When the user tries to authenticate using oidc-auth command
externally, the oidc-auth script wasn't able to verify the local
issuer certificate as following:
user@external-machine$ oidc-auth -c <oam_ip> -u user2 -p <password>
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable
to get local issuer certificate
When the StarlingX system has HTTPS certificate enabled, one of the
steps to configure the Remote CLIs and Clients Container is to
provide the ca certificate which oidc-auth script should use to
verify the requests during the authentication procedure, the
enviroment variable OS_CACERT will hold the ca certifile file name.
Refer the guide: https://docs.starlingx.io/security/openstack/
configure-remote-clis-and-clients.html for more information.
The fix basically lets the oidc-auth script know about which
certificate should be used during the authentication procedure. By
default, now the oidc-auth script will use the certificate file
provided into the OS_CACERT enviroment variable.
Additionally, an option was created for the users to specify a cacert
file when using the oidc-auth command.
Test Plan:
PASS: Deploy a SX and configure the oidc-auth-apps.
PASS: Create an ldap user and configure the user roles.
PASS: Try to authenticate locally using oidc-auth, should be
successed.
PASS: Configure the Remote CLIs in your remote workstation in
order to get access to the oidc-auth command, refer the guide: Configure
Container-backed Remote CLIs and Clients.
PASS: Authenticate from your remote workstation with the
oidc-auth command:
oidc-auth -c <oam_ip> -u <ldap_user> -p <ldap_user_password>
The command should now successed.
PASS: Opitional, authenticate from your remote workstation with the
oidc-auth command specifying a cacert file:
oidc-auth -c <oam_ip> -u <ldap_user> -p <ldap_user_password>
-ca <path to ca-certificate file>
Closes-Bug: 2086731
Change-Id: Ia8f37b44f846207a13b8b4983cc3ed0614d97a93
Signed-off-by: Joaci Morais <Joaci.deMorais@windriver.com>
b78a185adc