Skip to content

Commit cd0e783

Browse files
juliannguyen4juliannguyen4
authored
[CLIENT-3510] Add support for adding a PKI user without a password (#787)
- CI/CD: Enable mutual TLS authentication for running the create_pki_user test. Create client certificate and private signing key for the "superuser" user Extra changes: - Add missing documentation for aerospike.AUTH_PKI constant - Docs: Fix incorrect parameter name "username" by changing it to "user" for Client.admin_{create_user,drop_user,change_password,set_password,grant_roles,revoke_roles}() - Fix invalid usage of nullcontext in tests - Replace metadata section in dynamic config with version field - Tend interval must be at least 250 ms now - [CLIENT-3500] Fix seg fault when we run a paginated query with a partition filter and then re-run the same query object with another partition filter that has different "begin" and "count" values - [CLIENT-3543] Support client identifier user agent
1 parent 7ccf63b commit cd0e783

File tree

23 files changed

+326
-131
lines changed

23 files changed

+326
-131
lines changed

‎.github/actions/run-ee-server/action.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,9 @@ runs:
125125
crudini --set config.conf tls enable true
126126
# Cannot use abs path because config.conf is copied into Docker container during cibuildwheel tests
127127
crudini --set config.conf tls cafile ../.github/workflows/docker-build-context/${{ env.CA_CERT_FILE_NAME }}
128+
crudini --set config.conf tls keyfile ../.github/workflows/docker-build-context/client.pem
129+
crudini --set config.conf tls certfile ../.github/workflows/docker-build-context/client.cer
130+
128131
working-directory: test
129132
shell: bash
130133

‎.github/workflows/build-wheels.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -420,7 +420,7 @@ jobs:
420420
working-directory: test
421421
shell: bash
422422

423-
- run: python3 -m pytest -vv new_tests/${{ inputs.test-file }}
423+
- run: python3 -m pytest -vvs --full-trace new_tests/${{ inputs.test-file }}
424424
working-directory: test
425425
shell: bash
426426

‎.github/workflows/docker-build-context/Dockerfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,9 +66,11 @@ ARG SSL_WORKING_DIR=/etc/ssl
6666
WORKDIR $SSL_WORKING_DIR
6767
ARG SERVER_KEY_INSTALL_PATH=$SSL_WORKING_DIR/private/$SERVER_KEY_FILE_NAME
6868
ARG SERVER_CERT_INSTALL_PATH=$SSL_WORKING_DIR/certs/$SERVER_CERT_FILE_NAME
69+
ARG CA_CERT_INSTALL_PATH=$SSL_WORKING_DIR/certs/$CA_CERT_FILE_NAME
6970

7071
COPY --from=generate-server-cert-for-tls $SERVER_KEY_FILE_NAME $SERVER_KEY_INSTALL_PATH
7172
COPY --from=generate-server-cert-for-tls $SERVER_CERT_FILE_NAME $SERVER_CERT_INSTALL_PATH
73+
COPY --from=generate-server-cert-for-tls $CA_CERT_FILE_NAME $CA_CERT_INSTALL_PATH
7274

7375
# User can set their own TLS port if they want
7476
ARG TLS_PORT=4333

‎.github/workflows/docker-build-context/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
This Docker image deploys an Aerospike server with these features enabled by default:
44
- Strong consistency
55
- Security
6-
- TLS standard authentication
6+
- TLS mutual authentication
77

