{"action":"created","comment":{"url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/comments/62586817","id":62586817,"diff_hunk":"@@ -0,0 +1,141 @@\n+test_name \"(TK-293) TK-AUTH uses certificate extensions for authentication\" do\n+\n+server = master.puppet['certname']\n+ssldir = master.puppet['ssldir']\n+confdir = master.puppet['confdir']\n+\n+# Do we have a functioning cert?\n+step \"Confirm agent can connect with existing cert\" do\n+  agents.each do |a|\n+    if (not_controller(a))\n+      rc = on(a,\n+              puppet(\"agent --test --server #{server} --detailed-exitcodes\"),\n+              {:acceptable_exit_codes => [0,2]})\n+    end\n+  end\n+end\n+\n+# Not anymore we don't\n+step \"Revoke and destroy the existing cert on the server\" do\n+  agents.each do |a| \n+    if (not_controller(a))\n+      nodename = fact_on(a, 'fqdn')\n+      rc = on(master, \n+              puppet(\"cert destroy #{nodename}\"),\n+              {:acceptable_exit_codes => [0,2]})\n+    end\n+  end\n+end\n+\n+# FIXME: Should actually HUP the server instead of stopping/restarting\n+step \"HUP the server\" do\n+  rc = on(master,\n+          \"pgrep -f puppetserver\",\n+          {:acceptable_exit_codes => [0]})\n+  pid = rc.stdout\n+  rc = on(master,\n+          \"kill -HUP #{pid}\",\n+          {:acceptable_exit_codes => [0]})\n+  sleep 5\n+end\n+\n+# After a server HUP, the agent cert should be rejected\n+step \"Confirm agent can't connect with existing cert\" do\n+  agents.each do |a|\n+    if (not_controller(a))\n+      rc = on(a,\n+              puppet(\"agent --test --server #{server} --detailed-exitcodes\"),\n+              {:acceptable_exit_codes => [1]})\n+    end\n+  end\n+end\n+\n+step \"Remove the old certs on the agents so they'll make new ones\" do\n+  agents.each do |a|\n+    if (not_controller(a))\n+      nodename = fact_on(a, 'fqdn')\n+      rc = on(a,\n+              \"find #{confdir} -name #{nodename}.pem -delete\",\n+              {:acceptable_exit_codes => [0,1]})\n+    end\n+  end\n+end\n+\n+# Lay down an attributes file for puppet to read when creating\n+# a new cert\n+step \"Copy the CSR attributes file into place\" do\n+  agents.each do |a|\n+    if (not_controller(a))\n+      rc = scp_to(a,\n+                  'acceptance/suites/tests/authorization/fixtures/csr_attributes.yaml',\n+                  \"#{confdir}\",\n+                  {:acceptable_exit_codes => [0]})\n+    end\n+  end\n+end\n+\n+# # FIXME\n+# step \"Update tkauth config file to use CSR attribute to control access\" do\n+#   agents.each do |a|","path":"acceptance/suites/tests/authorization/use_csr_auth.rb","position":79,"original_position":79,"commit_id":"460ce9fc8eb6393279833f8930eec8a198222cee","original_commit_id":"460ce9fc8eb6393279833f8930eec8a198222cee","user":{"login":"erikPrime","id":7841318,"avatar_url":"https://avatars.githubusercontent.com/u/7841318?v=3","gravatar_id":"","url":"https://api.github.com/users/erikPrime","html_url":"https://github.com/erikPrime","followers_url":"https://api.github.com/users/erikPrime/followers","following_url":"https://api.github.com/users/erikPrime/following{/other_user}","gists_url":"https://api.github.com/users/erikPrime/gists{/gist_id}","starred_url":"https://api.github.com/users/erikPrime/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erikPrime/subscriptions","organizations_url":"https://api.github.com/users/erikPrime/orgs","repos_url":"https://api.github.com/users/erikPrime/repos","events_url":"https://api.github.com/users/erikPrime/events{/privacy}","received_events_url":"https://api.github.com/users/erikPrime/received_events","type":"User","site_admin":false},"body":"There are two, maybe three ways of approaching this:\r\n1.  Backup auth.conf, laydown the auth.conf we want to use for this test, hup.  restore backup and hup on teardown.\r\n2.  Create an additional helper method, 'remove_match_request'.\r\nBackup auth.conf, remote_match_request(#some rule set that would allow the agent by cn)\r\nappend_match_request(#rule set that allows access by extension), hup.\r\nReverse on teardown, or just restore backup.