summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--API.txt58
-rw-r--r--VERSION.m44
-rw-r--r--ipaclient/plugins/cert.py4
-rw-r--r--ipaclient/remote_plugins/schema.py4
-rw-r--r--ipalib/install/certstore.py8
-rw-r--r--ipalib/parameters.py42
-rw-r--r--ipalib/rpc.py10
-rw-r--r--ipalib/util.py3
-rw-r--r--ipalib/x509.py40
-rw-r--r--ipapython/ipaldap.py16
-rw-r--r--ipaserver/install/dogtaginstance.py2
-rw-r--r--ipaserver/install/krainstance.py7
-rw-r--r--ipaserver/plugins/baseuser.py18
-rw-r--r--ipaserver/plugins/cert.py63
-rw-r--r--ipaserver/plugins/certmap.py8
-rw-r--r--ipaserver/plugins/host.py24
-rw-r--r--ipaserver/plugins/idviews.py8
-rw-r--r--ipaserver/plugins/service.py33
-rw-r--r--ipatests/test_ipaserver/test_ldap.py14
19 files changed, 178 insertions, 188 deletions
diff --git a/API.txt b/API.txt
index 08ca9198a..4b06a9692 100644
--- a/API.txt
+++ b/API.txt
@@ -744,7 +744,7 @@ args: 1,29,4
arg: Str('criteria?')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Str('cacn?', cli_name='ca')
-option: Bytes('certificate?', autofill=False)
+option: Certificate('certificate?', autofill=False)
option: Flag('exactly?', autofill=True, default=False)
option: Str('host*', cli_name='hosts')
option: DateTime('issuedon_from?', autofill=False)
@@ -828,7 +828,7 @@ output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: PrimaryKey('value')
command: certmap_match/1
args: 1,3,4
-arg: Bytes('certificate', cli_name='certificate')
+arg: Certificate('certificate', cli_name='certificate')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('version?')
@@ -2434,7 +2434,7 @@ option: Str('nsosversion?', cli_name='os')
option: Flag('random?', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('setattr*', cli_name='setattr')
-option: Bytes('usercertificate*', cli_name='certificate')
+option: Certificate('usercertificate*', cli_name='certificate')
option: Str('userclass*', cli_name='class')
option: Str('userpassword?', cli_name='password')
option: Str('version?')
@@ -2447,7 +2447,7 @@ arg: Str('fqdn', cli_name='hostname')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
-option: Bytes('usercertificate+', alwaysask=True, cli_name='certificate')
+option: Certificate('usercertificate+', alwaysask=True, cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -2580,7 +2580,7 @@ option: Flag('pkey_only?', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Int('sizelimit?', autofill=False)
option: Int('timelimit?', autofill=False)
-option: Bytes('usercertificate*', autofill=False, cli_name='certificate')
+option: Certificate('usercertificate*', autofill=False, cli_name='certificate')
option: Str('userclass*', autofill=False, cli_name='class')
option: Str('userpassword?', autofill=False, cli_name='password')
option: Str('version?')
@@ -2613,7 +2613,7 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Flag('rights', autofill=True, default=False)
option: Str('setattr*', cli_name='setattr')
option: Flag('updatedns?', autofill=True, default=False)
-option: Bytes('usercertificate*', autofill=False, cli_name='certificate')
+option: Certificate('usercertificate*', autofill=False, cli_name='certificate')
option: Str('userclass*', autofill=False, cli_name='class')
option: Str('userpassword?', autofill=False, cli_name='password')
option: Str('version?')
@@ -2626,7 +2626,7 @@ arg: Str('fqdn', cli_name='hostname')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
-option: Bytes('usercertificate+', alwaysask=True, cli_name='certificate')
+option: Certificate('usercertificate+', alwaysask=True, cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -2862,7 +2862,7 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('setattr*', cli_name='setattr')
option: Str('uid?', cli_name='login')
option: Int('uidnumber?', cli_name='uid')
-option: Bytes('usercertificate*', cli_name='certificate')
+option: Certificate('usercertificate*', cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -2874,7 +2874,7 @@ arg: Str('ipaanchoruuid', cli_name='anchor')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('fallback_to_ldap?', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
-option: Bytes('usercertificate+', alwaysask=True, cli_name='certificate')
+option: Certificate('usercertificate+', alwaysask=True, cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -2934,7 +2934,7 @@ option: Flag('rights', autofill=True, default=False)
option: Str('setattr*', cli_name='setattr')
option: Str('uid?', autofill=False, cli_name='login')
option: Int('uidnumber?', autofill=False, cli_name='uid')
-option: Bytes('usercertificate*', autofill=False, cli_name='certificate')
+option: Certificate('usercertificate*', autofill=False, cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -2946,7 +2946,7 @@ arg: Str('ipaanchoruuid', cli_name='anchor')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('fallback_to_ldap?', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
-option: Bytes('usercertificate+', alwaysask=True, cli_name='certificate')
+option: Certificate('usercertificate+', alwaysask=True, cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -4470,7 +4470,7 @@ option: Str('krbprincipalauthind*', cli_name='auth_ind')
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Str('setattr*', cli_name='setattr')
-option: Bytes('usercertificate*', cli_name='certificate')
+option: Certificate('usercertificate*', cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -4481,7 +4481,7 @@ arg: Principal('krbcanonicalname', cli_name='canonical_principal')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
-option: Bytes('usercertificate+', alwaysask=True, cli_name='certificate')
+option: Certificate('usercertificate+', alwaysask=True, cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -4615,7 +4615,7 @@ option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
option: Flag('rights', autofill=True, default=False)
option: Str('setattr*', cli_name='setattr')
-option: Bytes('usercertificate*', autofill=False, cli_name='certificate')
+option: Certificate('usercertificate*', autofill=False, cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -4626,7 +4626,7 @@ arg: Principal('krbcanonicalname', cli_name='canonical_principal')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
-option: Bytes('usercertificate+', alwaysask=True, cli_name='certificate')
+option: Certificate('usercertificate+', alwaysask=True, cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -4880,7 +4880,7 @@ option: Str('street?', cli_name='street')
option: Str('telephonenumber*', cli_name='phone')
option: Str('title?')
option: Int('uidnumber?', cli_name='uid')
-option: Bytes('usercertificate*', cli_name='certificate')
+option: Certificate('usercertificate*', cli_name='certificate')
option: Str('userclass*', cli_name='class')
option: Password('userpassword?', cli_name='password')
option: Str('version?')
