34 lines
1.2 KiB
Python
34 lines
1.2 KiB
Python
from cryptography import x509
|
|
from cryptography.x509 import load_pem_x509_csr
|
|
|
|
from cert_portal.enrollment import (
|
|
SID_SAN_URI_PREFIX,
|
|
UPN_OID,
|
|
build_csr,
|
|
generate_rsa_key,
|
|
sid_san_uri,
|
|
)
|
|
|
|
|
|
def test_csr_contains_upn_othername_and_sid_uri():
|
|
key = generate_rsa_key(2048).key
|
|
upn = "[email protected]"
|
|
sid = "S-1-5-21-1-2-3-4"
|
|
pem = build_csr(key=key, upn=upn, sid=sid)
|
|
csr = load_pem_x509_csr(pem)
|
|
assert csr.subject.rfc4514_string() == f"CN={upn}"
|
|
san = csr.extensions.get_extension_for_class(x509.SubjectAlternativeName).value
|
|
names = list(san)
|
|
uris = [n.value for n in names if isinstance(n, x509.UniformResourceIdentifier)]
|
|
others = [n for n in names if isinstance(n, x509.OtherName)]
|
|
assert uris == [f"{SID_SAN_URI_PREFIX}{sid}"]
|
|
assert sid_san_uri(sid) in uris
|
|
assert any(o.type_id == UPN_OID for o in others)
|
|
upn_other = next(o for o in others if o.type_id == UPN_OID)
|
|
# DER UTF8String: tag 0x0c, short length, payload
|
|
assert upn_other.value[0] == 0x0C
|
|
length = upn_other.value[1]
|
|
assert upn_other.value[2 : 2 + length].decode("utf-8") == upn
|
|
assert b"-----BEGIN CERTIFICATE REQUEST-----" in pem
|
|
assert pem.startswith(b"-----BEGIN")
|