Implement UsernamePassword method

[hansjoachimknobloch]

And by the way:
Despite Microsoft saying otherwise in some parts of their documentation, Certificate authentication to CEP/CES doe not require message authentication but works with transport authentication using a TLS client certificate for HTTPS.

[dmulder]

This is not a good idea. I don't want AD passwords stored in a plain text file.

[hansjoachimknobloch]

I am not too fond of the idea either. However that concept was already in the part of the code for UsernamePassword authentication found in the master branch.

[dmulder]

Yeah, I didn't write that code ;-)
I think we could make this work with the creds stored in a keyring, if you want to pursue the idea.

[dmulder]

I don't think we should be implementing the username/password authentication, because this encourages users to place passwords in a plain-text file (at least the way it is currently written).
An alternative I'd consider is if we stored the creds in a keychain (such as using python keyring).

[dmulder]

@hansjoachimknobloch Maybe you could separate the UsernamePassword and Certificate auth methods into 2 different merge requests here. I'm ok with the Certificate auth.
Then we could continue to work through a potential solution for UsernamePassword auth.

[hansjoachimknobloch]

@dmulder What would you think about using a fitting certmonger getcert-request command-line parameter for transferring the AD password to cepces-submit as environment variable. "-L" might work.
However I do not yet know whether and if so, where, certmonger stores such passwords for certificate renewal.

[dmulder]

@dmulder What would you think about using a fitting certmonger getcert-request command-line parameter for transferring the AD password to cepces-submit as environment variable. "-L" might work. However I do not yet know whether and if so, where, certmonger stores such passwords for certificate renewal.

IIRC, you can list those later, so you would still be exposing the password.

[hansjoachimknobloch]

IIRC, you can list those later, so you would still be exposing the password.

Thinking about it twice, -L probably wouldn't even work the way I imagined because certmonger will incorprate the SCEP challenge password directly into the CSR and not even pass it to cepces-submit in a separate environment variable.

[dmulder]

@dmulder What would you think about using a fitting certmonger getcert-request command-line parameter for transferring the AD password to cepces-submit as environment variable. "-L" might work. However I do not yet know whether and if so, where, certmonger stores such passwords for certificate renewal.

We could provide a cepces-submit command line parameter, then overwrite the args to prevent seeing the password in a ps.