cli: acme: expose acme eab options on the cli

interactively ask for external account binding credentials if either:
* the ca requests it
* a custom ca is used

Signed-off-by: Folke Gleumes <f.gleumes@proxmox.com>

diff --git a/src/PMG/CLI/pmgconfig.pm b/src/PMG/CLI/pmgconfig.pm
index cc036fa1f8caab1c980f9faab3e532b9eef450dd..2a7a7a1deb66c1f051c63f6eeb4d6ace9318a40b 100644 (file)
--- a/src/PMG/CLI/pmgconfig.pm
+++ b/src/PMG/CLI/pmgconfig.pm
@@ -244,6 +244,7 @@ __PACKAGE__->register_method({
     code => sub {
        my ($param) = @_;
 
+       my $custom_directory = 1;
        if (!$param->{directory}) {
            my $directories = PMG::API2::ACME->get_directories({});
            print "Directory endpoints:\n";
@@ -264,6 +265,7 @@ __PACKAGE__->register_method({
                        return;
                    } elsif ($selection < $i && $selection >= 0) {
                        $param->{directory} = $directories->[$selection]->{url};
+                       $custom_directory = 0;
                        return;
                    }
                }
@@ -277,11 +279,13 @@ __PACKAGE__->register_method({
                $attempts++;
            }
        }
+
        print "\nAttempting to fetch Terms of Service from '$param->{directory}'..\n";
-       my $tos = PMG::API2::ACME->get_tos({ directory => $param->{directory} });
-       if ($tos) {
+       my $meta = PMG::API2::ACME->get_meta({ directory => $param->{directory} });
+       if ($meta->{termsOfService}) {
+           my $tos = $meta->{termsOfService};
            print "Terms of Service: $tos\n";
-           my $term = Term::ReadLine->new('pvenode');
+           my $term = Term::ReadLine->new('pmgconfig');
            my $agreed = $term->readline('Do you agree to the above terms? [y|N]: ');
            die "Cannot continue without agreeing to ToS, aborting.\n"
                if ($agreed !~ /^y$/i);
@@ -290,6 +294,25 @@ __PACKAGE__->register_method({
        } else {
            print "No Terms of Service found, proceeding.\n";
        }
+
+       my $eab_enabled = $meta->{externalAccountRequired};
+       if (!$eab_enabled && $custom_directory) {
+           my $term = Term::ReadLine->new('pmgconfig');
+           my $agreed = $term->readline('Do you want to use external account binding? [y|N]: ');
+           $eab_enabled = ($agreed =~ /^y$/i);
+       } elsif ($eab_enabled) {
+           print "The CA requires external account binding.\n";
+       }
+       if ($eab_enabled) {
+           print "You should have received a key id and a key from your CA.\n";
+           my $term = Term::ReadLine->new('pmgconfig');
+           my $eab_kid = $term->readline('Enter EAB key id: ');
+           my $eab_hmac_key = $term->readline('Enter EAB key: ');
+
+           $param->{'eab-kid'} = $eab_kid;
+           $param->{'eab-hmac-key'} = $eab_hmac_key;
+       }
+
        print "\nAttempting to register account with '$param->{directory}'..\n";
 
        $upid_exit->(PMG::API2::ACME->register_account($param));