Public Access
initial-commit
This commit is contained in:
Guillaume GRABÉ
Executable
+125
@@ -0,0 +1,125 @@
|
||||
#!/bin/bash
|
||||
# scripts/generate-client-cert.sh
|
||||
# Flexible client certificate generation for any use case
|
||||
# Usage: ./scripts/generate-client-cert.sh <name> <ou> [days-valid]
|
||||
|
||||
set -e
|
||||
|
||||
NAME=$1
|
||||
OU=$2
|
||||
DAYS_VALID=${3:-365}
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
CERT_DIR="${SCRIPT_DIR}/../certs"
|
||||
|
||||
if [ -z "$NAME" ] || [ -z "$OU" ]; then
|
||||
echo "Usage: $0 <name> <ou> [days-valid]"
|
||||
echo ""
|
||||
echo "Examples:"
|
||||
echo " $0 payment-service automation # Service certificate (default 365 days)"
|
||||
echo " $0 jane-doe platform-team # Admin certificate"
|
||||
echo " $0 jira-plugin plugins # Plugin certificate"
|
||||
echo " $0 contractor-bob monitoring 30 # Temporary certificate (30 days)"
|
||||
echo ""
|
||||
echo "Common OU values:"
|
||||
echo " automation → service-writer role (create, read, update, list)"
|
||||
echo " platform-team → admin role (full access)"
|
||||
echo " monitoring → catalog-reader role (read, list only)"
|
||||
echo " plugins → plugin role (read, update annotations)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Ensure cert directory exists
|
||||
mkdir -p "$CERT_DIR"
|
||||
cd "$CERT_DIR"
|
||||
|
||||
# Check if CA exists
|
||||
if [ ! -f "ca.pem" ] || [ ! -f "ca-key.pem" ]; then
|
||||
echo "❌ Error: CA not found!"
|
||||
echo " Run ./scripts/generate-dev-certs.sh first to create the CA"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "🔐 Generating certificate for: $NAME"
|
||||
echo " OU: $OU"
|
||||
echo " Organization: Company"
|
||||
echo " Valid for: $DAYS_VALID days"
|
||||
echo ""
|
||||
|
||||
# Generate private key
|
||||
openssl genrsa -out "${NAME}-key.pem" 2048 2>/dev/null
|
||||
|
||||
# Generate CSR
|
||||
openssl req -new \
|
||||
-key "${NAME}-key.pem" \
|
||||
-out "${NAME}.csr" \
|
||||
-subj "/CN=${NAME}/OU=${OU}/O=Company/C=US" \
|
||||
2>/dev/null
|
||||
|
||||
# Sign certificate
|
||||
openssl x509 -req \
|
||||
-days ${DAYS_VALID} \
|
||||
-in "${NAME}.csr" \
|
||||
-CA ca.pem \
|
||||
-CAkey ca-key.pem \
|
||||
-CAcreateserial \
|
||||
-out "${NAME}-cert.pem" \
|
||||
-extfile <(echo "extendedKeyUsage=clientAuth") \
|
||||
2>/dev/null
|
||||
|
||||
# Clean up CSR
|
||||
rm "${NAME}.csr"
|
||||
|
||||
echo "✅ Certificate generated successfully!"
|
||||
echo ""
|
||||
echo "📋 Files created:"
|
||||
echo " ${CERT_DIR}/${NAME}-cert.pem"
|
||||
echo " ${CERT_DIR}/${NAME}-key.pem"
|
||||
echo ""
|
||||
echo "🔍 Certificate details:"
|
||||
openssl x509 -in "${NAME}-cert.pem" -noout -subject -dates
|
||||
echo ""
|
||||
echo "🎯 Role mapping (based on OU):"
|
||||
case $OU in
|
||||
"platform-team"|"admin")
|
||||
echo " Role: admin"
|
||||
echo " Permissions: Full access (entity:*)"
|
||||
;;
|
||||
"automation"|"ci-cd")
|
||||
echo " Role: service-writer"
|
||||
echo " Permissions: create, read, update, list entities"
|
||||
;;
|
||||
"platform"|"monitoring"|"dashboard")
|
||||
echo " Role: catalog-reader"
|
||||
echo " Permissions: read, list entities only"
|
||||
;;
|
||||
"plugins")
|
||||
echo " Role: plugin"
|
||||
echo " Permissions: read, update annotations only"
|
||||
;;
|
||||
*)
|
||||
echo " Role: Unknown - check security-config.yaml for mapping"
|
||||
echo " You may need to add a rule for OU=${OU}"
|
||||
;;
|
||||
esac
|
||||
echo ""
|
||||
echo "📦 Distribute these files securely to the user:"
|
||||
echo " ${NAME}-cert.pem"
|
||||
echo " ${NAME}-key.pem"
|
||||
echo " ca.pem"
|
||||
echo ""
|
||||
echo "💡 Example distribution:"
|
||||
echo " # Copy to user's machine:"
|
||||
echo " scp ${NAME}-cert.pem ${NAME}-key.pem ca.pem user@host:~/.charybdis/"
|
||||
echo ""
|
||||
echo " # Or store in secrets manager:"
|
||||
echo " vault kv put secret/charybdis/${NAME} \\"
|
||||
echo " cert=@${NAME}-cert.pem \\"
|
||||
echo " key=@${NAME}-key.pem \\"
|
||||
echo " ca=@ca.pem"
|
||||
echo ""
|
||||
echo "🔒 Security reminder:"
|
||||
echo " - Keep private key (${NAME}-key.pem) secret!"
