Skip to content
This repository was archived by the owner on Jun 5, 2025. It is now read-only.

Commit 080671f

Browse files
marcos-albornozmarcos-albornoz
committed
Fixing the SSH Certificate support for VCertClient
1 parent 6313c29 commit 080671f

3 files changed

Lines changed: 188 additions & 3 deletions

File tree

‎src/main/java/com/venafi/vcert/sdk/connectors/tpp/Tpp.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,11 +93,11 @@ CertificateRetrieveResponse certificateRetrieve(
9393
@Headers({"Content-Type: application/json", "X-Venafi-Api-Key: {apiKey}"})
9494
TppSshCertRetrieveResponse retrieveSshCertificate(TppSshCertRetrieveRequest request, @Param("apiKey") String apiKey);
9595

96-
@RequestLine("GET /vedsdk/SSHCertificates/Template/Retrieve/PublicKeyData")
96+
@RequestLine("GET SSHCertificates/Template/Retrieve/PublicKeyData")
9797
@Headers({"Content-Type: text/plain"})
9898
Response retrieveSshCAPublicKeyData(@QueryMap Map<String, String> params);
9999

100-
@RequestLine("POST vedsdk/SSHCertificates/Template/Retrieve")
100+
@RequestLine("POST SSHCertificates/Template/Retrieve")
101101
@Headers({"Content-Type: application/json", "X-Venafi-Api-Key: {apiKey}"})
102102
TppSshCaTemplateResponse retrieveSshCATemplate(TppSshCaTemplateRequest request, @Param("apiKey") String apiKey);
103103

@@ -183,6 +183,10 @@ CertificateRetrieveResponse certificateRetrieveToken(
183183
@Headers({"Content-Type: application/json", "Authorization: {token}"})
184184
TppSshCertRetrieveResponse retrieveSshCertificateToken(TppSshCertRetrieveRequest request, @Param("token") String token);
185185

186+
@RequestLine("GET /vedsdk/SSHCertificates/Template/Retrieve/PublicKeyData")
187+
@Headers({"Content-Type: text/plain"})
188+
Response retrieveSshCAPublicKeyDataToken(@QueryMap Map<String, String> params);
189+
186190
@RequestLine("POST vedsdk/SSHCertificates/Template/Retrieve")
187191
@Headers({"Content-Type: application/json", "Authorization: {token}"})
188192
TppSshCaTemplateResponse retrieveSshCATemplateToken(TppSshCaTemplateRequest request, @Param("token") String token);

‎src/main/java/com/venafi/vcert/sdk/connectors/tpp/TppTokenConnector.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -629,7 +629,7 @@ String retrieveSshCAPublicKeyData(Map<String, String> params) throws VCertExcept
629629
String publicKeyData = null;
630630

631631
try {
632-
publicKeyData = CharStreams.toString(tpp.retrieveSshCAPublicKeyData(params).body().asReader());
632+
publicKeyData = CharStreams.toString(tpp.retrieveSshCAPublicKeyDataToken(params).body().asReader());
633633
} catch (Exception e) {
634634
throw new VCertException(e);
635635
}

