openstack/barbican
Code Issues Proposed changes

Changes to Preferred CA Features

Browse Source 
This commit contains the following updates related to preferred CAs

- GET /cas/preferred/ and GET /cas/global-preferred/ now return
  a ca_ref, instead of the CA object
- Functional tests are updated to receive that ref
- Update the functional tests to reset state with regards to preferred
  and project CAs (each test cleans up after self)
- Unskip tests that now pass
- Remove test case that incorrectly represented behavior of /preferred/
- Use hard delete instead of soft delete for preferred CAs

Partially-implements: blueprint add-cas
Change-Id: Ie3beb5c2bd7583626c1ffac088386b1a4d3dbb19
This commit is contained in:
Dave McCowan
2015-09-21 16:12:00 -04:00
parent 9646c5aa96
commit 9c17680bd6
8 changed files with 72 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
barbican/api/controllers/cas.py
+11 -6
View File
@@ -413,8 +413,10 @@ class CertificateAuthoritiesController(controllers.ACLMixin):
if not pref_ca:
pecan.abort(404, u._("No global preferred CA defined"))
ca = self.ca_repo.get(entity_id=pref_ca.ca_id)
return ca.to_dict_fields()
return {
'ca_ref':
hrefs.convert_certificate_authority_to_href(pref_ca.ca_id)
}
@pecan.expose()
@utils.allow_all_content_types
@@ -442,12 +444,15 @@ class CertificateAuthoritiesController(controllers.ACLMixin):
project = res.get_or_create_project(external_project_id)
pref_ca = self.preferred_ca_repo.get_project_entities(project.id)
if not pref_ca:
pref_cas = self.preferred_ca_repo.get_project_entities(project.id)
if not pref_cas:
pecan.abort(404, u._("No preferred CA defined for this project"))
ca = self.ca_repo.get(entity_id=pref_ca[0].ca_id)
return ca.to_dict_fields()
ca = pref_cas[0]
return {
'ca_ref':
hrefs.convert_certificate_authority_to_href(ca.ca_id)
}
@index.when(method='POST', template='json')
@controllers.handle_exceptions(u._('CA creation'))
barbican/model/models.py
+1 -1
View File
@@ -935,7 +935,7 @@ class CertificateAuthorityMetadatum(BASE, ModelBase):
}
class ProjectCertificateAuthority(BASE, SoftDeleteMixIn, ModelBase):
class ProjectCertificateAuthority(BASE, ModelBase):
"""Stores CAs available for a project.
Admins can define a set of CAs that are available for use in a particular
barbican/model/repositories.py
+6 -2
View File
@@ -1571,7 +1571,11 @@ class CertificateAuthorityMetadatumRepo(BaseRepo):
class ProjectCertificateAuthorityRepo(BaseRepo):
"""Repository for the ProjectCertificateAuthority entity."""
"""Repository for the ProjectCertificateAuthority entity.
ProjectCertificateAuthority entries are not soft delete. So there is no
need to have deleted=False filter in queries.
"""
def get_by_create_date(self, offset_arg=None, limit_arg=None,
project_id=None, ca_id=None,
@@ -1631,7 +1635,7 @@ class ProjectCertificateAuthorityRepo(BaseRepo):
:param session: existing db session reference.
"""
return session.query(models.ProjectCertificateAuthority).filter_by(
project_id=project_id).filter_by(deleted=False)
project_id=project_id)
class PreferredCertificateAuthorityRepo(BaseRepo):
barbican/tests/api/controllers/test_cas.py
+8 -8
View File
@@ -175,10 +175,10 @@ class WhenTestingCAsResource(utils.BarbicanAPIBaseTestCase):
self.create_cas()
resp = self.app.get('/cas/global-preferred')
self.assertEqual(self.global_preferred_ca.id,
resp.namespace['ca_id'])
self.assertEqual(self.global_preferred_ca.plugin_ca_id,
resp.namespace['plugin_ca_id'])
self.assertEqual(
hrefs.convert_certificate_authority_to_href(
self.global_preferred_ca.id),
resp.namespace['ca_ref'])
def test_should_get_no_global_preferred_ca(self):
resp = self.app.get('/cas/global-preferred', expect_errors=True)
@@ -193,10 +193,10 @@ class WhenTestingCAsResource(utils.BarbicanAPIBaseTestCase):
def test_should_get_preferred_ca(self):