|
||||
echo " - Store securely (1Password, Vault, etc.)"
|
||||
echo " - Never commit to git"
|
||||
echo " - Valid for ${DAYS_VALID} days (expires $(date -v +${DAYS_VALID}d '+%Y-%m-%d' 2>/dev/null || date -d "+${DAYS_VALID} days" '+%Y-%m-%d' 2>/dev/null || echo 'N/A'))"
|
||||
echo ""
|
||||
Executable
+134
@@ -0,0 +1,134 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Charybdis Development Certificate Generation Script
|
||||
# This script generates self-signed certificates for local development and testing
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
CERT_DIR="${SCRIPT_DIR}/../certs"
|
||||
DAYS_VALID=365
|
||||
|
||||
echo "🔐 Charybdis Certificate Generation"
|
||||
echo "===================================="
|
||||
echo ""
|
||||
|
||||
# Create certs directory
|
||||
mkdir -p "${CERT_DIR}"
|
||||
cd "${CERT_DIR}"
|
||||
|
||||
# Function to generate certificate
|
||||
generate_cert() {
|
||||
local name=$1
|
||||
local cn=$2
|
||||
local ou=$3
|
||||
local cert_type=$4 # "server" or "client"
|
||||
|
||||
echo "📝 Generating ${name}..."
|
||||
|
||||
# Generate private key
|
||||
openssl genrsa -out "${name}-key.pem" 2048 2>/dev/null
|
||||
|
||||
# Generate CSR
|
||||
openssl req -new \
|
||||
-key "${name}-key.pem" \
|
||||
-out "${name}.csr" \
|
||||
-subj "/CN=${cn}/OU=${ou}/O=Charybdis-Dev/C=US" \
|
||||
2>/dev/null
|
||||
|
||||
# Generate certificate
|
||||
if [ "${cert_type}" = "server" ]; then
|
||||
openssl x509 -req \
|
||||
-days ${DAYS_VALID} \
|
||||
-in "${name}.csr" \
|
||||
-CA ca.pem \
|
||||
-CAkey ca-key.pem \
|
||||
-CAcreateserial \
|
||||
-out "${name}-cert.pem" \
|
||||
-extfile <(echo "extendedKeyUsage=serverAuth
|
||||
subjectAltName=DNS:localhost,DNS:charybdis,DNS:charybdis.local,IP:127.0.0.1") \
|
||||
2>/dev/null
|
||||
else
|
||||
openssl x509 -req \
|
||||
-days ${DAYS_VALID} \
|
||||
-in "${name}.csr" \
|
||||
-CA ca.pem \
|
||||
-CAkey ca-key.pem \
|
||||
-CAcreateserial \
|
||||
-out "${name}-cert.pem" \
|
||||
-extfile <(echo "extendedKeyUsage=clientAuth") \
|
||||
2>/dev/null
|
||||
fi
|
||||
|
||||
# Clean up CSR
|
||||
rm "${name}.csr"
|
||||
|
||||
echo " ✅ Generated ${name}-cert.pem and ${name}-key.pem"
|
||||
}
|
||||
|
||||
# 1. Generate Root CA
|
||||
echo "🏛️ Generating Root CA..."
|
||||
if [ ! -f ca.pem ]; then
|
||||
openssl genrsa -out ca-key.pem 4096 2>/dev/null
|
||||
openssl req -new -x509 \
|
||||
-days 3650 \
|
||||
-key ca-key.pem \
|
||||
-out ca.pem \
|
||||
-subj "/CN=Charybdis Dev Root CA/O=Charybdis-Dev/C=US" \
|
||||
2>/dev/null
|
||||
echo " ✅ Generated ca.pem (Root CA)"
|
||||
else
|
||||
echo " ℹ️ Root CA already exists, skipping"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# 2. Generate Server Certificate
|
||||
echo "🖥️ Generating Server Certificate..."
|
||||
generate_cert "server" "localhost" "platform" "server"
|
||||
echo ""
|
||||
|
||||
# 3. Generate Client Certificates
|
||||
echo "👥 Generating Client Certificates..."
