From 183b587d77b09c7c5bff75eb34a83a8cd2db4371 Mon Sep 17 00:00:00 2001 From: William Brown Date: Wed, 4 Oct 2017 10:49:33 +1000 Subject: [PATCH 2/2] Ticket 84 - install TLS in test instances Bug Description: It should be easier to setup TLS in test instances. This includes certificates for replicas. Fix Description: In the setup process, we can optionally create TLS CA and certs for instances. https://pagure.io/lib389/issue/84 Author: wibrown Review by: ??? --- lib389/__init__.py | 40 +++++++- lib389/instance/setup.py | 38 ++++++-- lib389/nss_ssl.py | 224 ++++++++++++++++++++++++++++++++----------- lib389/tests/nss_ssl_test.py | 69 +++++++------ lib389/topologies.py | 4 +- 5 files changed, 272 insertions(+), 103 deletions(-) diff --git a/lib389/__init__.py b/lib389/__init__.py index a13a1ec..929dbf3 100644 --- a/lib389/__init__.py +++ b/lib389/__init__.py @@ -83,6 +83,7 @@ from lib389.utils import ( ensure_bytes, ensure_str) from lib389.paths import Paths +from lib389.nss_ssl import NssSsl # mixin # from lib389.tools import DirSrvTools @@ -292,7 +293,6 @@ class DirSrv(SimpleLDAPObject, object): def __add_brookers__(self): from lib389.config import Config from lib389.aci import Aci - from lib389.nss_ssl import NssSsl from lib389.config import RSA from lib389.config import Encryption from lib389.dirsrv_log import DirsrvAccessLog, DirsrvErrorLog @@ -334,7 +334,6 @@ class DirSrv(SimpleLDAPObject, object): self.mappingtrees = MappingTrees(self) self.replicas = Replicas(self) self.aci = Aci(self) - self.nss_ssl = NssSsl(self) self.rsa = RSA(self) self.encryption = Encryption(self) self.ds_access_log = DirsrvAccessLog(self) @@ -816,6 +815,10 @@ class DirSrv(SimpleLDAPObject, object): log.error("Can't find file: %r, removing extension" % prog) prog = prog[:-3] + # We need to tuck the SSLport away because we need to connect + hidden_ssl_port = self.sslport + self.sslport = None + # Create and extract a service keytab args = {SER_HOST: self.host, SER_PORT: self.port, @@ -850,7 +853,33 @@ class DirSrv(SimpleLDAPObject, object): (self.prefix, self.serverid)) self.restart() - # Restart the instance + # Now we need to connect and setup tls + self.open() + + # If it doesn't exist, create a cadb. + ssca_path = os.path.join(self.get_sysconf_dir(), 'dirsrv/ssca/') + ssca = NssSsl(dbpath=ssca_path) + if not ssca._db_exists(): + ssca.reinit() + ssca.create_rsa_ca() + + # Create certificate database. + tlsdb = NssSsl(dbpath=self.get_cert_dir()) + # Remember, DS breaks the db, so force init it. + tlsdb.reinit() + csr = tlsdb.create_rsa_key_and_csr() + (ca, crt) = ssca.rsa_ca_sign_csr(csr) + tlsdb.import_rsa_crt(ca, crt) + + # Setup the config + self.rsa.create() + self.config.set('nsslapd-secureport', '%s' % hidden_ssl_port) + self.config.set('nsslapd-security', 'on') + # Finally, unstash the sslport. + self.sslport = hidden_ssl_port + # Restart the instance + self.restart(post_open=False) + def _createPythonDirsrv(self, version): """ @@ -880,6 +909,8 @@ class DirSrv(SimpleLDAPObject, object): slapd_options.verify() slapd = slapd_options.collect() + print(slapd) + # In order to work by "default" for tests, we need to create a backend. userroot = { 