diff --git a/README.md b/README.md index 654c8348..bf2068d3 100644 --- a/README.md +++ b/README.md @@ -202,7 +202,7 @@ iex $cmd ## Setting up Certificate based authentication Perform the following steps to authenticate with a certificate instead of a username and password: -1. Generate a certificate with an Extended Key Usage of Client Authentication and a Subject Alternative Name with the UPN of the user. See this [powershell function](https://github.com/WinRb/WinRM/blob/main/WinrmAppveyor.psm1#L1) as an example of using `openssl` to create a self signed user certificate in `.pem` and `.pfx` formats along with the private key file. +1. Generate a certificate with an Extended Key Usage of Client Authentication and a Subject Alternative Name with the UPN of the user. e.g. using `openssl` to create a self signed user certificate in `.pem` and `.pfx` formats along with the private key file. 2. Import the pfx file into the `TrustedPeople` directory of the `LocalMachine` certificate store on the windows endpoint. diff --git a/WinrmAppveyor.psm1 b/WinrmAppveyor.psm1 deleted file mode 100644 index 58318f1b..00000000 --- a/WinrmAppveyor.psm1 +++ /dev/null @@ -1,32 +0,0 @@ -function New-ClientCertificate { - param([String]$username, [String]$basePath = ((Resolve-Path .).Path)) - - $env:OPENSSL_CONF=[System.IO.Path]::GetTempFileName() - - Set-Content -Path $env:OPENSSL_CONF -Value @" - distinguished_name = req_distinguished_name - [req_distinguished_name] - [v3_req_client] - extendedKeyUsage = clientAuth - subjectAltName = otherName:1.3.6.1.4.1.311.20.2.3;UTF8:$username@localhost -"@ - - $user_path = Join-Path $basePath user.pem - $key_path = Join-Path $basePath key.pem - $pfx_path = Join-Path $basePath user.pfx - - openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -out $user_path -outform PEM -keyout $key_path -subj "/CN=$username" -extensions v3_req_client 2>&1 - - openssl pkcs12 -export -in $user_path -inkey $key_path -out $pfx_path -passout pass: 2>&1 - - del $env:OPENSSL_CONF -} - -function New-WinrmUserCertificateMapping { - param([String]$issuer) - $secure_pass = ConvertTo-SecureString $env:winrm_password -AsPlainText -Force - $cred = New-Object System.Management.Automation.PSCredential ($env:winrm_user, $secure_pass) - New-Item -Path WSMan:\localhost\ClientCertificate -Subject "$env:winrm_user@localhost" -URI * -Issuer $issuer -Credential $cred -Force -} - -Export-ModuleMember New-ClientCertificate, New-WinrmUserCertificateMapping \ No newline at end of file diff --git a/appveyor.yml b/appveyor.yml deleted file mode 100644 index b9afb6d7..00000000 --- a/appveyor.yml +++ /dev/null @@ -1,53 +0,0 @@ -version: "master-{build}" - -image: Visual Studio 2022 -platform: - - x64 - -environment: - winrm_user: test_user - winrm_password: Pass@word1 - user_cert: c:\projects\winrm\user.pem - user_key: c:\projects\winrm\key.pem - - matrix: - - ruby_version: "33-x64" - winrm_endpoint: http://localhost:5985/wsman - - ruby_version: "32-x64" - winrm_endpoint: http://localhost:5985/wsman - -clone_folder: c:\projects\winrm -clone_depth: 1 -branches: - only: - - master - -install: - - ps: net user /add $env:winrm_user $env:winrm_password - - ps: net localgroup administrators $env:winrm_user /add - - ps: $env:PATH="C:\OpenSSL-Win64\bin;$env:PATH" - - ps: Import-Module c:\projects\winrm\WinrmAppveyor.psm1 - - ps: New-ClientCertificate $env:winrm_user c:\projects\winrm - - ps: $env:user_cert_thumb = (Import-pfxCertificate -FilePath c:\projects\winrm\user.pfx -CertStoreLocation Cert:\LocalMachine\root).Thumbprint - - ps: Import-pfxCertificate -FilePath c:\projects\winrm\user.pfx -CertStoreLocation Cert:\LocalMachine\TrustedPeople - - ps: $env:winrm_cert = (New-SelfSignedCertificate -DnsName localhost -CertStoreLocation cert:\localmachine\my).Thumbprint - - ps: Enable-PSRemoting -Force - - ps: winrm create winrm/config/Listener?Address=*+Transport=HTTPS "@{Hostname=`"localhost`";CertificateThumbprint=`"$($env:winrm_cert)`"}" - - ps: winrm set winrm/config/client/auth '@{Basic="true"}' - - ps: winrm set winrm/config/service/auth '@{Basic="true"}' - - ps: winrm set winrm/config/service/auth '@{Certificate="true"}' - - ps: winrm set winrm/config/service/auth '@{CbtHardeningLevel="Strict"}' - - ps: winrm set winrm/config/service '@{AllowUnencrypted="true"}' - - ps: New-WinrmUserCertificateMapping $env:user_cert_thumb - - ps: $env:PATH="C:\Ruby$env:ruby_version\bin;$env:PATH" - - ps: Write-Host $env:PATH - - ps: ruby --version - - ps: gem --version - - ps: bundler --version - -build_script: - - bundle install || bundle install || bundle install - -test_script: - - SET SPEC_OPTS=--format progress - - bundle exec rake integration