AdityaandClaude Opus 4.7
e1d7db9b7c
- m_user_mfa_factor is now the single 2FA gate. DSC enroll callback writes a factor row (factor_type=DSC), revoke flips disabled_on when the last cert goes. AuthenticationApiResource and TwoFactorAuthenticationFilter drop the direct m_bank_user_dsc check so disabling from the UI actually stops the challenge at login. - SecurityConfig exempts /api/*/dsc/** and /api/*/mfa/factors from the TWOFACTOR_AUTHENTICATED gate. Without this a user with a verified factor can't manage their own factors after they break the device. - MfaFactorType gains a DSC enum value; SelfUserMfaFactorServiceImpl error message lists it. - dsc-helper: CBSnexora-branded header (logo, title, subtitle, accent palette), 8-column cert table (Holder Name, Alias, Organisation, DSC Type, Serial, Issuer, Valid From, Expires), LdapName-based DN parsing, sign+verify proof- of-possession that picks SHA256withRSA / SHA256withECDSA from the key's own algorithm (works on RSA, RSA Signing-only, EC), pattern-matched JNLP age check, dscType JNLP-arg override with KeyUsage fallback. - generate-test-dsc.ps1 produces a realistic self-signed DSC with strong key protection so dev testing sees real CN/O values and a PIN prompt. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
114 lines
4.7 KiB
PowerShell
114 lines
4.7 KiB
PowerShell
# Generate a realistic self-signed DSC for testing the CBSnexora helper.
|
|
#
|
|
# Replaces the UUID-CN bare-bones dev cert with one that has:
|
|
# - Real-looking subject DN: CN=Test User, O=CBSnexora Pvt Ltd, OU=IT, L=Mumbai, ST=Maharashtra, C=IN
|
|
# - KeyUsage = DigitalSignature (matches real Indian Class 3 DSCs)
|
|
# - Strong private-key protection enabled — Windows pops a PIN dialog at creation time, then
|
|
# prompts you for that PIN on every signing operation (matches the UX of a real USB token).
|
|
#
|
|
# Run from PowerShell (no elevation needed; user store only):
|
|
# .\generate-test-dsc.ps1
|
|
#
|
|
# Why certreq + INF instead of New-SelfSignedCertificate:
|
|
# New-SelfSignedCertificate (Windows PowerShell 5.x) doesn't expose ProtectKey / strong-protection
|
|
# knobs — it creates a CNG/KSP key that won't prompt. certreq.exe with an INF using the legacy
|
|
# "Microsoft Enhanced RSA and AES Cryptographic Provider" CSP IS the supported path for forcing
|
|
# user-confirmation on key access.
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
Write-Host "=== Step 1: Clean up old UUID-CN test certs from Windows-MY ===" -ForegroundColor Cyan
|
|
$old = Get-ChildItem Cert:\CurrentUser\My | Where-Object {
|
|
$_.Subject -match "^CN=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}"
|
|
}
|
|
if ($old) {
|
|
Write-Host "Found $($old.Count) old UUID-CN cert(s) - removing:" -ForegroundColor Yellow
|
|
foreach ($c in $old) {
|
|
Write-Host " $($c.Thumbprint) $($c.Subject)"
|
|
Remove-Item "Cert:\CurrentUser\My\$($c.Thumbprint)" -Force
|
|
}
|
|
} else {
|
|
Write-Host "No old UUID-CN test certs in the user store."
|
|
}
|
|
|
|
Write-Host ""
