ca-publishing-user-cert-test.yml

name: CA with user cert publishing

on: workflow_call

env:
  DB_IMAGE: ${{ vars.DB_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve PKI images
        uses: actions/cache@v4
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up DS container
        run: |
          tests/bin/ds-container-create.sh ds
        env:
          IMAGE: ${{ env.DB_IMAGE }}
          HOSTNAME: ds.example.com
          PASSWORD: Secret.123

      - name: Connect DS container to network
        run: docker network connect example ds --alias ds.example.com

      - name: Set up PKI container
        run: |
          tests/bin/runner-init.sh pki
        env:
          HOSTNAME: pki.example.com

      - name: Connect PKI container to network
        run: docker network connect example pki --alias pki.example.com

      - name: Install CA
        run: |
          docker exec pki pkispawn \
              -f /usr/share/pki/server/examples/installation/ca.cfg \
              -s CA \
              -D pki_ds_url=ldap://ds.example.com:3389 \
              -v

      - name: Prepare publishing subtree
        run: |
          docker exec -i pki ldapadd \
              -H ldap://ds.example.com:3389 \
              -x \
              -D "cn=Directory Manager" \
              -w Secret.123 << EOF
          dn: ou=people,dc=pki,dc=example,dc=com
          objectClass: organizationalUnit
          ou: people

          dn: uid=testuser1,ou=people,dc=pki,dc=example,dc=com
          objectClass: person
          objectClass: organizationalPerson
          objectClass: inetOrgPerson
          uid: testuser1
          cn: Test User 1
          sn: User 1

          dn: uid=testuser2,ou=people,dc=pki,dc=example,dc=com
          objectClass: person
          objectClass: organizationalPerson
          objectClass: inetOrgPerson
          uid: testuser2
          cn: Test User 2
          sn: User 2
          EOF

      - name: Configure user cert publishing
        run: |
          # configure LDAP connection
          docker exec pki pki-server ca-config-set ca.publish.ldappublish.enable true
          docker exec pki pki-server ca-config-set ca.publish.ldappublish.ldap.ldapauth.authtype BasicAuth
          docker exec pki pki-server ca-config-set ca.publish.ldappublish.ldap.ldapauth.bindDN "cn=Directory Manager"
          docker exec pki pki-server ca-config-set ca.publish.ldappublish.ldap.ldapauth.bindPWPrompt internaldb
          docker exec pki pki-server ca-config-set ca.publish.ldappublish.ldap.ldapconn.host ds.example.com
          docker exec pki pki-server ca-config-set ca.publish.ldappublish.ldap.ldapconn.port 3389
          docker exec pki pki-server ca-config-set ca.publish.ldappublish.ldap.ldapconn.secureConn false

          # configure LDAP-based user cert publisher
          docker exec pki pki-server ca-config-set ca.publish.publisher.instance.LdapUserCertPublisher.certAttr "userCertificate;binary"
          docker exec pki pki-server ca-config-set ca.publish.publisher.instance.LdapUserCertPublisher.pluginName LdapUserCertPublisher

          # configure user cert mapper
          docker exec pki pki-server ca-config-set ca.publish.mapper.instance.LdapUserCertMap.dnPattern "uid=\$subj.UID,ou=people,dc=pki,dc=example,dc=com"
          docker exec pki pki-server ca-config-set ca.publish.mapper.instance.LdapUserCertMap.pluginName LdapSimpleMap

          # configure user cert publishing rule
          docker exec pki pki-server ca-config-set ca.publish.rule.instance.LdapUserCertRule.enable true
          docker exec pki pki-server ca-config-set ca.publish.rule.instance.LdapUserCertRule.mapper LdapUserCertMap
          docker exec pki pki-server ca-config-set ca.publish.rule.instance.LdapUserCertRule.pluginName Rule
          docker exec pki pki-server ca-config-set ca.publish.rule.instance.LdapUserCertRule.predicate ""
          docker exec pki pki-server ca-config-set ca.publish.rule.instance.LdapUserCertRule.publisher LdapUserCertPublisher
          docker exec pki pki-server ca-config-set ca.publish.rule.instance.LdapUserCertRule.type certs

          # enable publishing
          docker exec pki pki-server ca-config-set ca.publish.enable true

      - name: Configure caUserCert profile
        run: |
          # set cert validity to 1 minute
          VALIDITY_DEFAULT="policyset.userCertSet.2.default.params"
          docker exec pki sed -i \
              -e "s/^$VALIDITY_DEFAULT.range=.*$/$VALIDITY_DEFAULT.range=1/" \
              -e "/^$VALIDITY_DEFAULT.range=.*$/a $VALIDITY_DEFAULT.rangeUnit=minute" \
              /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caUserCert.cfg

          # check updated profile
          docker exec pki cat /var/lib/pki/pki-tomcat/conf/ca/profiles/ca/caUserCert.cfg

      - name: Configure cert status update task
        run: |
          # configure task to run every minute
          docker exec pki pki-server ca-config-set ca.certStatusUpdateInterval 60

