Add est to pkispawn #4844

fmarco76 · 2024-09-06T15:11:33Z

This initial commit add est configuration for deployment in instance with existing CA.

Actually, several step are just skipped which could be required like creating initial users, reporting the status, etc....

The final installation is compliant with the page: https://github.com/dogtagpki/pki/blob/master/docs/installation/est/Installing_EST.md

edewata · 2024-09-09T16:21:53Z

I noticed that there are some database changes. I think we should provide a database upgrade procedure for someone who already has a CA from an older PKI version then upgrades to the new PKI version to add EST into their system.

edewata · 2024-09-09T16:28:04Z

About the /usr/local/libexec/estauthz, I'd suggest to include that file in the RPM so it will be installed when the RPM is installed instead of creating it in pkispawn since there's no guarantee that the user running pkispawn will have a permission to modify /usr/local/libexec. If the user wants to use a different script, they should be able to specify that in pkispawn config.

fmarco76 · 2024-09-09T17:16:43Z

About the /usr/local/libexec/estauthz, I'd suggest to include that file in the RPM so it will be installed when the RPM is installed instead of creating it in pkispawn since there's no guarantee that the user running pkispawn will have a permission to modify /usr/local/libexec. If the user wants to use a different script, they should be able to specify that in pkispawn config.

Actually, this path is not needed, it could be inside /usr/share/pki/est or some other place. However, including the file in rpm avoid problems with fapolicy which could require a rule to access generated files.

I have added a first CI test for this deployment but there are many items not working and requiring some thinking before to move on with this PR.

fmarco76 · 2024-09-17T15:33:38Z

@edewata after a lot of effort to make it works like other subsystem I gave up and make it more like ACME. There were too many missing features.
Now there is a problem with ACME standalone which I can look at while writing the EST standalone test. Not sure the relation with other problems.
Finally, I think we can merge the realm configuration between ACME and EST. They can use the same classes in server package but can be done later.

edewata

In general it looks good, but there is a change that broke one of the ACME tests, and I also have some minor comments. Feel free to update & merge.

Just FYI, I'm working on adding support for ACME removal using pkidestroy. I suppose EST removal will be similar.

edewata · 2024-09-17T18:39:25Z

.github/workflows/est-ds-realm-test.yml

+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ca-basic


The artifacts name should match the test name to prevent conflicts and to make it easier to find, but gathering and uploading the artifacts is actually optional since the previous steps are already displaying the important logs so feel free to remove it if you want.

edewata · 2024-09-17T18:50:48Z

base/server/etc/default.cfg

-    acme_realm_bind_password
-    acme_realm_password
+    est_realm_bind_password
+    est_realm_password
+    est_ca_password


I think we need to keep the acme_* params here since they are still used in configure_acme_realm(). If we want to merge the realm params for ACME & EST we probably should use something like pki_realm_* or maybe just realm_*.

This is a mistake moving between different implementations. Thanks!

edewata · 2024-09-17T18:51:57Z

base/server/python/pki/server/deployment/__init__.py

@@ -5376,15 +5376,135 @@ def spawn_acme(self):

        self.deploy_acme_webapp(subsystem)

+    def create_est_subsystem(self):
+        '''
+        See also pki-server acme-create.


Should be pki-server est-create.

edewata · 2024-09-17T18:56:07Z

base/est/shared/authorizer.conf

@@ -0,0 +1,2 @@
+class=org.dogtagpki.est.ExternalProcessRequestAuthorizer
+executable=/usr/local/libexec/estauthz


Is the path correct?

edewata · 2024-09-17T19:00:38Z

base/server/etc/default.cfg

+est_realm_users_dn=ou=people,dc=est,dc=pki,dc=example,dc=com
+est_realm_groups_dn=ou=groups,dc=est,dc=pki,dc=example,dc=com
+est_realm_statements=/usr/share/pki/est/conf/realm/statements.conf
+est_authorizer_exec_path=/usr/libexec/estauthz


The path in authorizer.conf is different.

BTW, the estauthz script looks more like a sample script instead of a general purpose tool. Would it be better to install it somewhere under /usr/share/pki/est instead of /usr/libexec?

