Infra
/
lemur
5
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
lemur/lemur/tests/conf.py

189 lines
7.6 KiB
Python
Raw Normal View History

adding testing conf
2015-07-22 19:53:35 +02:00
# This is just Python which means you can inherit and tweak settings
import os
unit test
2018-11-28 23:27:03 +01:00
adding testing conf
2015-07-22 19:53:35 +02:00
_basedir = os.path.abspath(os.path.dirname(__file__))
THREADS_PER_PAGE = 8
Adding tests to AWS plugin
2015-07-23 17:52:56 +02:00
# General
adding testing conf
2015-07-22 19:53:35 +02:00
# These will need to be set to `True` if you are developing locally
CORS = False
debug = False
TESTING = True
# this is the secret key used by flask session management
SECRET_KEY = 'I/dVhOZNSMZMqrFJa5tWli6VQccOGudKerq3eWPMSzQNmHHVhMAQfQ=='
# You should consider storing these separately from your config
LEMUR_TOKEN_SECRET = 'test'
Use MultiFernet for encryption Facilitates key rotation and uses more secure encryption than what sqlalchemy-utils does. Fixes #117 and #119.
2015-10-10 02:17:05 +02:00
LEMUR_ENCRYPTION_KEYS = 'o61sBLNBSGtAckngtNrfVNd8xy8Hp9LBGDstTbMbqCY='
adding testing conf
2015-07-22 19:53:35 +02:00
Reworked sensitive domain name and restriction logic (#878) * This is a fix for a potential security issue; the old code had edge cases with unexpected behavior. * LEMUR_RESTRICTED_DOMAINS is no more, instead LEMUR_WHITELISTED_DOMAINS is a list of *allowed* domain name patterns. Per discussion in PR #600 * Domain restrictions are now checked everywhere: in domain name-like CN (common name) values and SAN DNSNames, including raw CSR requests. * Common name values that contain a space are exempt, since they cannot be valid domain names.
2017-08-17 04:24:49 +02:00
# List of domain regular expressions that non-admin users can issue
LEMUR_WHITELISTED_DOMAINS = [
Fix unit tests certificates to have correct chains and private keys In preparation for certificate integrity-checking: invalid certificate chains and mismatching private keys will no longer be allowed anywhere in Lemur code. The test vector certs were generated using the Lemur "cryptography" authority plugin. * Certificates are now more similar to real-world usage: long serial numbers, etc. * Private key is included for all certs, so it's easy to re-generate anything if needed.
2018-06-25 17:42:18 +02:00
'^[a-zA-Z0-9-]+\.example\.com$',
'^[a-zA-Z0-9-]+\.example\.org$',
Fill in missing cert rotation_policy; don't ignore validation errors when re-issuing certs CertificateInputSchema requires the rotation_policy field, but certificates created before the field existed have set to NULL. Thus saving such certificates failed and probably caused other errors. Made cert re-issuing (get_certificate_primitives) more strict so such errors are harder to miss in the future.
2018-08-03 12:21:45 +02:00
'^example\d+\.long\.com$',
Reworked sensitive domain name and restriction logic (#878) * This is a fix for a potential security issue; the old code had edge cases with unexpected behavior. * LEMUR_RESTRICTED_DOMAINS is no more, instead LEMUR_WHITELISTED_DOMAINS is a list of *allowed* domain name patterns. Per discussion in PR #600 * Domain restrictions are now checked everywhere: in domain name-like CN (common name) values and SAN DNSNames, including raw CSR requests. * Common name values that contain a space are exempt, since they cannot be valid domain names.
2017-08-17 04:24:49 +02:00
]
adding testing conf
2015-07-22 19:53:35 +02:00
Adding tests to AWS plugin
2015-07-23 17:52:56 +02:00
# Mail Server
adding testing conf
2015-07-22 19:53:35 +02:00
# Lemur currently only supports SES for sending email, this address
# needs to be verified
LEMUR_EMAIL = ''
Fixing a few things, adding tests. (#326)
2016-05-20 18:03:34 +02:00
LEMUR_SECURITY_TEAM_EMAIL = ['security@example.com']
adding testing conf
2015-07-22 19:53:35 +02:00
Slack spruce up (#394) * Formatting slack message. * Tweaking tests.
