Hello

I can't find any unittests that actually download a certificate from LDAP via the userCertificate attribute, extract the public key and convert it to a ssh-rsa key.
The ssh-test only tests for public keys already in ssh format.

Are there any other ways than LDAP to "publish" a certificate to be used for ssh public key extraction?

If I missed the obvious, please point me in the right direction otherwise I will start by writing the test.


Den tors 29 okt. 2020 07:03Sumit Bose <sbose@redhat.com> skrev:
On Wed, Oct 28, 2020 at 07:44:31PM +0100, Per-Erik Persson wrote:
>I will come back with an example certificate that fails.
>This seems to be more complicated than I first anticipated.
>The same certificate is working on older code  based on the mozilla-nss
>libray.
>You could reject the patch.

Hi,

thanks for the explanation. We can use
https://github.com/SSSD/sssd/pull/5376 for further communication for the
time being.

It would be very helpful if you can share a certificate where the
conversion does not produce the same key as sshd would expect. Adding it
to the unit test would help to avoid similar issues in future.

bye,
Sumit

>
>Den ons 28 okt. 2020 10:24sumit-bose <
>sssd-github-notification@fedorahosted.org> skrev:
>
>>   URL: https://github.com/SSSD/sssd/pull/5376
>> Title: #5376: Update cert.c
>>
>> sumit-bose commented:
>> """
>> Hi,
>>
>> can you give a bit more details about the purpose of this pull request?
>> Currently the `0` is added unconditionally, do you have a case where this
>> does not work as expected?
>>
>> bye,
>> Sumit
>> """
>>
>> See the full comment at
>> https://github.com/SSSD/sssd/pull/5376#issuecomment-717807192
>> _______________________________________________
>> sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
>> To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org
>> Fedora Code of Conduct:
>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
>> https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org
>>

>_______________________________________________
>sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
>To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org
>Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>List Archives: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org
_______________________________________________
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org