/*
|
* The contents of this file are subject to the terms of the Common Development and
|
* Distribution License (the License). You may not use this file except in compliance with the
|
* License.
|
*
|
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
|
* specific language governing permission and limitations under the License.
|
*
|
* When distributing Covered Software, include this CDDL Header Notice in each file and include
|
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
|
* Header, with the fields enclosed by brackets [] replaced by your own identifying
|
* information: "Portions copyright [year] [name of copyright owner]".
|
*
|
* Copyright 2026 3A Systems, LLC.
|
*/
|
package org.opends.quicksetup;
|
|
import static org.testng.Assert.assertEquals;
|
import static org.testng.Assert.assertFalse;
|
import static org.testng.Assert.assertNotEquals;
|
import static org.testng.Assert.assertTrue;
|
import static org.testng.Assert.fail;
|
|
import java.io.File;
|
import java.io.FileInputStream;
|
import java.nio.charset.StandardCharsets;
|
import java.nio.file.Files;
|
import java.security.KeyStore;
|
import java.security.Provider;
|
import java.security.Security;
|
import java.util.ArrayList;
|
import java.util.List;
|
import java.util.concurrent.TimeUnit;
|
|
import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider;
|
import org.opends.quicksetup.util.ServerController;
|
import org.opends.quicksetup.util.ZipExtractor;
|
import org.opends.server.DirectoryServerTestCase;
|
import org.opends.server.TestCaseUtils;
|
import org.opends.server.util.CertificateFixture;
|
import org.testng.annotations.Test;
|
|
import com.forgerock.opendj.util.OperatingSystem;
|
|
/**
|
* Installs a server with {@code setup} and the arguments which provision the trust store
|
* used for server to server communication, and checks what the installed instance holds:
|
* this is the whole point of the arguments, and the pieces which carry the values from
|
* the command line to the trust store and to the crypto manager sit in three different
|
* tools.
|
* <p>
|
* Each installation uses a different key store type, so that every arm of the mapping
|
* from the key store argument to the key store type is walked by one of them.
|
*/
|
public class AdsTrustStoreInstallTestCase extends DirectoryServerTestCase
|
{
|
private static final String KEY_STORE_PASSWORD = "keyStorePassword";
|
private static final String CERT_NICKNAME = "server-cert";
|
private static final String SECOND_CERT_NICKNAME = "server-cert-2";
|
/** How long one run of setup, or one stop of the server it started, is given. */
|
private static final long TIMEOUT_MINUTES = 5;
|
|
/**
|
* The installed server presents the CA-signed key pairs on the replication port and
|
* trusts the authority which issued them, with no manual {@code keytool} pass. Two key
|
* pairs are named, so that both nicknames reach the crypto manager.
|
*
|
* @throws Exception
|
* If a problem occurs.
|
*/
|
@Test
|
public void testSetupProvisionsTheAdsTrustStore() throws Exception
|
{
|
final File workspace = TestCaseUtils.createTemporaryDirectory("adsTrustStoreInstall");
|
try
|
{
|
final CertificateFixture ca = new CertificateFixture("CN=Example CA,O=Example");
|
final File keyStore = new File(workspace, "server.p12");
|
ca.addKeyEntry(keyStore, "PKCS12", KEY_STORE_PASSWORD, CERT_NICKNAME, "CN=host.example.com", true);
|
ca.addKeyEntry(keyStore, "PKCS12", KEY_STORE_PASSWORD, SECOND_CERT_NICKNAME, "CN=host.example.com", true);
|
|
final File serverRoot = installServer(workspace, "--usePkcs12keyStore", keyStore, "-O",
|
"--certNickname", CERT_NICKNAME, "--certNickname", SECOND_CERT_NICKNAME, "--useKeyStoreForReplication");
|
|
final KeyStore keys = loadAdsTrustStore(serverRoot);
|
assertTrue(keys.isKeyEntry(CERT_NICKNAME), "the key pair to present was not imported");
|
assertTrue(keys.isKeyEntry(SECOND_CERT_NICKNAME), "the second key pair to present was not imported");
|
assertEquals(keys.getCertificateChain(CERT_NICKNAME).length, 2);
|
assertEquals(keys.getCertificateAlias(ca.getCaCertificate()), "ads-ca-1",
|
"the issuing certificate is not trusted");
|
assertFalse(keys.containsAlias("ads-ca-2"), "the shared issuer is trusted twice");
|
|
assertEquals(cryptoManagerCertNicknames(serverRoot), List.of(CERT_NICKNAME, SECOND_CERT_NICKNAME),
|
"the crypto manager does not present both key pairs");
|
}
|
finally
|
{
|
TestCaseUtils.deleteDirectory(workspace);
|
}
|
}
|
|
/**
|
* A key store which holds the issued certificate alone is enough when the certificates
|
* of the authorities are named separately, and every certificate of the named file is
|
* trusted. With no nickname given, the only key pair of the key store is the one
|
* presented.