2016-07-06 19:27:13 +02:00
LEMUR_HOSTNAME = 'lemur.example.com'
Adding tests to AWS plugin
2015-07-23 17:52:56 +02:00
# Logging
adding testing conf
2015-07-22 19:53:35 +02:00
LOG_LEVEL = "DEBUG"
LOG_FILE = "lemur.log"
Closes #278 and #199, Starting transition to marshmallow (#299) * Closes #278 and #199, Starting transition to marshmallow
2016-05-05 21:52:08 +02:00
LEMUR_DEFAULT_COUNTRY = 'US'
LEMUR_DEFAULT_STATE = 'California'
LEMUR_DEFAULT_LOCATION = 'Los Gatos'
LEMUR_DEFAULT_ORGANIZATION = 'Example, Inc.'
LEMUR_DEFAULT_ORGANIZATIONAL_UNIT = 'Example'
Adds option to restrict certificate expiration dates to weekdays. (#453) * Adding ability to restrict certificate creation to weekdays. * Ensuring that we test for weekends.
2016-10-15 09:04:35 +02:00
LEMUR_ALLOW_WEEKEND_EXPIRATION = False
Adding tests to AWS plugin
2015-07-23 17:52:56 +02:00
# Database
adding testing conf
2015-07-22 19:53:35 +02:00
# modify this if you are not using a local database
Add docker setup for running tests on a docker enabled dev environment. (#771)
2017-04-28 18:28:06 +02:00
SQLALCHEMY_DATABASE_URI = os.getenv('SQLALCHEMY_DATABASE_URI', 'postgresql://lemur:lemur@localhost:5432/lemur')
Initial work on #125
2015-11-25 23:54:08 +01:00
SQLALCHEMY_TRACK_MODIFICATIONS = False
adding testing conf
2015-07-22 19:53:35 +02:00
Adding tests to AWS plugin
2015-07-23 17:52:56 +02:00
# AWS
LEMUR_INSTANCE_PROFILE = 'Lemur'
adding testing conf
2015-07-22 19:53:35 +02:00
Adding tests to AWS plugin
2015-07-23 17:52:56 +02:00
# Issuers
adding testing conf
2015-07-22 19:53:35 +02:00
# These will be dependent on which 3rd party that Lemur is
# configured to use.
PEP8
2015-07-23 18:08:07 +02:00
# CLOUDCA_URL = ''
# CLOUDCA_PEM_PATH = ''
# CLOUDCA_BUNDLE = ''
adding testing conf
2015-07-22 19:53:35 +02:00
# number of years to issue if not specified
PEP8
2015-07-23 18:08:07 +02:00
# CLOUDCA_DEFAULT_VALIDITY = 2
adding testing conf
2015-07-22 19:53:35 +02:00
Digicert plugin (#478) * Initial work on digicert plugin. * Adding certificate pickup, to digicert plugin. * Removing and rotating test api key.
2016-11-07 23:40:00 +01:00
Return correct intermediate certificate on digicert creation. (#762) This commit also removes the unused DIGICERT_INTERMEDIATE env var as it is not used.
2017-04-27 18:14:20 +02:00
DIGICERT_URL = 'mock://www.digicert.com'
Add DIGICERT_ORDER_TYPE to Digicert plugin (#1025) * Add DIGICERT_ORDER_TYPE to Digicert plugin This allows lemur.conf.py to control which kind of certificate to order. User defined options are not currently supported in the the UI, so we cannot create multiple Digicert authorities at runtime for separate certificate types. Change-Id: I06c216ec3c476e0001b240530626a86464be999e * Fix Mock URL for Digicert test Change-Id: Ida7c0ed1bd120c9024bea091c03b7d1ecfa66498 * Add documentation for DIGICERT_ORDER_TYPE Change-Id: I0bc347883b628416eb7f13a7c60c937dcb6ae0c2
2018-01-14 03:06:17 +01:00
DIGICERT_ORDER_TYPE = 'ssl_plus'
Digicert plugin (#478) * Initial work on digicert plugin. * Adding certificate pickup, to digicert plugin. * Removing and rotating test api key.
2016-11-07 23:40:00 +01:00
DIGICERT_API_KEY = 'api-key'
Time (#482) * adding python 3.5 as a target * adding env flag * Aligning on arrow dates.
2016-11-09 19:56:22 +01:00
DIGICERT_ORG_ID = 111111
DIGICERT_ROOT = "ROOT"
Digicert plugin (#478) * Initial work on digicert plugin. * Adding certificate pickup, to digicert plugin. * Removing and rotating test api key.
