cf-uaac 3.1.3 → 3.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 47cadfc05edd8a5368554f8da515fc79d7b6b66a
-  data.tar.gz: e4accbc8d0414b321e38b70e2216f8475db2d96e
+  metadata.gz: ceef01d629cbe38d03cfb10efaa1aa00148cace7
+  data.tar.gz: 94fa2bcc964a0bf540ad3e88bb75ffd5f276e879
 SHA512:
-  metadata.gz: cc7c7861b0fdf8bc3d8f3c132c107366295881097d8a6242647eff0500fc4b6811140021310c0c3579cda0c9360029ee2984956113b9dc87eec6055b99573295
-  data.tar.gz: 2ba75233691d77f1b0ead9bf33d058e1f0282493724e95ccdc4b02169f7586de22ea169b50f82612884e089a1a38f529758357064e0f1796a5762b59809752fa
+  metadata.gz: a9859b220984a395a14ae08de49f14cfe696ac875f6a284f264053325de9acaed2ad438aa9f6c1ef0bf4fdd899e4d1768cbc2d597e01da3910ef5b5bd73d70ef
+  data.tar.gz: ffb57562d844090b631259bac618e99b29b814af432b41cb0e7c23371c8ac2d9b293405d1c32dc18d671c170dcbacbbf2f8b0a25236e86fa2b30d079cd744b2f

data/lib/cli/common.rb

@@ -67,7 +67,9 @@ class CommonCli < Topic
   end
 
   def scim_request
-    yield Scim.new(Config.target, auth_header, { skip_ssl_validation: Config.target_value(:skip_ssl_validation) })
+    yield Scim.new(Config.target, auth_header, {
+      skip_ssl_validation: Config.target_value(:skip_ssl_validation),
+      ssl_ca_file: Config.target_value(:ca_cert) })
   rescue Exception => e
     complain e
   end
@@ -141,32 +143,34 @@ class MiscCli < CommonCli
     url.to_s.to_sym
   end
 
-  def bad_uaa_url(url, info, skip_ssl_validation = false)
-    info.replace(@cli_class.uaa_info_client(url.to_s, skip_ssl_validation).server)
+  def bad_uaa_url(url, info, skip_ssl_validation = false, ca_cert = nil)
+    info.replace(@cli_class.uaa_info_client(url.to_s, skip_ssl_validation, ca_cert).server)
     nil
   rescue Exception => e
     "failed to access #{url}: #{e.message}"
   end
 
+  define_option :ca_cert, "--ca-cert [file]", "use the given CA certificate to validate the target's SSL certificate"
   define_option :skip_ssl_validation, "--skip-ssl-validation", "do not attempt to validate ssl certificate"
   define_option :force, "--[no-]force", "-f", "set even if target does not respond"
-  desc "target [uaa_url]", "Display current or set new target", :force, :skip_ssl_validation do |uaa_url|
+  desc "target [uaa_url]", "Display current or set new target", :force, :ca_cert, :skip_ssl_validation do |uaa_url|
     msg, info = nil, {}
     if uaa_url
       if uaa_url.to_i.to_s == uaa_url
         return gripe "invalid target index" unless url = Config.target?(uaa_url.to_i)
       elsif url = normalize_url(uaa_url)
-        return gripe msg if (msg = bad_uaa_url(url, info, opts[:skip_ssl_validation])) unless opts[:force] || Config.target?(url)
+        return gripe msg if (msg = bad_uaa_url(url, info, opts[:skip_ssl_validation], opts[:ca_cert])) unless opts[:force] || Config.target?(url)
       elsif !Config.target?(url = normalize_url(uaa_url, "https")) &&
             !Config.target?(url = normalize_url(uaa_url, "http"))
         if opts[:force]
           url = normalize_url(uaa_url, "https")
         else
-          return gripe msg if msg = bad_uaa_url((url = normalize_url(uaa_url, "https")), info, opts[:skip_ssl_validation])
+          return gripe msg if msg = bad_uaa_url((url = normalize_url(uaa_url, "https")), info, opts[:skip_ssl_validation], opts[:ca_cert])
         end
       end
       Config.target = url # we now have a canonical url set to https if possible
       Config.target_opts(skip_ssl_validation: true) if opts[:skip_ssl_validation]
+      Config.target_opts(ca_cert: opts[:ca_cert])
       update_target_info(info) if info[:prompts]
     end
     return say "no target set" unless Config.target

data/lib/cli/runner.rb

@@ -50,9 +50,12 @@ class Cli < BaseCli
     @uaa_logger = Util.default_logger(opts[:trace]? :trace: opts[:debug]? :debug: :warn, @output)
   end
 
