From f1874aa8ed9da8798d062e4e1375d75ac0b183c3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adam=20Laz=C3=ADk?= Date: Fri, 17 Jul 2026 15:16:50 +0200 Subject: [PATCH 1/2] Fixes #39537 - Implement LDAP CA cert support Cacert can be provided as file or string. Made with Cursor. --- lib/hammer_cli_foreman/auth_source_ldap.rb | 19 +++++++++++++++++++ test/unit/auth_source_ldap_test.rb | 2 ++ 2 files changed, 21 insertions(+) diff --git a/lib/hammer_cli_foreman/auth_source_ldap.rb b/lib/hammer_cli_foreman/auth_source_ldap.rb index 1a8367c91..1f4f42909 100644 --- a/lib/hammer_cli_foreman/auth_source_ldap.rb +++ b/lib/hammer_cli_foreman/auth_source_ldap.rb @@ -4,6 +4,20 @@ class AuthSourceLdap < HammerCLIForeman::Command command_name 'ldap' desc _('Manage LDAP auth sources') + module CacertFileOption + def self.included(base) + base.option '--cacert-file', 'CACERT_FILE', + _('Path to a PEM file containing CA certificate(s) for LDAPS verification. Ignored if --cacert is set'), + :format => HammerCLI::Options::Normalizers::File.new + end + + def request_params + params = super + params['auth_source_ldap']['cacert'] ||= options['option_cacert_file'] if options['option_cacert_file'] + params + end + end + class ListCommand < HammerCLIForeman::ListCommand output do field :id, _('Id') @@ -23,6 +37,7 @@ class InfoCommand < HammerCLIForeman::InfoCommand field :name, _('Name') field :host, _('Server') field :tls, _('LDAPS'), Fields::Boolean + field :cacert, _('CA certificate'), Fields::LongText, :hide_blank => true field :port, _('Port') field :server_type, _('Server Type') end @@ -50,6 +65,8 @@ class InfoCommand < HammerCLIForeman::InfoCommand end class CreateCommand < HammerCLIForeman::CreateCommand + include CacertFileOption + success_message _('Auth source [%{name}] created.') failure_message _('Could not create the Auth Source') @@ -64,6 +81,8 @@ class DeleteCommand < HammerCLIForeman::DeleteCommand end class UpdateCommand < HammerCLIForeman::UpdateCommand + include CacertFileOption + success_message _('Auth source [%{name}] updated.') failure_message _('Could not update the Auth Source') diff --git a/test/unit/auth_source_ldap_test.rb b/test/unit/auth_source_ldap_test.rb index 57658086f..15dcffeb2 100644 --- a/test/unit/auth_source_ldap_test.rb +++ b/test/unit/auth_source_ldap_test.rb @@ -60,6 +60,7 @@ describe "parameters" do it_should_accept "all required params", ["--name=arch", "--host=my.host"] + it_should_accept "cacert file", ["--name=arch", "--host=my.host", "--cacert-file=#{__FILE__}"] # it_should_fail_with "name missing", [] # TODO: temporarily disabled, parameters are checked in the api end @@ -87,6 +88,7 @@ describe "parameters" do it_should_accept "name", ["--name=arch", "--new-name=arch2"] it_should_accept "id", ["--id=1", "--new-name=arch2"] + it_should_accept "cacert file", ["--id=1", "--cacert-file=#{__FILE__}"] # it_should_fail_with "no params", [] # TODO: temporarily disabled, parameters are checked in the id resolver # it_should_fail_with "name or id missing", ["--new-name=arch2"] # TODO: temporarily disabled, parameters are checked in the id resolver end From 7fd463bbe51de39d522b31fed96d2e05418c517d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adam=20Laz=C3=ADk?= Date: Mon, 20 Jul 2026 19:54:26 +0200 Subject: [PATCH 2/2] Hide the cacert option, only allow cacert-file --- lib/hammer_cli_foreman/auth_source_ldap.rb | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/lib/hammer_cli_foreman/auth_source_ldap.rb b/lib/hammer_cli_foreman/auth_source_ldap.rb index 1f4f42909..41b23a882 100644 --- a/lib/hammer_cli_foreman/auth_source_ldap.rb +++ b/lib/hammer_cli_foreman/auth_source_ldap.rb @@ -7,15 +7,10 @@ class AuthSourceLdap < HammerCLIForeman::Command module CacertFileOption def self.included(base) base.option '--cacert-file', 'CACERT_FILE', - _('Path to a PEM file containing CA certificate(s) for LDAPS verification. Ignored if --cacert is set'), + _('Path to a PEM file with CA certificate(s) added to the system trust store for LDAPS verification'), + :attribute_name => :option_cacert, :format => HammerCLI::Options::Normalizers::File.new end - - def request_params - params = super - params['auth_source_ldap']['cacert'] ||= options['option_cacert_file'] if options['option_cacert_file'] - params - end end class ListCommand < HammerCLIForeman::ListCommand @@ -70,7 +65,9 @@ class CreateCommand < HammerCLIForeman::CreateCommand success_message _('Auth source [%{name}] created.') failure_message _('Could not create the Auth Source') - build_options + build_options do |o| + o.without(:cacert) + end end class DeleteCommand < HammerCLIForeman::DeleteCommand @@ -86,7 +83,9 @@ class UpdateCommand < HammerCLIForeman::UpdateCommand success_message _('Auth source [%{name}] updated.') failure_message _('Could not update the Auth Source') - build_options + build_options do |o| + o.without(:cacert) + end end autoload_subcommands