|
*
|
* @throws Exception
|
* If a problem occurs.
|
*/
|
@Test
|
public void testSetupTrustsTheNamedCaCertificates() throws Exception
|
{
|
final File workspace = TestCaseUtils.createTemporaryDirectory("adsTrustStoreCaFile");
|
try
|
{
|
final CertificateFixture ca = new CertificateFixture("CN=Example CA,O=Example");
|
final CertificateFixture otherCa = new CertificateFixture("CN=Other CA,O=Example");
|
final File keyStore = new File(workspace, "server.jks");
|
ca.addKeyEntry(keyStore, "JKS", KEY_STORE_PASSWORD, CERT_NICKNAME, "CN=host.example.com", false);
|
final File caChainFile = new File(workspace, "ca-chain.crt");
|
CertificateFixture.writeCertificates(caChainFile, ca.getCaCertificate(), otherCa.getCaCertificate());
|
|
final File serverRoot = installServer(workspace, "--useJavaKeystore", keyStore, "-O",
|
"--useKeyStoreForReplication", "--replicationCaCertFile", caChainFile.getAbsolutePath());
|
|
final KeyStore keys = loadAdsTrustStore(serverRoot);
|
assertTrue(keys.isKeyEntry(CERT_NICKNAME), "the key pair to present was not imported");
|
assertEquals(keys.getCertificateAlias(ca.getCaCertificate()), "ads-ca-1",
|
"the first named certificate is not trusted");
|
assertEquals(keys.getCertificateAlias(otherCa.getCaCertificate()), "ads-ca-2",
|
"the second certificate of the named file is not trusted");
|
assertEquals(cryptoManagerCertNicknames(serverRoot), List.of(CERT_NICKNAME),
|
"the only key pair of the key store is not the one presented");
|
}
|
finally
|
{
|
TestCaseUtils.deleteDirectory(workspace);
|
}
|
}
|
|
/**
|
* A key store which holds the issued certificate alone, with no certificate to trust
|
* named either, would install a server which trusts no peer. The installation stops
|
* and says which key pair is at fault, rather than leave the failure to show up as a
|
* handshake error once the server joins a topology, and it stops before the
|
* configuration and the certificates of the server are written.
|
*
|
* @throws Exception
|
* If a problem occurs.