Moved the script to /usr/share/pki/est/bin/estauthz and update all the references.

edewata · 2024-09-17T19:09:53Z

base/server/python/pki/server/deployment/__init__.py

+
+        else:
+            # otherwise, deploy the subsystem and wait until it starts
+            subsystem.enable(
                wait=True,
                max_wait=self.startup_timeout,
                timeout=self.request_timeout)


The self.instance.start() in the original code is actually needed by spawn_acme() to start the instance in case ACME is the only subsystem on the server. See the test for ACME on separate instance (it's currently failing). EST probably needs a similar code too later.

EST deployment is included in pkispwn. The installation does not perform all the steps done for CA and other subsystems so there is no security domain management and user administration. During the installation there is no DS or other DBs connection which has to be performed by the user before or after the installation.

sonarcloud · 2024-09-18T09:48:35Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

fmarco76 · 2024-09-18T11:15:31Z

@edewata Thanks!
I have update following your comments. It is not clear to me why the rpminspect is failing now. Actually, IIUC we have the byte code version set to 17 for compiling but the jvm required is 21 so I was expecting different behaviour before. We can investigate in separate PR.

edewata · 2024-09-18T13:27:49Z

Yeah, rpminspect is a new but unrelated issue.

fmarco76 force-pushed the EST_pkispawn branch from f61256e to dfb98e1 Compare September 6, 2024 15:13

fmarco76 force-pushed the EST_pkispawn branch 9 times, most recently from 1e5944c to e01ae7b Compare September 13, 2024 13:12

fmarco76 force-pushed the EST_pkispawn branch 7 times, most recently from a8ec1a7 to 2af054b Compare September 17, 2024 14:48

fmarco76 marked this pull request as ready for review September 17, 2024 15:29

fmarco76 requested a review from edewata September 17, 2024 15:29

edewata approved these changes Sep 17, 2024

View reviewed changes

fmarco76 force-pushed the EST_pkispawn branch 2 times, most recently from 2f46def to 3c77764 Compare September 18, 2024 08:52

fmarco76 force-pushed the EST_pkispawn branch from 3c77764 to 85a9a9a Compare September 18, 2024 09:37

fmarco76 merged commit 9dd4ea2 into dogtagpki:master Sep 18, 2024
151 of 159 checks passed

fmarco76 deleted the EST_pkispawn branch September 18, 2024 14:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add est to pkispawn #4844

Add est to pkispawn #4844

fmarco76 commented Sep 6, 2024

edewata commented Sep 9, 2024 •

edited

Loading

edewata commented Sep 9, 2024

fmarco76 commented Sep 9, 2024 •

edited

Loading

fmarco76 commented Sep 17, 2024

edewata left a comment

edewata Sep 17, 2024

edewata Sep 17, 2024

fmarco76 Sep 18, 2024 •

edited

Loading

edewata Sep 17, 2024

edewata Sep 17, 2024

edewata Sep 17, 2024

fmarco76 Sep 18, 2024

edewata Sep 17, 2024 •

edited

Loading

sonarcloud bot commented Sep 18, 2024

fmarco76 commented Sep 18, 2024

edewata commented Sep 18, 2024

		@@ -0,0 +1,2 @@
		class=org.dogtagpki.est.ExternalProcessRequestAuthorizer
		executable=/usr/local/libexec/estauthz

Add est to pkispawn #4844

Add est to pkispawn #4844

Conversation

fmarco76 commented Sep 6, 2024

edewata commented Sep 9, 2024 • edited Loading

edewata commented Sep 9, 2024

fmarco76 commented Sep 9, 2024 • edited Loading

fmarco76 commented Sep 17, 2024

edewata left a comment

Choose a reason for hiding this comment

edewata Sep 17, 2024

Choose a reason for hiding this comment

edewata Sep 17, 2024

Choose a reason for hiding this comment

fmarco76 Sep 18, 2024 • edited Loading

Choose a reason for hiding this comment

edewata Sep 17, 2024

Choose a reason for hiding this comment

edewata Sep 17, 2024

Choose a reason for hiding this comment

edewata Sep 17, 2024

Choose a reason for hiding this comment

fmarco76 Sep 18, 2024

Choose a reason for hiding this comment

edewata Sep 17, 2024 • edited Loading

Choose a reason for hiding this comment

sonarcloud bot commented Sep 18, 2024

Quality Gate passed

fmarco76 commented Sep 18, 2024

edewata commented Sep 18, 2024

edewata commented Sep 9, 2024 •

edited

Loading

fmarco76 commented Sep 9, 2024 •

edited

Loading

fmarco76 Sep 18, 2024 •

edited

Loading

edewata Sep 17, 2024 •

edited

Loading