88
To disable any of the above features, start up the Docker container with any combination of these environment variables set:
99
```sh

‎.github/workflows/docker-build-context/aerospike-dev.conf.jinja‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,13 @@ network {
2626
tls docker {
2727
key-file /etc/ssl/private/server.pem
2828
cert-file /etc/ssl/certs/server.cer
29+
ca-file /etc/ssl/certs/ca.cer
2930
}
3031
{% endif %}
3132
service {
3233
{% if tls is true %}
3334
tls-port 4333
34-
tls-authenticate-client false
35+
tls-authenticate-client any
3536
tls-name docker
3637
{% endif %}
3738
address any
@@ -84,5 +85,8 @@ namespace test {
8485
{% if security is true %}
8586
security {
8687
enable-quotas true
88+
log {
89+
report-violation true
90+
}
8791
}
8892
{% endif %}

‎.github/workflows/docker-build-context/client.cer‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIEyDCCA7CgAwIBAgIUIETHVXivRIYcjdTxPSoh3RtC4ogwDQYJKoZIhvcNAQEL
3+
BQAwezELMAkGA1UEBhMCWFgxEjAQBgNVBAgMCVN0YXRlTmFtZTERMA8GA1UEBwwI
4+
Q2l0eU5hbWUxFDASBgNVBAoMC0NvbXBhbnlOYW1lMRswGQYDVQQLDBJDb21wYW55
5+
U2VjdGlvbk5hbWUxEjAQBgNVBAMMCW15ZHVtbXljYTAgFw0yNTA2MTYxNjEwNTNa
6+
GA85OTk5MTIzMTIzNTk1OVowezELMAkGA1UEBhMCWFgxEjAQBgNVBAgMCVN0YXRl
7+
TmFtZTERMA8GA1UEBwwIQ2l0eU5hbWUxFDASBgNVBAoMC0NvbXBhbnlOYW1lMRsw
8+
GQYDVQQLDBJDb21wYW55U2VjdGlvbk5hbWUxEjAQBgNVBAMMCXN1cGVydXNlcjCC
9+
AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALfGbEi8S6LpivbttTJSrFEb
10+
TN7rjk7hjbxlF9BTWKmVjhdrOxQQmVEJMy6PMgR0HgWtn3aGW6LONYhpx01K2l9w
11+
ZjB3BoJzNSXK3pRliIJofTUOhCdkwfHDwECWvPgaVmFgtxIexXMX2Kj/70fdncGk
12+
ucjeYQFolFfRcKCKPV5E4UceH2blU427e/PH3vFE8VRmYAIK/yTy31e1ES1IbG3H
13+
zcGDREWvA1RAqWcPeII65/vb++2xb8mW0JVQlE1mXIuLMtt3p7QVbK84ApgqxKxj
14+
2qjcq4O4RMmMgmUXU1k5/PLkgPwct3JmzZzkbv8fXe5LuYokUMIlpsJH0gNfPjCo
15+
sSZO34g1uf9HX/gszxA//27/O4yEgw9056+/bIAkMlLxP2VIyJB1WMjS6npv0A9D
16+
D+mDhdub2Y7fjxlz9geR3xrceRZWh8kn0QSgfio3kEVQEQXwi27AVoJB8Xg3GUYN
17+
F0eLsV57wrKFm/a2HmvVUzxL/aJOznaa8jsPNVGE845es4PMIYEHesTjeTn7umos
18+
/XILme0iRqzB1KsCbjrUbar2JOo0gFYWtpUOOEG2VXvVdpBYTDZ48XyFqUeybhUV
19+
XH3uQ7nemssYgdCqYpjHSS7jTEQrkkbofGd058XsmAon+bOexEJxZ0Fr4KlgRiUb
20+
SUUpTBqyiSKItzUzO1ehAgMBAAGjQjBAMB0GA1UdDgQWBBRwXiTq3ZMAkXifcUKi
21+
X9mkalOtWDAfBgNVHSMEGDAWgBRcG7rWKxU2uHJz9ZEMwStZi4oY5DANBgkqhkiG
22+
9w0BAQsFAAOCAQEApptwoi388Qtypv3/ArFEmGfaiL5Dne0NbT003NHyRpI6WkZf
23+
qnrZlrs8e46hqaqiEE8B8bIYX7ANZW8ZUCz+NAqvsY9QFlDytOVK3B/shEDCWAz6
24+
28edGAjeBXgJBX1yVQWQO882vux7Cgwut/ziBYQX9A5WNDkhj6PsvsGXqCq20C0B
25+
E8xa5BitGNaVwSXqdSUipt3DofCZQzTRYBXgvQXPrzVOWpye/5ls/xux9oIVwIiO
26+
P5WSNTj0J1vFUGlj8YSWLah9Lo52W94T00oQeRt5yAdkIaYzufwYYVzbcmlH5v23
27+
