mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-28 01:41:14 -06:00
32b1743e5f
Administrators need a way to retrieve the certificate or certificate chain of an IPA-managed lightweight CA. Add params to the `ca' object for carrying the CA certificate and chain (as multiple DER values). Add the `--chain' flag for including the chain in the result (chain is also included with `--all'). Add the `--certificate-out' option for writing the certificate to a file (or the chain, if `--chain' was given). Fixes: https://fedorahosted.org/freeipa/ticket/6178 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
54 lines
1.4 KiB
Python
54 lines
1.4 KiB
Python
#
|
|
# Copyright (C) 2016 FreeIPA Contributors see COPYING for license
|
|
#
|
|
|
|
import base64
|
|
from ipaclient.frontend import MethodOverride
|
|
from ipalib import util, x509, Str
|
|
from ipalib.plugable import Registry
|
|
from ipalib.text import _
|
|
|
|
register = Registry()
|
|
|
|
|
|
class WithCertOutArgs(MethodOverride):
|
|
|
|
takes_options = (
|
|
Str(
|
|
'certificate_out?',
|
|
doc=_('Write certificate (chain if --chain used) to file'),
|
|
include='cli',
|
|
cli_metavar='FILE',
|
|
),
|
|
)
|
|
|
|
def forward(self, *keys, **options):
|
|
filename = None
|
|
if 'certificate_out' in options:
|
|
filename = options.pop('certificate_out')
|
|
util.check_writable_file(filename)
|
|
|
|
result = super(WithCertOutArgs, self).forward(*keys, **options)
|
|
if filename:
|
|
def to_pem(x):
|
|
return x509.make_pem(x)
|
|
if options.get('chain', False):
|
|
ders = result['result']['certificate_chain']
|
|
data = '\n'.join(to_pem(base64.b64encode(der)) for der in ders)
|
|
else:
|
|
data = to_pem(result['result']['certificate'])
|
|
with open(filename, 'wb') as f:
|
|
f.write(data)
|
|
|
|
return result
|
|
|
|
|
|
@register(override=True, no_fail=True)
|
|
class ca_add(WithCertOutArgs):
|
|
pass
|
|
|
|
|
|
@register(override=True, no_fail=True)
|
|
class ca_show(WithCertOutArgs):
|
|
pass
|