NetKnights-GmbH / privacyidea-appliance

two-factor authentication system. This is a setup tool for easy system setup.
GNU Affero General Public License v3.0
4 stars 4 forks source link

Implement sanity check for malformed pi.cfg #78

Open fredreichbier opened 5 years ago

fredreichbier commented 5 years ago

Appliance versions < 3.0 have the issue already mentioned in #60: If the pi-appliance tool reads and writes /etc/privacyidea/pi.cfg, some of the resulting values are malformed, e.g.:

import logging
PI_PEPPER = 'YKroh9ZXchPh2DUVRexdnrnr'
SQLALCHEMY_DATABASE_URI = 'mysql://pi:0MY3mjw6Tw8R@localhost/pi'
PI_AUDIT_SQL_TRUNCATE = 'True'
PI_ENCFILE = '/etc/privacyidea/enckey'
PI_AUDIT_KEY_PUBLIC = '/etc/privacyidea/public.pem'
PI_LOGLEVEL = logging.INFO
PI_LOGFILE = '/var/log/privacyidea/privacyidea.log'
PI_ENGINE_REGISTRY_CLASS = '"shared"'
PI_AUDIT_POOL_SIZE = '20'
PI_AUDIT_KEY_PRIVATE = '/etc/privacyidea/private.pem'
SECRET_KEY = 'tR2HbnXb7Tk8C1cwxTWE8yEG'
SUPERUSER_REALM = ['super']

Note that privacyIDEA still works because the malformed values are handled as follows:

Currently, the user has to edit the config file manually to restore the correct config values.

In the version of the pi-appliance tool, we could add a sanity check that detects the malformed pi.cfg above, and offers to fix the values automatically.