feat: split key

certificates/client_server/ca/ca.srl

@@ -1 +1 @@
-640BF08B2D2C8FC41FC2300EF05F7A989419005F
+640BF08B2D2C8FC41FC2300EF05F7A9894190060

certificates/client_server/co3/co3.client.acme.com.crt

@@ -1,8 +1,8 @@
 -----BEGIN CERTIFICATE-----
-MIIDhjCCAm6gAwIBAgIUZAvwiy0sj8QfwjAO8F96mJQZAF8wDQYJKoZIhvcNAQEL
+MIIDhjCCAm6gAwIBAgIUZAvwiy0sj8QfwjAO8F96mJQZAGAwDQYJKoZIhvcNAQEL
 BQAwWjELMAkGA1UEBhMCRlIxDDAKBgNVBAgMA0lkRjEOMAwGA1UEBwwFUGFyaXMx
 ETAPBgNVBAoMCEFjbWVUZXN0MRowGAYDVQQDDBFBY21lIFRlc3QgUm9vdCBDQTAe
-Fw0yNjA4MTMxMTU0NTBaFw0zNjA4MTAxMTU0NTBaMFwxCzAJBgNVBAYTAkZSMQww
+Fw0yNjA4MTMxODI5NTNaFw0zNjA4MTAxODI5NTNaMFwxCzAJBgNVBAYTAkZSMQww
 CgYDVQQIDANJZEYxDjAMBgNVBAcMBVBhcmlzMREwDwYDVQQKDAhBY21lVGVzdDEc
 MBoGA1UEAwwTY28zLmNsaWVudEBhY21lLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
 ggEPADCCAQoCggEBALl3txZ9MNI7mJ5Y6UkvjPlKOiA92NJZSsuvwD6ZzfHXC0EP
@@ -12,10 +12,10 @@ PeXeU25Ft0DCFXawE1g/a0+CefpGJ6ee8YH5Ne0CwkOecmfW4/ou4dEjnVzX5N7O
 sHPUUsN26TSZp0dcyBax3ws1ZUDGbKtVngC85+JWkLi9t4+NeA+wVhiJfiP3I2ko
 4trF9Q7s/20HjG6hwwt0JdUpGZG3n50w6lh6bEsCAwEAAaNCMEAwHQYDVR0OBBYE
 FPDF8CLmuTR3/P38UVZndL035uWlMB8GA1UdIwQYMBaAFCrsQdVEgrwm8ED+4pCs
-lsN3SX3/MA0GCSqGSIb3DQEBCwUAA4IBAQB5ZxqHo5SucStiqn8Z4x0XEWntliTE
-s3QEIUl01icjoRdZfFrhLxS7sKp0wbOvxfzsIl3lHAXxxcPW6rQdKcuWwNYY6cOY
-B9dfTJbVgGGaAg1vczqCFQ55XOqYkzua7UeZWPUTTpUPI9cD4pEHr25yGgcLs3Jt
-yGWkyP3iZEVXHSYCRkDKUMugyC5R29aCjoCyA1sbA2A7PkHz9RB61S7srhYl64Ui
-/lC30jOkAH4Rvl8IylISJzfut1WVM9U5qfclCYXCfSDm/BF+68aRePw06ICE0A4+
-RayVj57mkBTePSpcS2c05eFVOyyrRWul1whq0uy9dJN6dWa3m7gh5q8C
+lsN3SX3/MA0GCSqGSIb3DQEBCwUAA4IBAQCi2DoSBefV3t6TRiEDqUT/sufFKbb+
+2Ddl2Gz3Ev5lG854VkkmwzDbHuIy0PvdnseRHetKE8U/Avt+o6KWJCEblBw85Q5Q
+FmvOoXtD9YdrQediOr5m6ARKTwjHb5C7vwTQluXL16SuC9ATVWBW5/osaoAu+G7w
+OYhcLnSwj15Faf+sL7kdD+k1497xTlzdlQK0g5Cw523IKxwqqrp51or9d9XEKRcO
+u0w+3pJJvjkE8hoKTQ1o1cXVxl28q+dZAKd9ThdTEKIkqzdcTRJpV7rXwucY1UOu
+yh3Sfh/RDTKlCCNshDfJJ2nNQjRSPNKgjnVrB4s6mlSbjmSBfrZud2Td
 -----END CERTIFICATE-----

certificates/client_server/generate_certs.sh

@@ -1,56 +1,81 @@
 #!/bin/bash
+set -euo pipefail
 
-# on MacOS, you should pass a link to an actually installed openssl binary, and not use the default `libressl`
-# which generates PKCS12 files with the deprecated RC2 algorithm
+# On macOS, pass the path to a modern OpenSSL binary as the first argument.
+# The system `libressl` generates PKCS12 files with the deprecated RC2 algorithm.
 OPENSSL_BIN=${1:-openssl}
 