|
||||
echo ""
|
||||
|
||||
# Admin client
|
||||
generate_cert "admin" "admin-user" "platform-team" "client"
|
||||
|
||||
# CI/CD Pipeline client
|
||||
generate_cert "ci-pipeline" "ci-pipeline" "automation" "client"
|
||||
|
||||
# Backstage client
|
||||
generate_cert "backstage" "backstage" "platform" "client"
|
||||
|
||||
# DefectDojo plugin client
|
||||
generate_cert "defectdojo-plugin" "defectdojo-plugin" "plugins" "client"
|
||||
|
||||
# DependencyTrack plugin client
|
||||
generate_cert "dependencytrack-plugin" "dependencytrack-plugin" "plugins" "client"
|
||||
|
||||
echo ""
|
||||
echo "✅ Certificate Generation Complete!"
|
||||
echo ""
|
||||
echo "📂 Certificates generated in: ${CERT_DIR}"
|
||||
echo ""
|
||||
echo "📋 Summary:"
|
||||
echo " - Root CA: ca.pem, ca-key.pem"
|
||||
echo " - Server: server-cert.pem, server-key.pem"
|
||||
echo " - Clients:"
|
||||
echo " • admin-cert.pem, admin-key.pem (role: admin)"
|
||||
echo " • ci-pipeline-cert.pem, ci-pipeline-key.pem (role: service-writer)"
|
||||
echo " • backstage-cert.pem, backstage-key.pem (role: catalog-reader)"
|
||||
echo " • defectdojo-plugin-cert.pem, defectdojo-plugin-key.pem (role: plugin)"
|
||||
echo " • dependencytrack-plugin-cert.pem, dependencytrack-plugin-key.pem (role: plugin)"
|
||||
echo ""
|
||||
echo "🔍 Verify certificates:"
|
||||
echo " openssl x509 -in ${CERT_DIR}/server-cert.pem -text -noout"
|
||||
echo ""
|
||||
echo "🚀 Use with Charybdis:"
|
||||
echo " export SECURITY_MTLS_ENABLED=true"
|
||||
echo " export SECURITY_MTLS_SERVER_CERT=${CERT_DIR}/server-cert.pem"
|
||||
echo " export SECURITY_MTLS_SERVER_KEY=${CERT_DIR}/server-key.pem"
|
||||
echo " export SECURITY_MTLS_CLIENT_CA=${CERT_DIR}/ca.pem"
|
||||
echo ""
|
||||
echo "⚠️ These are DEVELOPMENT certificates only!"
|
||||
echo " Do NOT use in production. Generate proper certificates from a trusted CA."
|
||||
echo ""
|
||||
@@ -0,0 +1,82 @@
|
||||
{
|
||||
"realm": "charybdis",
|
||||
"enabled": true,
|
||||
"clients": [
|
||||
{
|
||||
"clientId": "charybdis-sync",
|
||||
"enabled": true,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"secret": "charybdis-sync-secret",
|
||||
"serviceAccountsEnabled": true,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"publicClient": false,
|
||||
"protocol": "openid-connect",
|
||||
"fullScopeAllowed": true
|
||||
}
|
||||
],
|
||||
"groups": [
|
||||
{
|
||||
"name": "engineering",
|
||||
"path": "/engineering",
|
||||
"subGroups": [
|
||||
{
|
||||
"name": "backend",
|
||||
"path": "/engineering/backend",
|
||||
"subGroups": []
|
||||
},
|
||||
{
|
||||
"name": "frontend",
|
||||
"path": "/engineering/frontend",
|
||||
"subGroups": []
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "security",
|
||||
"path": "/security",
|
||||
"subGroups": []
|
||||
}
|
||||
],
|
||||
"users": [
|
||||
{
|
||||
"username": "alice",
|
||||
"email": "alice@example.com",
|
||||
"firstName": "Alice",
|
||||
"lastName": "Martin",
|
||||
"enabled": true,
|
||||
"emailVerified": true,
|
||||
"groups": ["/engineering/backend", "/security"]
|
||||
},
|
||||
{
|
||||
"username": "bob",
|
||||
"email": "bob@example.com",
|
||||
"firstName": "Bob",
|
||||
"lastName": "Dupont",
|
||||
"enabled": true,
|
||||
"emailVerified": true,
|
||||
"groups": ["/engineering/frontend"]
|
||||
},
|
||||
{
|
||||
"username": "charlie",
|
||||
"email": "charlie@example.com",
|
||||
"firstName": "Charlie",
|
||||
"lastName": "Garcia",
|
||||
"enabled": true,
|
||||
"emailVerified": false,
|
||||
"groups": ["/engineering"]
|
||||
},
|
||||
{
|
||||
"username": "service-account-charybdis-sync",
|
||||
"enabled": true,
|
||||
"serviceAccountClientId": "charybdis-sync",
|
||||
"clientRoles": {
|
||||
"realm-management": [
|
||||
"view-users",
|
||||
"query-users",
|
||||
"query-groups",
|
||||
"view-realm"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user