self.create_cas()
resp = self.app.get('/cas/preferred')
self.assertEqual(self.preferred_ca.id,
resp.namespace['ca_id'])
self.assertEqual(self.preferred_ca.plugin_ca_id,
resp.namespace['plugin_ca_id'])
self.assertEqual(
hrefs.convert_certificate_authority_to_href(
self.preferred_ca.id),
resp.namespace['ca_ref'])
def test_should_get_ca(self):
self.create_cas()
functionaltests/api/v1/behaviors/ca_behaviors.py
+4 -2
View File
@@ -150,10 +150,11 @@ class CABehaviors(base_behaviors.BaseBehaviors):
def get_preferred(self, extra_headers=None, use_auth=True,
user_name=None):
return self.client.get('cas/preferred',
resp = self.client.get('cas/preferred',
response_model_type=ca_models.CAModel,
extra_headers=extra_headers, use_auth=use_auth,
user_name=user_name)
return resp
def set_global_preferred(self, ca_ref, headers=None,
use_auth=True, user_name=None):
@@ -171,7 +172,8 @@ class CABehaviors(base_behaviors.BaseBehaviors):
def get_global_preferred(self, extra_headers=None,
use_auth=True, user_name=None):
return self.client.get('cas/global-preferred',
resp = self.client.get('cas/global-preferred',
response_model_type=ca_models.CAModel,
extra_headers=extra_headers,
use_auth=use_auth, user_name=user_name)
return resp
functionaltests/api/v1/functional/test_cas.py
+38 -33
View File
@@ -16,7 +16,6 @@
import base64
import copy
import re
import testtools
from OpenSSL import crypto
@@ -181,6 +180,9 @@ class CertificateAuthoritiesTestCase(CATestCommon):
subject_dn=convert_to_X509Name(self.subca_subject),
issuer_dn=root_subject)
resp = self.ca_behaviors.delete_ca(ca_ref=ca_ref)
self.assertEqual(204, resp.status_code)
@depends_on_ca_plugins('snakeoil_ca')
def test_create_subca_of_snakeoil_subca(self):
parent_model = self.get_snakeoil_subca_model()
@@ -197,6 +199,11 @@ class CertificateAuthoritiesTestCase(CATestCommon):
subject_dn=convert_to_X509Name(self.subca_subca_subject),
issuer_dn=parent_subject)
resp = self.ca_behaviors.delete_ca(ca_ref=child_ref)
self.assertEqual(204, resp.status_code)
resp = self.ca_behaviors.delete_ca(ca_ref=parent_ref)
self.assertEqual(204, resp.status_code)
def test_create_subca_with_invalid_parent_ca_id(self):
ca_model = self.get_snakeoil_subca_model()
ca_model.parent_ca_ref = 'http://localhost:9311/cas/invalid_ref'
@@ -222,15 +229,26 @@ class CertificateAuthoritiesTestCase(CATestCommon):
self.assertEqual(201, resp.status_code)
self.send_test_order(ca_ref)
# @depends_on_ca_plugins('snakeoil_ca')
@testtools.skip("Skip test until ca behaviors tracks project cas")
resp = self.ca_behaviors.delete_ca(ca_ref=ca_ref)
self.assertEqual(204, resp.status_code)
@depends_on_ca_plugins('snakeoil_ca')
def test_add_snakeoil_ca__to_project_and_get_preferred(self):
ca_ref = self.get_snakeoil_root_ca_ref()
resp = self.ca_behaviors.add_ca_to_project(ca_ref, user_name=admin_a)
self.assertEqual(204, resp.status_code)
ca = self.ca_behaviors.get_preferred(user_name=admin_a)
self.assertEqual(hrefs.get_ca_id_from_ref(ca_ref), ca.model.ca_id)
resp = self.ca_behaviors.get_preferred(user_name=admin_a)
self.assertEqual(200, resp.status_code)
ca_id = hrefs.get_ca_id_from_ref(resp.model.ca_ref)
self.assertEqual(hrefs.get_ca_id_from_ref(ca_ref), ca_id)
resp = self.ca_behaviors.remove_ca_from_project(
ca_ref, user_name=admin_a)
self.assertEqual(204, resp.status_code)
resp = self.ca_behaviors.get_preferred(user_name=admin_a)
self.assertEqual(404, resp.status_code)
@depends_on_ca_plugins('snakeoil_ca')
def test_create_and_delete_snakeoil_subca(self):
@@ -258,6 +276,9 @@ class CertificateAuthoritiesTestCase(CATestCommon):
self.assertEqual(200, resp.status_code)
crypto.load_certificate(crypto.FILETYPE_PEM, resp.text)
resp = self.ca_behaviors.delete_ca(ca_ref=ca_ref)
self.assertEqual(204, resp.status_code)
class ListingCAsTestCase(CATestCommon):
"""Tests for listing CAs.