@@ -4893,7 +4893,7 @@ arg: Str('uid', cli_name='login')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
-option: Bytes('usercertificate+', alwaysask=True, cli_name='certificate')
+option: Certificate('usercertificate+', alwaysask=True, cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -4903,7 +4903,7 @@ args: 2,7,3
arg: Str('uid', cli_name='login')
arg: Str('ipacertmapdata*', alwaysask=False, cli_name='certmapdata')
option: Flag('all', autofill=True, cli_name='all', default=False)
-option: Bytes('certificate*', cli_name='certificate')
+option: Certificate('certificate*', cli_name='certificate')
option: DNParam('issuer?', cli_name='issuer')
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
@@ -4995,7 +4995,7 @@ option: Int('timelimit?', autofill=False)
option: Str('title?', autofill=False)
option: Str('uid?', autofill=False, cli_name='login')
option: Int('uidnumber?', autofill=False, cli_name='uid')
-option: Bytes('usercertificate*', autofill=False, cli_name='certificate')
+option: Certificate('usercertificate*', autofill=False, cli_name='certificate')
option: Str('userclass*', autofill=False, cli_name='class')
option: Password('userpassword?', autofill=False, cli_name='password')
option: Str('version?')
@@ -5049,7 +5049,7 @@ option: Str('street?', autofill=False, cli_name='street')
option: Str('telephonenumber*', autofill=False, cli_name='phone')
option: Str('title?', autofill=False)
option: Int('uidnumber?', autofill=False, cli_name='uid')
-option: Bytes('usercertificate*', autofill=False, cli_name='certificate')
+option: Certificate('usercertificate*', autofill=False, cli_name='certificate')
option: Str('userclass*', autofill=False, cli_name='class')
option: Password('userpassword?', autofill=False, cli_name='password')
option: Str('version?')
@@ -5062,7 +5062,7 @@ arg: Str('uid', cli_name='login')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
-option: Bytes('usercertificate+', alwaysask=True, cli_name='certificate')
+option: Certificate('usercertificate+', alwaysask=True, cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -5072,7 +5072,7 @@ args: 2,7,3
arg: Str('uid', cli_name='login')
arg: Str('ipacertmapdata*', alwaysask=False, cli_name='certmapdata')
option: Flag('all', autofill=True, cli_name='all', default=False)
-option: Bytes('certificate*', cli_name='certificate')
+option: Certificate('certificate*', cli_name='certificate')
option: DNParam('issuer?', cli_name='issuer')
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
@@ -5947,7 +5947,7 @@ option: Str('street?', cli_name='street')
option: Str('telephonenumber*', cli_name='phone')
option: Str('title?')
option: Int('uidnumber?', cli_name='uid')
-option: Bytes('usercertificate*', cli_name='certificate')
+option: Certificate('usercertificate*', cli_name='certificate')
option: Str('userclass*', cli_name='class')
option: Password('userpassword?', cli_name='password')
option: Str('version?')
@@ -5960,7 +5960,7 @@ arg: Str('uid', cli_name='login')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
-option: Bytes('usercertificate+', alwaysask=True, cli_name='certificate')
+option: Certificate('usercertificate+', alwaysask=True, cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -5970,7 +5970,7 @@ args: 2,7,3
arg: Str('uid', cli_name='login')
arg: Str('ipacertmapdata*', alwaysask=False, cli_name='certmapdata')
option: Flag('all', autofill=True, cli_name='all', default=False)
-option: Bytes('certificate*', cli_name='certificate')
+option: Certificate('certificate*', cli_name='certificate')
option: DNParam('issuer?', cli_name='issuer')
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
@@ -6079,7 +6079,7 @@ option: Int('timelimit?', autofill=False)
option: Str('title?', autofill=False)
option: Str('uid?', autofill=False, cli_name='login')
option: Int('uidnumber?', autofill=False, cli_name='uid')
-option: Bytes('usercertificate*', autofill=False, cli_name='certificate')
+option: Certificate('usercertificate*', autofill=False, cli_name='certificate')
option: Str('userclass*', autofill=False, cli_name='class')
option: Password('userpassword?', autofill=False, cli_name='password')
option: Str('version?')
@@ -6135,7 +6135,7 @@ option: Str('street?', autofill=False, cli_name='street')
option: Str('telephonenumber*', autofill=False, cli_name='phone')
option: Str('title?', autofill=False)
option: Int('uidnumber?', autofill=False, cli_name='uid')
-option: Bytes('usercertificate*', autofill=False, cli_name='certificate')
+option: Certificate('usercertificate*', autofill=False, cli_name='certificate')
option: Str('userclass*', autofill=False, cli_name='class')
option: Password('userpassword?', autofill=False, cli_name='password')
option: Str('version?')