      - name: Configure unpublish expired job to run automatically
        run: |
          # configure job to run every minute
          docker exec pki pki-server ca-config-set jobsScheduler.enabled true
          docker exec pki pki-server ca-config-set jobsScheduler.job.unpublishExpiredCerts.cron "* * * * *"
          docker exec pki pki-server ca-config-set jobsScheduler.job.unpublishExpiredCerts.enabled true
          docker exec pki pki-server ca-config-set jobsScheduler.job.unpublishExpiredCerts.summary.enabled false

      - name: Restart CA subsystem
        run: |
          docker exec pki pki-server ca-redeploy --wait

      - name: Check CA admin
        run: |
          docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec pki pki pkcs12-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password Secret.123
          docker exec pki pki -n caadmin ca-user-show caadmin

      - name: Check user 1 before enrollment
        run: |
          docker exec pki ldapsearch \
              -H ldap://ds.example.com:3389 \
              -x \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -b "uid=testuser1,ou=people,dc=pki,dc=example,dc=com" \
              -o ldif_wrap=no \
              -t | tee output

          # there should be no cert attributes
          grep "userCertificate;binary:" output | wc -l > actual
          echo "0" > expected
          diff expected actual

      - name: Enroll user 1 cert
        run: |
          docker exec pki pki client-cert-request uid=testuser1 | tee output

          REQUEST_ID=$(sed -n -e 's/^ *Request ID: *\(.*\)$/\1/p' output)
          echo "REQUEST_ID: $REQUEST_ID"

          docker exec pki pki -n caadmin ca-cert-request-approve $REQUEST_ID --force | tee output
          CERT_ID=$(sed -n -e 's/^ *Certificate ID: *\(.*\)$/\1/p' output)
          echo "CERT_ID: $CERT_ID"
          echo $CERT_ID > cert.id

          docker exec pki pki ca-cert-show $CERT_ID | tee output

          # cert should be valid
          sed -n "s/^ *Status: \(.*\)$/\1/p" output > actual
          echo "VALID" > expected
          diff expected actual

      - name: Check user 1 after enrollment
        run: |
          docker exec pki ldapsearch \
              -H ldap://ds.example.com:3389 \
              -x \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -b "uid=testuser1,ou=people,dc=pki,dc=example,dc=com" \
              -o ldif_wrap=no \
              -t | tee output

          # there should be one cert attribute
          grep "userCertificate;binary:" output | wc -l > actual
          echo "1" > expected
          diff expected actual

          FILENAME=$(sed -n 's/userCertificate;binary:< file:\/\/\(.*\)$/\1/p' output)
          echo "FILENAME: $FILENAME"

          # check the cert
          docker exec pki openssl x509 \
              -in "$FILENAME" \
              -inform DER \
              -text -noout

      - name: Revoke user 1 cert
        run: |
          CERT_ID=$(cat cert.id)
          docker exec pki pki -n caadmin ca-cert-hold $CERT_ID --force

          docker exec pki pki ca-cert-show $CERT_ID | tee output

          # cert should be revoked
          sed -n "s/^ *Status: \(.*\)$/\1/p" output > actual
          echo "REVOKED" > expected
          diff expected actual

      - name: Check user 1 after revocation
        run: |
          docker exec pki ldapsearch \
              -H ldap://ds.example.com:3389 \
              -x \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -b "uid=testuser1,ou=people,dc=pki,dc=example,dc=com" \
              -o ldif_wrap=no \
              -t | tee output

          # there should be no cert attributes
          grep "userCertificate;binary:" output | wc -l > actual
          echo "0" > expected
          diff expected actual

      - name: Unrevoke user 1 cert
        run: |
          CERT_ID=$(cat cert.id)
          docker exec pki pki -n caadmin ca-cert-release-hold $CERT_ID --force

          docker exec pki pki ca-cert-show $CERT_ID | tee output

          # cert should be valid again
          sed -n "s/^ *Status: \(.*\)$/\1/p" output > actual
          echo "VALID" > expected
          diff expected actual

      - name: Check user 1 after unrevocation
        run: |
          docker exec pki ldapsearch \
              -H ldap://ds.example.com:3389 \
              -x \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -b "uid=testuser1,ou=people,dc=pki,dc=example,dc=com" \
              -o ldif_wrap=no \
              -t | tee output

          # there should be one cert attribute
          grep "userCertificate;binary:" output | wc -l > actual
          echo "1" > expected
          diff expected actual

          FILENAME=$(sed -n 's/userCertificate;binary:< file:\/\/\(.*\)$/\1/p' output)
          echo "FILENAME: $FILENAME"

          # check the cert
          docker exec pki openssl x509 \
              -in "$FILENAME" \
              -inform DER \
              -text -noout

      - name: Wait for user 1 cert expiration
        run: |
          sleep 120

          CERT_ID=$(cat cert.id)
          docker exec pki pki ca-cert-show $CERT_ID | tee output

