Allow overriding passwords generated by extlib

[coreone]

@ekohl anything else needed on this?

[ekohl]

I did some testing: if you change the password for either the keystore or the truststore it fails to open it:

Error 1: Puppet Truststore_certificate resource '/etc/candlepin/certs/truststore:artemis-client' failed. Logs:
  /Stage[main]/Certs::Candlepin/Truststore_certificate[/etc/candlepin/certs/truststore:artemis-client]
    Adding autorequire relationship with File[/etc/pki/katello/truststore_password-file]
    Adding autorequire relationship with File[/etc/foreman/client_cert.pem]
    Adding autonotify relationship with File[/etc/candlepin/certs/truststore]
    Starting to evaluate the resource (581 of 1413)
    Evaluated in 0.46 seconds
  /Stage[main]/Certs::Candlepin/Truststore_certificate[/etc/candlepin/certs/truststore:artemis-client]/ensure
    change from 'absent' to 'present' failed: Execution of '/bin/keytool -import -v -noprompt -storetype pkcs12 -keystore /etc/candlepin/certs/truststore -alias artemis-client -file /etc/foreman/client_cert.pem -storepass:file /etc/pki/katello/truststore_password-file -J-Dcom.redhat.fips=false' returned 1: keytool error: java.io.IOException: keystore password was incorrect
java.io.IOException: keystore password was incorrect
    at sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2089)
    at java.security.KeyStore.load(KeyStore.java:1445)
    at sun.security.tools.keytool.Main.doCommands(Main.java:839)
    at sun.security.tools.keytool.Main.run(Main.java:380)
    at sun.security.tools.keytool.Main.main(Main.java:373)
Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
    ... 5 more
Error 2: Puppet Truststore_certificate resource '/etc/candlepin/certs/truststore:candlepin-ca' failed. Logs:
  /Stage[main]/Certs::Candlepin/Truststore_certificate[/etc/candlepin/certs/truststore:candlepin-ca]
    Adding autorequire relationship with File[/etc/pki/katello/truststore_password-file]
    Adding autorequire relationship with File[/etc/candlepin/certs/candlepin-ca.crt]
    Adding autonotify relationship with File[/etc/candlepin/certs/truststore]
    Starting to evaluate the resource (602 of 1413)
    Evaluated in 0.36 seconds
  /Stage[main]/Certs::Candlepin/Truststore_certificate[/etc/candlepin/certs/truststore:candlepin-ca]/ensure
    change from 'absent' to 'present' failed: Execution of '/bin/keytool -import -v -noprompt -storetype pkcs12 -keystore /etc/candlepin/certs/truststore -alias candlepin-ca -file /etc/candlepin/certs/candlepin-ca.crt -storepass:file /etc/pki/katello/truststore_password-file -J-Dcom.redhat.fips=false' returned 1: keytool error: java.io.IOException: keystore password was incorrect
java.io.IOException: keystore password was incorrect
    at sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2089)
    at java.security.KeyStore.load(KeyStore.java:1445)
    at sun.security.tools.keytool.Main.doCommands(Main.java:839)
    at sun.security.tools.keytool.Main.run(Main.java:380)
    at sun.security.tools.keytool.Main.main(Main.java:373)
Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
    ... 5 more

You can delete the file and it will be recreated, but rotating passwords is not supported. I'm not sure what's the best solution to prevent users from this footgun.

@ehelms any thoughts on changing the keystore & truststore types to catch the password error and recreate the file?

[ehelms]

@ehelms any thoughts on changing the keystore & truststore types to catch the password error and recreate the file?

Possible to add I should think -- if password change is detected we need to trigger a delete of the truststore and then let it re-build itself.

[ekohl]

I've opened https://github.com/theforeman/puppet-certs/pull/428 but it doesn't work yet. I'll continue on it tomorrow.

[coreone]

@ekohl circling back around to this after I see that the #428 has been merged.

[ehelms]

I think this needs at least two acceptance tests added:

1. Providing a password on fresh run
2. Changing the password for an existing setup

[ekohl]

@coreone Any chance you could take a look at the acceptance tests @ehelms asked about?