I've encountered a couple of issues:

Certificate Management -> ... -> Actions -> Delete

Cannot close the dialog with 'No' button nor the cross.

Cipher Preferences -> Cipher Suite -> No Ciphers

The cli command call fails.

Security Configuration -> Security Enabled

Turning to on, then confirming the dialog with "Enable Security" button, does not close the dialog.

Security Configuration - combo boxes

Changing value and saving sometimes :tm: does not issue a cli command call when it probably should. However, what the actual semantics should be is a bit difficult since the values are often applied only on reboot.

Security Configuration - toggle boxes

Changing the state of one and pressing Save Configuration does not issue any CLI command.

And one more general: top menu bar on narrow window does not show menu buttons at all. Also, after widening the window a bit the top menu buttons appear and are wrapped to two lines hiding the top submenu on the Security page.

Thanks @mhonek! Everything is fixed except for the sizing issue. It's not related to this ticket - perhaps it can be addressed once we convert everything to reactJS?

It is just commented without any additional comment like TODO, etc.
Do we plan to add it later? Maybe it makes sense to add an issue number in the comment here for tracking purposes...

If you don't need it, I think, we can just remove it from the list

Hm, it's empty :)

If I go to Certificate Management->CA Certificates and try to Edit Trust Flags it does not update the content and it just says Success.

I understand that editing CA cert Trust flags on the DS instance machine may be not the intended behaviour. But then we should notify the user about it or something...

Another critical issue is:
- If I remove all flags and save - it removes the certificate from the list completely.

At the Certificate Management->Server Certificates we can see the trust flags u,u,u across the Server Cert. It is not editable thing but at least, maybe, we can describe them in the Edit Trust Flags modal window and mark them gray (not editable).

While adding a new certificate in Certificate Management->Server Certificates, it gives an error

Error adding certificate - Command '['/usr/bin/certutil', '-A', '-d', '/etc/dirsrv/slapd-localhost', '-n',
'sdf', '-t', ',,', '-i', '/etc/dirsrv/slapd-localhost/Server-Cert.cr', '-a', '-f', '/etc/dirsrv/slapd-
localhost/pwdfile.txt']' returned non-zero exit status 255.

Can we somehow validate the path first, so if the cert file format is not valid or not found - we send a proper error to UI and CLI?

That's it from me :)

If I go to Certificate Management->CA Certificates and try to Edit Trust Flags it does not update the content and it just says Success.
I understand that editing CA cert Trust flags on the DS instance machine may be not the intended behaviour. But then we should notify the user about it or something...

Actually what happens is that certutil is not applying the flags as requested. Some flags are contradicting. So you can try and set certain flags but certutil/NSS is overriding some of the flags.

Another critical issue is:
- If I remove all flags and save - it removes the certificate from the list completely.

If you remove the CA flags (CT), the certificate is moved out of the CA cert table, and into the server cert table. The only condition that makes a cert a CA cert is the flags so if you rmeove them it should be moved out of that table.

Maybe I can add a warning if you remove the CT flags that the cert will no longer function as a CA.

At the Certificate Management->Server Certificates we can see the trust flags u,u,u across the Server Cert. It is not editable thing but at least, maybe, we can describe them in the Edit Trust Flags modal window and mark them gray (not editable).

Okay I'll look into this.

Thanks,
Mark

@spichugi changes applied please review again

@mreynolds Sure, the sizing issue shall be resolved in a different ticket, just didn't know which. :/

Testing from ecbd1c024:

Security Configuration -> Server Certificate Name

The field's drop-down does not suggest certs with CTu,u,u. Although fairly discouraged, still a valid case. But low priority and postponable if that'd need bigger code changes.

Security Configuration -> Secure Port

Something for lib389 I guess but after setting port 6363 SELinux strikes again after restart rendering ns-slapd failing to start:

Jul 12 01:56:52 b audit[16797]: AVC avc:  denied  { name_bind } for  pid=16797 comm="ns-slapd" src=6363 scontext=system_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:repository_port_t:s0 tclass=tcp_socket permissive=0
Jul 12 01:56:52 b ns-slapd[16797]: [12/Jul/2019:01:56:52.890720266 +0000] - ERR - createprlistensockets - PR_Bind() on All Interfaces port 6363 failed: Netscape Portable Runtime error -5966 (Access Denied.)

Security Configuration -> Verify Certificate Subject Hostname

Changing and saving does request an CLI command for update.

Cipher Preferences

The three configuration fields do not seem to load the actual configuration after Restart Instance. Probably due to the fact the setting of the ciphers is now including double-quotes:

# sudo dsconf -j ldapi://%2fvar%2frun%2fslapd-b.socket security ciphers get
{'type': 'list', 'items': ['"-all', '+TLS_AES_128_GCM_SHA256', '-TLS_CHACHA20_POLY1305_SHA256"']}

Certificate Management -> CA Certificates

Given we show only Trusted CA certs, I think we should name this section so. And rename the other section to something like Other Certificates since untrusted CA certs end up there as well.