2016-11-07 23:40:00 +01:00
Adding tests to AWS plugin
2015-07-23 17:52:56 +02:00
VERISIGN_URL = 'http://example.com'
VERISIGN_PEM_PATH = '~/'
VERISIGN_FIRST_NAME = 'Jim'
VERISIGN_LAST_NAME = 'Bob'
VERSIGN_EMAIL = 'jim@example.com'
Adding ACME Support (#178)
2016-06-28 00:57:53 +02:00
Adjusting the way that certificates are requested. (#643) * Adjusting the way that certificates are requested. * Fixing tests.
2017-02-16 22:24:05 +01:00
ACME_AWS_ACCOUNT_NUMBER = '11111111111'
Adding ACME Support (#178)
2016-06-28 00:57:53 +02:00
ACME_PRIVATE_KEY = '''
-----BEGIN RSA PRIVATE KEY-----
MIIJJwIBAAKCAgEA0+jySNCc1i73LwDZEuIdSkZgRYQ4ZQVIioVf38RUhDElxy51
4gdWZwp8/TDpQ8cVXMj6QhdRpTVLluOz71hdvBAjxXTISRCRlItzizTgBD9CLXRh
vPLIMPvAJH7JZxp9xW5oVYUcHBveQJ5tQvnP7RgPykejl7DPKm/SGKYealnoGPcP
U9ipz2xXlVlx7ZKivLbaijh2kD/QE9pC//CnP31g3QFCsxOTLAWtICz5VbvaWuTT
whqFs5cT3kKYAW/ccPcty573AX/9Y/UZ4+B3wxXY3/6GYPMcINRuu/7Srs3twlNu
udoTNdM9SztWMYUzz1SMYad9v9LLGTrv+5Tog4YsqMFxyKrBBBz8/bf1lKwyfAW+
okvVe+1bUY8iSDuDx1O0iMyHe5w8lxsoTy91ujjr1cQDyJR70TKQpeBmfNtBVnW+
D8E6Xw2yCuL9XTyBApldzQ/J1ObPd1Hv+yzhEx4VD9QOmQPn7doiapTDYfW51o1O
Mo+zuZgsclhePvzqN4/6VYXZnPE68uqx982u0W82tCorRUtzfFoO0plNRCjmV7cw
0fp0ie3VczUOH9gj4emmdQd1tVA/Esuh3XnzZ2ANwohtPytn+I3MX0Q+5k7AcRlt
AyI80x8CSiDStI6pj3BlPJgma9G8u7r3E2aqW6qXCexElTCaH2t8A7JWI80CAwEA
AQKCAgBDXLyQGwiQKXPYFDvs/cXz03VNA9/tdQV/SzCT8FQxhXIN5B4DEPQNY08i
KUctjX6j9RtgoQsKKmvx9kY/omaBntvQK/RzDXpJrx62tMM1dmpyCpn7N24d7BlD
QK6DQO+UMCmobdzmrpEzF2mCLelD5C84zRca5FCmm888mKn4gsX+EaNksu4gCr+4
sSs/KyriNHo6EALYjgB2Hx7HP1fbHd8JwhnS1TkmeFN1c/Z6o3GhDTancEjqMu9U
6vRpGIcJvflnzguVBXumJ8boInXPpQVBBybucLmTUhQ1XKbafInFCUKcf881gAXv
AVi/+yjiEm1hqZ2WucpoJc0du1NBz/MP+/MxHGQ/5eaEMIz5X2QcXzQ4xn5ym0sk
Hy0SmH3v/9by1GkK5eH/RTV/8bmtb8Qt0+auLQ6/ummFDjPw866Or4FdL3tx2gug
fONjaZqypee+EmlLG1UmMejjCblmh0bymAHnFkf7tAJsLGd8I00PQiObEqaqd03o
xiYUvrbDpCHah4gB7Uv3AgrHVTbcHsEWmXuNDooD0sSXCFMf3cA81M8vGfkypqi/
ixxZtxtdTU5oCFwI9zEjnQvdA1IZMUAmz8vLwn/fKgENek9PAV3voQr1c0ctZPvy