@@ -332,66 +353,50 @@ class GlobalPreferredCATestCase(CATestCommon):
self.ca_ids = [hrefs.get_ca_id_from_ref(ref) for ref in self.cas]
def tearDown(self):
self.ca_behaviors.unset_global_preferred(user_name=service_admin)
super(CATestCommon, self).tearDown()
def test_global_preferred_no_project_admin_access(self):
resp = self.ca_behaviors.get_global_preferred()
self.assertEqual(403, resp.status_code)
resp = self.ca_behaviors.set_global_preferred(ca_ref=self.cas[1])
resp = self.ca_behaviors.set_global_preferred(ca_ref=self.cas[0])
self.assertEqual(403, resp.status_code)
resp = self.ca_behaviors.unset_global_preferred()
self.assertEqual(403, resp.status_code)
def test_global_preferred_update(self):
if self.num_cas < 2:
self.skipTest("At least two CAs are required for this test")
self.sTest("At least two CAs are required for this test")
resp = self.ca_behaviors.set_global_preferred(
ca_ref=self.cas[0], user_name=service_admin)
self.assertEqual(204, resp.status_code)
resp = self.ca_behaviors.get_global_preferred(user_name=service_admin)
self.assertEqual(200, resp.status_code)
self.assertEqual(self.ca_ids[0], resp.model.ca_id)
ca_id = hrefs.get_ca_id_from_ref(resp.model.ca_ref)
self.assertEqual(self.ca_ids[0], ca_id)
resp = self.ca_behaviors.set_global_preferred(
ca_ref=self.cas[1], user_name=service_admin)
self.assertEqual(204, resp.status_code)
resp = self.ca_behaviors.get_global_preferred(user_name=service_admin)
self.assertEqual(200, resp.status_code)
self.assertEqual(self.ca_ids[1], resp.model.ca_id)
ca_id = hrefs.get_ca_id_from_ref(resp.model.ca_ref)
self.assertEqual(self.ca_ids[1], ca_id)
resp = self.ca_behaviors.unset_global_preferred(
user_name=service_admin)
self.assertEqual(204, resp.status_code)
def test_global_preferred_set_and_unset(self):
resp = self.ca_behaviors.unset_global_preferred(
user_name=service_admin)
self.assertEqual(204, resp.status_code)
resp = self.ca_behaviors.get_global_preferred(user_name=service_admin)
self.assertEqual(404, resp.status_code)
resp = self.ca_behaviors.set_global_preferred(
ca_ref=self.cas[0], user_name=service_admin)
self.assertEqual(204, resp.status_code)
resp = self.ca_behaviors.get_global_preferred(user_name=service_admin)
self.assertEqual(200, resp.status_code)
self.assertEqual(self.ca_ids[0], resp.model.ca_id)
ca_id = hrefs.get_ca_id_from_ref(resp.model.ca_ref)
self.assertEqual(self.ca_ids[0], ca_id)
resp = self.ca_behaviors.unset_global_preferred(
user_name=service_admin)
self.assertEqual(204, resp.status_code)
resp = self.ca_behaviors.get_global_preferred(user_name=service_admin)
self.assertEqual(404, resp.status_code)
@testtools.skip("Skip test until ca behaviors tracks project cas")
def test_global_preferred_affects_project_preferred(self):
if self.num_cas < 2:
self.skipTest("At least two CAs are required for this test")
resp = self.ca_behaviors.get_preferred(user_name=admin_a)
self.assertEqual(200, resp.status_code)
self.assertEqual(self.ca_ids[0], resp.model.ca_id)
resp = self.ca_behaviors.set_global_preferred(
ca_ref=self.cas[1], user_name=service_admin)
self.assertEqual(204, resp.status_code)
resp = self.ca_behaviors.get_preferred(user_name=admin_a)
self.assertEqual(200, resp.status_code)
self.assertEqual(self.ca_ids[1], resp.model.ca_id)
functionaltests/api/v1/models/ca_models.py
+3 -2
View File
@@ -19,14 +19,15 @@ from functionaltests.api.v1.models.base_models import BaseModel
class CAModel(BaseModel):
def __init__(self, expiration=None, ca_id=None, status=None,
updated=None, created=None, plugin_name=None,
def __init__(self, expiration=None, ca_id=None, ca_ref=None,
status=None, updated=None, created=None, plugin_name=None,
plugin_ca_id=None, meta=None, parent_ca_ref=None,
subject_dn=None, name=None, description=None):
super(CAModel, self).__init__()
self.expiration = expiration
self.ca_id = ca_id
self.ca_ref = ca_ref
self.status = status
self.updated = updated
self.created = created
functionaltests/run_tests.sh
+1 -1
View File
@@ -29,7 +29,7 @@ retval=$?
testr slowest
# run the tests in parallel
SKIP=^\(\?\!\.\*\(ProjectQuotasPagingTestCase\|QuotaEnforcementTestCase\|ListingCAsTestCase\|ProjectCATestCase\|GlobalPreferredCATestCase\)\)
SKIP=^\(\?\!\.\*\(ProjectQuotasPagingTestCase\|QuotaEnforcementTestCase\|ListingCAsTestCase\|ProjectCATestCase\|GlobalPreferredCATestCase\|CertificateAuthoritiesTestCase\)\)
testr init
testr run $SKIP --parallel --subunit | subunit-trace --no-failure-debug -f
retval=$(($retval || $?))