-# Generate CA private key
-$OPENSSL_BIN genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out ca.key
-
-# Generate self-signed CA certificate
-$OPENSSL_BIN req -new -x509 -days 3650 -key ca.key -subj "/C=FR/ST=IdF/L=Paris/O=AcmeTest/CN=Acme Test Root CA" -out ca.crt
-
-
-## Server Cert
-
-# Generate private key for kmserver.acme.com
-$OPENSSL_BIN genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out kmserver.acme.com.key
-
-# Generate certificate signing request for kmserver.acme.com
-$OPENSSL_BIN req -new -key kmserver.acme.com.key -subj "/C=FR/ST=IdF/L=Paris/O=AcmeTest/CN=kmserver.acme.com" -out kmserver.acme.com.csr
-
-# Generate certificate for kmserver.acme.com signed by our own CA
-$OPENSSL_BIN x509 -req -days 3650 -in kmserver.acme.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out kmserver.acme.com.crt
-
-# Generate a PKCS12 file
-$OPENSSL_BIN pkcs12 -export -out kmserver.acme.com.p12 -inkey kmserver.acme.com.key -in kmserver.acme.com.crt -certfile ca.crt -password pass:password
-
-
-## "owner" client cert
-
-# Generate private key for owner.client.acme.com
-$OPENSSL_BIN genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out owner.client.acme.com.key
-
-# Generate certificate signing request for owner.client.acme.com
-$OPENSSL_BIN req -new -key owner.client.acme.com.key -subj "/C=FR/ST=IdF/L=Paris/O=AcmeTest/CN=owner.client@acme.com" -out owner.client.acme.com.csr
-
-# Generate certificate for owner.client.acme.com signed by our own CA
-$OPENSSL_BIN x509 -req -days 3650 -in owner.client.acme.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out owner.client.acme.com.crt
-
-# Generate a PKCS12 file
-$OPENSSL_BIN pkcs12 -export -out owner.client.acme.com.p12 -inkey owner.client.acme.com.key -in owner.client.acme.com.crt -certfile ca.crt -password pass:password
-
-
-## "user" client cert
-
-# Generate private key for user.client.acme.com
-$OPENSSL_BIN genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out user.client.acme.com.key
-
-# Generate certificate signing request for user.client.acme.com
-$OPENSSL_BIN req -new -key user.client.acme.com.key -subj "/C=FR/ST=IdF/L=Paris/O=AcmeTest/CN=user.client@acme.com" -out user.client.acme.com.csr
-
-# Generate certificate for user.client.acme.com signed by our own CA
-$OPENSSL_BIN x509 -req -days 3650 -in user.client.acme.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out user.client.acme.com.crt
-
-# Generate a PKCS12 file
-$OPENSSL_BIN pkcs12 -export -out user.client.acme.com.p12 -inkey user.client.acme.com.key -in user.client.acme.com.crt -certfile ca.crt -password pass:password
+# ---------------------------------------------------------------------------
+# generate_cert BASENAME CN OUTDIR [CADIR] [PASSOUT]
+#
+# Issues a CA-signed RSA-2048 certificate and writes four files under OUTDIR:
+#   BASENAME.key   private key
+#   BASENAME.csr   certificate signing request
+#   BASENAME.crt   signed certificate
+#   BASENAME.p12   PKCS12 bundle (password = PASSOUT, empty string = no password)
+#
+# Arguments:
+#   BASENAME  filename stem, e.g. "owner.client.acme.com"
+#   CN        X.509 Common Name, e.g. "owner.client@acme.com"
+#   OUTDIR    output directory, e.g. "owner"
+#   CADIR     directory containing ca.crt / ca.key (default: "ca")
+#   PASSOUT   PKCS12 export password (default: empty = no password)
+# ---------------------------------------------------------------------------
+generate_cert() {
+    local basename="$1"
+    local cn="$2"
+    local outdir="$3"
+    local cadir="${4:-ca}"
+    local passout="${5:-password}"
+
+    mkdir -p "$outdir"
+
+    local key="${outdir}/${basename}.key"
+    local csr="${outdir}/${basename}.csr"
+    local crt="${outdir}/${basename}.crt"
+    local p12="${outdir}/${basename}.p12"
+
+    echo "── Generating ${cn} (${outdir}) ──"
+
+    "$OPENSSL_BIN" genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
+        -out "$key"
+
+    "$OPENSSL_BIN" req -new -key "$key" \
+        -subj "/C=FR/ST=IdF/L=Paris/O=AcmeTest/CN=${cn}" \
+        -out "$csr"
+
+    "$OPENSSL_BIN" x509 -req -days 3650 \
+        -in "$csr" -CA "${cadir}/ca.crt" -CAkey "${cadir}/ca.key" -CAcreateserial \
+        -out "$crt"
+
+    "$OPENSSL_BIN" pkcs12 -export \
+        -out "$p12" -inkey "$key" -in "$crt" -certfile "${cadir}/ca.crt" \
+        -passout "pass:${passout}"
+}
+
+
+# ---------------------------------------------------------------------------
+# CA
+# ---------------------------------------------------------------------------
+mkdir -p ca
+echo "── Generating CA ──"
+"$OPENSSL_BIN" genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out ca/ca.key
+"$OPENSSL_BIN" req -new -x509 -days 3650 -key ca/ca.key \
+    -subj "/C=FR/ST=IdF/L=Paris/O=AcmeTest/CN=Acme Test Root CA" \
+    -out ca/ca.crt
+
+
+# ---------------------------------------------------------------------------
+# Server cert
+# ---------------------------------------------------------------------------
+generate_cert "kmserver.acme.com" "kmserver.acme.com" "server"
+
+
+# ---------------------------------------------------------------------------
+# Client certs
+# ---------------------------------------------------------------------------
+generate_cert "owner.client.acme.com" "owner.client@acme.com" "owner"
+generate_cert "user.client.acme.com"  "user.client@acme.com"  "user"
+generate_cert "co3.client.acme.com"   "co3.client@acme.com"   "co3"
+
+echo "Done."