S/k7HgJt+2Wj7Pqb4mwPgxeYVSBEM7ygOq6Gdisyhi8DP0A2fQKCAQEA6iIrSqQM
pVDqhQsk9Cc0b4kdsG/EM66M7ND5Q2GLiPPFrR59Hm7ViG6h2DhwqSnSRigiO+TN
jIuvD/O0kbmCUZSar19iKPiJipENN+AX3MBm1cS5Oxp6jgY+3jj4KgDQPYmL49fJ
CojnmLKjrAPoUi4f/7s4O1rEAghXPrf5/9coaRPORiNi+bZK0bReJwf1GE/9CPqs
FiZrQNz+/w/1MwFisG6+g0/58fp9j9r6l8JXETjpyO5F+8W8bg8M4V7aoYt5Ec2X
+BG6Gq06Tvm2UssYa6iEVNSKF39ssBzKKALi4we/fcfwjq4bCTKMCjV0Tp3zY/FG
1VyDtMGKrlPnOwKCAQEA57Nw+qdh2wbihz1uKffcoDoW6Q3Ws0mu8ml+UvBn48Ur
41PKrvIb8lhVY7ZiF2/iRyodua9ztE4zvgGs7UqyHaSYHR+3mWeOAE2Hb/XiNVgu
JVupTXLpx3y7d9FxvrU/27KUxhJgcbVpIGRiMn5dmY2S86EYKX1ObjZKmwvFc6+n
1YWgtI2+VOKe5+0ttig6CqzL9qJLZfL6QeAy0yTp/Wz+G1c06XTL87QNeU7CXN00
rB7I4n1Xn422rZnE64MOsARVChyE2fUC9syfimoryR9yIL2xor9QdjL2tK6ziyPq
WgedY4bDjZLM5KbcHcRng0j5WCJV+pX9Hh1c4n5AlwKCAQAxjun68p56n5YEc0dv
Jp1CvpM6NW4iQmAyAEnCqXMPmgnNixaQyoUIS+KWEdxG8kM/9l7IrrWTej2j8sHV
1p5vBjV3yYjNg04ZtnpFyXlDkLYzqWBL0l7+kPPdtdFRkrqBTAwAPjyfrjrXZ3id
gHY8bub3CnnsllnG1F0jOW4BaVl0ZGzVC8h3cs6DdNo5CMYoT0YQEH88cQVixWR0
OLx9/10UW1yYDuWpAoxxVriURt6HFrTlgwntMP2hji37xkggyZTm3827BIWP//rH
nLOq8rJIl3LrQdG5B4/J904TCglcZNdzmE6i5Nd0Ku7ZelcUDPrnvLpxjxORvyXL
oJbhAoIBAD7QV9WsIQxG7oypa7828foCJYni9Yy/cg1H6jZD9HY8UuybH7yT6F2n
8uZIYIloDJksYsifNyfvd3mQbLgb4vPEVnS2z4hoGYgdfJUuvLeng0MfeWOEvroV
J6GRB1wjOP+vh0O3YawR+UEN1c1Iksl5JxijWLCOxv97+nfUFiCJw19QjcPFFY9f
rKLFmvniJ/IS7GydjQFDgPLw+/Zf8IuCy9TPrImJ32zfKDP11R1l3sy2v9EfF+0q
dxbTNB6A9i9jzUYjeyS3lqkfyjS1Gc+5lbAonQq5APA6WsWbAxO6leL4Y4PC2ir8
XE20qsHrKADgfLCXBmYb2XYbkb3ZalsCggEAfOuB9/eLMSmtney3vDdZNF8fvEad
DF+8ss8yITNQQuC0nGdXioRuvSyejOxtjHplMT5GXsgLp1vAujDQmGTv/jK+EXsU
cRe4df5/EbRiUOyx/ZBepttB1meTnsH6cGPN0JnmTMQHQvanL3jjtjrC13408ONK
1yK2S4xJjKYFLT86SjKvV6g5k49ntLYk59nviqHl8bYzAVMoEjb62Z+hERwd/2hx
omsEEjDt4qVqGvSyy+V/1EhqGPzm9ri3zapnorf69rscuXYYsMBZ8M6AtSio4ldB
LjCRNS1lR6/mV8AqUNR9Kn2NLQyJ76yDoEVLulKZqGUsC9STN4oGJLUeFw==
-----END RSA PRIVATE KEY-----
'''
Fix acme tests (#619) * Ensures that in-active users are not allowed to login. * Ensuring acme issuer loads correctly.