‎src/test/java/com/venafi/vcert/sdk/connectors/tpp/TppConnectorATForSSH.java‎

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
package com.venafi.vcert.sdk.connectors.tpp;
2+
3+
import static org.junit.Assert.assertEquals;
4+
import static org.junit.Assert.assertNotNull;
5+
import static org.junit.Assert.assertNull;
6+
import static org.junit.Assert.assertTrue;
7+
8+
import java.security.Security;
9+
10+
import org.bouncycastle.jce.provider.BouncyCastleProvider;
11+
import org.junit.jupiter.api.BeforeEach;
12+
import org.junit.jupiter.api.DisplayName;
13+
import org.junit.jupiter.api.Tag;
14+
import org.junit.jupiter.api.Test;
15+
import org.junit.jupiter.api.TestInfo;
16+
17+
import com.sshtools.common.publickey.SshKeyPairGenerator;
18+
import com.sshtools.common.publickey.SshKeyUtils;
19+
import com.sshtools.common.ssh.components.SshKeyPair;
20+
import com.venafi.vcert.sdk.VCertException;
21+
import com.venafi.vcert.sdk.certificate.SshCaTemplateRequest;
22+
import com.venafi.vcert.sdk.certificate.SshCertRetrieveDetails;
23+
import com.venafi.vcert.sdk.certificate.SshCertificateRequest;
24+
import com.venafi.vcert.sdk.certificate.SshConfig;
25+
import com.venafi.vcert.sdk.endpoint.Authentication;
26+
27+
class TppConnectorATForSSH {
28+
29+
private TppConnector classUnderTest = new TppConnector(Tpp.connect(System.getenv("TPPURL")));
30+
31+
@BeforeEach
32+
void authenticate(TestInfo testInfo) throws VCertException {
33+
if(testInfo.getTags()!=null && !testInfo.getTags().contains("AuthenticationUnneeded")) {
34+
Security.addProvider(new BouncyCastleProvider());
35+
Authentication authentication = new Authentication()
36+
.user(System.getenv("TPPUSER"))
37+
.password(System.getenv("TPPPASSWORD"))
38+
.scope("ssh:manage");
39+
classUnderTest.authenticate(authentication);
40+
}
41+
}
42+
43+
@Test
44+
@DisplayName("TPP - Testing the requestSshCertificate() and retrieveSshCertificate() methods when KeyPair is provided")
45+
public void requestAndRetrieveSshCertificateWithKeyPairProvided() throws VCertException, Exception {
46+
47+
String keyId = TppTestUtils.getRandSshKeyId();
48+
49+
//getting an SSH Key Pair with a key size of 3072 bits
50+
SshKeyPair pair = SshKeyPairGenerator.generateKeyPair(SshKeyPairGenerator.SSH2_RSA, 3072);
51+
52+
//extracting the Public Key and adding the KeyId as comment, at the end of the Public Key
53+
//because TPP returns the Public Key on that way
54+
String publicKeyData = SshKeyUtils.getFormattedKey(pair.getPublicKey(), keyId);
55+
56+
//building an SshCertificateRequest
57+
SshCertificateRequest req = new SshCertificateRequest()
58+
.keyId( keyId )
59+
.validityPeriod("4h")
60+
.template(System.getenv("TPP_SSH_CA"))
61+
.publicKeyData(publicKeyData)
62+
.sourceAddresses(new String[]{"test.com"});
63+
64+
//requesting the SSH Certificate
65+
String pickUpID = classUnderTest.requestSshCertificate(req);
66+
67+
//setting the pickUp ID
68+
req.pickupID(pickUpID);
69+
70+
//retrieving the Cert and details
71+
SshCertRetrieveDetails sshCertRetrieveDetails = classUnderTest.retrieveSshCertificate(req);
72+
73+
assertEquals(publicKeyData, sshCertRetrieveDetails.publicKeyData());
74+
assertNotNull(sshCertRetrieveDetails.certificateData());
75+
76+
Long validityPeriodFromCert = Long.parseLong(sshCertRetrieveDetails.certificateDetails().validTo()) - Long.parseLong(sshCertRetrieveDetails.certificateDetails().validFrom());
77+
78+
assertEquals(14400L, validityPeriodFromCert.longValue());//4h
79+
}
80+
81+
@Test
82+
@DisplayName("TPP - Testing the requestSshCertificate() and retrieveSshCertificate() methods when the KeyPair is not provided and it will be generated by the Server")
83+
public void requestAndRetrieveSshCertificate() throws VCertException, Exception {
84+
85+
SshCertificateRequest req = new SshCertificateRequest()
