Renew samba fixture expired test certificates

[jkakavas]

Add a README file for how these certificates can be renewed in the
future, when the need arises again.

[elasticmachine]

Pinging @elastic/es-security (Team:Security)

[hendrikmuhs]

Due to the cryptic failure, it took time to find the root cause, this was the error message:

13:02:22 + ldapmodify -D Administrator@ad.test.elasticsearch.com -w Passw0rd -H ldaps://127.0.0.1:636 -f /tmp/entrymods -v
13:02:22 ldap_initialize( ldaps://127.0.0.1:636/??base )
13:02:22 ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

It would therefore be nice to e.g. add something like:

if ! openssl x509 -noout -checkend 86400  -in /fixture/src/main/resources/certs/ca.pem; then echo "Certificate has expired, please check the readme for instructions."; fi

to src/main/resources/provision/installsmb.sh and potentially other places.

update: requires adding the installation of openssl in Dockerfile

[jkakavas]

to src/main/resources/provision/installsmb.sh and potentially other places.

Agreed, but I think we can do a better job with the fixture and I don't want us to block intake for more than necessary while we think/iterate on solutions. If you don't mind @hendrikmuhs , I'll merge this with just the certificate changes and open an issue to properly address the fixture's resilience

[hendrikmuhs]

to src/main/resources/provision/installsmb.sh and potentially other places.

Agreed, but I think we can do a better job with the fixture and I don't want us to block intake for more than necessary while we think/iterate on solutions. If you don't mind @hendrikmuhs , I'll merge this with just the certificate changes and open an issue to properly address the fixture's resilience

👍, improvements can be done in a follow-up

[albertzaharovits]

Suggested change

	--dns localhost --ip 127.0.0.1,0:0:0:0:0:0:0:1 --name samba4
	--dns localhost --ip 127.0.0.1,0:0:0:0:0:0:0:1 --name samba4 --out ${PWD}/samba4.zip

[jkakavas]

Thanks, it's good to be explicit

[albertzaharovits]

Suggested change

	These keys and certificates are copied by installsmb.sh for the Samba server to use for TLS. See `../resources/installsmb.sh`
	These keys and certificates are copied by installsmb.sh for the Samba server to use for TLS. See `../provision/installsmb.sh`

[albertzaharovits]

I've tested UserAttributeGroupsResolverTests and ActiveDirectoryGroupsResolverTests (the only users of ADtrust.jks) with only the smb_ca entry in the truststore (no smb_cert and no mykey entries) and they pass.

Might be worth adjusting the truststore while we're at it.

[jkakavas]

Can do since I'll respin this eitherway, but we definitely need to clean our key/cert resources up soon. I think we have an open issue about this somewhere too

[hendrikmuhs]

LGTM