|
|
Write-Host "=== Step 2: Build INF for certreq ===" -ForegroundColor Cyan
|
|
|
|
# Random container name avoids collisions when the script is re-run before old containers expire.
|
|
$containerName = "CBSnexora-DSC-Test-$(Get-Random -Maximum 999999)"
|
|
$inf = @"
|
|
[Version]
|
|
Signature = "`$Windows NT`$"
|
|
|
|
[NewRequest]
|
|
Subject = "CN=Test User, OU=IT Department, O=CBSnexora Pvt Ltd, L=Mumbai, ST=Maharashtra, C=IN"
|
|
KeyAlgorithm = RSA
|
|
KeyLength = 2048
|
|
KeyUsage = "CERT_DIGITAL_SIGNATURE_KEY_USAGE"
|
|
MachineKeySet = false
|
|
KeyContainer = "$containerName"
|
|
ProviderName = "Microsoft Enhanced RSA and AES Cryptographic Provider"
|
|
KeySpec = AT_SIGNATURE
|
|
ProtectKey = true
|
|
SMIME = false
|
|
RequestType = Cert
|
|
Exportable = false
|
|
HashAlgorithm = SHA256
|
|
ValidityPeriod = Years
|
|
ValidityPeriodUnits = 2
|
|
|
|
[Extensions]
|
|
2.5.29.37 = "{text}1.3.6.1.5.5.7.3.4"
|
|
"@
|
|
|
|
$infPath = Join-Path $env:TEMP "cbsnexora-test-dsc.inf"
|
|
$cerPath = Join-Path $env:TEMP "cbsnexora-test-dsc.cer"
|
|
$inf | Out-File -FilePath $infPath -Encoding ASCII -Force
|
|
Write-Host "INF written to $infPath"
|
|
|
|
Write-Host ""
|
|
Write-Host "=== Step 3: certreq -new ===" -ForegroundColor Cyan
|
|
Write-Host "WINDOWS WILL POP A DIALOG asking 'Creating an RSA exchange key':" -ForegroundColor Yellow
|
|
Write-Host " -> Click 'Set Security Level...'" -ForegroundColor Yellow
|
|
Write-Host " -> Select 'High'" -ForegroundColor Yellow
|
|
Write-Host " -> Click 'Next', then set a PIN you'll remember" -ForegroundColor Yellow
|
|
Write-Host " -> Click 'Finish' then 'OK'" -ForegroundColor Yellow
|
|
Write-Host ""
|
|
|
|
& certreq.exe -new $infPath $cerPath
|
|
if ($LASTEXITCODE -ne 0) {
|
|
Write-Error "certreq -new failed with exit code $LASTEXITCODE"
|
|
exit $LASTEXITCODE
|
|
}
|
|
|
|
Write-Host ""
|
|
Write-Host "=== Step 4: New cert summary ===" -ForegroundColor Cyan
|
|
$new = Get-ChildItem Cert:\CurrentUser\My | Where-Object {
|
|
$_.Subject -like "*CN=Test User*"
|
|
} | Sort-Object NotBefore -Descending | Select-Object -First 1
|
|
|
|
if ($new) {
|
|
Write-Host "Subject: $($new.Subject)" -ForegroundColor Green
|
|
Write-Host "Issuer: $($new.Issuer)"
|
|
Write-Host "Serial: $($new.SerialNumber)"
|
|
Write-Host "Thumbprint: $($new.Thumbprint)"
|
|
Write-Host "Valid From: $($new.NotBefore)"
|
|
Write-Host "Valid Until: $($new.NotAfter)"
|
|
Write-Host "KeyUsage: $($new.Extensions | Where-Object { $_.Oid.Value -eq '2.5.29.15' } | ForEach-Object { $_.KeyUsages })"
|
|
} else {
|
|
Write-Warning "Cert created but not findable - check certmgr.msc -> Personal -> Certificates"
|
|
}
|
|
|
|
# Cleanup temp files
|
|
Remove-Item $infPath -Force -ErrorAction SilentlyContinue
|
|
Remove-Item $cerPath -Force -ErrorAction SilentlyContinue
|
|
|
|
Write-Host ""
|
|
Write-Host "=== Done ===" -ForegroundColor Green
|
|
Write-Host "Next:"
|
|
Write-Host " 1. Clear JWS cache:"
|
|
Write-Host " Remove-Item -Recurse -Force `"`$env:USERPROFILE\.cache\icedtea-web`""
|
|
Write-Host " 2. Trigger DSC enroll from the web UI."
|
|
Write-Host " 3. Pick 'Test User' from the cert table - now shows real Holder Name and Organisation."
|
|
Write-Host " 4. Windows pops the PIN prompt; enter the PIN you set above. Helper proceeds to enroll."
|