\r\n ","created_at":"2016-05-09T22:52:10Z","updated_at":"2016-05-09T22:52:10Z","html_url":"https://github.com/puppetlabs/puppetserver/pull/1056#discussion_r62586817","pull_request_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1056","_links":{"self":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/comments/62586817"},"html":{"href":"https://github.com/puppetlabs/puppetserver/pull/1056#discussion_r62586817"},"pull_request":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1056"}}},"pull_request":{"url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1056","id":68937669,"html_url":"https://github.com/puppetlabs/puppetserver/pull/1056","diff_url":"https://github.com/puppetlabs/puppetserver/pull/1056.diff","patch_url":"https://github.com/puppetlabs/puppetserver/pull/1056.patch","issue_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues/1056","number":1056,"state":"open","locked":false,"title":"REVIEW ONLY (TK-293) Validates server support for CSR attributes","user":{"login":"kurtwall","id":5178160,"avatar_url":"https://avatars.githubusercontent.com/u/5178160?v=3","gravatar_id":"","url":"https://api.github.com/users/kurtwall","html_url":"https://github.com/kurtwall","followers_url":"https://api.github.com/users/kurtwall/followers","following_url":"https://api.github.com/users/kurtwall/following{/other_user}","gists_url":"https://api.github.com/users/kurtwall/gists{/gist_id}","starred_url":"https://api.github.com/users/kurtwall/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kurtwall/subscriptions","organizations_url":"https://api.github.com/users/kurtwall/orgs","repos_url":"https://api.github.com/users/kurtwall/repos","events_url":"https://api.github.com/users/kurtwall/events{/privacy}","received_events_url":"https://api.github.com/users/kurtwall/received_events","type":"User","site_admin":false},"body":"This test verifies that Puppet Server can use CSR attributes to manage authorization.","created_at":"2016-05-04T21:48:31Z","updated_at":"2016-05-09T22:52:10Z","closed_at":null,"merged_at":null,"merge_commit_sha":"71202462082da79b0d2e2f916da75e7013b40ca8","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1056/commits","review_comments_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1056/comments","review_comment_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/comments{/number}","comments_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues/1056/comments","statuses_url":"https://api.github.com/repos/puppetlabs/puppetserver/statuses/460ce9fc8eb6393279833f8930eec8a198222cee","head":{"label":"kurtwall:server-1268","ref":"server-1268","sha":"460ce9fc8eb6393279833f8930eec8a198222cee","user":{"login":"kurtwall","id":5178160,"avatar_url":"https://avatars.githubusercontent.com/u/5178160?v=3","gravatar_id":"","url":"https://api.github.com/users/kurtwall","html_url":"https://github.com/kurtwall","followers_url":"https://api.github.com/users/kurtwall/followers","following_url":"https://api.github.com/users/kurtwall/following{/other_user}","gists_url":"https://api.github.com/users/kurtwall/gists{/gist_id}","starred_url":"https://api.github.com/users/kurtwall/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kurtwall/subscriptions","organizations_url":"https://api.github.com/users/kurtwall/orgs","repos_url":"https://api.github.com/users/kurtwall/repos","events_url":"https://api.github.com/users/kurtwall/events{/privacy}","received_events_url":"https://api.github.com/users/kurtwall/received_events","type":"User","site_admin":false},"repo":{"id":56799128,"name":"puppetserver","full_name":"kurtwall/puppetserver","owner":{"login":"kurtwall","id":5178160,"avatar_url":"https://avatars.githubusercontent.com/u/5178160?v=3","gravatar_id":"","url":"https://api.github.com/users/kurtwall","html_url":"https://github.com/kurtwall","followers_url":"https://api.github.com/users/kurtwall/followers","following_url":"https://api.github.com/users/kurtwall/following{/other_user}","gists_url":"https://api.github.com/users/kurtwall/gists{/gist_id}","starred_url":"https://api.github.com/users/kurtwall/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kurtwall/subscriptions","organizations_url":"https://api.github.com/users/kurtwall/orgs","repos_url":"https://api.github.com/users/kurtwall/repos","events_url":"https://api.github.com/users/kurtwall/events{/privacy}","received_events_url":"https://api.github.com/users/kurtwall/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/kurtwall/puppetserver","description":"Server automation framework and