@@ -6148,7 +6148,7 @@ arg: Str('uid', cli_name='login')
option: Flag('all', autofill=True, cli_name='all', default=False)
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
-option: Bytes('usercertificate+', alwaysask=True, cli_name='certificate')
+option: Certificate('usercertificate+', alwaysask=True, cli_name='certificate')
option: Str('version?')
output: Entry('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
@@ -6158,7 +6158,7 @@ args: 2,7,3
arg: Str('uid', cli_name='login')
arg: Str('ipacertmapdata*', alwaysask=False, cli_name='certmapdata')
option: Flag('all', autofill=True, cli_name='all', default=False)
-option: Bytes('certificate*', cli_name='certificate')
+option: Certificate('certificate*', cli_name='certificate')
option: DNParam('issuer?', cli_name='issuer')
option: Flag('no_members', autofill=True, default=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False)
diff --git a/VERSION.m4 b/VERSION.m4
index cc308f1e2..9d50ad972 100644
--- a/VERSION.m4
+++ b/VERSION.m4
@@ -73,8 +73,8 @@ define(IPA_DATA_VERSION, 20100614120000)
# #
########################################################
define(IPA_API_VERSION_MAJOR, 2)
-define(IPA_API_VERSION_MINOR, 228)
-# Last change: Expose ipaNTAdditionalSuffixes in trust-mod
+define(IPA_API_VERSION_MINOR, 229)
+# Last change: Added the Certificate parameter
########################################################
diff --git a/ipaclient/plugins/cert.py b/ipaclient/plugins/cert.py
index 860f92553..d5daaf3a1 100644
--- a/ipaclient/plugins/cert.py
+++ b/ipaclient/plugins/cert.py
@@ -66,8 +66,8 @@ class CertRetrieveOverride(MethodOverride):
certs = result['result']['certificate_chain']
else:
certs = [result['result']['certificate']]
- certs = (x509.load_der_x509_certificate(
- x509.ensure_der_format(cert)) for cert in certs)
+ certs = (x509.load_der_x509_certificate(base64.b64decode(cert))
+ for cert in certs)
x509.write_certificate_list(certs, certificate_out)
return result
diff --git a/ipaclient/remote_plugins/schema.py b/ipaclient/remote_plugins/schema.py
index 41cd735b7..efb479079 100644
--- a/ipaclient/remote_plugins/schema.py
+++ b/ipaclient/remote_plugins/schema.py
@@ -12,6 +12,8 @@ import tempfile
import types
import zipfile
+from cryptography import x509 as crypto_x509
+
import six
from ipaclient.frontend import ClientCommand, ClientMethod
@@ -44,6 +46,7 @@ _TYPES = {
'list': list,
'tuple': tuple,
'unicode': unicode,
+ 'Certificate': crypto_x509.Certificate,
}
_PARAMS = {
@@ -57,6 +60,7 @@ _PARAMS = {
'dict': parameters.Dict,
'int': parameters.Int,
'str': parameters.Str,
+ 'Certificate': parameters.Certificate,
}
diff --git a/ipalib/install/certstore.py b/ipalib/install/certstore.py
index 89302f6d8..b26b8a7d2 100644
--- a/ipalib/install/certstore.py
+++ b/ipalib/install/certstore.py
@@ -310,12 +310,11 @@ def get_ca_certs(ldap, base_dn, compat_realm, compat_ipa_ca,
for cert in entry.get('cACertificate;binary', []):
try:
- cert_obj = x509.load_der_x509_certificate(cert)
- _parse_cert(cert_obj)
+ _parse_cert(cert)
except ValueError:
certs = []
break
- certs.append((cert_obj, nickname, trusted, ext_key_usage))
+ certs.append((cert, nickname, trusted, ext_key_usage))
except errors.NotFound:
try:
ldap.get_entry(container_dn, [''])
@@ -324,8 +323,7 @@ def get_ca_certs(ldap, base_dn, compat_realm, compat_ipa_ca,
dn = DN(('cn', 'CAcert'), config_dn)
entry = ldap.get_entry(dn, ['cACertificate;binary'])
- cert = x509.load_der_x509_certificate(
- entry.single_value['cACertificate;binary'])
+ cert = entry.single_value['cACertificate;binary']
try:
subject, _issuer_serial, _public_key_info = _parse_cert(cert)
except ValueError:
diff --git a/ipalib/parameters.py b/ipalib/parameters.py
index 7f19642e2..462e6e35e 100644
--- a/ipalib/parameters.py
+++ b/ipalib/parameters.py
@@ -108,15 +108,19 @@ import six
# pylint: disable=import-error
from six.moves.xmlrpc_client import MAXINT, MININT
# pylint: enable=import-error
+from cryptography import x509 as crypto_x509
from ipalib.text import _ as ugettext
from ipalib.base import check_name
from ipalib.plugable import ReadOnly, lock
from ipalib.errors import ConversionError, RequirementError, ValidationError
-from ipalib.errors import PasswordMismatch, Base64DecodeError
+from ipalib.errors import (
+ PasswordMismatch, Base64DecodeError, CertificateFormatError
+)
from ipalib.constants import TYPE_ERROR, CALLABLE_ERROR, LDAP_GENERALIZED_TIME_FORMAT
from ipalib.text import Gettext, FixMe
from ipalib.util import json_serialize, validate_idna_domain
+from ipalib.x509 import load_der_x509_certificate, IPACertificate
from ipapython import kerberos
from ipapython.dn import DN
from ipapython.dnsutil import DNSName
@@ -1407,6 +1411,42 @@ class Bytes(Data):
return super(Bytes, self)._convert_scalar(value)
+class Certificate(Param):
+ type = crypto_x509.Certificate
+ type_error = _('must be a certificate')
+ allowed_types = (IPACertificate, bytes, unicode)
+
+ def _convert_scalar(self, value, index=None):
+ """
+ :param value: either DER certificate or base64 encoded certificate
+ :returns: bytes representing value converted to DER format
+ """
+ if isinstance(value, bytes):
+ try:
+ value = value.decode('ascii')
+ except UnicodeDecodeError:
+ # value is possibly a DER-encoded certificate
+ pass
+
+ if isinstance(value, unicode):
+ # if we received unicodes right away or we got them after the
+ # decoding, we will now try to receive DER-certificate
+ try:
+ value = base64.b64decode(value)
+ except (TypeError, ValueError) as e:
+ raise Base64DecodeError(reason=str(e))
+
+ if isinstance(value, bytes):
+ # we now only have either bytes or an IPACertificate object
+ # if it's bytes, make it an IPACertificate object
+ try:
+ value = load_der_x509_certificate(value)
+ except ValueError as e:
+ raise CertificateFormatError(error=str(e))
+
+ return super(Certificate, self)._convert_scalar(value)
+
+
class Str(Data):
"""
A parameter for Unicode text (stored in the ``unicode`` type).
