subca-lightweight-test.yml

name: Lightweight CA

on: workflow_call

env:
  DB_IMAGE: ${{ vars.DB_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  # docs/installation/ca/Installing_CA.md
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v3

      - name: Retrieve PKI images
        uses: actions/cache@v3
        with:
          key: pki-images-${{ github.sha }}
          path: pki-images.tar

      - name: Load PKI images
        run: docker load --input pki-images.tar

      - name: Create network
        run: docker network create example

      - name: Set up DS container
        run: |
          tests/bin/ds-container-create.sh ds
        env:
          IMAGE: ${{ env.DB_IMAGE }}
          HOSTNAME: ds.example.com
          PASSWORD: Secret.123

      - name: Connect DS container to network
        run: docker network connect example ds --alias ds.example.com

      - name: Set up PKI container
        run: |
          tests/bin/runner-init.sh pki
        env:
          HOSTNAME: pki.example.com

      - name: Connect PKI container to network
        run: docker network connect example pki --alias pki.example.com

      - name: Install CA
        run: |
          docker exec pki pkispawn \
              -f /usr/share/pki/server/examples/installation/ca.cfg \
              -s CA \
              -D pki_ds_url=ldap://ds.example.com:3389 \
              -v

      - name: Check admin user
        run: |
          docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec pki pki pkcs12-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password Secret.123
          docker exec pki pki -n caadmin ca-user-show caadmin

      - name: Check host CA
        run: |
          docker exec pki pki -n caadmin ca-authority-find | tee output

          # there should be 1 authority initially
          echo "1" > expected
          sed -n 's/^\s*ID:\s*\(.*\)$/\1/p' output | wc -l > actual
          diff expected actual

          # it should be a host CA
          echo "true" > expected
          sed -n 's/^\s*Host authority:\s*\(.*\)$/\1/p' output > actual
          diff expected actual

          # store host CA ID
          sed -n 's/^\s*ID:\s*\(.*\)$/\1/p' output > hostca-id

      - name: Check host CA's LDAP entry
        run: |
          HOSTCA_ID=$(cat hostca-id)

          docker exec pki ldapsearch \
              -H ldap://ds.example.com:3389 \
              -x \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -b "cn=$HOSTCA_ID,ou=authorities,ou=ca,dc=ca,dc=pki,dc=example,dc=com" \
              -o ldif_wrap=no \
              -LLL \
              "(objectClass=*)" | tee output

          # check authorityKeyNickname
          echo "ca_signing" > expected
          sed -n 's/^authorityKeyNickname:\s*\(.*\)$/\1/p' output > actual
          diff expected actual

      - name: Check certs and keys in NSS database
        run: |
          docker exec pki pki \
              -d /etc/pki/pki-tomcat/alias \
              -f /etc/pki/pki-tomcat/password.conf \
              nss-cert-find | tee output

          # there should be 5 certs
          echo "5" > expected
          sed -n 's/^\s*Nickname:\s*\(.*\)$/\1/p' output | wc -l > actual
          diff expected actual

          docker exec pki pki \
              -d /etc/pki/pki-tomcat/alias \
              -f /etc/pki/pki-tomcat/password.conf \
              nss-key-find | tee output

          # there should be 5 keys
          echo "5" > expected
          sed -n 's/^\s*Key ID:\s*\(.*\)$/\1/p' output | wc -l > actual
          diff expected actual

      - name: Create lightweight CA
        run: |
          HOSTCA_ID=$(cat hostca-id)

          # create a LWCA under the host CA
          docker exec pki pki -n caadmin ca-authority-create \
              --parent $HOSTCA_ID \
              CN="Lightweight CA" | tee output

          # store LWCA ID
          sed -n 's/^\s*ID:\s*\(.*\)$/\1/p' output > lwca-id

          docker exec pki pki -n caadmin ca-authority-find | tee output

          # there should be 2 authorities now
          echo "2" > expected
          sed -n 's/^\s*ID:\s*\(.*\)$/\1/p' output | wc -l > actual
          diff expected actual

      - name: Check lightweight CA's LDAP entry
        run: |
          LWCA_ID=$(cat lwca-id)

          docker exec pki ldapsearch \
              -H ldap://ds.example.com:3389 \
              -x \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -b "cn=$LWCA_ID,ou=authorities,ou=ca,dc=ca,dc=pki,dc=example,dc=com" \
              -o ldif_wrap=no \
              -LLL \
              "(objectClass=*)" | tee output

          # check authorityKeyNickname
          echo "ca_signing $LWCA_ID" > expected
          sed -n 's/^authorityKeyNickname:\s*\(.*\)$/\1/p' output > actual
          diff expected actual

      - name: Check certs and keys in NSS database
        run: |
          docker exec pki pki \
              -d /etc/pki/pki-tomcat/alias \
              -f /etc/pki/pki-tomcat/password.conf \
              nss-cert-find | tee output

          # there should be 6 certs now
          echo "6" > expected
          sed -n 's/^\s*Nickname:\s*\(.*\)$/\1/p' output | wc -l > actual
          diff expected actual

          docker exec pki pki \
              -d /etc/pki/pki-tomcat/alias \
              -f /etc/pki/pki-tomcat/password.conf \
              nss-key-find | tee output

          # there should be 6 keys now
          echo "6" > expected
          sed -n 's/^\s*Key ID:\s*\(.*\)$/\1/p' output | wc -l > actual
          diff expected actual

      - name: Check enrollment against lightweight CA
        run: |
          LWCA_ID=$(cat lwca-id)

          # submit enrollment request against LWCA
          docker exec pki pki client-cert-request \
              --issuer-id $LWCA_ID \
              UID=testuser | tee output

          # get request ID
          REQUEST_ID=$(sed -n -e 's/^\s*Request ID:\s*\(.*\)$/\1/p' output)

          # approve request
          docker exec pki pki \
              -n caadmin \
              ca-cert-request-approve \
              $REQUEST_ID \
              --force | tee output

          # get cert ID
          CERT_ID=$(sed -n -e 's/^\s*Certificate ID:\s*\(.*\)$/\1/p' output)

          docker exec pki pki ca-cert-show $CERT_ID | tee output

          # verify that it's signed by LWCA
          echo "CN=Lightweight CA" > expected
          sed -n -e 's/^\s*Issuer DN:\s*\(.*\)$/\1/p' output > actual
          diff expected actual

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh --output=/tmp/artifacts/pki ds
          tests/bin/pki-artifacts-save.sh pki
        continue-on-error: true

      - name: Remove CA
        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: ca-lightweight
          path: |
            /tmp/artifacts/pki