You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@openwhisk.apache.org by ho...@apache.org on 2017/07/21 16:33:31 UTC
[incubator-openwhisk-cli] 02/04: Support client certificate on cli
and nginx (#2427)
This is an automated email from the ASF dual-hosted git repository.
houshengbo pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-openwhisk-cli.git
commit 407cda0d6c381a4ccc7166a9f41538ea9a44194c
Author: ningyougang <41...@qq.com>
AuthorDate: Wed Jul 19 20:01:23 2017 +0800
Support client certificate on cli and nginx (#2427)
In order to increase the security of auth, it is necessary to add client
certificate on cli and nginx. So user can use wsk -i property set --cert
openwhisk-client-cert.pem --key openwhisk-client-key.pem to pass client
certificate to nginx. If you don't want to use default client certificate
which system provides, you can create your own client certificate instead
of them.
---
.../whisk/core/cli/test/WskBasicUsageTests.scala | 47 +++++++++++++++++++++-
1 file changed, 45 insertions(+), 2 deletions(-)
diff --git a/tests/src/test/scala/whisk/core/cli/test/WskBasicUsageTests.scala b/tests/src/test/scala/whisk/core/cli/test/WskBasicUsageTests.scala
index 987d0ae..e32acf3 100644
--- a/tests/src/test/scala/whisk/core/cli/test/WskBasicUsageTests.scala
+++ b/tests/src/test/scala/whisk/core/cli/test/WskBasicUsageTests.scala
@@ -113,6 +113,41 @@ class WskBasicUsageTests
}
}
+ // If client certificate verification is off, should ingore run below tests.
+ if (!WhiskProperties.getProperty("whisk.ssl.client.verification").equals("off")){
+ it should "set valid cert key to get expected success result for client certificate verification" in {
+ val tmpwskprops = File.createTempFile("wskprops", ".tmp")
+ try {
+ val namespace = wsk.namespace.list().stdout.trim.split("\n").last
+ val env = Map("WSK_CONFIG_FILE" -> tmpwskprops.getAbsolutePath())
+ // Send request to https://<apihost>/api/v1/namespaces, wsk client passes client certificate to nginx, nginx will
+ // verify it by client ca's openwhisk-client-ca-cert.pem
+ val stdout = wsk.cli(Seq("property", "set", "-i", "--apihost", wskprops.apihost, "--auth", wskprops.authKey,
+ "--cert", wskprops.cert, "--key", wskprops.key, "--namespace", namespace), env = env).stdout
+ stdout should include(s"ok: client cert set")
+ stdout should include(s"ok: client key set")
+ stdout should include(s"ok: whisk auth set")
+ stdout should include(s"ok: whisk API host set to ${wskprops.apihost}")
+ stdout should include(s"ok: whisk namespace set to ${namespace}")
+ } finally {
+ tmpwskprops.delete()
+ }
+ }
+
+ it should "set invalid cert key to get expected exception result for client certificate verification" in {
+ val tmpwskprops = File.createTempFile("wskprops", ".tmp")
+ try {
+ val namespace = wsk.namespace.list().stdout.trim.split("\n").last
+ val env = Map("WSK_CONFIG_FILE" -> tmpwskprops.getAbsolutePath())
+ val thrown = the [Exception] thrownBy wsk.cli(Seq("property", "set", "-i", "--apihost", wskprops.apihost, "--auth", wskprops.authKey,
+ "--cert", "invalid-cert.pem", "--key", "invalid-key.pem", "--namespace", namespace), env = env)
+ thrown.getMessage should include ("cannot validate certificate")
+ } finally {
+ tmpwskprops.delete()
+ }
+ }
+ }
+
it should "ensure default namespace is used when a blank namespace is set" in {
val tmpwskprops = File.createTempFile("wskprops", ".tmp")
try {
@@ -170,15 +205,21 @@ class WskBasicUsageTests
it should "validate default property values" in {
val tmpwskprops = File.createTempFile("wskprops", ".tmp")
val env = Map("WSK_CONFIG_FILE" -> tmpwskprops.getAbsolutePath())
- val stdout = wsk.cli(Seq("property", "unset", "--auth", "--apihost", "--apiversion", "--namespace"), env = env).stdout
+ val stdout = wsk.cli(Seq("property", "unset", "--auth", "--cert", "--key", "--apihost", "--apiversion", "--namespace"), env = env).stdout
try {
stdout should include regex ("ok: whisk auth unset")
+ stdout should include regex ("ok: client cert unset")
+ stdout should include regex ("ok: client key unset")
stdout should include regex ("ok: whisk API host unset")
stdout should include regex ("ok: whisk API version unset")
stdout should include regex ("ok: whisk namespace unset")
wsk.cli(Seq("property", "get", "--auth"), env = env).
stdout should include regex ("""(?i)whisk auth\s*$""") // default = empty string
+ wsk.cli(Seq("property", "get", "--cert"), env = env).
+ stdout should include regex ("""(?i)client cert\s*$""") // default = empty string
+ wsk.cli(Seq("property", "get", "--key"), env = env).
+ stdout should include regex ("""(?i)client key\s*$""") // default = empty string
wsk.cli(Seq("property", "get", "--apihost"), env = env).
stdout should include regex ("""(?i)whisk API host\s*$""") // default = empty string
wsk.cli(Seq("property", "get", "--namespace"), env = env).
@@ -203,9 +244,11 @@ class WskBasicUsageTests
it should "set multiple property values with single command" in {
val tmpwskprops = File.createTempFile("wskprops", ".tmp")
val env = Map("WSK_CONFIG_FILE" -> tmpwskprops.getAbsolutePath())
- val stdout = wsk.cli(Seq("property", "set", "--auth", "testKey", "--apihost", "openwhisk.ng.bluemix.net", "--apiversion", "v1"), env = env).stdout
+ val stdout = wsk.cli(Seq("property", "set", "--auth", "testKey", "--cert", "cert.pem", "--key", "key.pem", "--apihost", "openwhisk.ng.bluemix.net", "--apiversion", "v1"), env = env).stdout
try {
stdout should include regex ("ok: whisk auth set")
+ stdout should include regex ("ok: client cert set")
+ stdout should include regex ("ok: client key set")
stdout should include regex ("ok: whisk API host set")
stdout should include regex ("ok: whisk API version set")
val fileContent = FileUtils.readFileToString(tmpwskprops)
--
To stop receiving notification emails like this one, please contact
"commits@openwhisk.apache.org" <co...@openwhisk.apache.org>.