diff --git a/ipalib/rpc.py b/ipalib/rpc.py
index 8635894a5..ffa2b92f9 100644
--- a/ipalib/rpc.py
+++ b/ipalib/rpc.py
@@ -42,6 +42,7 @@ import json
import re
import socket
import gzip
+from cryptography import x509 as crypto_x509
import gssapi
from dns import resolver, rdatatype
@@ -56,6 +57,7 @@ from ipalib.errors import (public_errors, UnknownError, NetworkError,
XMLRPCMarshallError, JSONError)
from ipalib import errors, capabilities
from ipalib.request import context, Connection
+from ipalib.x509 import Encoding as x509_Encoding
from ipapython import ipautil
from ipapython import session_storage
from ipapython.cookie import Cookie
@@ -191,6 +193,10 @@ def xml_wrap(value, version):
if isinstance(value, Principal):
return unicode(value)
+ if isinstance(value, crypto_x509.Certificate):
+ return base64.b64encode(
+ value.public_bytes(x509_Encoding.DER)).encode('ascii')
+
assert type(value) in (unicode, float, bool, type(None)) + six.integer_types
return value
@@ -318,6 +324,7 @@ class _JSONPrimer(dict):
list: self._enc_list,
tuple: self._enc_list,
dict: self._enc_dict,
+ crypto_x509.Certificate: self._enc_certificate,
})
# int, long
for t in six.integer_types:
@@ -384,6 +391,9 @@ class _JSONPrimer(dict):
result[k] = v if func is _identity else func(v)
return result
+ def _enc_certificate(self, val):
+ return self._enc_bytes(val.public_bytes(x509_Encoding.DER))
+
def json_encode_binary(val, version, pretty_print=False):
"""Serialize a Python object structure to JSON
diff --git a/ipalib/util.py b/ipalib/util.py
index 880d2bc21..cb77104bf 100644
--- a/ipalib/util.py
+++ b/ipalib/util.py
@@ -129,7 +129,8 @@ def normalize_name(name):
def isvalid_base64(data):
"""
- Validate the incoming data as valid base64 data or not.
+ Validate the incoming data as valid base64 data or not. This is only
+ used in the ipalib.Parameters module which expects ``data`` to be unicode.
The character set must only include of a-z, A-Z, 0-9, + or / and
be padded with = to be a length divisible by 4 (so only 0-2 =s are
diff --git a/ipalib/x509.py b/ipalib/x509.py
index 87f0edad4..7877df328 100644
--- a/ipalib/x509.py
+++ b/ipalib/x509.py
@@ -19,8 +19,7 @@
# Certificates should be stored internally DER-encoded. We can be passed
# a certificate several ways: read if from LDAP, read it from a 3rd party
-# app (dogtag, candlepin, etc) or as user input. The ensure_der_format()
-# function will convert an incoming certificate to DER-encoding.
+# app (dogtag, candlepin, etc) or as user input.
# Conventions
#
@@ -51,8 +50,6 @@ from pyasn1.codec.der import decoder, encoder
from pyasn1_modules import rfc2315, rfc2459
import six
-from ipalib import api
-from ipalib import util
from ipalib import errors
from ipapython.dn import DN
from ipapython.dnsutil import DNSName
@@ -82,6 +79,7 @@ SAN_KRB5PRINCIPALNAME = '1.3.6.1.5.2.2'
_subject_base = None
def subject_base():
+ from ipalib import api
global _subject_base
if _subject_base is None:
@@ -504,40 +502,6 @@ def pkcs7_to_certs(data, datatype=PEM):
return result
-def ensure_der_format(rawcert):
- """
- Incoming certificates should be DER-encoded. If not it is converted to
- DER-format.
-
- Note that this can't be a normalizer on a Param because only unicode
- variables are normalized.
- """
- if not rawcert:
- return None
-
- try:
- if isinstance(rawcert, bytes):
- # base64 must work with utf-8, otherwise it is raw bin certificate
- decoded_cert = rawcert.decode('utf-8')
- else:
- decoded_cert = rawcert
- except UnicodeDecodeError:
- dercert = rawcert
- else:
- if util.isvalid_base64(decoded_cert):
- try:
- dercert = base64.b64decode(decoded_cert)
- except Exception as e:
- raise errors.Base64DecodeError(reason=str(e))
- else:
- dercert = rawcert
-
- # At this point we should have a DER certificate.
- # Attempt to decode it.
- validate_der_x509_certificate(dercert)
- return dercert
-
-
def validate_pem_x509_certificate(cert):
"""
Perform cert validation by trying to load it via python-cryptography.
diff --git a/ipapython/ipaldap.py b/ipapython/ipaldap.py
index 6ef661447..6ed2e9aff 100644
--- a/ipapython/ipaldap.py
+++ b/ipapython/ipaldap.py
@@ -34,6 +34,8 @@ import pwd
from six.moves.urllib.parse import urlparse
# pylint: enable=import-error
+from cryptography import x509 as crypto_x509
+
import ldap
import ldap.sasl
import ldap.filter
@@ -41,7 +43,7 @@ from ldap.controls import SimplePagedResultsControl
import six
# pylint: disable=ipa-forbidden-import
-from ipalib import errors, _
+from ipalib import errors, x509, _
from ipalib.constants import LDAP_GENERALIZED_TIME_FORMAT
# pylint: enable=ipa-forbidden-import
from ipapython.ipautil import format_netloc, CIDict
@@ -670,6 +672,10 @@ class LDAPClient(object):
'dnszoneidnsname': DNSName,
'krbcanonicalname': Principal,
'krbprincipalname': Principal,
+ 'usercertificate': crypto_x509.Certificate,
+ 'usercertificate;binary': crypto_x509.Certificate,
+ 'cACertificate': crypto_x509.Certificate,
+ 'cACertificate;binary': crypto_x509.Certificate,
'nsds5replicalastupdatestart': unicode,
'nsds5replicalastupdateend': unicode,
'nsds5replicalastinitstart': unicode,
@@ -842,7 +848,7 @@ class LDAPClient(object):
def encode(self, val):
"""
- Encode attribute value to LDAP representation (str).