'cn': 'userRoot', @@ -1619,6 +1650,9 @@ class DirSrv(SimpleLDAPObject, object): def get_sysconf_dir(self): return self.ds_paths.sysconf_dir + def get_ssca_dir(self): + return os.path.join(self.ds_paths.sysconf_dir, 'dirsrv/ssca') + def get_initconfig_dir(self): return self.ds_paths.initconfig_dir diff --git a/lib389/instance/setup.py b/lib389/instance/setup.py index 424d847..75a35b9 100644 --- a/lib389/instance/setup.py +++ b/lib389/instance/setup.py @@ -21,6 +21,8 @@ from lib389._constants import * from lib389.properties import * from lib389.passwd import password_hash, password_generate +from lib389.nss_ssl import NssSsl + from lib389.configurations import get_config from lib389.instance.options import General2Base, Slapd2Base @@ -267,10 +269,9 @@ class SetupDs(object): assert(slapd['port'] is not None) assert(socket_check_open('::1', slapd['port']) is False) - ## This causes some problems in tests :( - # assert(slapd['secure_port'] is not None) - if slapd['secure_port'] is not None: - assert(socket_check_open('::1', slapd['secure_port']) is False) + # We enable secure port by default. + assert(slapd['secure_port'] is not None) + assert(socket_check_open('::1', slapd['secure_port']) is False) if self.verbose: self.log.info("PASSED: network avaliability checking") @@ -425,9 +426,21 @@ class SetupDs(object): ds_instance.allocate(args) # Does this work? assert(ds_instance.exists()) - # Create the nssdb - assert(ds_instance.nss_ssl.reinit()) - # Do we want to selfsign a CA and cert? + + # If it doesn't exist, create a cadb. + ssca_path = os.path.join(slapd['sysconf_dir'], 'dirsrv/ssca/') + ssca = NssSsl(dbpath=ssca_path) + if not ssca._db_exists(): + ssca.reinit() + ssca.create_rsa_ca() + + # Create certificate database. + tlsdb = NssSsl(dbpath=slapd['cert_dir']) + if not tlsdb._db_exists(): + tlsdb.reinit() + csr = tlsdb.create_rsa_key_and_csr() + (ca, crt) = ssca.rsa_ca_sign_csr(csr) + tlsdb.import_rsa_crt(ca, crt) ## LAST CHANCE, FIX PERMISSIONS. # Selinux fixups? @@ -442,6 +455,12 @@ class SetupDs(object): base_config_inst = base_config(ds_instance) base_config_inst.apply_config(install=True) + # Setup TLS with the instance. + ### FUTURE: This should be part of template.dse.ldif + ds_instance.rsa.create() + ds_instance.config.set('nsslapd-secureport', '%s' % slapd['secure_port']) + ds_instance.config.set('nsslapd-security', 'on') + # Create the backends as listed # Load example data if needed. for backend in backends: @@ -454,7 +473,10 @@ class SetupDs(object): ds_instance.config.set('nsslapd-rootpw', ensure_str(slapd['root_password'])) - # In a container build we need to stop DirSrv at the end if self.containerised: + # In a container build we need to stop DirSrv at the end ds_instance.stop() + else: + # Restart for changes to take effect - this could be removed later + ds_instance.restart(post_open=False) diff --git a/lib389/nss_ssl.py b/lib389/nss_ssl.py index 90e78f9..fe7e0be 100644 --- a/lib389/nss_ssl.py +++ b/lib389/nss_ssl.py @@ -15,6 +15,9 @@ import random import string import re import socket +import time +import shutil +import logging # from nss import nss from subprocess import check_call, check_output from