2016-12-20 07:59:23 +01:00
ACME_ROOT = """
-----BEGIN CERTIFICATE-----
MIIFjTCCA3WgAwIBAgIRANOxciY0IzLc9AUoUSrsnGowDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTYxMDA2MTU0MzU1
WhcNMjExMDA2MTU0MzU1WjBKMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDEjMCEGA1UEAxMaTGV0J3MgRW5jcnlwdCBBdXRob3JpdHkgWDMwggEi
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCc0wzwWuUuR7dyXTeDs2hjMOrX
NSYZJeG9vjXxcJIvt7hLQQWrqZ41CFjssSrEaIcLo+N15Obzp2JxunmBYB/XkZqf
89B4Z3HIaQ6Vkc/+5pnpYDxIzH7KTXcSJJ1HG1rrueweNwAcnKx7pwXqzkrrvUHl
Npi5y/1tPJZo3yMqQpAMhnRnyH+lmrhSYRQTP2XpgofL2/oOVvaGifOFP5eGr7Dc
Gu9rDZUWfcQroGWymQQ2dYBrrErzG5BJeC+ilk8qICUpBMZ0wNAxzY8xOJUWuqgz
uEPxsR/DMH+ieTETPS02+OP88jNquTkxxa/EjQ0dZBYzqvqEKbbUC8DYfcOTAgMB
AAGjggFnMIIBYzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADBU
BgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEBATAwMC4GCCsGAQUFBwIB
FiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMB0GA1UdDgQWBBSo
SmpjBH3duubRObemRWXv86jsoTAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3Js
LnJvb3QteDEubGV0c2VuY3J5cHQub3JnMHIGCCsGAQUFBwEBBGYwZDAwBggrBgEF
BQcwAYYkaHR0cDovL29jc3Aucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcvMDAGCCsG
AQUFBzAChiRodHRwOi8vY2VydC5yb290LXgxLmxldHNlbmNyeXB0Lm9yZy8wHwYD
VR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wDQYJKoZIhvcNAQELBQADggIB
ABnPdSA0LTqmRf/Q1eaM2jLonG4bQdEnqOJQ8nCqxOeTRrToEKtwT++36gTSlBGx
A/5dut82jJQ2jxN8RI8L9QFXrWi4xXnA2EqA10yjHiR6H9cj6MFiOnb5In1eWsRM
UM2v3e9tNsCAgBukPHAg1lQh07rvFKm/Bz9BCjaxorALINUfZ9DD64j2igLIxle2
DPxW8dI/F2loHMjXZjqG8RkqZUdoxtID5+90FgsGIfkMpqgRS05f4zPbCEHqCXl1
eO5HyELTgcVlLXXQDgAWnRzut1hFJeczY1tjQQno6f6s+nMydLN26WuU4s3UYvOu
OsUxRlJu7TSRHqDC3lSE5XggVkzdaPkuKGQbGpny+01/47hfXXNB7HntWNZ6N2Vw
p7G6OfY+YQrZwIaQmhrIqJZuigsrbe3W+gdn5ykE9+Ky0VgVUsfxo52mwFYs1JKY
2PGDuWx8M6DlS6qQkvHaRUo0FMd8TsSlbF0/v965qGFKhSDeQoMpYnwcmQilRh/0
ayLThlHLN81gSkJjVrPI0Y8xCVPB4twb1PFUd2fPM3sA1tJ83sZ5v8vgFv2yofKR
PB0t6JzUA81mSqM3kxl5e+IZwhYAyO0OTg3/fs8HqGTNKd9BqoUwSRBzp06JMg5b
rUCGwbCUDI0mxadJ3Bz4WxR6fyNpBK2yAinWEsikxqEt
-----END CERTIFICATE-----
"""
Adding ACME Support (#178)
2016-06-28 00:57:53 +02:00
ACME_URL = 'https://acme-v01.api.letsencrypt.org'
ACME_EMAIL = 'jim@example.com'
ACME_TEL = '4088675309'
Fix acme tests (#619) * Ensures that in-active users are not allowed to login. * Ensuring acme issuer loads correctly.
2016-12-20 07:59:23 +01:00
ACME_DIRECTORY_URL = 'https://acme-v01.api.letsencrypt.org'
unit test
2018-11-28 23:27:03 +01:00
ACME_DISABLE_AUTORESOLVE = True
basic ldap support (#842)
2017-09-04 05:41:43 +02:00
LDAP_AUTH = True
LDAP_BIND_URI = 'ldap://localhost'
LDAP_BASE_DN = 'dc=example,dc=com'
LDAP_EMAIL_DOMAIN = 'example.com'
LDAP_REQUIRED_GROUP = 'Lemur Access'
LDAP_DEFAULT_ROLE = 'role1'