Skip to content

Commit 076a398

Browse files
edewataedewata
committed
Update pki-server status
The pki-server status command has been modified to no longer show the subsystem "Type" field since it's redundant. Instead, it will show an "SD Manager" field which will indicate whether the subsystem is a security domain manager. Some CI tests have been updated to validate this command.
1 parent a2c528d commit 076a398

12 files changed

+223
-41
lines changed

‎.github/workflows/ca-basic-test.yml

+9
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,15 @@ jobs:
5656
-D pki_ds_url=ldap://ds.example.com:3389 \
5757
-v
5858
59+
- name: Check CA server status
60+
run: |
61+
docker exec pki pki-server status | tee output
62+
63+
# CA should be a domain manager
64+
echo "True" > expected
65+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
66+
diff expected actual
67+
5968
- name: Check webapps
6069
run: |
6170
docker exec pki pki-server webapp-find | tee output

‎.github/workflows/ca-clone-test.yml

+22
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,17 @@ jobs:
5656
-D pki_ds_url=ldap://primaryds.example.com:3389 \
5757
-v
5858
59+
- name: Check primary CA server status
60+
run: |
61+
docker exec primary pki-server status | tee output
62+
63+
# primary CA should be a domain manager
64+
echo "True" > expected
65+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
66+
diff expected actual
67+
68+
- name: Check primary CA system certs
69+
run: |
5970
docker exec primary pki-server cert-find
6071
6172
- name: Verify users and SD hosts in primary PKI container
@@ -107,6 +118,17 @@ jobs:
107118
-D pki_ds_url=ldap://secondaryds.example.com:3389 \
108119
-v
109120
121+
- name: Check secondary CA server status
122+
run: |
123+
docker exec secondary pki-server status | tee output
124+
125+
# secondary CA should be a domain manager
126+
echo "True" > expected
127+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
128+
diff expected actual
129+
130+
- name: Check secondary CA system certs
131+
run: |
110132
docker exec secondary pki-server cert-find
111133
112134
- name: Check schema in primary DS and secondary DS

‎.github/workflows/kra-basic-test.yml

+10
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,16 @@ jobs:
103103
-D pki_ds_url=ldap://ds.example.com:3389 \
104104
-v
105105
106+
- name: Check PKI server status
107+
run: |
108+
docker exec pki pki-server status | tee output
109+
110+
# CA should be a domain manager, but KRA should not
111+
echo "True" > expected
112+
echo "False" >> expected
113+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
114+
diff expected actual
115+
106116
- name: Check security domain config in KRA
107117
run: |
108118
# KRA should join security domain in CA

‎.github/workflows/kra-separate-test.yml

+28
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,15 @@ jobs:
5656
-D pki_ds_url=ldap://rootcads.example.com:3389 \
5757
-v
5858
59+
- name: Check root CA server status
60+
run: |
61+
docker exec rootca pki-server status | tee output
62+
63+
# root CA should be a domain manager
64+
echo "True" > expected
65+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
66+
diff expected actual
67+
5968
- name: Check security domain config in root CA
6069
run: |
6170
# root CA should run security domain service
@@ -123,6 +132,16 @@ jobs:
123132
-D pki_issuing_ca_uri=https://rootca.example.com:8443 \
124133
-v
125134
135+
- name: Check sub CA server status
136+
run: |
137+
docker exec subca pki-server status | tee output
138+
139+
# this sub CA should be a domain manager since it's created with
140+
# pki_subordinate_create_new_security_domain=True
141+
echo "True" > expected
142+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
143+
diff expected actual
144+
126145
- name: Check sub CA certs
127146
if: always()
128147
run: |
@@ -219,6 +238,15 @@ jobs:
219238
-D pki_ds_url=ldap://krads.example.com:3389 \
220239
-v
221240
241+
- name: Check KRA server status
242+
run: |
243+
docker exec kra pki-server status | tee output
244+
245+
# KRA should not be a domain manager
246+
echo "False" > expected
247+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
248+
diff expected actual
249+
222250
- name: Check security domain config in KRA
223251
run: |
224252
# KRA should join existing security domain in sub CA

