URL:
https://github.com/SSSD/sssd/pull/198
Author: pbrezina
Title: #198: secrets: support https in proxy provider
Action: edited
Changed field: body
Original value:
"""
I had to switch to libcurl as a client in order to communicate properly over HTTPS
protocol.
I added several new options that are necessary to initialize SSL (which certificates
should
be used and whether to check hostname in server's certificate or not).
* Example SSSD configuration:
```
[secrets]
debug_level = 0x3ff0
[secrets/users/10001]
provider = proxy
proxy_url =
https://custodia.pb:10443/secrets
auth_type = header
auth_header_name = REMOTE_USER
auth_header_value = mysecretkey
cacert = /home/pbrezina/Downloads/cer/custodia-ca.pem
cert = /home/pbrezina/Downloads/cer/custodia-client.pem
key = /home/pbrezina/Downloads/cer/custodia-client.key
verify_host = false
```
* Example custodia configuration (just modify default configuration, keeping the rest
options intact):
```
[global]
server_version = "Secret/0.0.7"
debug = True
server_url =
https://0.0.0.0:10443
tls_certfile = tests/ca/custodia-server.pem
tls_keyfile = tests/ca/custodia-server.key
tls_cafile = tests/ca/custodia-ca.pem
tls_verify_client = true
umask = 027
[auth:header]
handler = SimpleHeaderAuth
header = REMOTE_USER
value = mysecretkey
[authz:paths]
handler = SimplePathAuthz
paths = /.
```
* Download certificates and key to your client and you can use it like this
```shell
curl -v -H "Content-Type: application/json" -H "REMOTE_USER:
mysecretkey" --unix-socket /var/run/secrets.socket -X POST
http://localhost/secrets/mysecretkey/
curl -v -H "Content-Type: application/json" -H "REMOTE_USER:
mysecretkey" --unix-socket /var/run/secrets.socket -X PUT
http://localhost/secrets/mysecretkey/foo
-d'{"type":"simple","value":"foosecret"}'
curl -v -H "Content-Type: application/json" -H "REMOTE_USER:
mysecretkey" --unix-socket /var/run/secrets.socket -X POST
http://localhost/secrets/mysecretkey/foo
curl -v -H "Content-Type: application/json" -H "REMOTE_USER:
mysecretkey" --unix-socket /var/run/secrets.socket -X DELETE
http://localhost/secrets/mysecretkey/foo
curl -v -H "Content-Type: application/json" -H "REMOTE_USER:
mysecretkey" --unix-socket /var/run/secrets.socket -X DELETE
http://localhost/secrets/mysecretkey/
```
"""