lib389.passwd import password_generate @@ -27,25 +30,27 @@ CERT_NAME = 'Server-Cert' USER_PREFIX = 'user-' PIN_TXT = 'pin.txt' PWD_TXT = 'pwdfile.txt' -ISSUER = 'CN=ca.lib389.example.com,O=testing,L=lib389,ST=Queensland,C=AU' -SELF_ISSUER = 'CN={HOSTNAME},O=testing,L=lib389,ST=Queensland,C=AU' +ISSUER = 'CN=ssca.389ds.example.com,O=testing,L=389ds,ST=Queensland,C=AU' +SELF_ISSUER = 'CN={HOSTNAME},O=testing,L=389ds,ST=Queensland,C=AU' VALID = 2 +# My logger +log = logging.getLogger(__name__) class NssSsl(object): - def __init__(self, dirsrv, dbpassword=None): + def __init__(self, dirsrv=None, dbpassword=None, dbpath=None): self.dirsrv = dirsrv - self.log = self.dirsrv.log + self._certdb = dbpath + if self._certdb is None: + self._certdb = self.dirsrv.get_cert_dir() + self.log = log + if self.dirsrv is not None: + self.log = self.dirsrv.log if dbpassword is None: self.dbpassword = password_generate() else: self.dbpassword = dbpassword - @property - def _certdb(self): - # return "sql:%s" % self.dirsrv.get_cert_dir() - return self.dirsrv.get_cert_dir() - def _generate_noise(self, fpath): noise = password_generate(256) with open(fpath, 'w') as f: @@ -60,38 +65,44 @@ class NssSsl(object): for f in ('key3.db', 'cert8.db', 'key4.db', 'cert9.db', 'secmod.db', 'pkcs11.txt'): try: # Perhaps we should be backing these up instead ... - os.remove("%s/%s" % (self.dirsrv.get_cert_dir(), f )) + os.remove("%s/%s" % (self._certdb, f )) except: pass + try: + os.makedirs(self._certdb) + except FileExistsError: + pass + # In the future we may add the needed option to avoid writing the pin # files. # Write the pin.txt, and the pwdfile.txt - if not os.path.exists('%s/%s' % (self.dirsrv.get_cert_dir(), PIN_TXT)): - with open('%s/%s' % (self.dirsrv.get_cert_dir(), PIN_TXT), 'w') as f: + if not os.path.exists('%s/%s' % (self._certdb, PIN_TXT)): + with open('%s/%s' % (self._certdb, PIN_TXT), 'w') as f: f.write('Internal (Software) Token:%s' % self.dbpassword) - if not os.path.exists('%s/%s' % (self.dirsrv.get_cert_dir(), PWD_TXT)): - with open('%s/%s' % (self.dirsrv.get_cert_dir(), PWD_TXT), 'w') as f: + if not os.path.exists('%s/%s' % (self._certdb, PWD_TXT)): + with open('%s/%s' % (self._certdb, PWD_TXT), 'w') as f: f.write('%s' % self.dbpassword) # Init the db. # 48886; This needs to be sql format ... - cmd = ['/usr/bin/certutil', '-N', '-d', self._certdb, '-f', '%s/%s' % (self.dirsrv.get_cert_dir(), PWD_TXT)] - self.dirsrv.log.debug("nss cmd: %s" % cmd) - result = check_output(cmd) - self.dirsrv.log.debug("nss output: %s" % result) + cmd = ['/usr/bin/certutil', '-N', '-d', self._certdb, '-f', '%s/%s' % (self._certdb, PWD_TXT)] + self._generate_noise('%s/noise.txt' % self._certdb) + self.log.debug("nss cmd: %s" % cmd) + result = ensure_str(check_output(cmd)) + self.log.debug("nss output: %s" % result) return True def _db_exists(self): """ Check that a nss db exists at the certpath """ - key3 = os.path.exists("%s/key3.db" % (self.dirsrv.get_cert_dir())) - cert8 = os.path.exists("%s/cert8.db" % (self.dirsrv.get_cert_dir())) - key4 = os.path.exists("%s/key4.db" % (self.dirsrv.get_cert_dir())) - cert9 = os.path.exists("%s/cert9.db" % (self.dirsrv.get_cert_dir())) - secmod = os.path.exists("%s/secmod.db" % (self.dirsrv.get_cert_dir())) - pkcs11 = os.path.exists("%s/pkcs11.txt" % (self.dirsrv.get_cert_dir())) + key3 = os.path.exists("%s/key3.db" % (self._certdb)) + cert8 = os.path.exists("%s/cert8.db" % (self._certdb)) + key4 = os.path.exists("%s/key4.db" % (self._certdb)) + cert9 = os.path.exists("%s/cert9.db" % (self._certdb)) + secmod = os.path.exists("%s/secmod.db" % (self._certdb)) + pkcs11 = os.path.exists("%s/pkcs11.txt" % (self._certdb)) if ((key3 and cert8 and secmod) or (key4 and cert9 and pkcs11)): return True @@ -102,8 +113,10 @@ class NssSsl(object): Create a self signed CA. """ + # Wait a second to avoid an NSS bug with serial ids based on time. + time.sleep(1) # Create noise. - self._generate_noise('%s/noise.txt' % self.dirsrv.get_cert_dir()) + self._generate_noise('%s/noise.txt' % self._certdb) # Now run the command. Can we do this with NSS native? cmd = [ '/usr/bin/certutil', @@ -122,12 +135,12 @@ class NssSsl(object): '-d', self._certdb, '-z', - '%s/noise.txt' % self.dirsrv.get_cert_dir(), + '%s/noise.txt' % self._certdb, '-f', - '%s/%s' % (self.dirsrv.get_cert_dir(), PWD_TXT), + '%s/%s' % (self._certdb, PWD_TXT), ] - result = check_output(cmd) - self.dirsrv.log.debug("nss output: %s" % result) + result = ensure_str(check_output(cmd)) + self.log.debug("nss output: %s" % result) # Now extract the CAcert to a well know place. # This allows us to point the cacert dir here and it "just works" cmd = [ @@ -140,10 +153,10 @@ class NssSsl(object): '-a', ] certdetails = check_output(cmd) - with open('%s/ca.crt' % self.dirsrv.get_cert_dir(), 'w') as f: + with open('%s/ca.crt' % self._certdb, 'w') as f: f.write(ensure_str(certdetails)) if os.path.isfile('/usr/sbin/cacertdir_rehash'): - check_output(['/usr/sbin/cacertdir_rehash', self.dirsrv.get_cert_dir()]) + check_output(['/usr/sbin/cacertdir_rehash', self._certdb]) return True def _rsa_cert_list(self): @@ -153,9 +166,9 @@ class NssSsl(object): '-d', self._certdb, '-f', - '%s/%s' % (self.dirsrv.get_cert_dir(), PWD_TXT), + '%s/%s' % (self._certdb, PWD_TXT), ] - result = check_output(cmd) + result = ensure_str(check_output(cmd)) # We can skip the first few lines. They are junk # IE ['', @@ -180,9 +193,9 @@ class NssSsl(object): '-d', self._certdb, '-f', - '%s/%s' % (self.dirsrv.get_cert_dir(), PWD_TXT), + '%s/%s' % (self._certdb, PWD_TXT), ] - result = check_output(cmd) + result = ensure_str(check_output(cmd)) lines = result.split('\n')[1:-1] key_list = [] @@ -255,18 +268,20 @@ class NssSsl(object): if len(alt_names) == 0: alt_names.append(socket.gethostname()) - if self.dirsrv.host not in alt_names: + if self.dirsrv and self.dirsrv.host not in alt_names: alt_names.append(self.dirsrv.host) + # Wait a second to avoid an NSS bug with serial ids based on time. + time.sleep(1) # Create noise. - self._generate_noise('%s/noise.txt' % self.dirsrv.get_cert_dir()) + self._generate_noise('%s/noise.txt' % self._certdb) cmd = [ '/usr/bin/certutil', '-S', '-n', CERT_NAME, '-s', - SELF_ISSUER.format(HOSTNAME=self.dirsrv.host), + SELF_ISSUER.format(HOSTNAME=alt_names[0]), # We MUST issue with SANs else ldap wont verify the