X.509 Certguards plugin for the Pulp Project
Project description
This is the pulp_certguard Plugin for the Pulp Project 3.0+. This plugin provides X.509 certificate based content protection. The X509CertGuard authenticates the web request by validating the client certificate passed in the SSL_CLIENT_CERTIFICATE HTTP header using the CA (Certificate Authority) certificate that it has been configured with.
All REST API examples bellow use httpie to perform the requests. The httpie commands below assume that the user executing the commands has a .netrc file in the home directory. The ~/.netrc should have the following configuration:
machine localhost
login admin
password adminIf you configured the admin user with a different password, adjust the configuration accordingly. If you prefer to specify the username and password with each request, please see httpie documentation on how to do that.
This documentation makes use of the jq library to parse the json received from requests, in order to get the unique urls generated when objects are created. To follow this documentation as-is please install the jq library with:
$ sudo dnf install jq
Install pulpcore
Follow the installation instructions provided with pulpcore.
Users should install from either PyPI or source.
Install pulp-certguard from source
source ~/pulpvenv/bin/activate
git clone https://github.com/pulp/pulp-certguard.git
cd pulp-certguard
pip install -e .Install pulp-certguard From PyPI
source ~/pulpvenv/bin/activate
pip install pulp-certguardMake and Run Migrations
django-admin makemigrations certguard
django-admin migrate certguardCreate a content guard named foo
This example assumes that ~/ca.pem is a PEM encoded CA certificate.
$ http --form POST http://localhost:8000/pulp/api/v3/contentguards/certguard/x509/ name=foo ca_certificate@~/ca.pem
{
...
"_href": "/pulp/api/v3/contentguards/certguard/x509/3046291f-d432-4a85-9d7e-fad12b0aaed7/",
...
}$ export GUARD_HREF=$(http localhost:8000/pulp/api/v3/contentguards/certguard/x509/?name=foo | jq -r '.results[0]._href')
Create a distribution with content protection
`` $ http POST http://localhost:8000/pulp/api/v3/distributions/ name=bar base_path=files content_guard=${GUARD_HREF}``
{
...
"_href": "/pulp/api/v3/distributions/305adfe0-4851-432f-9de3-13f9b10fe131/"
...
}Add content protection to an existing distribution
`` $ http PATCH http://localhost:8000/pulp/api/v3/distributions/1/ content_guard=${GUARD_HREF}``
{
...
"_href": "/pulp/api/v3/distributions/0fbb102a-cb38-4d5c-afc2-b9a76e862a1d/"
...
}Download protected content
The following examples assume there is a file named 1.iso published under the files distribution. Further, they assume there is a PEM encoded client certificate at ~/client.pem signed by the CA at ~/ca.pem. And, a PEM encoded private key at ~/key.pem.
Example of GET directly to the content application running on port 8080 over HTTP. When setting the SSL-CLIENT-CERTIFICATE manually, the newlines need to be stripped due to restrictions on legal characters in HTTP header values.
$ http localhost:8080/pulp/content/files/1.iso SSL-CLIENT-CERTIFICATE:"$(tr -d '\n' < ~/client.pem)"
+-----------------------------------------+
| NOTE: binary data not shown in terminal |
+-----------------------------------------+Example of GET through a reverse proxy using HTTPS (like apache or nginx) in front of the content application. It’s assumed that the reverse proxy has been configured to set the SSL-CLIENT-CERTIFICATE header using the client certificate exchanged as part of the SSL negotiation.
$ http https://localhost/pulp/content/files/1.iso --cert=~/client.pem --cert-key=~/key.pem --verify=no
+-----------------------------------------+
| NOTE: binary data not shown in terminal |
+-----------------------------------------+Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
File details
Details for the file pulp-certguard-0.1.0rc1.tar.gz.
File metadata
- Download URL: pulp-certguard-0.1.0rc1.tar.gz
- Upload date:
- Size: 15.6 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/1.13.0 pkginfo/1.5.0.1 requests/2.21.0 setuptools/40.8.0 requests-toolbelt/0.9.1 tqdm/4.31.1 CPython/3.6.7
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 4b32ba7501b8dfbd773e7aeeff6c409acf348e4c79c7d0e739c9f2d8be91f9b7 |
|
| MD5 | bc8b412407d1e67fa40b969d70a2b61d |
|
| BLAKE2b-256 | 2036b1927be375a417ca5fba65037e4ba0bb4ca49e62a49ab2ca3bff09fd1930 |
File details
Details for the file pulp_certguard-0.1.0rc1-py3-none-any.whl.
File metadata
- Download URL: pulp_certguard-0.1.0rc1-py3-none-any.whl
- Upload date:
- Size: 17.2 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/1.13.0 pkginfo/1.5.0.1 requests/2.21.0 setuptools/40.8.0 requests-toolbelt/0.9.1 tqdm/4.31.1 CPython/3.6.7
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 5720c037fe1bd78451d30e28e429a06e417a7c800ba16138f1c7d86eec7eb502 |
|
| MD5 | 675eb0f61f89ad4ea09dabcef9ab2128 |
|
| BLAKE2b-256 | fd65380448b7c1c784008950050f4642367c21ae3bb0f1880dc82364623bdc43 |
