From 47bbdc8b63068535f0da4ed76299e41153535d69 Mon Sep 17 00:00:00 2001 From: pauline ramon Date: Wed, 2 Sep 2026 10:01:44 +0200 Subject: [PATCH] fix: respect env vars in XKS config --- aws_xks/scripts/utils/config.sh | 10 +++---- configs/server/rbac/crypto_officer_users.toml | 29 +++++++------------ 2 files changed, 16 insertions(+), 23 deletions(-) diff --git a/aws_xks/scripts/utils/config.sh b/aws_xks/scripts/utils/config.sh index 791a1ee..c287319 100644 --- a/aws_xks/scripts/utils/config.sh +++ b/aws_xks/scripts/utils/config.sh @@ -1,12 +1,12 @@ # Change this to your XKS Proxy endpoint to test. -export XKS_PROXY_HOST="localhost:9998" +export XKS_PROXY_HOST="${XKS_PROXY_HOST:-localhost:9998}" # Change this to the URI_PREFIX of a logical keystore supported by your XKS Proxy. -export URI_PREFIX="aws" +export URI_PREFIX="${URI_PREFIX:-aws}" # Change this to the Access key ID for request authentication to your logical keystore. # Valid characters are a-z, A-Z, 0-9, /, - (hyphen), and _ (underscore) -export SIGV4_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE" +export SIGV4_ACCESS_KEY_ID="${SIGV4_ACCESS_KEY_ID:-AKIAIOSFODNN7EXAMPLE}" # Change this to the Secret access key for request authentication to your logical keystore. # Secret access key must have between 43 and 64 characters. Valid characters are a-z, A-Z, 0-9, /, +, and = -export SIGV4_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" +export SIGV4_SECRET_ACCESS_KEY="${SIGV4_SECRET_ACCESS_KEY:-wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY}" # Change this to a test key id supported by your logical keystore. -export KEY_ID="aws_xks_kek" +export KEY_ID="${KEY_ID:-aws_xks_kek}" diff --git a/configs/server/rbac/crypto_officer_users.toml b/configs/server/rbac/crypto_officer_users.toml index 08fa892..ecc4c62 100644 --- a/configs/server/rbac/crypto_officer_users.toml +++ b/configs/server/rbac/crypto_officer_users.toml @@ -1,12 +1,16 @@ -# Test KMS server — TLS + JWT auth, for privileged-user tests. -# Uses PEM cert + key (works in both FIPS and non-FIPS mode). -# Bound to port 10003. crypto_officer_users is injected at runtime. +# Test KMS server — RBAC mode with privileged users, no ceremony. +# Loaded by start_default_test_kms_server_with_crypto_officer_users() and +# start_default_test_kms_server_with_multi_crypto_officer_users(). +# The crypto_officer_users field is overridden at runtime by the test helper. +# Port and database paths are allocated dynamically at runtime. +# +# CO users: injected at runtime (owner.client@acme.com, user.privileged@acme.com, …) default_username = "tech@cosmian.com" -kms_public_url = "https://localhost:10003" +kms_public_url = "https://localhost:10005" [http] -port = 10003 +port = 10005 hostname = "0.0.0.0" [db] @@ -23,16 +27,5 @@ tls_cert_file = "test_data/certificates/client_server/server/kmserver.acme.com.c tls_key_file = "test_data/certificates/client_server/server/kmserver.acme.com.key" clients_ca_cert_file = "test_data/certificates/client_server/ca/ca.crt" -[socket_server] -socket_server_start = true -socket_server_port = 10103 - -[idp_auth] -jwt_auth_provider = [ - "https://accounts.google.com,https://www.googleapis.com/oauth2/v3/certs,kacls-migration,996739510374-2tauakcggau7kvk37784k0s2lmveb9c9.apps.googleusercontent.com", - "https://login.microsoftonline.com/612da4de-35c0-42de-ba56-174b69062c96/v2.0,https://login.microsoftonline.com/612da4de-35c0-42de-ba56-174b69062c96/discovery/v2.0/keys", - "https://demo-kms.eu.auth0.com/,https://demo-kms.eu.auth0.com/.well-known/jwks.json", -] - -[ui_config] -ui_index_html_folder = "ui/dist" +[roles] +crypto_officer_require_ceremony = false