name. '-8', ','.join(alt_names), '-c', @@ -280,21 +295,107 @@ class NssSsl(object): '-d', self._certdb, '-z', - '%s/noise.txt' % self.dirsrv.get_cert_dir(), + '%s/noise.txt' % self._certdb, '-f', - '%s/%s' % (self.dirsrv.get_cert_dir(), PWD_TXT), + '%s/%s' % (self._certdb, PWD_TXT), ] - result = check_output(cmd) - self.dirsrv.log.debug("nss output: %s" % result) + result = ensure_str(check_output(cmd)) + self.log.debug("nss output: %s" % result) return True + def create_rsa_key_and_csr(self, alt_names=[]): + csr_path = os.path.join(self._certdb, '%s.csr' % CERT_NAME) + + if len(alt_names) == 0: + alt_names.append(socket.gethostname()) + if self.dirsrv and self.dirsrv.host not in alt_names: + alt_names.append(self.dirsrv.host) + + # Wait a second to avoid an NSS bug with serial ids based on time. + time.sleep(1) + # Create noise. + self._generate_noise('%s/noise.txt' % self._certdb) + + check_call([ + '/usr/bin/certutil', + '-R', + '-s', + SELF_ISSUER.format(HOSTNAME=alt_names[0]), + # We MUST issue with SANs else ldap wont verify the name. + '-8', ','.join(alt_names), + '-g', + '%s' % KEYBITS, + '-v', + '%s' % VALID, + '-d', + self._certdb, + '-z', + '%s/noise.txt' % self._certdb, + '-f', + '%s/%s' % (self._certdb, PWD_TXT), + '-a', + '-o', csr_path, + ]) + return csr_path + + def rsa_ca_sign_csr(self, csr_path): + crt_path = 'crt'.join(csr_path.rsplit('csr', 1)) + ca_path = '%s/ca.crt' % self._certdb + + check_call([ + '/usr/bin/certutil', + '-C', + '-d', + self._certdb, + '-f', + '%s/%s' % (self._certdb, PWD_TXT), + '-a', + '-i', csr_path, + '-o', crt_path, + '-c', CA_NAME, + ]) + + return (ca_path, crt_path) + + def import_rsa_crt(self, ca, crt): + shutil.copyfile(ca, '%s/ca.crt' % self._certdb) + if os.path.isfile('/usr/sbin/cacertdir_rehash'): + check_output(['/usr/sbin/cacertdir_rehash', self._certdb]) + check_call([ + '/usr/bin/certutil', + '-A', + '-n', CA_NAME, + '-t', "C,,", + '-a', + '-i', '%s/ca.crt' % self._certdb, + '-d', self._certdb, + ]) + check_call([ + '/usr/bin/certutil', + '-A', + '-n', CERT_NAME, + '-t', ",,", + '-a', + '-i', crt, + '-d', self._certdb, + ]) + check_call([ + '/usr/bin/certutil', + '-V', + '-d', self._certdb, + '-n', CERT_NAME, + '-u', 'V' + ]) + def create_rsa_user(self, name): """ Create a key and cert for a user to authenticate to the directory. Name is the uid of the account, and will become the CN of the cert. """ + # Wait a second to avoid an NSS bug with serial ids based on time. + time.sleep(1) cmd = [ '/usr/bin/certutil', '-S', @@ -319,20 +420,20 @@ class NssSsl(object): '-d', self._certdb, '-z', - '%s/noise.txt' % self.dirsrv.get_cert_dir(), + '%s/noise.txt' % self._certdb, '-f', - '%s/%s' % (self.dirsrv.get_cert_dir(), PWD_TXT), + '%s/%s' % (self._certdb, PWD_TXT), ] - result = check_output(cmd) - self.dirsrv.log.debug("nss output: %s" % result) + result = ensure_str(check_output(cmd)) + self.log.debug("nss output: %s" % result) # Now extract this into PEM files that we can use. # pk12util -o user-william.p12 -d . -k pwdfile.txt -n user-william -W '' check_call([ 