URL: https://github.com/SSSD/sssd/pull/198 Author: pbrezina Title: #198: secrets: support https in proxy provider Action: opened
PR body: """ I had to switch to libcurl as a client in order to communicate properly over HTTPS protocol. I added several new options that are necessary to initialize SSL (which certificates should be used and whether to check hostname in server's certificate or not).
* Example SSSD configuration: ``` [secrets] debug_level = 0x3ff0
[secrets/users/10001] provider = proxy proxy_url = https://custodia.pb:10443/secrets auth_type = header auth_header_name = REMOTE_USER auth_header_value = mysecretkey cacert = /home/pbrezina/Downloads/cer/custodia-ca.pem cert = /home/pbrezina/Downloads/cer/custodia-client.pem key = /home/pbrezina/Downloads/cer/custodia-client.key verify_host = false ```
* Example custodia configuration (just modify default configuration, keeping the rest options intact): ``` [global] server_version = "Secret/0.0.7" debug = True server_url = https://0.0.0.0:10443 tls_certfile = tests/ca/custodia-server.pem tls_keyfile = tests/ca/custodia-server.key tls_cafile = tests/ca/custodia-ca.pem tls_verify_client = true umask = 027
[auth:header] handler = SimpleHeaderAuth header = REMOTE_USER value = mysecretkey
[authz:paths] handler = SimplePathAuthz paths = /. ```
* Download certificates and key to your client and you can use it like this ```shell curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X POST http://localhost/secrets/mysecretkey/
curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X PUT http://localhost/secrets/mysecretkey/foo -d'{"type":"simple","value":"foosecret"}'
curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X POST http://localhost/secrets/mysecretkey/foo
curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X DELETE http://localhost/secrets/mysecretkey/foo
curl -v -H "Content-Type: application/json" -H "REMOTE_USER: mysecretkey" --unix-socket /var/run/secrets.socket -X DELETE http://localhost/secrets/mysecretkey/ ``` """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/198/head:pr198 git checkout pr198