support domain lookup from oidHEADmaster

1 files changed, 25 insertions, 4 deletions

diff --git a/read-cert-template.sh b/read-cert-template.sh
index 5006bd5..902a4de 100644..100755
--- a/read-cert-template.sh
+++ b/read-cert-template.sh
@@ -7,6 +7,7 @@
 # Title: Read cert template
 # Purpose: read certificate and print cert tempalte name if discoverable
 # History:
+#    2024-07-23 added to support RCT_LDAPSERVER_1234567 values in the conf file for domain-specific connection info
 # Usage:
 # Reference: see blog post
 # Improve:
@@ -19,7 +20,7 @@ test -f "${RCT_CONF}" && . "${RCT_CONF}"
 
 # use RCT_IN env var or first parameter, or else standard input
 RCT_IN="${RCT_IN:-${1}}"
-RCT_IN="${RCT_IN:-/dev/stdin}"
+RCT_IN="${RTC_IN:-/dev/stdin}"
 
 if echo "${RCT_IN}" | grep -qE -e '^-$|^stdin$' ;
 then
@@ -28,6 +29,26 @@ else
    _input="$( cat "${RCT_IN}" )"
 fi
 
-oid="$( echo "${_input}" | openssl x509 -in /dev/stdin -noout -text -certopt no_header,no_version,no_serial,no_signame,no_validity,no_subject,no_issuer,no_pubkey,ext_parse | sed -n -r -e '/1.3.6.1.4.1.311.21.7/,+2p' | awk '/OBJECT/{print $NF}' | sed -r -e 's/^://;' )"
-test -n "${VERBOSE}" && printf 'oid=%s\n' "${oid}" 1>&2
-LDAPTLS_REQCERT=never ldapsearch -LLL -o ldif-wrap=9000 -H "${RCT_LDAPSERVER}" ${RCT_LDAPAUTHUNQUOTED} "${RCT_LDAPAUTHQUOTED}" -b "CN=Certificate Templates,CN=Public Key,CN=Services,CN=Configuration,${RCT_LDAPBASE}" "(msPKI-Cert-Template-OID=${oid})" CN | awk '$1~/cn:/{$1="";print;}' | sed -r -e 's/^ +| +$//g;'
+oid="$( echo "${_input}" | openssl x509 -in /dev/stdin -noout -text -certopt no_header,no_version,no_serial,no_signame,no_validity,no_subject,no_issuer,no_pubkey,ext_parse | sed -n -r -e '/1.3.6.1.4.1.311.21.7|Microsoft certificate template/,+2p' | awk '/OBJECT/{print $NF}' | sed -r -e 's/^://;' )"
+# domain oid segment
+_d="$( echo "${oid}" | awk -F'.' '$0~/1\.3\.6\.1\.4\.1\.311\.21\.8/{print $10}' )"
+# Load RCT_ALIAS_1234567 where 1234567=domain oid segment
+for word in ALIAS LDAPSERVER LDAPBASE LDAPAUTH1 LDAPAUTH2 ;
+do
+   eval test -n \"\${RCT_${word}_${_d}}\" && eval RCT_${word}=\"\${RCT_${word}_${_d}}\"
+done
+test -n "${VERBOSE}" && {
+   printf 'oid=%s\n' "${oid}"
+   printf 'domain=%s\n' "${RCT_ALIAS}"
+} 1>&2
+
+# look up template
+LDAPTLS_REQCERT=never ldapsearch -LLL -o ldif-wrap=9000 -H "${RCT_LDAPSERVER}" ${RCT_LDAPAUTH1} "${RCT_LDAPAUTH2}" -b "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,${RCT_LDAPBASE}" "(msPKI-Cert-Template-OID=${oid})" CN | awk '$1~/cn:/{$1="";print;}' | sed -r -e 's/^ +| +$//g;' | {
+   if test -n "${RCT_ALIAS}" ;
+   then
+      # append alias on end
+      sed -r -e "s/ *$/ (${RCT_ALIAS})/g;"
+   else
+      cat
+   fi
+}