'pk12util', '-d', self._certdb, - '-o', '%s/%s%s.p12' % (self.dirsrv.get_cert_dir(), USER_PREFIX, name), - '-k', '%s/%s' % (self.dirsrv.get_cert_dir(), PWD_TXT), + '-o', '%s/%s%s.p12' % (self._certdb, USER_PREFIX, name), + '-k', '%s/%s' % (self._certdb, PWD_TXT), '-n', '%s%s' % (USER_PREFIX, name), '-W', '""' ]) @@ -341,9 +442,9 @@ class NssSsl(object): check_call([ 'openssl', 'pkcs12', - '-in', '%s/%s%s.p12' % (self.dirsrv.get_cert_dir(), USER_PREFIX, name), + '-in', '%s/%s%s.p12' % (self._certdb, USER_PREFIX, name), '-passin', 'pass:""', - '-out', '%s/%s%s.key' % (self.dirsrv.get_cert_dir(), USER_PREFIX, name), + '-out', '%s/%s%s.key' % (self._certdb, USER_PREFIX, name), '-nocerts', '-nodes' ]) @@ -351,21 +452,32 @@ class NssSsl(object): check_call([ 'openssl', 'pkcs12', - '-in', '%s/%s%s.p12' % (self.dirsrv.get_cert_dir(), USER_PREFIX, name), + '-in', '%s/%s%s.p12' % (self._certdb, USER_PREFIX, name), '-passin', 'pass:""', - '-out', '%s/%s%s.crt' % (self.dirsrv.get_cert_dir(), USER_PREFIX, name), + '-out', '%s/%s%s.crt' % (self._certdb, USER_PREFIX, name), '-nokeys', '-clcerts', '-nodes' ]) + # Convert the cert for userCertificate attr + check_call([ + 'openssl', + 'x509', + '-inform', 'PEM', + '-outform', 'DER', + '-in', '%s/%s%s.crt' % (self._certdb, USER_PREFIX, name), + '-out', '%s/%s%s.der' % (self._certdb, USER_PREFIX, name), + ]) + return True def get_rsa_user(self, name): """ Return a dict of information for ca, key and cert paths for the user id """ - ca_path = '%s/ca.crt' % self.dirsrv.get_cert_dir() - key_path = '%s/%s%s.key' % (self.dirsrv.get_cert_dir(), USER_PREFIX, name) - crt_path = '%s/%s%s.crt' % (self.dirsrv.get_cert_dir(), USER_PREFIX, name) - return {'ca': ca_path, 'key': key_path, 'crt': crt_path} + ca_path = '%s/ca.crt' % self._certdb + key_path = '%s/%s%s.key' % (self._certdb, USER_PREFIX, name) + crt_path = '%s/%s%s.crt' % (self._certdb, USER_PREFIX, name) + crt_der_path = '%s/%s%s.der' % (self._certdb, USER_PREFIX, name) + return {'ca': ca_path, 'key': key_path, 'crt': crt_path, 'crt_der_path': crt_der_path} diff --git a/lib389/tests/nss_ssl_test.py b/lib389/tests/nss_ssl_test.py index e1867b6..6808d89 100644 --- a/lib389/tests/nss_ssl_test.py +++ b/lib389/tests/nss_ssl_test.py @@ -14,6 +14,8 @@ import logging from lib389.topologies import topology_st as topo +from lib389.nss_ssl import NssSsl + DEBUGGING = os.getenv('DEBUGGING', False) if DEBUGGING: @@ -23,52 +25,49 @@ else: log = logging.getLogger(__name__) -def test_nss(topo): +def test_external_ca(): + # If it doesn't exist, create a cadb. + ssca = NssSsl(dbpath='/tmp/lib389-ssca') + ssca.reinit() + ssca.create_rsa_ca() + + # Create certificate database. + tlsdb = NssSsl(dbpath='/tmp/lib389-tlsdb') + tlsdb.reinit() + + csr = tlsdb.create_rsa_key_and_csr() + (ca, crt) = ssca.rsa_ca_sign_csr(csr) + tlsdb.import_rsa_crt(ca, crt) + +def test_nss_server(topo): """ Build a nss db, create a ca, and check that it is correct. """ + inst_db = NssSsl(dirsrv=topo.standalone) + + # Check our instance installed a valid and correct DB + assert(inst_db._db_exists() is True) + assert(inst_db._rsa_key_and_cert_exists() is True) + +def test_nss_ssca_users(topo): + """ + Validate that we can submit user certs to the ds ca for signing. + """ + ssca = NssSsl(dbpath=topo.standalone.get_ssca_dir()) - standalone = topo.standalone - - # This is a trick. The nss db that ships with DS is broken fundamentally. - # THIS ASSUMES old nss format. SQLite will bite us! - for f in ('key3.db', 'cert8.db', 'key4.db', 'cert9.db', 'secmod.db', 'pkcs11.txt'): - try: - os.remove("%s/%s" % (standalone.confdir, f)) - except: - pass - - - # Check if the db exists. Should be false. - assert(standalone.nss_ssl._db_exists() is False) - # Create it. Should work. - assert(standalone.nss_ssl.reinit() is True) - # Check if the db exists. Should be true - assert(standalone.nss_ssl._db_exists() is True) - - # Check if ca exists. Should be false. - assert(standalone.nss_ssl._rsa_ca_exists() is False) - # Create it. Should work. - assert(standalone.nss_ssl.create_rsa_ca() is True) - # Check if ca exists. Should be true - assert(standalone.nss_ssl._rsa_ca_exists() is True) - - # Check if we have a server cert / key. Should be false. - assert(standalone.nss_ssl._rsa_key_and_cert_exists() is False) - # Create it. Should work. - assert(standalone.nss_ssl.create_rsa_key_and_cert() is True) - # Check if server cert and key exist. Should be true. - assert(standalone.nss_ssl._rsa_key_and_cert_exists() is True) + assert(ssca._rsa_ca_exists() is True) # Check making users certs. They should never conflict for user in ('william', 'noriko', 'mark'): - assert(standalone.nss_ssl._rsa_user_exists(user) is False) + assert(ssca._rsa_user_exists(user) is False) # Create the user cert - assert(standalone.nss_ssl.create_rsa_user(user) is True) + assert(ssca.create_rsa_user(user) is True) # Assert it exists now - assert(standalone.nss_ssl._rsa_user_exists(user) is True) + assert(ssca._rsa_user_exists(user) is True) + if __name__ == "__main__": CURRENT_FILE = os.path.realpath(__file__) pytest.main("-s -vv %s" % CURRENT_FILE) + diff --git a/lib389/topologies.py b/lib389/topologies.py index 674f1d0..443420b 100644 --- a/lib389/topologies.py +++ b/lib389/topologies.py @@ -16,7 +16,7 @@ from lib389 import DirSrv from lib389.utils import generate_ds_params from lib389.replica import Replicas from lib389._constants import (args_instance, SER_HOST, SER_PORT, SER_SERVERID_PROP, SER_CREATION_SUFFIX, - ReplicaRole, DEFAULT_SUFFIX, REPLICA_ID) + SER_SECURE_PORT, ReplicaRole, DEFAULT_SUFFIX, REPLICA_ID) DEBUGGING = os.getenv('DEBUGGING', default=False) if DEBUGGING: @@ -61,6 +61,7 @@ def create_topology(topo_dict): # the instance creation here. args_instance[SER_HOST] = instance_data[SER_HOST] args_instance[SER_PORT] = instance_data[SER_PORT] + args_instance[SER_SECURE_PORT] = instance_data[SER_SECURE_PORT] args_instance[SER_SERVERID_PROP] = instance_data[SER_SERVERID_PROP] args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX args_copied = args_instance.copy() @@ -320,6 +321,7 @@ def topology_m1h1c1(request): instance = DirSrv(verbose=False) args_instance[SER_HOST] = instance_data[SER_HOST] args_instance[SER_PORT] = instance_data[SER_PORT] + args_instance[SER_SECURE_PORT] = instance_data[SER_SECURE_PORT] args_instance[SER_SERVERID_PROP] = instance_data[SER_SERVERID_PROP] args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX args_copied = args_instance.copy() -- 1.8.3.1