|
*/
|
@Test
|
public void testSetupRefusesAKeyStoreWithNoCertificateToTrust() throws Exception
|
{
|
final File workspace = TestCaseUtils.createTemporaryDirectory("adsTrustStoreNoAnchor");
|
try
|
{
|
final CertificateFixture ca = new CertificateFixture("CN=Example CA,O=Example");
|
final File keyStore = new File(workspace, "server.jceks");
|
ca.addKeyEntry(keyStore, "JCEKS", KEY_STORE_PASSWORD, CERT_NICKNAME, "CN=host.example.com", false);
|
|
final SetupResult result = runSetup(workspace, "--useJCEKS", keyStore, "-O",
|
"--certNickname", CERT_NICKNAME, "--useKeyStoreForReplication");
|
assertNotEquals(result.exitCode, 0, "setup installed a server which trusts no peer:\n" + result.output);
|
assertTrue(result.output.contains(CERT_NICKNAME), result.output);
|
assertTrue(result.output.contains("--replicationCaCertFile"), result.output);
|
assertFalse(configFile(result.serverRoot, "ads-truststore").exists(), "a trust store was left behind");
|
assertFalse(configFile(result.serverRoot, "ads-truststore.pin").exists(), "a PIN file was left behind");
|
assertEquals(cryptoManagerCertNicknames(result.serverRoot), List.of("ads-certificate"),
|
"the configuration was written before the refusal");
|
assertFalse(configFile(result.serverRoot, "truststore").exists(),
|
"the certificates were configured before the refusal");
|
}
|
finally
|
{
|
TestCaseUtils.deleteDirectory(workspace);
|
}
|
}
|
|
/**
|
* A BCFKS key store is provisioned like the others, and the nickname has to match its
|
* alias exactly: a BCFKS key store looks aliases up exactly where JKS, JCEKS and PKCS#12
|
* fold them to lower case, so a nickname differing in case names a key pair the
|
* installer cannot read, and is refused when the arguments are checked rather than
|
* reported as a missing key pair half way through.
|
*
|
* @throws Exception
|
* If a problem occurs.
|
*/
|
@Test
|
public void testSetupProvisionsABcfksKeyStoreUnderItsExactAlias() throws Exception
|
{
|
final File workspace = TestCaseUtils.createTemporaryDirectory("adsTrustStoreBcfks");
|
try
|
{
|
final CertificateFixture ca = new CertificateFixture("CN=Example CA,O=Example");
|
final File keyStore = new File(workspace, "server.bcfks");
|
final Provider bcFips = new BouncyCastleFipsProvider();
|
final boolean registered = Security.addProvider(bcFips) != -1;
|
try
|
{
|
ca.addKeyEntry(keyStore, "BCFKS", KEY_STORE_PASSWORD, "Server-Cert", "CN=host.example.com", true);
|
}
|
finally
|
{
|
if (registered)
|
{
|
Security.removeProvider(bcFips.getName());
|
}
|
}
|
|
final SetupResult refused = runSetup(workspace, "--useBcfksKeystore", keyStore, "-O",
|
"--certNickname", CERT_NICKNAME, "--useKeyStoreForReplication");
|
assertNotEquals(refused.exitCode, 0, "setup accepted a nickname the BCFKS key store does not hold:\n"
|
+ refused.output);
|
assertTrue(refused.output.contains("Server-Cert"), "the aliases of the key store are not listed:\n"
|
+ refused.output);
|
assertFalse(configFile(refused.serverRoot, "config.ldif").exists(), "the refusal came after the arguments");
|
TestCaseUtils.deleteDirectory(refused.serverRoot);
|
|
final File serverRoot = installServer(workspace, "--useBcfksKeystore", keyStore, "-O",
|
"--certNickname", "Server-Cert", "--useKeyStoreForReplication");
|
final KeyStore keys = loadAdsTrustStore(serverRoot);
|
assertTrue(keys.isKeyEntry("Server-Cert"), "the key pair to present was not imported");
|
assertEquals(keys.getCertificateAlias(ca.getCaCertificate()), "ads-ca-1",
|
"the issuing certificate is not trusted");
|
assertEquals(cryptoManagerCertNicknames(serverRoot), List.of("Server-Cert"));
|
}
|
finally
|
{
|
TestCaseUtils.deleteDirectory(workspace);
|
}
|
}
|
|
/**
|
* Without the arguments, the installation is left as it was: the trust store is created
|
* by the server on its first start and the crypto manager keeps presenting the
|
* self-signed key pair the trust store backend generates.
|
*
|
* @throws Exception
|
* If a problem occurs.
