Jira (PUP-2995) Proposal for custom trusted oid mapping file

Josh Cooper (JIRA) Tue, 04 Nov 2014 15:46:49 -0800

Title: Message Title

Josh Cooper commented on

PUP-2995

Verified that you can reference certificate extensions using the short name as specified in the custom oid mapping file:

Created attributes.yaml on agent to add permanent extensions:

---

extension_requests:

  1.3.6.1.4.1.34380.1.2.1.1: somedata

  1.3.6.1.4.1.34380.1.2.1.2: someotherdata

Ran agent with csr_attributes option.

$ bundle exec puppet agent -td --server $(bundle exec facter fqdn) --csr_attributes ./attributes.yaml

In site.pp:

notice $trusted[extensions]

In oid.yaml:

---

oid_mapping:

  1.3.6.1.4.1.34380.1.2.1.1:

    shortname: 'myshortname'

    longname: 'My Long Name'

  1.3.6.1.4.1.34380.1.2.1.2:

    shortname: 'myothershortname'

    longname: 'My Other Long Name'

Ran master enabling trusted facts and using oid mapping file, and ran agent:

$ bundle exec puppet master --no-daemonize --dns_alt_names $(bundle exec facter fqdn) --autosign --debug --trusted_node_data --trusted_oid_mapping_file oids.yaml

...

Notice: Scope(Class[main]): {"myshortname"=>"somedata", "myothershortname"=>"someotherdata"}

When the oid mapping file is not specified, extensions are indexed by their oids in the trusted extensions hash:

$ bundle exec puppet master --no-daemonize --dns_alt_names $(bundle exec facter fqdn) --debug --trusted_node_data

...

Notice: Scope(Class[main]): {"1.3.6.1.4.1.34380.1.2.1.1"=>"somedata", "1.3.6.1.4.1.34380.1.2.1.2"=>"someotherdata"}

Also verified the setting is documented:

# man puppet.conf

...

   trusted_oid_mapping_file

       File that provides mapping between custom SSL oids and user-friendly names

   ·   Default: $confdir/custom_trusted_oid_mapping.yaml

Add Comment

This message was sent by Atlassian JIRA

--
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To post to this group, send email to [email protected].
Visit this group at http://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.

Jira (PUP-2995) Proposal for custom trusted oid mapping file

Reply via email to