-  def self.uaa_info_client(url = Config.target, skip_ssl_validation = false)
-    skip_ssl_validation = Config.config[url][:skip_ssl_validation] if Config.config[url]
-    client = Info.new(url, { skip_ssl_validation: skip_ssl_validation })
+  def self.uaa_info_client(url = Config.target, skip_ssl_validation = false, ca_cert = nil)
+    if Config.config[url]
+      skip_ssl_validation = Config.config[url][:skip_ssl_validation]
+      ca_cert = Config.config[url][:ca_cert]
+    end
+    client = Info.new(url, { skip_ssl_validation: skip_ssl_validation, ssl_ca_file: ca_cert })
     client.logger = @uaa_logger
     client
   end

data/lib/cli/token.rb

@@ -25,7 +25,7 @@ class TokenCatcher < Stub::Base
     secret = server.info.delete(:client_secret)
     ti = TokenIssuer.new(Config.target, server.info.delete(:client_id), secret,
         { token_target: Config.target_value(:token_target),
-          skip_ssl_validation: Config.target_value(:skip_ssl_validation) })
+          skip_ssl_validation: Config.target_value(:skip_ssl_validation)})
     tkn = secret ? ti.authcode_grant(server.info.delete(:uri), data) :
         ti.implicit_grant(server.info.delete(:uri), data)
     server.info.update(token_info: tkn.info)
@@ -88,7 +88,8 @@ class TokenCli < CommonCli
     update_target_info
     yield TokenIssuer.new(Config.target.to_s, client_id, secret,
         { token_target: Config.target_value(:token_endpoint),
-          skip_ssl_validation: Config.target_value(:skip_ssl_validation) })
+          skip_ssl_validation: Config.target_value(:skip_ssl_validation),
+          ssl_ca_file: Config.target_value(:ca_cert) })
   rescue Exception => e
     complain e
   end

data/lib/cli/version.rb

@@ -14,6 +14,6 @@
 # Cloud Foundry namespace
 module CF
   module UAA
-    CLI_VERSION = "3.1.3"
+    CLI_VERSION = "3.1.4"
   end
 end

data/spec/common_spec.rb

@@ -89,6 +89,12 @@ describe CommonCli do
     Config.yaml.should include "skip_ssl_validation: true"
   end
 
+  it "accepts a root CA as a commandline parameter" do
+    Cli.run("target --force --ca-cert dir/rootCA.pem https://example.com")
+    Cli.output.string.should include "https://example.com"
+    Config.yaml.should include "ca_cert: dir/rootCA.pem"
+  end
+
   it "only attempts http if scheme is http" do
     Cli.run("target http://example.com")
     puts Cli.output.string

data/spec/ssl_integration_spec.rb

@@ -50,19 +50,50 @@ module CF::UAA
         end
       end
 
+      describe 'targetting a https URL' do
+        it "fails ssl validation without a certificate via HTTPS" do
+          Cli.run("target #{ENV["UAA_CLIENT_TARGET"]}")
+          Cli.output.string.should include "Invalid SSL Cert"
+        end
+
+        it "passes ssl validation if a valid rootCA is passed with an option" do
+          Cli.run("target #{ENV["UAA_CLIENT_TARGET"]} --ca-cert #{ENV["UAA_CLIENT_CA_CERT_PATH"]}")
+          Cli.output.string.should include "Target: #{ENV["UAA_CLIENT_TARGET"]}"
+          Cli.output.string.should_not match /invalid/i
+        end
+      end
+
       describe 'targeting a URL without specifying the scheme' do
         it "uses HTTPS if --skip-ssl-validation is true" do
           Cli.run("target #{@url.host}:#{@url.port}/#{@url.path} --skip-ssl-validation")
           Cli.output.string.should include "https"
           Cli.output.string.should_not include "Invalid SSL Cert"
         end
+
+        it "uses HTTPS if --ca-cert is true" do
+          Cli.run("target #{@url.host}:#{@url.port}/#{@url.path} --ca-cert #{ENV["UAA_CLIENT_CA_CERT_PATH"]}")
+          Cli.output.string.should include "https"
+          Cli.output.string.should_not match /invalid/i
+        end
       end
 
       describe 'using other commands after skipping ssl validation' do
         it "does not raise SSLException for the same target" do
           Cli.run("target #{ENV["UAA_CLIENT_TARGET"]} --skip-ssl-validation")
           Cli.run("token client get foo -s bar")
-          Cli.output.string.should_not include "Invalid SSL Cert"
+          Cli.output.string.should_not match /invalid/i
+          Cli.run("groups")
+          Cli.output.string.should_not match /invalid/i
+        end
+      end
+
+      describe 'using other commands after setting ca-cert' do
+        it "does not raise SSLException for the same target" do
+          Cli.run("target #{ENV["UAA_CLIENT_TARGET"]} --ca-cert #{ENV["UAA_CLIENT_CA_CERT_PATH"]}")
+          Cli.run("token client get foo -s bar")
+          Cli.output.string.should_not match /invalid/i
+          Cli.run("groups")
+          Cli.output.string.should_not match /invalid/i
         end
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cf-uaac
 version: !ruby/object:Gem::Version
-  version: 3.1.3
+  version: 3.1.4
 platform: ruby
 authors:
 - Dave Syer
@@ -12,7 +12,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-09-22 00:00:00.000000000 Z
+date: 2015-10-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler