On Sun, Nov 01, 2020 at 09:38:57PM +0100, Per-Erik Persson wrote:
Hello
I can't find any unittests that actually download a certificate from LDAP
via the userCertificate attribute, extract the public key and convert it to
a ssh-rsa key.
The ssh-test only tests for public keys already in ssh format.
Are there any other ways than LDAP to "publish" a certificate to be used
for ssh public key extraction?
If I missed the obvious, please point me in the right direction otherwise I
will start by writing the test.
Hi,
you can find tests which extract ssh keys from certificates e.g. in
test_ssh_user_pubkey_cert(), test_ssh_user_pubkey_cert_with_rule() and
the following tests in src/tests/cmocka/test_ssh_srv.c.
HTH
bye,
Sumit
Den tors 29 okt. 2020 07:03Sumit Bose <sbose(a)redhat.com> skrev:
> On Wed, Oct 28, 2020 at 07:44:31PM +0100, Per-Erik Persson wrote:
> >I will come back with an example certificate that fails.
> >This seems to be more complicated than I first anticipated.
> >The same certificate is working on older code based on the mozilla-nss
> >libray.
> >You could reject the patch.
>
> Hi,
>
> thanks for the explanation. We can use
>
https://github.com/SSSD/sssd/pull/5376 for further communication for the
> time being.
>
> It would be very helpful if you can share a certificate where the
> conversion does not produce the same key as sshd would expect. Adding it
> to the unit test would help to avoid similar issues in future.
>
> bye,
> Sumit
>
> >
> >Den ons 28 okt. 2020 10:24sumit-bose <
> >sssd-github-notification(a)fedorahosted.org> skrev:
> >
> >> URL:
https://github.com/SSSD/sssd/pull/5376
> >> Title: #5376: Update cert.c
> >>
> >> sumit-bose commented:
> >> """
> >> Hi,
> >>
> >> can you give a bit more details about the purpose of this pull request?
> >> Currently the `0` is added unconditionally, do you have a case where
> this
> >> does not work as expected?
> >>
> >> bye,
> >> Sumit
> >> """
> >>
> >> See the full comment at
> >>
https://github.com/SSSD/sssd/pull/5376#issuecomment-717807192
> >> _______________________________________________
> >> sssd-devel mailing list -- sssd-devel(a)lists.fedorahosted.org
> >> To unsubscribe send an email to sssd-devel-leave(a)lists.fedorahosted.org
> >> Fedora Code of Conduct:
> >>
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> >> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> >> List Archives:
> >>
>
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahoste...
> >>
>
> >_______________________________________________
> >sssd-devel mailing list -- sssd-devel(a)lists.fedorahosted.org
> >To unsubscribe send an email to sssd-devel-leave(a)lists.fedorahosted.org
> >Fedora Code of Conduct:
>
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> >List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> >List Archives:
>
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahoste...
> _______________________________________________
> sssd-devel mailing list -- sssd-devel(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-devel-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
>
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
>
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahoste...
>
_______________________________________________
sssd-devel mailing list -- sssd-devel(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahoste...