From b210018ed1abfd673abf49a23fc6cf0d6fcbdba4 Mon Sep 17 00:00:00 2001 From: krishnavema Date: Fri, 9 Oct 2026 15:45:22 +0530 Subject: [PATCH] roles/ad: return (cert, key) consistently from AD CA request The basic (no enrollment agent) path previously returned a PFX bundle, forcing test callers to know the internal PFX password and to map the certificate to the user themselves. Extract the key and map the cert via userCertificate inside request() so callers always get a (cert, key) pair. Co-Authored-By: Claude Sonnet 4.6 --- sssd_test_framework/roles/ad.py | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/sssd_test_framework/roles/ad.py b/sssd_test_framework/roles/ad.py index fb5cf22e..193473ae 100644 --- a/sssd_test_framework/roles/ad.py +++ b/sssd_test_framework/roles/ad.py @@ -2896,7 +2896,20 @@ def request( enrollment_agent_hash = self._get_enrollment_agent_hash() if enrollment_agent_hash is None: - return self.request_basic(template, subject) + # Basic path (no enrollment agent): request_basic returns a PFX bundle. + # Extract the private key and map the certificate to the user here, so + # callers always receive a (cert, key) pair and never need to know the + # internal PFX password. + cert_path, pfx_path, req_path = self.request_basic(template, subject) + key_path = os.path.join(self.temp_dir, f"{os.path.splitext(os.path.basename(pfx_path))[0]}.key") + self.host.conn.run( + f'"Secret123" | & openssl pkcs12 -in "{pfx_path}" -nocerts -nodes -out "{key_path}" -passin stdin' + ) + self.host.conn.run( + f'$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("{cert_path}"); ' + f'Set-ADUser -Identity "{user_dn}" -Replace @{{userCertificate = $cert.RawData}}' + ) + return cert_path, key_path, req_path base = subject.split(",")[0].split("=")[1] netbios_domain = self.host.conn.run("Write-Host (Get-ADDomain).NetBIOSName").stdout.strip()