application","fork":true,"url":"https://api.github.com/repos/kurtwall/puppetserver","forks_url":"https://api.github.com/repos/kurtwall/puppetserver/forks","keys_url":"https://api.github.com/repos/kurtwall/puppetserver/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kurtwall/puppetserver/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kurtwall/puppetserver/teams","hooks_url":"https://api.github.com/repos/kurtwall/puppetserver/hooks","issue_events_url":"https://api.github.com/repos/kurtwall/puppetserver/issues/events{/number}","events_url":"https://api.github.com/repos/kurtwall/puppetserver/events","assignees_url":"https://api.github.com/repos/kurtwall/puppetserver/assignees{/user}","branches_url":"https://api.github.com/repos/kurtwall/puppetserver/branches{/branch}","tags_url":"https://api.github.com/repos/kurtwall/puppetserver/tags","blobs_url":"https://api.github.com/repos/kurtwall/puppetserver/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kurtwall/puppetserver/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kurtwall/puppetserver/git/refs{/sha}","trees_url":"https://api.github.com/repos/kurtwall/puppetserver/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kurtwall/puppetserver/statuses/{sha}","languages_url":"https://api.github.com/repos/kurtwall/puppetserver/languages","stargazers_url":"https://api.github.com/repos/kurtwall/puppetserver/stargazers","contributors_url":"https://api.github.com/repos/kurtwall/puppetserver/contributors","subscribers_url":"https://api.github.com/repos/kurtwall/puppetserver/subscribers","subscription_url":"https://api.github.com/repos/kurtwall/puppetserver/subscription","commits_url":"https://api.github.com/repos/kurtwall/puppetserver/commits{/sha}","git_commits_url":"https://api.github.com/repos/kurtwall/puppetserver/git/commits{/sha}","comments_url":"https://api.github.com/repos/kurtwall/puppetserver/comments{/number}","issue_comment_url":"https://api.github.com/repos/kurtwall/puppetserver/issues/comments{/number}","contents_url":"https://api.github.com/repos/kurtwall/puppetserver/contents/{+path}","compare_url":"https://api.github.com/repos/kurtwall/puppetserver/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kurtwall/puppetserver/merges","archive_url":"https://api.github.com/repos/kurtwall/puppetserver/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kurtwall/puppetserver/downloads","issues_url":"https://api.github.com/repos/kurtwall/puppetserver/issues{/number}","pulls_url":"https://api.github.com/repos/kurtwall/puppetserver/pulls{/number}","milestones_url":"https://api.github.com/repos/kurtwall/puppetserver/milestones{/number}","notifications_url":"https://api.github.com/repos/kurtwall/puppetserver/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kurtwall/puppetserver/labels{/name}","releases_url":"https://api.github.com/repos/kurtwall/puppetserver/releases{/id}","deployments_url":"https://api.github.com/repos/kurtwall/puppetserver/deployments","created_at":"2016-04-21T19:08:55Z","updated_at":"2016-04-21T19:08:56Z","pushed_at":"2016-05-09T18:29:58Z","git_url":"git://github.com/kurtwall/puppetserver.git","ssh_url":"git@github.com:kurtwall/puppetserver.git","clone_url":"https://github.com/kurtwall/puppetserver.git","svn_url":"https://github.com/kurtwall/puppetserver","homepage":"https://tickets.puppetlabs.com/browse/SERVER","size":3897,"stargazers_count":0,"watchers_count":0,"language":"Clojure","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"puppetlabs:master","ref":"master","sha":"24326f9f133093410b1d04a664764b66e0023141","user":{"login":"puppetlabs","id":234268,"avatar_url":"https://avatars.githubusercontent.com/u/234268?v=3","gravatar_id":"","url":"https://api.github.com/users/puppetlabs","html_url":"https://github.com/puppetlabs","followers_url":"https://api.github.com/users/puppetlabs/followers","following_url":"https://api.github.com/users/puppetlabs/following{/other_user}","gists_url":"https://api.github.com/users/puppetlabs/gists{/gist_id}","starred_url":"https://api.github.com/users/puppetlabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/puppetlabs/subscriptions","organizations_url":"https://api.github.com/users/puppetlabs/orgs","repos_url":"https://api.github.com/users/puppetlabs/repos","events_url":"https://api.github.com/users/puppetlabs/events{/privacy}","received_events_url":"https://api.github.com/users/puppetlabs/received_events","type":"Organization","site_admin":false},"repo":{"id":19546488,"name":"puppetserver","full_name":"puppetlabs/puppetserver","owner":{"login":"puppetlabs","id":234268,"avatar_url":"https://avatars.githubusercontent.com/u/234268?v=3","gravatar_id":"","url":"https://api.github.com/users/puppetlabs","html_url":"https://github.com/puppetlabs","followers_url":"https://api.github.com/users/puppetlabs/followers","following_url":"https://api.github.com/users/puppetlabs/following{/other_user}","gists_url":"https://api.github.com/users/puppetlabs/gists{/gist_id}","starred_url":"https://api.github.com/users/puppetlabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/puppetlabs/subscriptions","organizations_url":"https://api.github.com/users/puppetlabs/orgs","repos_url":"https://api.github.com/users/puppetlabs/repos","events_url":"https://api.github.com/users/puppetlabs/events{/privacy}","received_events_url":"https://api.github.com/users/puppetlabs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/puppetlabs/puppetserver","description":"Server