certificates/csr/ca.srl

@@ -1 +1 @@
-184F7763E7B126D3F188B20D137DD2B2B2756744
+184F7763E7B126D3F188B20D137DD2B2B2756745

certificates/csr/generate.sh

@@ -44,10 +44,12 @@ openssl req -new -key intermediate.key -out intermediate.csr -subj "/C=FR/ST=IdF
 # ```
 # [ v3_ca ]
 # basicConstraints=CA:TRUE,pathlen:0
-# keyUsage=keyCertSign,digitalSignature
+# keyUsage=keyCertSign,cRLSign,digitalSignature
 # extendedKeyUsage=emailProtection
 # crlDistributionPoints=URI:http://cse.example.com/crl.pem
 # ```
+# `cRLSign` is required by RFC 5280 §4.2.1.3 for any CA that issues CRLs —
+# without it the KMS server rejects CRL generation requests for this issuer.
 # The `crlDistributionPoints` option should be replaced with the URL of a publicly accessible HTTP uniformResourceIdentifier that contains the CRL for the intermediate certificate.
 # This will sign the CSR with the CA's private key and generate an intermediate certificate. The intermediate certificate will be stored in the file `intermediate.crt`.
 openssl x509 -req -in intermediate.csr -CA ca.crt -CAkey ca.key -out intermediate.crt -days 1825 -extensions v3_ca -extfile extensions.ext