          # cert should be expired
          sed -n "s/^ *Status: \(.*\)$/\1/p" output > actual
          echo "EXPIRED" > expected
          diff expected actual

      - name: Check user 1 after expiration
        run: |
          docker exec pki ldapsearch \
              -H ldap://ds.example.com:3389 \
              -x \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -b "uid=testuser1,ou=people,dc=pki,dc=example,dc=com" \
              -o ldif_wrap=no \
              -t | tee output

          # there should be no cert attributes
          grep "userCertificate;binary:" output | wc -l > actual
          echo "0" > expected
          diff expected actual

      - name: Configure unpublish expired job to run manually
        run: |
          docker exec pki pki-server ca-config-unset jobsScheduler.job.unpublishExpiredCerts.cron

      - name: Restart CA subsystem
        run: |
          docker exec pki pki-server ca-redeploy --wait

      - name: Check user 2 before enrollment
        run: |
          docker exec pki ldapsearch \
              -H ldap://ds.example.com:3389 \
              -x \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -b "uid=testuser2,ou=people,dc=pki,dc=example,dc=com" \
              -o ldif_wrap=no \
              -t | tee output

          # there should be no cert attributes
          grep "userCertificate;binary:" output | wc -l > actual
          echo "0" > expected
          diff expected actual

      - name: Enroll user 2 cert
        run: |
          docker exec pki pki client-cert-request uid=testuser2 | tee output

          REQUEST_ID=$(sed -n -e 's/^ *Request ID: *\(.*\)$/\1/p' output)
          echo "REQUEST_ID: $REQUEST_ID"

          docker exec pki pki -n caadmin ca-cert-request-approve $REQUEST_ID --force | tee output
          CERT_ID=$(sed -n -e 's/^ *Certificate ID: *\(.*\)$/\1/p' output)
          echo "CERT_ID: $CERT_ID"
          echo $CERT_ID > cert.id

          docker exec pki pki ca-cert-show $CERT_ID | tee output

          # cert should be valid
          sed -n "s/^ *Status: \(.*\)$/\1/p" output > actual
          echo "VALID" > expected
          diff expected actual

      - name: Check user 2 after enrollment
        run: |
          docker exec pki ldapsearch \
              -H ldap://ds.example.com:3389 \
              -x \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -b "uid=testuser2,ou=people,dc=pki,dc=example,dc=com" \
              -o ldif_wrap=no \
              -t | tee output

          # there should be one cert attribute
          grep "userCertificate;binary:" output | wc -l > actual
          echo "1" > expected
          diff expected actual

          FILENAME=$(sed -n 's/userCertificate;binary:< file:\/\/\(.*\)$/\1/p' output)
          echo "FILENAME: $FILENAME"

          # check the cert
          docker exec pki openssl x509 \
              -in "$FILENAME" \
              -inform DER \
              -text -noout

      - name: Wait for user 2 cert expiration
        run: |
          sleep 120

          CERT_ID=$(cat cert.id)
          docker exec pki pki ca-cert-show $CERT_ID | tee output

          # cert should be expired
          sed -n "s/^ *Status: \(.*\)$/\1/p" output > actual
          echo "EXPIRED" > expected
          diff expected actual

      - name: Check user 2 after expiration
        run: |
          docker exec pki ldapsearch \
              -H ldap://ds.example.com:3389 \
              -x \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -b "uid=testuser2,ou=people,dc=pki,dc=example,dc=com" \
              -o ldif_wrap=no \
              -t | tee output

          # there should still be one cert attribute
          grep "userCertificate;binary:" output | wc -l > actual
          echo "1" > expected
          diff expected actual

          FILENAME=$(sed -n 's/userCertificate;binary:< file:\/\/\(.*\)$/\1/p' output)
          echo "FILENAME: $FILENAME"

          # check the cert
          docker exec pki openssl x509 \
              -in "$FILENAME" \
              -inform DER \
              -text -noout

      - name: Run unpublish job manually
        run: |
          docker exec pki pki -n caadmin ca-job-start unpublishExpiredCerts

      - name: Check user 2 after manual execution
        run: |
          sleep 10

          docker exec pki ldapsearch \
              -H ldap://ds.example.com:3389 \
              -x \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -b "uid=testuser2,ou=people,dc=pki,dc=example,dc=com" \
              -o ldif_wrap=no \
              -t | tee output

          # there should be no cert attributes
          grep "userCertificate;binary:" output | wc -l > actual
          echo "0" > expected
          diff expected actual

      - name: Remove CA
        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

      - name: Check PKI server systemd journal
        if: always()
        run: |
          docker exec pki journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check CA debug log
        if: always()
        run: |
          docker exec pki find /var/lib/pki/pki-tomcat/logs/ca -name "debug.*" -exec cat {} \;

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh ds
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ca-publishing-user-cert
          path: /tmp/artifacts