+ Encode attribute value to LDAP representation (str/bytes).
"""
# Booleans are both an instance of bool and int, therefore
# test for bool before int otherwise the int clause will be
@@ -869,6 +875,8 @@ class LDAPClient(object):
return dct
elif isinstance(val, datetime.datetime):
return val.strftime(LDAP_GENERALIZED_TIME_FORMAT).encode('utf-8')
+ elif isinstance(val, crypto_x509.Certificate):
+ return val.public_bytes(x509.Encoding.DER)
elif val is None:
return None
else:
@@ -876,7 +884,7 @@ class LDAPClient(object):
def decode(self, val, attr):
"""
- Decode attribute value from LDAP representation (str).
+ Decode attribute value from LDAP representation (str/bytes).
"""
if isinstance(val, bytes):
target_type = self.get_attribute_type(attr)
@@ -892,6 +900,8 @@ class LDAPClient(object):
return DNSName.from_text(val.decode('utf-8'))
elif target_type in (DN, Principal):
return target_type(val.decode('utf-8'))
+ elif target_type is crypto_x509.Certificate:
+ return x509.load_der_x509_certificate(val)
else:
return target_type(val)
except Exception:
diff --git a/ipaserver/install/dogtaginstance.py b/ipaserver/install/dogtaginstance.py
index e63831968..6aa333944 100644
--- a/ipaserver/install/dogtaginstance.py
+++ b/ipaserver/install/dogtaginstance.py
@@ -376,7 +376,7 @@ class DogtagInstance(service.Service):
if conn is not None:
conn.unbind()
- return base64.b64encode(admin_cert)
+ return admin_cert
def handle_setup_error(self, e):
logger.critical("Failed to configure %s instance: %s",
diff --git a/ipaserver/install/krainstance.py b/ipaserver/install/krainstance.py
index 5a780b25f..7f82b755d 100644
--- a/ipaserver/install/krainstance.py
+++ b/ipaserver/install/krainstance.py
@@ -22,6 +22,7 @@ import os
import pwd
import shutil
import tempfile
+import base64
import six
# pylint: disable=import-error
@@ -268,13 +269,15 @@ class KRAInstance(DogtagInstance):
"https://%s" % ipautil.format_netloc(self.master_host, 443))
else:
# the admin cert file is needed for the first instance of KRA
- cert = DogtagInstance.get_admin_cert(self)
+ cert = self.get_admin_cert()
# First make sure that the directory exists
parentdir = os.path.dirname(paths.ADMIN_CERT_PATH)
if not os.path.exists(parentdir):
os.makedirs(parentdir)
with open(paths.ADMIN_CERT_PATH, "w") as admin_path:
- admin_path.write(cert)
+ admin_path.write(
+ base64.b64encode(cert.public_bytes(x509.Encoding.DER))
+ )
# Generate configuration file
with open(cfg_file, "w") as f:
diff --git a/ipaserver/plugins/baseuser.py b/ipaserver/plugins/baseuser.py
index 8b902aa4e..ef5585822 100644
--- a/ipaserver/plugins/baseuser.py
+++ b/ipaserver/plugins/baseuser.py
@@ -19,10 +19,10 @@
import six
-from ipalib import api, errors, x509
+from ipalib import api, errors
from ipalib import (
- Flag, Int, Password, Str, Bool, StrEnum, DateTime, Bytes, DNParam)
-from ipalib.parameters import Principal
+ Flag, Int, Password, Str, Bool, StrEnum, DateTime, DNParam)
+from ipalib.parameters import Principal, Certificate
from ipalib.plugable import Registry
from .baseldap import (
DN, LDAPObject, LDAPCreate, LDAPUpdate, LDAPSearch, LDAPDelete,
@@ -30,8 +30,7 @@ from .baseldap import (
LDAPAddMember, LDAPRemoveMember,
LDAPAddAttributeViaOption, LDAPRemoveAttributeViaOption,
add_missing_object_class)
-from ipaserver.plugins.service import (
- validate_certificate, validate_realm, normalize_principal)
+from ipaserver.plugins.service import (validate_realm, normalize_principal)
from ipalib.request import context
from ipalib import _
from ipalib.constants import PATTERN_GROUPUSER_NAME
@@ -363,7 +362,7 @@ class baseuser(LDAPObject):
+ '(\s*,\s*[a-zA-Z]{1,8}(-[a-zA-Z]{1,8})?(;q\=((0(\.[0-9]{0,3})?)|(1(\.0{0,3})?)))?)*)|(\*))$',
pattern_errmsg='must match RFC 2068 - 14.4, e.g., "da, en-gb;q=0.8, en;q=0.7"',
),
- Bytes('usercertificate*', validate_certificate,
+ Certificate('usercertificate*',
cli_name='certificate',
label=_('Certificate'),
doc=_('Base-64 encoded user certificate'),
@@ -762,8 +761,8 @@ class ModCertMapData(LDAPModAttribute):
doc=_('Subject of the certificate'),
flags=['virtual_attribute']
),
- Bytes(
- 'certificate*', validate_certificate,
+ Certificate(
+ 'certificate*',
cli_name='certificate',
label=_('Certificate'),
doc=_('Base-64 encoded user certificate'),
@@ -798,8 +797,7 @@ class ModCertMapData(LDAPModAttribute):
if issuer or subject:
data.append(cls._build_mapdata(subject, issuer))
- for dercert in certificates:
- cert = x509.load_der_x509_certificate(dercert)
+ for cert in certificates:
issuer = DN(cert.issuer)
subject = DN(cert.subject)
if not subject:
diff --git a/ipaserver/plugins/cert.py b/ipaserver/plugins/cert.py
index 1b2991bd0..ad8bea669 100644
--- a/ipaserver/plugins/cert.py
+++ b/ipaserver/plugins/cert.py
@@ -39,7 +39,9 @@ from ipalib import ngettext
from ipalib.constants import IPA_CA_CN
from ipalib.crud import Create, PKQuery, Retrieve, Search
from ipalib.frontend import Method, Object
-from ipalib.parameters import Bytes, DateTime, DNParam, DNSNameParam, Principal
+from ipalib.parameters import (
+ Bytes, Certificate, DateTime, DNParam, DNSNameParam, Principal
+)
from ipalib.plugable import Registry
from .virtual import VirtualCommand
from .baseldap import pkey_to_value
@@ -324,10 +326,6 @@ def ca_kdc_check(api_instance, hostname):
% dict(hostname=hostname))
-def validate_certificate(value):
- return x509.validate_der_x509_certificate(value)
-
-
def bind_principal_can_manage_cert(cert):
"""Check that the bind principal can manage the given cert.