certificates/csr/intermediate.crt

@@ -2,7 +2,7 @@
 MIIExzCCAy+gAwIBAgIUGE93Y+exJtPxiLINE33SsrJ1Z0UwDQYJKoZIhvcNAQEL
 BQAwXTELMAkGA1UEBhMCRlIxDDAKBgNVBAgMA0lkRjEOMAwGA1UEBwwFUGFyaXMx
 EDAOBgNVBAoMB0Nvc21pYW4xDDAKBgNVBAsMA1ImRDEQMA4GA1UEAwwHVGVzdCBD
-QTAeFw0yNjA4MjMwOTA1NDFaFw0zMTA4MjIwOTA1NDFaMGcxCzAJBgNVBAYTAkZS
+QTAeFw0yNjA2MDcwNzQ4NDFaFw0zMTA2MDYwNzQ4NDFaMGcxCzAJBgNVBAYTAkZS
 MQwwCgYDVQQIDANJZEYxDjAMBgNVBAcMBVBhcmlzMRAwDgYDVQQKDAdDb3NtaWFu
 MQwwCgYDVQQLDANSJkQxGjAYBgNVBAMMEVRlc3QgSW50ZXJtZWRpYXRlMIIBojAN
 BgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA8fqz6gS1zKOw0ITYtiQZyfBJ0j2z
@@ -16,13 +16,13 @@ RjU/4K0sWSPyCJ6z3iq7blwH4VpXSrCVe5eNkoEhx4+oFtJA6InR33On7zBFAvln
 Ru9er+PmddNGMcCDYkFqZvyre3rDeec/hTIvAgMBAAGjdTBzMA8GA1UdEwQIMAYB
 Af8CAQAwCwYDVR0PBAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMEMB0GA1UdDgQW
 BBQEK8XsqNesHDBu2Xz6rEdg09OK9DAfBgNVHSMEGDAWgBQJbsVPDK4X9gjOFhy+
-sVf/0DzKGDANBgkqhkiG9w0BAQsFAAOCAYEAdI+PmcD9PTJnJ3Q39xWYik8CtRt1
-MitZ2OQT2ZCJ5+Z2J/1isffMZh0WiAiU9v4wsUeYMja4Ft0d0cjMOn6Www4enZQU
-OtVtGAKHa8jeV8qfsLHK9VisWTy2cKcIPE6x0/Rvp/SdWLYA5CCFks9va01VvDKP
-y9xX6+m+vV8xWtDKVg3nMow8eyE2AfAAw0c8b+g/8VfliE+iSCkmDjX66ORIIZdT
-AL3Utj1ix89axs+BfmMsBXGz4C/zLXxolnJn+w9hbPtr3gsV4937VkeNnND/foOm
-tuCTAMkrHyu9Uv4R52F3xAaSLoJNS3I+SukJlcGB3zC/GsDwfi4IFwv6AtDLUeKU
-Rb0DwvyH+PILiiXEOElhW8/euWAS4zxKRV1H2O9Jx68/ufrrb7JUHgjvz4l7yJI0
-60MVlwiPmc6+ooVXx/LQHSxLPe3vt6gA1roBt7yHg8if39jtKIQeu/fEXamtlUDB
-D3Xg+jbHKqJPs3Ul28JsWe5Yt5tFo6LQnAGX
+sVf/0DzKGDANBgkqhkiG9w0BAQsFAAOCAYEAlhNiN9Lktl+wx/BN/sDPSm2a/4xI
+ZpjUj/Yrnp1KWMmj9hgmPZx89XSbrW42FxKLId5o9+eCWrVZDQowlnVjrokgM3WM
+wcQ67lqg50vW25UOni5HKFF0vDZiMBP+KVUYvGI1P10JM/6aayGl5r+gxqnDI1m8
+72mO8M4Q/nN7DEzZQ3tCnWo6b2wbHsrRRo1LYqTx4QDL4M2EQ/yseC9qCC8N0JPH
+fQU7Crq89+VdEnq9WFemnoiEvOU7fpyh884SegmFGKojzW8QU5xMbzcooZseYdTD
+mBTzavPwiU2evs6/YDJO5s9mZTtI/GRhBtHqIVnollMzxEYebcmB5Xy0dB4j0tsi
+38UyjlO8QIXo2wQ0xaKD4dDksmvKPKcJgJsX21bMdbGHUMrMYm8qcyvPRr+HNm2j
++njI1i6RTL2qbcqVON9zlxYUYBcYto6GCvufOIna/eVlnKd4R761JtwbHHPZOIdh
+Ilq5N2JdqLVERca4700lEht+R2+TESLEKFM+
 -----END CERTIFICATE-----