iRtOk9ZTxN/1VdT+3KGjj92ukH2McLrR1A1fWg==
28+
-----END CERTIFICATE-----

‎.github/workflows/docker-build-context/client.pem‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQC3xmxIvEui6Yr2
3+
7bUyUqxRG0ze645O4Y28ZRfQU1iplY4XazsUEJlRCTMujzIEdB4FrZ92hluizjWI
4+
acdNStpfcGYwdwaCczUlyt6UZYiCaH01DoQnZMHxw8BAlrz4GlZhYLcSHsVzF9io
5+
/+9H3Z3BpLnI3mEBaJRX0XCgij1eROFHHh9m5VONu3vzx97xRPFUZmACCv8k8t9X
6+
tREtSGxtx83Bg0RFrwNUQKlnD3iCOuf72/vtsW/JltCVUJRNZlyLizLbd6e0FWyv
7+
OAKYKsSsY9qo3KuDuETJjIJlF1NZOfzy5ID8HLdyZs2c5G7/H13uS7mKJFDCJabC
8+
R9IDXz4wqLEmTt+INbn/R1/4LM8QP/9u/zuMhIMPdOevv2yAJDJS8T9lSMiQdVjI
9+
0up6b9APQw/pg4Xbm9mO348Zc/YHkd8a3HkWVofJJ9EEoH4qN5BFUBEF8ItuwFaC
10+
QfF4NxlGDRdHi7Fee8KyhZv2th5r1VM8S/2iTs52mvI7DzVRhPOOXrODzCGBB3rE
11+
43k5+7pqLP1yC5ntIkaswdSrAm461G2q9iTqNIBWFraVDjhBtlV71XaQWEw2ePF8
12+
halHsm4VFVx97kO53prLGIHQqmKYx0ku40xEK5JG6HxndOfF7JgKJ/mznsRCcWdB
13+
a+CpYEYlG0lFKUwasokiiLc1MztXoQIDAQABAoICAAD6rtBG55Nv8Y3TXQODrFfM
14+
y1CwmjbPox2UP3zx0BTBlMr0Ecck4lTrwCubofljLyyaJ5xo3B4OlvtZzpuZ84wD
15+
ZBoBQltpgX3zb32Z2mZmfTdOMzRSCD9cFYnKkSnJxc4kRv7ILka+GL6SyYu9RwZK
16+
1PNt7ZVQNo0kEwNvT83RKbmjKT6XPXtxeq2P0goV/dVfK8cLAl/IJwTsvzFkc8Z0
17+
ec38ikg28I+5/fpsJc5c1xMGRwNV2RSECBW+7YwJiKKfjIxzPg/6tr7qxPHFCudS
18+
a2N6XzQXGY+7iXoq1lv7pVOb1decuroCc/lFwCp+GGt+WLgJ7ZURQLWY5B9g5NVj
19+
eLToZFjhNUm6vWJkRWkZkR69qRveDsRj73gR9Rd8OQLjPgjP96gCiubzODZC45Eh
20+
/OTj6IGJ9e6JSq814SJ4ICPmoxLi2bSaWhKzrTbblvPcNAdwsjJ/dYyR8gCxM7cU
21+
HalGfWAovDsQjzqioyn2gTbgKNqYgkmHm954T82TqbnAGVeXkAbgtrDRtRBKqU//
22+
WFhZ6ODcAYpql2Xbt4AJe8xog8xNFpDqdDz50szDDeidYyYINQc/WTOYuAWOG/aP
23+
zAJvJmQMkl/v+7+ga1rVKPzDQL/fSwx2RPNZpcsVln5LSCTD3NGiKuO2Sut1sd7s
24+
yVu8gl7ZeRWF+yfLnoFhAoIBAQDsvNhXNZXfcwZZVZTAJD422+BzvBON26mawNr/
25+
/Jb4JwMquJqGaY+yAaf3YXFM/HdZvEDOAbq7gIRX+Zkw+5P5Ur8qbgDyKYDDV57t
26+
BAoGh7aixuoBC0QYoW780S2zjBWoanbaRr+xHJyEPmdYgiGR9rTr0Av425PyjAnr
27+
Zp6SsT68T6plq4L7ByBc4F9fcBEWbVZzEwdadBpuhMym/I1F1YLO7fvmN6M/oK9H
28+
Ni+KpXzk0xAF3w4/l5L+vdzoNQbkul3JV8tZIGe8a7lK4xlpJXwhKcDDQm55LT44
29+
BHGgsjBU8GWcoQuzGOpMiNJponu2x13iuItVCNVE1pcwAutxAoIBAQDGumM3OZXO
30+
KqwOu3RipAMELpo4paoE8SwYYkSgxfAW0Vjvumdstu3NJhP4SCQYOygTVmAQhoTn
31+
8czgzDS8yMYPiJTq2HP8O71ekndTcWz5LtY4z1WIGIGn01rPqB3jznjwpBkQ+T/O
32+
XUpca2Bc3zPPlkk3gbxP/JIIic+hBrWJexjfgR/Q2sY/1vuAe3hdWhWmm5IzGd4T
33+
hqG+4DtgCbrDtgSNVDS8KTvposM/H7LLAkCjxua5Udo1yMVUAWw4oXTA8CbuOJtv
34+
Y3jv4XkGgK/0T0/7ZfUJAeuwhsHsPCM8egVdDhizyddcRPWkHlI4plKubuMwI4/3
35+
/J+wjHISBzcxAoIBAFURrzP3X3nCHZ/wbtl0rJ6N+GPeS7CIJLQlZQzjuWRGsI6j
36+
c3OlbytqCO+OJmahukmWqjrcyDskfWoXmQLPBGdtYqBekxxx6YFIdSV6dBfQoMJx
37+
dBkX8UpgiD9081U3m3i/eSIKlkuQmnWy7vQRHvsSigTK5+JvFQTtaYsbfxP7eS21
38+