@@ -362,11 +360,10 @@ class BaseCertObject(Object):
doc=_('Name of issuing CA'),
flags={'no_create', 'no_update', 'no_search'},
),
- Bytes(
- 'certificate', validate_certificate,
+ Certificate(
+ 'certificate',
label=_("Certificate"),
doc=_("Base-64 encoded certificate."),
- normalizer=x509.ensure_der_format,
flags={'no_create', 'no_update', 'no_search'},
),
Bytes(
@@ -1438,17 +1435,7 @@ class cert_find(Search, CertMethod):
)
def _get_cert_key(self, cert):
- try:
- cert_obj = x509.load_der_x509_certificate(cert)
- except ValueError as e:
- message = messages.SearchResultTruncated(
- reason=_("failed to load certificate: %s") % e,
- )
- self.add_message(message)
-
- raise
-
- return (DN(cert_obj.issuer), cert_obj.serial_number)
+ return (DN(cert.issuer), cert.serial_number)
def _cert_search(self, pkey_only, **options):
result = collections.OrderedDict()
@@ -1458,16 +1445,12 @@ class cert_find(Search, CertMethod):
except KeyError:
return result, False, False
- try:
- issuer, serial_number = self._get_cert_key(cert)
- except ValueError:
- return result, True, True
-
- obj = {'serial_number': serial_number}
+ obj = {'serial_number': cert.serial_number}
if not pkey_only:
- obj['certificate'] = base64.b64encode(cert).decode('ascii')
+ obj['certificate'] = base64.b64encode(
+ cert.public_bytes(x509.Encoding.DER)).decode('ascii')
- result[issuer, serial_number] = obj
+ result[self._get_cert_key(cert)] = obj
return result, False, True
@@ -1570,7 +1553,8 @@ class cert_find(Search, CertMethod):
cert = options.get('certificate')
if cert is not None:
- filter = ldap.make_filter_from_attr('usercertificate', cert)
+ filter = ldap.make_filter_from_attr(
+ 'usercertificate', cert.public_bytes(x509.Encoding.DER))
else:
filter = '(usercertificate=*)'
filters.append(filter)
@@ -1598,20 +1582,18 @@ class cert_find(Search, CertMethod):
for entry in entries:
for attr in ('usercertificate', 'usercertificate;binary'):
for cert in entry.get(attr, []):
+ cert_key = self._get_cert_key(cert)
try:
- issuer, serial_number = self._get_cert_key(cert)
- except ValueError:
- truncated = True
- continue
-
- try:
- obj = result[issuer, serial_number]
+ obj = result[cert_key]
except KeyError:
- obj = {'serial_number': serial_number}
+ obj = {'serial_number': cert.serial_number}
if not pkey_only and all:
obj['certificate'] = (
- base64.b64encode(cert).decode('ascii'))
- result[issuer, serial_number] = obj
+ base64.b64encode(
+ cert.public_bytes(x509.Encoding.DER))
+ .decode('ascii'))
+
+ result[cert_key] = obj
if not pkey_only and (all or not no_members):
owners = obj.setdefault('owner', [])
@@ -1695,10 +1677,7 @@ class cert_find(Search, CertMethod):
obj['certificate'].replace('\r\n', ''))
if 'certificate_chain' in ca_obj:
- cert = x509.load_der_x509_certificate(
- obj['certificate'])
- cert_der = (
- cert.public_bytes(serialization.Encoding.DER))
+ cert_der = base64.b64decode(obj['certificate'])
obj['certificate_chain'] = (
[cert_der] + ca_obj['certificate_chain'])
diff --git a/ipaserver/plugins/certmap.py b/ipaserver/plugins/certmap.py
index f26bf672a..6b44d376c 100644
--- a/ipaserver/plugins/certmap.py
+++ b/ipaserver/plugins/certmap.py
@@ -23,10 +23,9 @@ import dbus
import six
from ipalib import api, errors, x509
-from ipalib import Bytes
from ipalib.crud import Search
from ipalib.frontend import Object
-from ipalib.parameters import Bool, DNSNameParam, Flag, Int, Str
+from ipalib.parameters import Bool, DNSNameParam, Flag, Int, Str, Certificate
from ipalib.plugable import Registry
from .baseldap import (
LDAPCreate,
@@ -39,7 +38,6 @@ from .baseldap import (
pkey_to_value)
from ipalib import _, ngettext
from ipalib import output
-from ipaserver.plugins.service import validate_certificate
if six.PY3:
@@ -521,8 +519,8 @@ class certmap_match(Search):
if arg.name == 'criteria':
continue
yield arg
- yield Bytes(
- 'certificate', validate_certificate,
+ yield Certificate(
+ 'certificate',
cli_name='certificate',
label=_('Certificate'),
doc=_('Base-64 encoded user certificate'),
diff --git a/ipaserver/plugins/host.py b/ipaserver/plugins/host.py
index d5716a288..672966e87 100644
--- a/ipaserver/plugins/host.py
+++ b/ipaserver/plugins/host.py
@@ -27,9 +27,10 @@ import dns.resolver
import six
from ipalib import api, errors, util
+from ipalib.x509 import Encoding as x509_Encoding
from ipalib import messages
-from ipalib import Str, Flag, Bytes
-from ipalib.parameters import Principal
+from ipalib import Str, Flag
+from ipalib.parameters import Principal, Certificate
from ipalib.plugable import Registry
from .baseldap import (LDAPQuery, LDAPObject, LDAPCreate,