automation framework and application","fork":false,"url":"https://api.github.com/repos/puppetlabs/puppetserver","forks_url":"https://api.github.com/repos/puppetlabs/puppetserver/forks","keys_url":"https://api.github.com/repos/puppetlabs/puppetserver/keys{/key_id}","collaborators_url":"https://api.github.com/repos/puppetlabs/puppetserver/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/puppetlabs/puppetserver/teams","hooks_url":"https://api.github.com/repos/puppetlabs/puppetserver/hooks","issue_events_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues/events{/number}","events_url":"https://api.github.com/repos/puppetlabs/puppetserver/events","assignees_url":"https://api.github.com/repos/puppetlabs/puppetserver/assignees{/user}","branches_url":"https://api.github.com/repos/puppetlabs/puppetserver/branches{/branch}","tags_url":"https://api.github.com/repos/puppetlabs/puppetserver/tags","blobs_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/refs{/sha}","trees_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/trees{/sha}","statuses_url":"https://api.github.com/repos/puppetlabs/puppetserver/statuses/{sha}","languages_url":"https://api.github.com/repos/puppetlabs/puppetserver/languages","stargazers_url":"https://api.github.com/repos/puppetlabs/puppetserver/stargazers","contributors_url":"https://api.github.com/repos/puppetlabs/puppetserver/contributors","subscribers_url":"https://api.github.com/repos/puppetlabs/puppetserver/subscribers","subscription_url":"https://api.github.com/repos/puppetlabs/puppetserver/subscription","commits_url":"https://api.github.com/repos/puppetlabs/puppetserver/commits{/sha}","git_commits_url":"https://api.github.com/repos/puppetlabs/puppetserver/git/commits{/sha}","comments_url":"https://api.github.com/repos/puppetlabs/puppetserver/comments{/number}","issue_comment_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues/comments{/number}","contents_url":"https://api.github.com/repos/puppetlabs/puppetserver/contents/{+path}","compare_url":"https://api.github.com/repos/puppetlabs/puppetserver/compare/{base}...{head}","merges_url":"https://api.github.com/repos/puppetlabs/puppetserver/merges","archive_url":"https://api.github.com/repos/puppetlabs/puppetserver/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/puppetlabs/puppetserver/downloads","issues_url":"https://api.github.com/repos/puppetlabs/puppetserver/issues{/number}","pulls_url":"https://api.github.com/repos/puppetlabs/puppetserver/pulls{/number}","milestones_url":"https://api.github.com/repos/puppetlabs/puppetserver/milestones{/number}","notifications_url":"https://api.github.com/repos/puppetlabs/puppetserver/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/puppetlabs/puppetserver/labels{/name}","releases_url":"https://api.github.com/repos/puppetlabs/puppetserver/releases{/id}","deployments_url":"https://api.github.com/repos/puppetlabs/puppetserver/deployments","created_at":"2014-05-07T19:00:24Z","updated_at":"2016-04-26T01:19:43Z","pushed_at":"2016-05-09T22:36:32Z","git_url":"git://github.com/puppetlabs/puppetserver.git","ssh_url":"git@github.com:puppetlabs/puppetserver.git","clone_url":"https://github.com/puppetlabs/puppetserver.git","svn_url":"https://github.com/puppetlabs/puppetserver","homepage":"https://tickets.puppetlabs.com/browse/SERVER","size":6357,"stargazers_count":138,"watchers_count":138,"language":"Clojure","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":88,"mirror_url":null,"open_issues_count":11,"forks":88,"open_issues":11,"watchers":138,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1056"},"html":{"href":"https://github.com/puppetlabs/puppetserver/pull/1056"},"issue":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/issues/1056"},"comments":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/issues/1056/comments"},"review_comments":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1056/comments"},"review_comment":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/pulls/1056/commits"},"statuses":{"href":"https://api.github.com/repos/puppetlabs/puppetserver/statuses/460ce9fc8eb6393279833f8930eec8a198222cee"}}}}