+uc58IFAGFMHlX34CUvj0lLbnaLVYcIhGmFPE3zqsmylfAVILPNqTFHsmLzbprub
39+
VICnnLkhQIMlusH+fBGpHpaBY+MND/nXQ+gzHyh3fdl05X3E22nT5i2++w3huhhr
40+
ojfcbxXWeCs0Z1fqOUZ+8a/M3NSbrfdknUN1aSECggEAFfHdJOsJ/OM/br0KhB4C
41+
a0LOKvU4SiVrriGj3HEfKxXhEU/vPdURe3b5+4/T1I0rxr7iCtEf+hD8g9Jo/HPb
42+
UznM4AYZAMCED95yqNc8pmOiqlFS651xK9wuCgJRkqdpOYGVdwdfIWWx4XTGBltr
43+
eD/rQ+LirZ6BbcnyEKESCOV8AKpcng6al9Ago7Z+uyhIfcZuJZB0solKcS6Hv/oz
44+
EouWAxlKXYDcKdecYesZLkvIYY2ESvCb/RZ3m+gwUCycHPYoBmRf3bQJVcv7Nlmd
45+
lIfxmBxRK7Z3lV28Kl8VsQb0cqss1SWzz2+aBI6Im9LaDIMYOWej7UmLRM6thgof
46+
8QKCAQEAoTd/lynH1+DnoDNRWLvXTkyTiZ8T9DJT632K94J2cHcXJ+uhdhDGrLPq
47+
5kahYb8Ji/O+i/ti75D6rF8FkJoYwNbmwDzftD98pdoX+vEZRhLWi6BeU8vEvVWK
48+
Wq/6U7n7RFNJBRmr4TLNHoIdDnfuIpxjbCdAG4Hd/kL7ULs30SuXTb+tYKZzw+4G
49+
XpONoWCP17Or9ZV4/PftYdk3XJaEc4nLEIfL2BZErpNSV8Jm62Xj8JCsheAPDN1L
50+
2kWSf4wYySstpc+qvejdn0kWiaVB6A6sqXrHMWUE5pdWLECURC2l/Wd/9e13ll12
51+
bTJcNI/1lR7ZONcgBG7vh43FD3Yk8w==
52+
-----END PRIVATE KEY-----

‎.github/workflows/tests.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -401,7 +401,9 @@ jobs:
401401
registry-password: ${{ env.REGISTRY_NAME == 'docker.io' && secrets.DOCKER_HUB_BOT_PW || secrets.QE_DOCKER_REGISTRY_PASSWORD }}
402402

403403
- name: Run tests
404-
run: python -m pytest ./new_tests/test_{mrt_functionality,admin_*,compress}.py -W error::pytest.PytestUnraisableExceptionWarning
404+
# -s: we want to check that the test_create_pki_user test case passes or raises an exception as expected
405+
# There's no way to tell unless we see the logs
406+
run: python -m pytest -s ./new_tests/test_{mrt_functionality,admin_*,compress}.py -W error::pytest.PytestUnraisableExceptionWarning
405407
working-directory: test
406408

407409
- name: Show logs if failed

‎aerospike-client-c‎

Submodule aerospike-client-c updated 67 files

‎aerospike-stubs/aerospike.pyi‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -334,6 +334,7 @@ class Client:
334334
def __init__(self, *args, **kwargs) -> None: ...
335335
def admin_change_password(self, username: str, password: str, policy: dict = ...) -> None: ...
336336
def admin_create_role(self, role: str, privileges: list, policy: dict = ..., whitelist: list = ..., read_quota: int = ..., write_quota: int = ...) -> None: ...
337+
def admin_create_pki_user(self, username: str, roles: list, policy: dict = ...) -> None: ...
337338
def admin_create_user(self, username: str, password: str, roles: list, policy: dict = ...) -> None: ...
338339
def admin_drop_role(self, role: str, policy: dict = ...) -> None: ...
339340
def admin_drop_user(self, username: str, policy: dict = ...) -> None: ...

0 commit comments

Comments
 (0)