Chromium Code Reviews Chromium Code Reviews
Issue
2828713002:
Enable client certificate patterns in device ONC policy (Closed)
DescriptionEnable client certificate patterns in device ONC policy
Enables client certificate patterns for EAP-TLS networks in device
ONC policy. Device-wide client certificate patterns are restricted
to only match certificates which are present in the system token.
This prevents the device from presenting the user's certificates
involuntarily.
Two supporting changes were made to achieve this:
- CertLoader has been extended by the system_cert_list() method
to retrieve available certificates which exist on the system token.
- The ClientCertConfig struct has a new onc_source member which
can be checked to see if the client cert pattern originates from
device policy.
BUG=655266
TEST=unit_tests && chromeos_unittests
Manual test scenario:
--
Prerequisites:
Install a certificate (subject common name e.g.: “cert_user”)
into the user token and a different certificate (subject common
name e.g.: “cert_system”) into the system token.
Have a EAP-TLS wifi network connected to a radius server which
would accept both client certificates.
--
Test Case 1: device policy ONC / user token certificate
Configure a device policy OpenNetworkPolicy to connect to the
EAP-TLS network with
"ClientCertPattern": {
"Subject": {
"CommonName": "cert_user"
}
Expected result: The device does not try to auto-connect to the
wifi network because the ClientCertPattern originating from device
policy does not match user certificates.
--
Test Case 2: device policy ONC / system token certificate
Configure a device policy OpenNetworkPolicy to connect to the
EAP-TLS network with
"ClientCertPattern": {
"Subject": {
"CommonName": "cert_system"
}
Expected result: The device auto-connects to the wifi network
because the ClientCertPattern originating from device policy
matches certificates present on the system token. It authenticates
with cert_system.
--
Test Case 3: user policy ONC / user token certificate
Configure a user policy OpenNetworkPolicy to connect to the
EAP-TLS network with
"ClientCertPattern": {
"Subject": {
"CommonName": "cert_user"
}
Expected result: The device auto-connects to the wifi network. It
authenticates with cert_user.
--
Test Case 4: user policy ONC / system token certificate
Configure a user OpenNetworkPolicy to connect to the EAP-TLS network
with
"ClientCertPattern": {
"Subject": {
"CommonName": "cert_system"
}
Expected result: The device auto-connects to the wifi network. It
authenticates with cert_system.
Review-Url: https://codereview.chromium.org/2828713002
Cr-Commit-Position: refs/heads/master@{#467634}
Committed: https://chromium.googlesource.com/chromium/src/+/93bc5d7c02d275d27c030ab15a8c68efc8efdd99
Patch Set 1 #Patch Set 2 : Check for system token instead of !user token #Patch Set 3 : Fixed tests, added tests. #Patch Set 4 : Ensure no enrollment dialog on sign-in screen. #Patch Set 5 : Rebase. #
Total comments: 40
Patch Set 6 : Addressed comments, extended logic to ResolveCertificatePatternSync. #Patch Set 7 : Clean up. #
Total comments: 19
Patch Set 8 : Addressed comments. #
Total comments: 11
Patch Set 9 : Addressed comments. #
Total comments: 10
Patch Set 10 : Use BindOnce, PostTaskWithTraitsAndReplyWithResult. #
Total comments: 12
Patch Set 11 : Addressed comments - more DCHECKs, use PostTask..WithReply in client_cert_resolver.cc. #Messages
Total messages: 30 (12 generated)
|