certificates/csr/intermediate.srl

@@ -1 +1 @@
-459C68F5070C2DCB2E6F84F7D0E396B9AD5417F1
+459C68F5070C2DCB2E6F84F7D0E396B9AD5417F2

configs/auth_verifier/kms_opa_rbac.toml

@@ -0,0 +1,91 @@
+# =============================================================================
+# Authentication Verifier — KMS OPA RBAC configuration
+# =============================================================================
+#
+# Configures the Authentication Verifier for use with the Cosmian KMS
+# OPA RBAC integration.  The five role names declared here match exactly
+# the roles evaluated by `test_data/opa/kms.rego`.
+#
+# Start from the `authentication/` directory:
+#
+#   ./target/debug/auth_verifier \
+#     ../test_data/configs/auth_verifier/kms_opa_rbac.toml
+#
+# Default super-admin credentials (realm "_"):
+#   username : admin
+#   password : change_me
+#
+# KMS realm seeded on first start:
+#   realm    : kms
+#   admin    : kms-admin / kms-admin-pass
+#
+# =============================================================================
+
+host_name = "127.0.0.1"
+host_port = 8443
+
+# ---------------------------------------------------------------------------
+# RBAC role names — must match the role names used in test_data/opa/kms.rego.
+# Exposed at GET /public/roles so the KMS admin UI can list available roles.
+# ---------------------------------------------------------------------------
+roles = [
+  "SuperAdmin",      # Unrestricted, cross-domain  (ANSI/INCITS 359 §4.2)
+  "DomainAdmin",     # Full access within own domain
+  "CryptoOfficer",   # Key lifecycle within own domain (FIPS 140-3 §7.4)
+  "Auditor",         # Read-only metadata within own domain (NIST SP 800-53 AU-9)
+  "User",            # Crypto-use only, no lifecycle (FIPS 140-3 §7.4)
+]
+
+# Admin UI — serve the pre-built SPA at /admin-ui.
+# Path is relative to the directory where auth_verifier is started (authentication/).
+admin_ui_path = "admin-ui/dist"
+
+# ---------------------------------------------------------------------------
+# Console logging
+# ---------------------------------------------------------------------------
+[log]
+level = "info"
+
+# ---------------------------------------------------------------------------
+# TLS — paths are relative to the authentication/ submodule root.
+# Replace with production certificates for non-development environments.
+# ---------------------------------------------------------------------------
+[tls_params]
+server_private_key = "server/src/tests/certificates/ec/auth.server.key.pem"
+server_certificate = "server/src/tests/certificates/ec/auth.server.cert.pem"
+server_ca_chain    = "server/src/tests/certificates/ec/auth.ca.pem"
+
+# ---------------------------------------------------------------------------
+# JWT signing — reuse the server TLS key for token signing (dev only).
+# In production, use a dedicated signing key.
+# ---------------------------------------------------------------------------
+[session_jwt_params]
+jwt_ec_private_key = "server/src/tests/certificates/ec/auth.server.key.pem"
+jwt_ec_public_key  = "server/src/tests/certificates/ec/auth.server.cert.pem"
+
+# ---------------------------------------------------------------------------
+# Database — persistent SQLite for the KMS RBAC test environment.
+# Switch to `sqlite::memory:` for fully ephemeral test runs.
+# ---------------------------------------------------------------------------
+[database_params]
+auto_init_schema = true
+backend          = "sqlite"
+connection_url   = "sqlite:///tmp/kms_opa_rbac_auth.db"
+
+# ---------------------------------------------------------------------------
+# Development seed — creates the `kms` realm and a realm-admin on first start.
+# All operations are idempotent; the seed is safe to leave enabled.
+# ---------------------------------------------------------------------------
+[dev_seed]
+realm_id       = "kms"
+admin_username = "kms-admin"
+admin_password = "kms-admin-pass"
+
+# ---------------------------------------------------------------------------
+# CORS — allow the KMS server origin on admin endpoints.
+# Adjust to match the actual KMS public URL in your deployment.
+# ---------------------------------------------------------------------------
+allowed_origins = [
+  "http://localhost:9998",
+  "http://127.0.0.1:9998",
+]