Finally, not related to CLI nor UI, but whatever is set up in sslVersionMin/Max is behaving weirdly for me, not respecting whatever was set in dse.ldif. Could you please quickly check along the way if it works for you as expected? Thanks.

EDIT: PS: Maybe it's really too little but on 1GB RAM machine I very often get OOM-killed dsconfs when first loading instance info, since like 20ish instances pop up simultaneously. We should think about it...

If I remove only one of the flags, it still removes the certificate from the list but showConfirmCAChange is not shown.

@mreynolds Sure, the sizing issue shall be resolved in a different ticket, just didn't know which. :/
Testing from ecbd1c0:

Security Configuration -> Server Certificate Name
The field's drop-down does not suggest certs with CTu,u,u. Although fairly discouraged, still a valid case. But low priority and postponable if that'd need bigger code changes.

What I'm trying to do in the UI is force the correct behavior. A server certificate would not be a CA - although that is technically possible. So the typeahead is only listing what the UI thinks are Server Certs. I'm trying to prevent users from doing the wrong thing and making accidents

Security Configuration -> Secure Port
Something for lib389 I guess but after setting port 6363 SELinux strikes again after restart rendering ns-slapd failing to start:

Jul 12 01:56:52 b audit[16797]: AVC avc: denied { name_bind } for pid=16797 comm="ns-slapd" src=6363 scontext=system_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:repository_port_t:s0 tclass=tcp_socket permissive=0
Jul 12 01:56:52 b ns-slapd[16797]: [12/Jul/2019:01:56:52.890720266 +0000] - ERR - createprlistensockets - PR_Bind() on All Interfaces port 6363 failed: Netscape Portable Runtime error -5966 (Access Denied.)

Yeah there is a ticket already open for this I believe. I will try and merge it into this PR...

Security Configuration -> Verify Certificate Subject Hostname
Changing and saving does request an CLI command for update.
Cipher Preferences
The three configuration fields do not seem to load the actual configuration after Restart Instance. Probably due to the fact the setting of the ciphers is now including double-quotes:

sudo dsconf -j ldapi://%2fvar%2frun%2fslapd-b.socket security ciphers get

{'type': 'list', 'items': ['"-all', '+TLS_AES_128_GCM_SHA256', '-TLS_CHACHA20_POLY1305_SHA256"']}

Ahh okay I'll look into this...

Certificate Management -> CA Certificates
Given we show only Trusted CA certs, I think we should name this section so. And rename the other section to something like Other Certificates since untrusted CA certs end up there as well.

Finally, not related to CLI nor UI, but whatever is set up in sslVersionMin/Max is behaving weirdly for me, not respecting whatever was set in dse.ldif. Could you please quickly check along the way if it works for you as expected? Thanks.

Yup, but what are you seeing that is weird?

EDIT: PS: Maybe it's really too little but on 1GB RAM machine I very often get OOM-killed dsconfs when first loading instance info, since like 20ish instances pop up simultaneously. We should think about it...

Hmmm, note sure this is something we can "fix", but might need to release note the memory requirements for the UI.

If I remove only one of the flags, it still removes the certificate from the list but showConfirmCAChange is not shown.

As of right now, its expects CT to be a CA cert, if one is missing it thinks its a server certificate. Its a bit inconsistent, I'll look into this...

@mhonek

Finally, not related to CLI nor UI, but whatever is set up in sslVersionMin/Max is behaving weirdly for me, not respecting whatever was set in dse.ldif. Could you please quickly check along the way if it works for you as expected? Thanks.

Looks like the server is adjusted the SSL min and Max: See errors log clip:

[09/Jul/2019:13:10:38.420475077 -0400] - WARN - Security Initialization - SSL alert: nsTLS1 is on, but the version range is lower than "TLS1.2"; Configuring the version range as default min: TLS1.2, max: TLS1.3.
[09/Jul/2019:13:10:38.423102620 -0400] - INFO - Security Initialization - slapd_ssl_init2 - Configured SSL version range: min: TLS1.2, max: TLS1.3
[09/Jul/2019:13:10:38.425555873 -0400] - INFO - Security Initialization - slapd_ssl_init2 - NSS adjusted SSL version range: min: TLS1.2, max: TLS1.3

There might be a bug here since in my dse.,ldif I requested TLS1.2 as the Max, but its using the NSS max. I suspect this is a bug from:

https://pagure.io/389-ds-base/pull-request/50372

I'll look into this...

Changes applied, I think I fixed everything and did not break anything. Please review...

LGTM
but I'll give @mhonek to check and set the ack

I would probably use a regex to make it more transparent (but not a big deal):

>>> re.match(r'^(.+[^\s])[\s]+([^\s]+)$', 'Self Signed CA                                               CTu,u,u').groups()
('Self Signed CA', 'CTu,u,u')

Testing 293d926a0 the UI looks to work as expected. ACK! Thanks!

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3538

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.