise errors.NotFound(
|
|
reason=_("The principal for this request doesn't exist."))
|
|
principal_obj = principal_obj['result']
|
|
|
|
generator = CSRGenerator(FileRuleProvider())
|
|
|
|
script = generator.csr_script(
|
|
principal_obj, profile_id, helper)
|
|
|
|
result = {}
|
|
if 'out' in options:
|
|
with open(options['out'], 'wb') as f:
|
|
f.write(script)
|
|
else:
|
|
result = dict(script=script)
|
|
|
|
return dict(
|
|
result=result
|
|
)
|