‎.github/workflows/kra-standalone-test.yml

+36-10
Original file line numberDiff line numberDiff line change
@@ -186,24 +186,26 @@ jobs:
186186
-D pki_admin_cert_path=${SHARED}/kra_admin.crt \
187187
-v
188188
189+
- name: Check KRA server status
190+
run: |
191+
docker exec kra pki-server status | tee output
192+
193+
# standalone KRA should be a domain manager
194+
echo "True" > expected
195+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
196+
diff expected actual
197+
198+
- name: Check KRA system certs
199+
run: |
189200
docker exec kra pki-server cert-find
190201
191202
# TODO: Fix DogtagKRAConnectivityCheck to work without CA
192203
# - name: Run PKI healthcheck
193204
# run: docker exec kra pki-healthcheck --failures-only
194205

195-
- name: Check KRA security domain
196-
run: |
197-
docker exec kra pki client-cert-import ca_signing --ca-cert ${SHARED}/ca_signing.crt
198-
docker exec kra pki securitydomain-show \
199-
> >(tee stdout) 2> >(tee stderr >&2) || true
200-
201-
# standalone KRA should not return security domain info
202-
echo "PKIException: Not Found" > expected
203-
diff expected stderr
204-
205206
- name: Check KRA admin
206207
run: |
208+
docker exec kra pki client-cert-import ca_signing --ca-cert ${SHARED}/ca_signing.crt
207209
docker exec kra pki pkcs12-import \
208210
--pkcs12 /root/.dogtag/pki-tomcat/kra_admin_cert.p12 \
209211
--pkcs12-password Secret.123
@@ -220,6 +222,30 @@ jobs:
220222
echo "UserNotFoundException: User CA-ca.example.com-8443 not found" > expected
221223
diff expected stderr
222224
225+
- name: Check KRA security domain
226+
run: |
227+
# security domain should be enabled (i.e. securitydomain.select=new)
228+
cat > expected << EOF
229+
securitydomain.checkIP=false
230+
securitydomain.checkinterval=300000
231+
securitydomain.flushinterval=86400000
232+
securitydomain.host=kra.example.com
233+
securitydomain.httpport=8080
234+
securitydomain.httpsadminport=8443
235+
securitydomain.name=example.com Security Domain
236+
securitydomain.select=new
237+
securitydomain.source=ldap
238+
EOF
239+
240+
docker exec kra pki-server kra-config-find | grep ^securitydomain. | sort | tee actual
241+
diff expected actual
242+
243+
# TODO: Fix pki securitydomain-show to work with standalone KRA
244+
# docker exec kra pki securitydomain-show \
245+
# > >(tee stdout) 2> >(tee stderr >&2) || true
246+
247+
# standalone KRA should return security domain info
248+
223249
- name: Check KRA connector in CA
224250
run: |
225251
# KRA connector should not be configured

‎.github/workflows/ocsp-basic-test.yml

+10
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,16 @@ jobs:
103103
-D pki_ds_url=ldap://ds.example.com:3389 \
104104
-v
105105
106+
- name: Check PKI server status
107+
run: |
108+
docker exec pki pki-server status | tee output
109+
110+
# CA should be a domain manager, but OCSP should not
111+
echo "True" > expected
112+
echo "False" >> expected
113+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
114+
diff expected actual
115+
106116
- name: Check security domain config in OCSP
107117
run: |
108118
# OCSP should join security domain in CA

‎.github/workflows/ocsp-standalone-test.yml

+36-10
Original file line numberDiff line numberDiff line change
@@ -174,24 +174,26 @@ jobs:
174174
-D pki_admin_cert_path=${SHARED}/ocsp_admin.crt \
175175
-v
176176
177+
- name: Check OCSP server status
178+
run: |
179+
docker exec ocsp pki-server status | tee output
180+
181+
# standalone OCSP should be a domain manager
182+
echo "True" > expected
183+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
184+
diff expected actual
185+
186+
- name: Check OCSP system certs
187+
run: |
177188
docker exec ocsp pki-server cert-find
178189
179190
# TODO: Fix DogtagOCSPConnectivityCheck to work without CA
180191
# - name: Run PKI healthcheck
181192
# run: docker exec ocsp pki-healthcheck --failures-only
182193

