tree cc1af8ebbc8057c52145f3ae2f0abdb65b4aa2b2
parent cf9085acd78ed83bfbc075d3fa70babed49a8a9b
author Malik Akbar Hashemi Rafsanjani <malikrafsan@meta.com> 1741801428 -0700
committer Ed Tanous <ed@tanous.net> 1742263962 +0000

extend test script to cover upn testing

This commit is intended to extend existing `generate_auth_certificate`
python script that automatically test the auth functionality of bmcweb.
We extend the script by adding test for UserPrincipalName (UPN) feature.
This feature[1] allow us to use SubjectAlternativeName (SAN) extension
on X509 certificate and enable us to use the different name as username.
Previously we can only use CommonName in the certificate as username

By adding this changes, we can test the UPN feature easily using the
script. We add a new flag that enable the user to test using UPN feature
by specifying the UPN name to be tested.

UPN has OID that is specified by Microsoft[2]. The full OID path:
1 ISO
1.3 identified-organization (ISO/IEC 6523),
1.3.6 DoD,
1.3.6.1 internet,
1.3.6.1.4 private,
1.3.6.1.4.1 enterprise,
1.3.6.1.4.1.311 Microsoft,
1.3.6.1.4.1.311.20 Microsoft enrollment infrastructure,
1.3.6.1.4.1.311.20.2 Certificate Type Extension,
1.3.6.1.4.1.311.20.2.3 UserPrincipalName

Tested:
- Regress test on CommonName by running without `--upn` flag
- Test using correct UPN name
  - There are two requirements for the UPN name (`username@domain`)
  - `username` must exist in the BMC device accounts
  - `domain` must match the domain forest of the device
  - eg: malik@fb.com match macbmc1.abc.fb.com
- Test using incorrect UPN name
  - Violate one of the requirements and the test should fail

[1] Patch feature: https://gerrit.openbmc.org/c/openbmc/bmcweb/+/78519
[2] OID of UPN: https://oidref.com/1.3.6.1.4.1.311.20.2.3

Change-Id: I997bea9a6662fa41c3824fde71ea4f20b606ca9c
Signed-off-by: Malik Akbar Hashemi Rafsanjani <malikrafsan@meta.com>