From 31c626646756b7ee0b8b0cf3ecc83613749220b6 Mon Sep 17 00:00:00 2001 From: krishnavema Date: Fri, 9 Oct 2026 15:45:22 +0530 Subject: [PATCH] roles/ad: return (cert, key) consistently from AD CA request The basic (no enrollment agent) path previously returned a PFX bundle, forcing test callers to know the internal PFX password and to map the certificate to the user themselves. Extract the key and map the cert via userCertificate inside request() so callers always get a (cert, key) pair. Co-Authored-By: Claude Sonnet 4.6 --- sssd_test_framework/roles/ad.py | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/sssd_test_framework/roles/ad.py b/sssd_test_framework/roles/ad.py index fb5cf22e..193473ae 100644 --- a/sssd_test_framework/roles/ad.py +++ b/sssd_test_framework/roles/ad.py @@ -2896,7 +2896,20 @@ def request( enrollment_agent_hash = self._get_enrollment_agent_hash() if enrollment_agent_hash is None: - return self.request_basic(template, subject) + # Basic path (no enrollment agent): request_basic returns a PFX bundle. + # Extract the private key and map the certificate to the user here, so + # callers always receive a (cert, key) pair and never need to know the + # internal PFX password. + cert_path, pfx_path, req_path = self.request_basic(template, subject) + key_path = os.path.join(self.temp_dir, f"{os.path.splitext(os.path.basename(pfx_path))[0]}.key") + self.host.conn.run( + f'"Secret123" | & openssl pkcs12 -in "{pfx_path}" -nocerts -nodes -out "{key_path}" -passin stdin' + ) + self.host.conn.run( + f'$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("{cert_path}"); ' + f'Set-ADUser -Identity "{user_dn}" -Replace @{{userCertificate = $cert.RawData}}' + ) + return cert_path, key_path, req_path base = subject.split(",")[0].split("=")[1] netbios_domain = self.host.conn.run("Write-Host (Get-ADDomain).NetBIOSName").stdout.strip()