183-
- name: Check OCSP security domain
184-
run: |
185-
docker exec ocsp pki client-cert-import ca_signing --ca-cert ${SHARED}/ca_signing.crt
186-
docker exec ocsp pki securitydomain-show \
187-
> >(tee stdout) 2> >(tee stderr >&2) || true
188-
189-
# standalone OCSP should not return security domain info
190-
echo "PKIException: Not Found" > expected
191-
diff expected stderr
192-
193194
- name: Check OCSP admin cert
194195
run: |
196+
docker exec ocsp pki client-cert-import ca_signing --ca-cert ${SHARED}/ca_signing.crt
195197
docker exec ocsp pki pkcs12-import \
196198
--pkcs12 /root/.dogtag/pki-tomcat/ocsp_admin_cert.p12 \
197199
--pkcs12-password Secret.123
@@ -208,6 +210,30 @@ jobs:
208210
echo "UserNotFoundException: User CA-ca.example.com-8443 not found" > expected
209211
diff expected stderr
210212
213+
- name: Check OCSP security domain
214+
run: |
215+
# security domain should be enabled (i.e. securitydomain.select=new)
216+
cat > expected << EOF
217+
securitydomain.checkIP=false
218+
securitydomain.checkinterval=300000
219+
securitydomain.flushinterval=86400000
220+
securitydomain.host=ocsp.example.com
221+
securitydomain.httpport=8080
222+
securitydomain.httpsadminport=8443
223+
securitydomain.name=example.com Security Domain
224+
securitydomain.select=new
225+
securitydomain.source=ldap
226+
EOF
227+
228+
docker exec ocsp pki-server ocsp-config-find | grep ^securitydomain. | sort | tee actual
229+
diff expected actual
230+
231+
# TODO: Fix pki securitydomain-show to work with standalone OCSP
232+
# docker exec ocsp pki securitydomain-show \
233+
# > >(tee stdout) 2> >(tee stderr >&2) || true
234+
235+
# standalone OCSP should return security domain info
236+
211237
- name: Check OCSP publishing in CA
212238
run: |
213239
# OCSP publishing should not be configured

‎.github/workflows/subca-basic-test.yml

+24
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,17 @@ jobs:
5656
-D pki_ds_url=ldap://rootds.example.com:3389 \
5757
-v
5858
59+
- name: Check root CA server status
60+
run: |
61+
docker exec root pki-server status | tee output
62+
63+
# root CA should be a domain manager
64+
echo "True" > expected
65+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
66+
diff expected actual
67+
68+
- name: Check root CA system certs
69+
run: |
5970
docker exec root pki-server cert-find
6071
6172
- name: Install banner in root container
@@ -91,6 +102,19 @@ jobs:
91102
-D pki_ds_url=ldap://subds.example.com:3389 \
92103
-v
93104
105+
- name: Check sub CA server status
106+
run: |
107+
docker exec subordinate pki-server status | tee output
108+
109+
# sub CA should not be a domain manager
110+
echo "False" > expected
111+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
112+
diff expected actual
113+
114+
- name: Check sub CA system certs
115+
run: |
116+
docker exec subordinate pki-server cert-find
117+
94118
- name: Install banner in subordinate container
95119
run: docker exec subordinate cp /usr/share/pki/server/examples/banner/banner.txt /etc/pki/pki-tomcat
96120

‎.github/workflows/tks-basic-test.yml

+14
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,20 @@ jobs:
6666
-D pki_ds_url=ldap://ds.example.com:3389 \
6767
-v
6868
69+
- name: Check TKS server status
70+
run: |
71+
docker exec pki pki-server status | tee output
72+
73+
# CA should be a domain manager, but TKS should not
74+
echo "True" > expected
75+
echo "False" >> expected
76+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
77+
diff expected actual
78+
79+
- name: Check TKS system certs
80+
run: |
81+
docker exec pki pki-server cert-find
82+
6983
- name: Check TKS audit signing cert
7084
run: |
7185
docker exec pki pki-server cert-export tks_audit_signing \

‎.github/workflows/tps-basic-test.yml

+16
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,22 @@ jobs:
8989
-D pki_enable_server_side_keygen=True \
9090
-v
9191
92+
- name: Check TPS server status
93+
run: |
94+
docker exec pki pki-server status | tee output
95+
96+
# CA should be a domain manager, but KRA, TKS, TPS should not
97+
echo "True" > expected
98+
echo "False" >> expected
99+
echo "False" >> expected
100+
echo "False" >> expected
101+
sed -n 's/^ *SD Manager: *\(.*\)$/\1/p' output > actual
102+
diff expected actual
103+
104+
- name: Check TPS system certs
105+
run: |
106+
docker exec pki pki-server cert-find
107+
92108
- name: Check TPS audit signing cert
93109
run: |
94110
docker exec pki pki-server cert-export tps_audit_signing \

0 commit comments

Comments
 (0)