first build

tests/test_issue.py

@@ -0,0 +1,43 @@
+from cryptography import x509
+from cryptography.hazmat.primitives.serialization import Encoding
+from cryptography.x509 import load_pem_x509_csr
+from tests.helpers import sign_csr
+
+from cert_portal.certsrv import CertsrvClient
+from cert_portal.enrollment import SID_SAN_URI_PREFIX
+from cert_portal.issue import ProfileIssuer
+
+
+class _FakeCertsrv:
+    def __init__(self, ca_key, ca_cert):
+        self.ca_key = ca_key
+        self.ca_cert = ca_cert
+        self.last_csr = None
+
+    def submit_csr(self, csr_pem, template=None):
+        pem = csr_pem if isinstance(csr_pem, bytes) else csr_pem.encode("ascii")
+        self.last_csr = pem
+        csr = load_pem_x509_csr(pem)
+        cert = sign_csr(csr, self.ca_key, self.ca_cert)
+        return cert.public_bytes(Encoding.PEM)
+
+
+def test_issue_signs_profile_for_user(settings, directory_user, test_ca):
+    ca_key, ca_cert = test_ca
+    fake = _FakeCertsrv(ca_key, ca_cert)
+    issuer = ProfileIssuer(settings, certsrv=fake)
+    issued = issuer.issue(directory_user)
+    assert issued.upn == directory_user.upn
+    assert issued.sid == directory_user.sid
+    assert issued.filename.endswith(".mobileconfig")
+    assert issued.signed_mobileconfig.startswith(b"\x30")
+    assert b"com.apple.security.pkcs12" in issued.signed_mobileconfig
+    csr = load_pem_x509_csr(fake.last_csr)
+    san = csr.extensions.get_extension_for_class(x509.SubjectAlternativeName).value
+    uris = [n.value for n in san if isinstance(n, x509.UniformResourceIdentifier)]
+    assert f"{SID_SAN_URI_PREFIX}{directory_user.sid}" in uris
+
+
+def test_ntlm_username_includes_domain(settings):
+    client = CertsrvClient(settings)
+    assert client._ntlm_user() == "EXAMPLE\\portal"