f1ed12e2cf
Signing requests are expected to arrive at /v1/sign/<registration_authority> now. Virtual registration authority is a new concept which right now includes everything the original configuration included. That means for example each registration authority available within Anchor deployment can configure its own CA, auth, and validators. Clients request a specific registration authority via the URL. This does not mean they can just choose who signs the CSR - they still need to pass all checks. Only the guesswork of "which validation set applies to them" is gone because of this change. The previous concept of validator sets is gone. Each registration authority configures its own validators and all of them need to pass. Previous endpoint /sign will not work anymore. It's incompatible with the new design. The configuration file changes in the following way: 1. Registration authorities need to be defined in the main config. 2. Validator sets are not available anymore. 3. CA and auth settings at the top level need to be named. They can be referred to in the registration authority block. 4. Old names are removed. Any use of "auth", "ca", or "validators" at the top level will result in an error and explanation regarding the upgrade path. Further documentation and a sample config with the new layout can be found in the docs/configuration.rst file. Closes-bug: 1463752 Change-Id: I5a949e0c79a2d56eadadf5ece62bb8b8eea89e78
71 lines
2.3 KiB
Python
71 lines
2.3 KiB
Python
# -*- coding:utf-8 -*-
|
|
#
|
|
# Copyright 2014 Hewlett-Packard Development Company, L.P.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
|
|
import logging
|
|
|
|
# NOTE(tkelsey): by default Python 2.7 has no default logging handler
|
|
# this fixes the "No handler for logger ..." message spam
|
|
#
|
|
handler = logging.NullHandler()
|
|
logging.getLogger().addHandler(handler)
|
|
|
|
|
|
class DefaultConfigMixin(object):
|
|
"""Mixin for reuse in any test class which needs to load a config.
|
|
|
|
`sample_conf` is always a valid, no thrills configuration. It can be
|
|
reused in any test case. Constructing it in setUp() guarantees that it
|
|
can be changed without affecting other tests.
|
|
"""
|
|
|
|
def setUp(self):
|
|
self.sample_conf_auth = {
|
|
"default_auth": {
|
|
"backend": "static",
|
|
"user": "myusername",
|
|
"secret": "simplepassword"
|
|
}
|
|
}
|
|
self.sample_conf_ca = {
|
|
"default_ca": {
|
|
"cert_path": "tests/CA/root-ca.crt",
|
|
"key_path": "tests/CA/root-ca-unwrapped.key",
|
|
"output_path": "certs",
|
|
"signing_hash": "sha256",
|
|
"valid_hours": 24
|
|
}
|
|
}
|
|
self.sample_conf_validators = {
|
|
"common_name": {
|
|
"allowed_domains": [".test.com"]
|
|
}
|
|
}
|
|
self.sample_conf_ra = {
|
|
"default_ra": {
|
|
"authentication": "default_auth",
|
|
"signing_ca": "default_ca",
|
|
"validators": self.sample_conf_validators
|
|
}
|
|
}
|
|
self.sample_conf = {
|
|
"authentication": self.sample_conf_auth,
|
|
"signing_ca": self.sample_conf_ca,
|
|
"registration_authority": self.sample_conf_ra,
|
|
}
|
|
|
|
super(DefaultConfigMixin, self).setUp()
|