- file = os.path.join(self.options.sfi_dir, self.user.replace(self.authority + '.', '') + ".cert")
- if (os.path.isfile(file)):
- # use existing cert if it exists
- return file
- else:
- try:
- # attempt to use gid as the cert.
- gid = self._get_gid()
- self.logger.info("Writing certificate to %s"%file)
- gid.save_to_file(file)
- except:
- # generate self signed certificate
- k = Keypair(filename=key_file)
- cert = Certificate(subject=self.user)
- cert.set_pubkey(k)
- cert.set_issuer(k, self.user)
- cert.sign()
- self.logger.info("Writing self-signed certificate to %s"%file)
- cert.save_to_file(file)
-
- return file
+ cert_file = os.path.join(self.options.sfi_dir, self.user.replace(self.authority + '.', '') + ".cert")
+ if (os.path.isfile(cert_file)):
+ # we'd perfer to use Registry issued certs instead of self signed certs.
+ # if this is a Registry cert (GID) then we are done
+ gid = GID(filename=cert_file)
+ if gid.get_urn():
+ return cert_file
+
+ # generate self signed certificate
+ k = Keypair(filename=key_file)
+ cert = Certificate(subject=self.user)
+ cert.set_pubkey(k)
+ cert.set_issuer(k, self.user)
+ cert.sign()
+ self.logger.info("Writing self-signed certificate to %s"%cert_file)
+ cert.save_to_file(cert_file)
+ # try to get registry issued cert
+ try:
+ self.logger.info("Getting Registry issued cert")
+ self.read_config()
+ # *hack. need to set registyr before _get_gid() is called
+ self.registry = xmlrpcprotocol.get_server(self.reg_url, key_file, cert_file, self.options)
+ gid = self._get_gid(type='user')
+ self.registry = None
+ self.logger.info("Writing certificate to %s"%cert_file)
+ gid.save_to_file(cert_file)
+ except:
+ self.logger.info("Failed to download Registry issued cert")
+
+ return cert_file