86+
.keyId(TppTestUtils.getRandSshKeyId())
87+
.validityPeriod("4h")
88+
.template(System.getenv("TPP_SSH_CA"))
89+
.sourceAddresses(new String[]{"test.com"});
90+
91+
//requesting the SSH Certificate
92+
String pickUpID = classUnderTest.requestSshCertificate(req);
93+
94+
//setting the pickUp ID
95+
req.pickupID(pickUpID);
96+
//setting a passphrase to the KeyPair service generated
97+
req.privateKeyPassphrase("my-passphrase");
98+
99+
//retrieving the Cert and details
100+
SshCertRetrieveDetails sshCertRetrieveDetails = classUnderTest.retrieveSshCertificate(req);
101+
102+
assertNotNull(sshCertRetrieveDetails.certificateData());
103+
104+
//The following it should works correctly given that the passphrase is correct.
105+
SshKeyPair sshKeyPair = SshKeyUtils.getPrivateKey(sshCertRetrieveDetails.privateKeyData(), "my-passphrase");
106+
107+
assertNotNull(sshKeyPair);
108+
}
109+
110+
@Test
111+
@DisplayName("TPP - Testing the retrieveSshConfig() method using CA name")
112+
public void retrieveSshConfigFromCAName() throws VCertException, Exception {
113+
114+
SshCaTemplateRequest req = new SshCaTemplateRequest()
115+
.template(System.getenv("TPP_SSH_CA"));
116+
117+
//getting the sshConfig of the SSH Cert CA
118+
retrieveSshConfig(req);
119+
}
120+
121+
@Test
122+
@DisplayName("TPP - Testing the retrieveSshConfig() method using CADN")
123+
public void retrieveSshConfigFromCADN() throws VCertException, Exception {
124+
125+
SshCaTemplateRequest req = new SshCaTemplateRequest()
126+
.template(System.getenv("TPP_SSH_CADN"));
127+
128+
//getting the sshConfig of the SSH Cert CA
129+
retrieveSshConfig(req);
130+
}
131+
132+
private void retrieveSshConfig(SshCaTemplateRequest req) throws VCertException, Exception {
133+
134+
//getting the sshConfig of the SSH Cert CA
135+
SshConfig sshConfig = classUnderTest.retrieveSshConfig(req);
136+
137+
assertNotNull(sshConfig);
138+
assertNotNull(sshConfig.caPublicKey());
139+
assertTrue(!sshConfig.caPublicKey().isEmpty());
140+
assertNotNull(sshConfig.principals());
141+
assertTrue(sshConfig.principals().length>0);
142+
}
143+
144+
@Test
145+
@Tag("AuthenticationUnneeded")
146+
@DisplayName("TPP - Testing the retrieveSshConfig() method without authentication using CA name")
147+
public void retrieveSshConfigWithoutCredentialsFromCAName() throws VCertException, Exception {
148+
149+
//Given this test is tagged as AuthenticationUnneeded, then the Authentication will not be performed
150+
SshCaTemplateRequest req = new SshCaTemplateRequest()
151+
.template(System.getenv("TPP_SSH_CA"));
152+
153+
//getting the sshConfig of the SSH Cert CA
154+
retrieveSshConfigWithoutCredentials(req);
155+
}
156+
157+
@Test
158+
@Tag("AuthenticationUnneeded")
159+
@DisplayName("TPP - Testing the retrieveSshConfig() method without authentication using CADN")
160+
public void retrieveSshConfigWithoutCredentialsFromCADN() throws VCertException, Exception {
161+
162+
//Given this test is tagged as AuthenticationUnneeded, then the Authentication will not be performed
163+
SshCaTemplateRequest req = new SshCaTemplateRequest()
164+
.template(System.getenv("TPP_SSH_CADN"));
165+
166+
//getting the sshConfig of the SSH Cert CA
167+
retrieveSshConfigWithoutCredentials(req);
168+
}
169+
170+
private void retrieveSshConfigWithoutCredentials(SshCaTemplateRequest req) throws VCertException, Exception {
171+
172+
//getting the sshConfig of the SSH Cert CA
173+
SshConfig sshConfig = classUnderTest.retrieveSshConfig(req);
174+
175+
assertNotNull(sshConfig);
176+
assertNotNull(sshConfig.caPublicKey());
177+
assertTrue(!sshConfig.caPublicKey().isEmpty());
178+
//When the authentication is not provided, then the principals are not retrieved
179+
assertNull(sshConfig.principals());
180+
}
181+
}

0 commit comments

Comments
 (0)