|
*/
|
@Test
|
public void testSetupLeavesTheSelfSignedInstanceKeyByDefault() throws Exception
|
{
|
final File workspace = TestCaseUtils.createTemporaryDirectory("adsTrustStoreDefault");
|
try
|
{
|
final CertificateFixture ca = new CertificateFixture("CN=Example CA,O=Example");
|
final File keyStore = new File(workspace, "server.p12");
|
ca.addKeyEntry(keyStore, "PKCS12", KEY_STORE_PASSWORD, CERT_NICKNAME, "CN=host.example.com", true);
|
|
final File serverRoot = installServer(workspace, "--usePkcs12keyStore", keyStore, "-O",
|
"--certNickname", CERT_NICKNAME);
|
|
assertFalse(configFile(serverRoot, "ads-truststore").exists(),
|
"the trust store is provisioned without being asked for");
|
assertEquals(cryptoManagerCertNicknames(serverRoot), List.of("ads-certificate"));
|
}
|
finally
|
{
|
TestCaseUtils.deleteDirectory(workspace);
|
}
|
}
|
|
/**
|
* The installed server starts on the provisioned trust store: the trust store backend
|
* opens it with the PIN setup wrote, generates the instance key next to the imported
|
* entries, and the crypto manager finds the nickname it is configured with. This is
|
* the road from the provisioned store to the replication port, which no other case
|
* walks.
|
*
|
* @throws Exception
|
* If a problem occurs.
|
*/
|
@Test
|
public void testInstalledServerStartsOnTheProvisionedTrustStore() throws Exception
|
{
|
final File workspace = TestCaseUtils.createTemporaryDirectory("adsTrustStoreStart");
|
try
|
{
|
final CertificateFixture ca = new CertificateFixture("CN=Example CA,O=Example");
|
final File keyStore = new File(workspace, "server.p12");
|
ca.addKeyEntry(keyStore, "PKCS12", KEY_STORE_PASSWORD, CERT_NICKNAME, "CN=host.example.com", true);
|
|
final File serverRoot;
|
final SetupResult started = runSetup(workspace, "--usePkcs12keyStore", keyStore,
|
"--certNickname", CERT_NICKNAME, "--useKeyStoreForReplication");
|
serverRoot = started.serverRoot;
|
try
|
{
|
assertEquals(started.exitCode, 0, "setup failed to start the server:\n" + started.output);
|
}
|
finally
|
{
|
stopServer(serverRoot);
|
}
|
|
final File errorLog = new File(serverRoot, "logs" + File.separator + "errors");
|
for (String line : Files.readAllLines(errorLog.toPath(), StandardCharsets.UTF_8))
|
{
|
assertFalse(line.contains("severity=ERROR") && line.contains("ads-truststore"),
|
"the first start could not use the provisioned trust store: " + line);
|
assertFalse(line.contains("severity=ERROR") && line.contains(CERT_NICKNAME),
|
"the first start could not find the nickname: " + line);
|
}
|
|
final KeyStore keys = loadAdsTrustStore(serverRoot);
|
assertTrue(keys.isKeyEntry(CERT_NICKNAME), "the imported key pair did not survive the first start");
|
assertTrue(keys.isCertificateEntry("ads-ca-1"), "the trusted certificate did not survive the first start");
|
assertTrue(keys.isKeyEntry("ads-certificate"), "the server did not generate its instance key");
|
}
|
finally
|
{
|
TestCaseUtils.deleteDirectory(workspace);
|
}
|
}
|
|
/** Loads the provisioned trust store with the PIN setup wrote for it. */
|
private KeyStore loadAdsTrustStore(File serverRoot) throws Exception
|
{
|
final File trustStore = configFile(serverRoot, "ads-truststore");
|
final File pinFile = configFile(serverRoot, "ads-truststore.pin");
|
assertTrue(trustStore.exists(), "setup left no " + trustStore);
|
assertTrue(pinFile.exists(), "setup left no " + pinFile);
|
|
final KeyStore keys = KeyStore.getInstance("JKS");
|
final String pin = new String(Files.readAllBytes(pinFile.toPath()), StandardCharsets.UTF_8).trim();
|
try (final FileInputStream in = new FileInputStream(trustStore))
|
{
|
keys.load(in, pin.toCharArray());
|
}
|
return keys;
|
}
|
|
private File configFile(File serverRoot, String name)
|
{
|
return new File(serverRoot, "config" + File.separator + name);
|
}
|
|
/** Extracts the built package and runs setup on it, returning the server root. */
|
private File installServer(File workspace, String keyStoreArgument, File keyStore, String... extraArgs)
|
throws Exception
|
{
|
final SetupResult result = runSetup(workspace, keyStoreArgument, keyStore, extraArgs);
|
assertEquals(result.exitCode, 0, "setup failed:\n" + result.output);
|
return result.serverRoot;
|
}
|
|
/**
|
* Extracts the built package and runs setup on it, whether it succeeds or not. The
|
* server is started unless {@code -O} is among the extra arguments.