LDAPDelete, LDAPUpdate, LDAPSearch,
@@ -40,7 +41,7 @@ from .baseldap import (LDAPQuery, LDAPObject, LDAPCreate,
LDAPAddAttributeViaOption,
LDAPRemoveAttributeViaOption)
from .service import (
- validate_realm, normalize_principal, validate_certificate,
+ validate_realm, normalize_principal,
set_certificate_attrs, ticket_flags_params, update_krbticketflags,
set_kerberos_attrs, rename_ipaallowedtoperform_from_ldap,
rename_ipaallowedtoperform_to_ldap, revoke_certs)
@@ -48,7 +49,6 @@ from .dns import (dns_container_exists,
add_records_for_host_validation, add_records_for_host,
get_reverse_zone)
from ipalib import _, ngettext
-from ipalib import x509
from ipalib import output
from ipalib.request import context
from ipalib.util import (normalize_sshpubkey, validate_sshpubkey_no_options,
@@ -485,7 +485,7 @@ class host(LDAPObject):
label=_('Random password'),
flags=('no_create', 'no_update', 'no_search', 'virtual_attribute'),
),
- Bytes('usercertificate*', validate_certificate,
+ Certificate('usercertificate*',
cli_name='certificate',
label=_('Certificate'),
doc=_('Base-64 encoded host certificate'),
@@ -690,9 +690,8 @@ class host_add(LDAPCreate):
entropy_bits=TMP_PWD_ENTROPY_BITS)
# save the password so it can be displayed in post_callback
setattr(context, 'randompassword', entry_attrs['userpassword'])
- certs = options.get('usercertificate', [])
- certs_der = [x509.ensure_der_format(c) for c in certs]
- entry_attrs['usercertificate'] = certs_der
+
+ entry_attrs['usercertificate'] = options.get('usercertificate', [])
entry_attrs['managedby'] = dn
entry_attrs['objectclass'].append('ieee802device')
entry_attrs['objectclass'].append('ipasshhost')
@@ -895,7 +894,6 @@ class host_mod(LDAPUpdate):
# verify certificates
certs = entry_attrs.get('usercertificate') or []
- certs_der = [x509.ensure_der_format(c) for c in certs]
# revoke removed certificates
ca_is_enabled = self.api.Command.ca_is_enabled()['result']
@@ -905,14 +903,13 @@ class host_mod(LDAPUpdate):
except errors.NotFound:
self.obj.handle_not_found(*keys)
old_certs = entry_attrs_old.get('usercertificate', [])
- old_certs_der = [x509.ensure_der_format(c) for c in old_certs]
- removed_certs_der = set(old_certs_der) - set(certs_der)
+ removed_certs_der = set(old_certs) - set(certs)
for der in removed_certs_der:
rm_certs = api.Command.cert_find(certificate=der)['result']
revoke_certs(rm_certs)
if certs:
- entry_attrs['usercertificate'] = certs_der
+ entry_attrs['usercertificate'] = certs
if options.get('random'):
entry_attrs['userpassword'] = ipa_generate_password(
@@ -1344,7 +1341,8 @@ class host_remove_cert(LDAPRemoveAttributeViaOption):
assert isinstance(dn, DN)
for cert in options.get('usercertificate', []):
- revoke_certs(api.Command.cert_find(certificate=cert)['result'])
+ revoke_certs(api.Command.cert_find(
+ certificate=cert.public_bytes(x509_Encoding.DER))['result'])
return dn
diff --git a/ipaserver/plugins/idviews.py b/ipaserver/plugins/idviews.py
index 3cc7762ec..263a35a84 100644
--- a/ipaserver/plugins/idviews.py
+++ b/ipaserver/plugins/idviews.py
@@ -27,8 +27,10 @@ from .baseldap import (LDAPQuery, LDAPObject, LDAPCreate,
LDAPRemoveAttributeViaOption,
LDAPRetrieve, global_output_params)
from .hostgroup import get_complete_hostgroup_member_list
-from .service import validate_certificate
-from ipalib import api, Str, Int, Bytes, Flag, _, ngettext, errors, output
+from ipalib import (
+ api, Str, Int, Flag, _, ngettext, errors, output
+)
+from ipalib.parameters import Certificate
from ipalib.constants import (
IPA_ANCHOR_PREFIX,
SID_ANCHOR_PREFIX,
@@ -922,7 +924,7 @@ class idoverrideuser(baseidoverride):
normalizer=normalize_sshpubkey,
flags=['no_search'],
),
- Bytes('usercertificate*', validate_certificate,
+ Certificate('usercertificate*',
cli_name='certificate',
label=_('Certificate'),
doc=_('Base-64 encoded user certificate'),
diff --git a/ipaserver/plugins/service.py b/ipaserver/plugins/service.py
index a373a9ea9..0ec71cec1 100644
--- a/ipaserver/plugins/service.py
+++ b/ipaserver/plugins/service.py
@@ -25,8 +25,8 @@ from cryptography.hazmat.primitives import hashes
import six
from ipalib import api, errors, messages
-from ipalib import Bytes, StrEnum, Bool, Str, Flag
-from ipalib.parameters import Principal
+from ipalib import StrEnum, Bool, Str, Flag
+from ipalib.parameters import Principal, Certificate
from ipalib.plugable import Registry
from .baseldap import (
host_is_master,
@@ -215,13 +215,6 @@ def normalize_principal(value):
return unicode(principal)
-def validate_certificate(ugettext, cert):
- """
- Check whether the certificate is properly encoded to DER
- """
- if api.env.in_server:
- x509.validate_der_x509_certificate(cert)
-
def revoke_certs(certs):
"""
@@ -269,8 +262,6 @@ def set_certificate_attrs(entry_attrs):
cert = entry_attrs['usercertificate'][0]
else:
cert = entry_attrs['usercertificate']
- cert = x509.ensure_der_format(cert)
- cert = x509.load_der_x509_certificate(cert)
entry_attrs['subject'] = unicode(DN(cert.subject))
entry_attrs['serial_number'] = unicode(cert.serial_number)
entry_attrs['serial_number_hex'] = u'0x%X' % cert.serial_number
@@ -478,7 +469,7 @@ class service(LDAPObject):
require_service=True,
flags={'no_create'}
),
- Bytes('usercertificate*', validate_certificate,
+ Certificate('usercertificate*',
cli_name='certificate',
label=_('Certificate'),
doc=_('Base-64 encoded service certificate'),
@@ -632,9 +623,7 @@ class service_add(LDAPCreate):
self.obj.validate_ipakrbauthzdata(entry_attrs)
- certs = options.get('usercertificate', [])
- certs_der = [x509.ensure_der_format(c) for c in certs]
- entry_attrs['usercertificate'] = certs_der
+ entry_attrs['usercertificate'] = options.get('usercertificate', [])
if not options.get('force', False):
# We know the host exists if we've gotten this far but we
@@ -705,7 +694,6 @@ class service_mod(LDAPUpdate):
# verify certificates
certs = entry_attrs.get('usercertificate') or []
- certs_der = [x509.ensure_der_format(c) for c in certs]
# revoke removed certificates
ca_is_enabled = self.api.Command.ca_is_enabled()['result']
if 'usercertificate' in options and ca_is_enabled:
@@ -714,14 +702,14 @@ class service_mod(LDAPUpdate):
except errors.NotFound:
self.obj.handle_not_found(*keys)
old_certs = entry_attrs_old.get('usercertificate', [])
- old_certs_der = [x509.ensure_der_format(c) for c in old_certs]
- removed_certs_der = set(old_certs_der) - set(certs_der)
- for der in removed_certs_der:
- rm_certs = api.Command.cert_find(certificate=der)['result']
+ removed_certs = set(old_certs) - set(certs)
+ for cert in removed_certs:
+ rm_certs = api.Command.cert_find(
+ certificate=cert.public_bytes(x509.Encoding.DER))['result']
revoke_certs(rm_certs)
if certs:
- entry_attrs['usercertificate'] = certs_der
+ entry_attrs['usercertificate'] = certs
update_krbticketflags(ldap, entry_attrs, attrs_list, options, True)
@@ -997,7 +985,8 @@ class service_remove_cert(LDAPRemoveAttributeViaOption):
assert isinstance(dn, DN)
for cert in options.get('usercertificate', []):
- revoke_certs(api.Command.cert_find(certificate=cert)['result'])
+ revoke_certs(api.Command.cert_find(
+ certificate=cert.public_bytes(x509.Encoding.DER))['result'])
return dn
diff --git a/ipatests/test_ipaserver/test_ldap.py b/ipatests/test_ipaserver/test_ldap.py
index 88638dea2..a0d2a4554 100644
--- a/ipatests/test_ipaserver/test_ldap.py
+++ b/ipatests/test_ipaserver/test_ldap.py
@@ -35,7 +35,7 @@ import six
from ipaplatform.paths import paths
from ipaserver.plugins.ldap2 import ldap2, AUTOBIND_DISABLED
-from ipalib import api, x509, create_api, errors
+from ipalib import api, create_api, errors
from ipapython import ipautil
from ipapython.dn import DN
@@ -77,8 +77,7 @@ class test_ldap(object):
self.conn = ldap2(api)
self.conn.connect(autobind=AUTOBIND_DISABLED)
entry_attrs = self.conn.get_entry(self.dn, ['usercertificate'])
- cert = entry_attrs.get('usercertificate')
- cert = x509.load_der_x509_certificate(cert[0])
+ cert = entry_attrs.get('usercertificate')[0]
assert cert.serial_number is not None
def test_simple(self):
@@ -94,8 +93,7 @@ class test_ldap(object):
self.conn = ldap2(api)
self.conn.connect(bind_dn=DN(('cn', 'directory manager')), bind_pw=dm_password)
entry_attrs = self.conn.get_entry(self.dn, ['usercertificate'])
- cert = entry_attrs.get('usercertificate')
- cert = x509.load_der_x509_certificate(cert[0])
+ cert = entry_attrs.get('usercertificate')[0]
assert cert.serial_number is not None
def test_Backend(self):
@@ -120,8 +118,7 @@ class test_ldap(object):
result = myapi.Command['service_show']('ldap/%s@%s' % (api.env.host, api.env.realm,))
entry_attrs = result['result']
- cert = entry_attrs.get('usercertificate')
- cert = x509.load_der_x509_certificate(cert[0])
+ cert = entry_attrs.get('usercertificate')[0]
assert cert.serial_number is not None
def test_autobind(self):
@@ -134,8 +131,7 @@ class test_ldap(object):
except errors.ACIError:
raise nose.SkipTest("Only executed as root")
entry_attrs = self.conn.get_entry(self.dn, ['usercertificate'])
- cert = entry_attrs.get('usercertificate')
- cert = x509.load_der_x509_certificate(cert[0])
+ cert = entry_attrs.get('usercertificate')[0]
assert cert.serial_number is not None
generated by cgit (git 2.34.1) at 2024-09-27 21:51:09 +0000