name: Run SSCEP on node01
testcases:
- name: create_temp_directory
  steps:
    - type: exec
      script: "mktemp -d"
      info: '{{.result.systemout}}'
      vars:
        temp_dir:
          from: result.systemout

- name: generate_private_key_without_passphrase
  steps:
    - type: exec
      script: |
        ( _fd="{{.create_temp_directory.temp_dir}}/client.key" ; _len="2048" ; \
        openssl genrsa -out ${_fd} ${_len} )

- name: generate_csr_config
  steps:
    - type: exec
      script: |
        cat > {{.create_temp_directory.temp_dir}}/client.cnf << EOF
        [req]
        default_bits = 2048
        prompt = no
        # must be ignored by pfpki in favor of PKI template setting
        default_md = sha1
        distinguished_name = dn
        attributes = req_attributes
        req_extensions = req_ext
        
        [ req_attributes ]
        challengePassword = {{.wired_dot1x_eap_tls_manual.certs.user.scep_challenge_password}}

        [ req_ext ]
        subjectAltName = @alt_names
        # must be ignored by pfpki in favor of PKI template setting
        extendedKeyUsage = serverAuth
        
        [ dn ]
        CN={{.wired_dot1x_eap_tls_scep.certs.user.cn}}

        [ alt_names ]
        DNS.1 = {{.wired_dot1x_eap_tls_scep.certs.user.dns1}}
        email.1 = {{.wired_dot1x_eap_tls_scep.certs.user.email}}
        # first number is an OID to identify attribute
        otherName = 1.3.6.1.4.1.311.20.2.3;UTF8:{{.wired_dot1x_eap_tls_scep.certs.user.other_name}}
        EOF
        
- name: generate_csr_with_challenge
  steps:
    - type: exec
      script: |
        ( _fd="{{.create_temp_directory.temp_dir}}/client.key" ; _fd_csr="{{.create_temp_directory.temp_dir}}/client.csr" ; \
        openssl req -out ${_fd_csr} -new -key ${_fd} -config {{.create_temp_directory.temp_dir}}/client.cnf )

- name: get_ca_cert_using_sscep
  steps:
    - type: exec
      script: |
        sscep getca -u http://{{.pfserver_mgmt_ip}}/scep/{{.wired_dot1x_eap_tls_scep.templates.user.name}} \
        -c {{.create_temp_directory.temp_dir}}/ca.pem -i {{.wired_dot1x_eap_tls_scep.certs.ca.cn}} -v -d

- name: get_client_cert_using_sscep
  steps:
    - type: exec
      script: |
        sscep enroll -c {{.create_temp_directory.temp_dir}}/ca.pem  -k {{.create_temp_directory.temp_dir}}/client.key \
        -r {{.create_temp_directory.temp_dir}}/client.csr \
        -u http://{{.pfserver_mgmt_ip}}/scep/{{.wired_dot1x_eap_tls_scep.templates.user.name}} -l {{.create_temp_directory.temp_dir}}/client.pem -v -d -S sha1 -E aes

- name: check_client_cert
  steps:

    # check signature algorithm
    - type: exec
      script: |
        openssl x509 -in {{.create_temp_directory.temp_dir}}/client.pem -text \
        -certopt ca_default \
        -certopt no_validity \
        -certopt no_serial \
        -certopt no_subject \
        -certopt no_extensions \
        -certopt no_signame
      assertions:
        - result.systemout ShouldContainSubstring "{{.wired_dot1x_eap_tls_scep.certs.digest.text}}"

    # check extendedKeyUsage
    - type: exec
      script: 'openssl x509 -in {{.create_temp_directory.temp_dir}}/client.pem -noout -ext extendedKeyUsage'
      assertions:
        - result.systemout ShouldContainSubstring "{{.wired_dot1x_eap_tls_scep.certs.user.extended_key_usage.text}}"

      # check subject
    - type: exec
      script: 'openssl x509 -in {{.create_temp_directory.temp_dir}}/client.pem -noout -subject'
      assertions:
        - result.systemout ShouldContainSubstring "{{.wired_dot1x_eap_tls_scep.certs.user.subject_openssl}}"

    # check email
    - type: exec
      script: 'openssl x509 -in {{.create_temp_directory.temp_dir}}/client.pem -noout -email'
      # exact match
      assertions:
        - result.systemout ShouldEqual "{{.wired_dot1x_eap_tls_scep.certs.user.email}}"

    # check subjectAltName which can contains mail, IP addresses, DNS and otherName
    # here we check for DNS
    # otherName value can be read using:
    # openssl asn1parse -in client.pem (to get offset of SAN)
    # openssl asn1parse -in client.epm -strparse OFFSET_NUMBER
    - type: exec
      script: 'openssl x509 -in {{.create_temp_directory.temp_dir}}/client.pem -noout -ext subjectAltName'
      assertions:
        - result.systemout ShouldContainSubstring "DNS:{{.wired_dot1x_eap_tls_scep.certs.user.dns1}}"

- name: move_certificates
  steps:
    - type: exec
      script: |
        sudo cp -v {{.create_temp_directory.temp_dir}}/* /etc/wpa_supplicant/eap_tls/