|
*/
|
private SetupResult runSetup(File workspace, String keyStoreArgument, File keyStore, String... extraArgs)
|
throws Exception
|
{
|
final File serverRoot = new File(workspace, "opendj");
|
new ZipExtractor(TestUtilities.getInstallPackageFile()).extract(serverRoot);
|
|
final int[] ports = TestCaseUtils.findFreePorts(3);
|
final List<String> args = new ArrayList<>();
|
args.add(new File(serverRoot, OperatingSystem.isWindows() ? "setup.bat" : "setup").getPath());
|
args.add("--cli");
|
args.add("-n");
|
args.add("-w");
|
args.add("password");
|
args.add("-b");
|
args.add("dc=example,dc=com");
|
args.add("-p");
|
args.add(String.valueOf(ports[0]));
|
args.add("--adminConnectorPort");
|
args.add(String.valueOf(ports[1]));
|
args.add("-x");
|
args.add(String.valueOf(ports[2]));
|
args.add(keyStoreArgument);
|
args.add(keyStore.getAbsolutePath());
|
args.add("--keyStorePassword");
|
args.add(KEY_STORE_PASSWORD);
|
args.add("--enableStartTLS");
|
args.addAll(List.of(extraArgs));
|
|
// The output goes to a file rather than a pipe, so that a hung setup is killed on
|
// expiry instead of holding the suite until the failsafe timeout.
|
final File output = new File(workspace, "setup.out");
|
final Process process = new ProcessBuilder(args).redirectErrorStream(true).redirectOutput(output).start();
|
if (!process.waitFor(TIMEOUT_MINUTES, TimeUnit.MINUTES))
|
{
|
process.destroyForcibly();
|
fail("setup did not finish within " + TIMEOUT_MINUTES + " minutes:\n" + readOutput(output));
|
}
|
return new SetupResult(serverRoot, process.exitValue(), readOutput(output));
|
}
|
|
private String readOutput(File output) throws Exception
|
{
|
return new String(Files.readAllBytes(output.toPath()), StandardCharsets.UTF_8);
|
}
|
|
/** Stops the server setup started, if it is running. */
|
private void stopServer(File serverRoot) throws Exception
|
{
|
final Installation installation = new Installation(serverRoot, serverRoot);
|
if (installation.getStatus().isServerRunning())
|
{
|
new ServerController(installation).stopServer();
|
}
|
}
|
|
/** What one run of the setup command produced. */
|
private static final class SetupResult
|
{
|
private final File serverRoot;
|
private final int exitCode;
|
private final String output;
|
|
private SetupResult(File serverRoot, int exitCode, String output)
|
{
|
this.serverRoot = serverRoot;
|
this.exitCode = exitCode;
|
this.output = output;
|
}
|
}
|
|
/** Returns the ssl-cert-nickname values of the crypto manager entry of the written configuration. */
|
private List<String> cryptoManagerCertNicknames(File serverRoot) throws Exception
|
{
|
final File configFile = configFile(serverRoot, "config.ldif");
|
final List<String> nicknames = new ArrayList<>();
|
boolean inCryptoManager = false;
|
for (String line : Files.readAllLines(configFile.toPath(), StandardCharsets.UTF_8))
|
{
|
if (line.isEmpty())
|
{
|
inCryptoManager = false;
|
}
|
else if (line.equalsIgnoreCase("dn: cn=Crypto Manager,cn=config"))
|
{
|
inCryptoManager = true;
|
}
|
else if (inCryptoManager && line.startsWith("ds-cfg-ssl-cert-nickname:"))
|
{
|
nicknames.add(line.substring("ds-cfg-ssl-cert-nickname:".length()).trim());
|
}
|
}
|
return nicknames;
|
}
|
}
|
