certmonger: finish refactoring for request script

The recent certificate refactoring assures that ipaldap operations
are able to work with IPACertificate values when communication with
the LDAP server. Use these capabilities and prevent possible bugs.

https://pagure.io/freeipa/issue/4985

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
This commit is contained in:
Stanislav Laznicka 2017-08-16 15:07:28 +02:00 committed by Pavel Vomacka
parent 32be3ef622
commit 0412625a2b

View File

@ -281,8 +281,7 @@ def store_cert(**kwargs):
cert = os.environ.get('CERTMONGER_CERTIFICATE')
if not cert:
return (REJECTED, "New certificate requests not supported")
cert = x509.load_pem_x509_certificate(fix_pem(cert))
dercert = cert.public_bytes(x509.Encoding.DER)
cert = x509.load_pem_x509_certificate(fix_pem(cert.encode('ascii')))
dn = DN(('cn', nickname), ('cn', 'ca_renewal'),
('cn', 'ipa'), ('cn', 'etc'), api.env.basedn)
@ -290,14 +289,14 @@ def store_cert(**kwargs):
with ldap_connect() as conn:
try:
entry = conn.get_entry(dn, ['usercertificate'])
entry['usercertificate'] = [dercert]
entry['usercertificate'] = [cert]
conn.update_entry(entry)
except errors.NotFound:
entry = conn.make_entry(
dn,
objectclass=['top', 'pkiuser', 'nscontainer'],
cn=[nickname],
usercertificate=[dercert])
usercertificate=[cert])
conn.add_entry(entry)
except errors.EmptyModlist:
pass
@ -394,8 +393,7 @@ def retrieve_or_reuse_cert(**kwargs):
except errors.NotFound:
pass
else:
cert = x509.load_der_x509_certificate(
entry.single_value['usercertificate'])
cert = entry.single_value['usercertificate']
return (ISSUED, cert.public_bytes(x509.Encoding.PEM))