github.com/canhui/fabric_ca2_2@v2.0.0-alpha+incompatible/images/fabric-ca-fvt/payload/fabric-ca_utils (about)

     1  #!/bin/bash
     2  #
     3  # Copyright IBM Corp. All Rights Reserved.
     4  #
     5  # SPDX-License-Identifier: Apache-2.0
     6  #
     7  export FABRIC_CA="$GOPATH/src/github.com/hyperledger/fabric-ca"
     8  export FABRIC_CA_CLIENTEXEC="/usr/local/bin/fabric-ca-client"
     9  export FABRIC_CA_SERVEREXEC="/usr/local/bin/fabric-ca-server"
    10  export TESTDATA="$FABRIC_CA/testdata"
    11  export SCRIPTDIR="$FABRIC_CA/scripts/fvt"
    12  export MYSQL_PORT="3306"
    13  export LDAP_PORT="389"
    14  export LDAP_PROTO="ldap://"
    15  export POSTGRES_PORT="5432"
    16  export PGPASSWORD='postgres'
    17  export MSP_KEY_DIR='msp/keystore'
    18  export MSP_CERT_DIR='msp/signcerts'
    19  export FABRIC_CA_DATA="/etc/hyperledger/fabric-ca"
    20  export TLS_ROOTCERT="$FABRIC_CA_DATA/FabricTlsPkiBundle.pem"
    21  export TLS_SUBCACERT="$FABRIC_CA_DATA/FabricTlsSubCa-cert.pem"
    22  export TLS_RACERT="$FABRIC_CA_DATA/FabricTlsRa-cert.pem"
    23  export TLS_SERVERCERT="$FABRIC_CA_DATA/FabricTlsServerEEcert.pem"
    24  export TLS_SERVERKEY="$FABRIC_CA_DATA/FabricTlsServerEEkey.pem"
    25  export TLS_CLIENTCERT="$FABRIC_CA_DATA/FabricTlsClientEEcert.pem"
    26  export TLS_CLIENTKEY="$FABRIC_CA_DATA/FabricTlsClientEEkey.pem"
    27  export CA_HOST_ADDRESS="localhost"
    28  export PROXY_PORT="7054"
    29  export CA_DEFAULT_PORT="1${PROXY_PORT}"
    30  
    31  DATE='date +%Y-%m-%d'
    32  TIME='date +%I:%M:%S%p'
    33  
    34  TimeStamp() {
    35     printf "TIMESTAMP--%s %s\n" $($DATE) $($TIME)
    36  }
    37  
    38  tolower() {
    39    echo "$1" | tr [:upper:] [:lower:]
    40  }
    41  
    42  setTLS() {
    43     PROTO="http://"
    44     TLSOPT=""
    45     # if not set, default to OFF
    46     if test -n "$FABRIC_TLS"; then
    47       # otherwise, set TLS-related stuff
    48       if $($FABRIC_TLS); then
    49          PROTO="https://"
    50          TLSOPT="--tls.certfiles $TLS_ROOTCERT"
    51       fi
    52     fi
    53  }
    54  
    55  ErrorMsg() {
    56     local msg="$1"
    57     local rc="$2"
    58     : ${rc:="RC"}
    59     echo -e "\033[31m ****** ERROR ****** $msg \033[0m"
    60     let $rc+=1
    61  }
    62  
    63  ErrorExit() {
    64     $SCRIPTDIR/fabric-ca_setup.sh -R -x $CA_CFG_PATH -d $driver
    65     local msg="$1"
    66     local rc="$2"
    67     : ${rc:="RC"}
    68     let $rc+=1
    69     echo -e "\033[31m ****** ERROR ****** $msg \033[0m"
    70     CleanUp $(eval echo \$$rc)
    71     exit $(eval echo \$$rc)
    72  }
    73  
    74  isReachable() {
    75     # a test to see if there is a listener on
    76     # specified host:port
    77     # netcat would be *far* simpler:
    78     #    nc -nzvt host port
    79     # but not guaranteed to be installed
    80     # so use python, since it is ubiquitious
    81     local host="$1"
    82     local port="$2"
    83     test -z "$host" -o -z "$port" && return 1
    84  
    85     python - <<END
    86  import socket
    87  import sys
    88  import os
    89  remoteServer =  "$host"
    90  port         = int("$port");
    91  remoteServerIP  = socket.gethostbyname(remoteServer)
    92  sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    93  result = sock.connect_ex((remoteServerIP, port))
    94  sock.close()
    95  os._exit(result)
    96  END
    97  }
    98  
    99  pollServer() {
   100     local app="$1"
   101     local host="$2"
   102     local port="$3"
   103     local timeout="$4"
   104     : ${timeout:="10"}
   105     local rc=1
   106     local starttime=$(date +%s)
   107  
   108     # continue to poll host:port until
   109     # we either get a response, or reach timeout
   110     while test "$(($(date +%s)-starttime))" -lt "$((timeout*2))" -a $rc -ne 0
   111     do
   112        printf "\r%s%03d" "Waiting for $app start on $host:$port ..." "$(($(date +%s)-starttime))"
   113        ss -lpnt "src $host:$port"
   114        isReachable "$host" "$port"
   115        rc=$?
   116        test $rc -eq 0 && break
   117        sleep .5
   118     done
   119     echo "Server rc $rc"
   120     return $rc
   121  }
   122  
   123  CleanUp() {
   124     local RC=$1
   125     : ${RC:=0}
   126     ###############################################################################
   127     # Summary
   128     ###############################################################################
   129     echo ""
   130     echo "#########################################################################"
   131     printf "RC: $RC, $TESTCASE "
   132  
   133     if test "$RC" -eq 0; then
   134        RESULT="PASSED"
   135     else
   136        RESULT="FAILED"
   137     fi
   138  
   139     printf "%s\n" $RESULT
   140     RUNTIME_S="$((SECONDS-STARTIME))"
   141     echo "$((RUNTIME_S/60)) minutes, $((RUNTIME_S%60)) seconds runtime"
   142     printf "$(TimeStamp) $TESTCASE ENDED\n"
   143     echo "#########################################################################"
   144  
   145     TimeStamp
   146     printf "%s test ended.\n" $TESTCASE
   147  }
   148  
   149  verifyServerTraffic() {
   150     # verifyServerTraffic
   151     # validate that backend <server_name>
   152     # got at least <num_requests> requests from client
   153     # with a minimum of <percent> HTTP status code <code>
   154     local haproxy_addr="$1"
   155     local server_name="$2"
   156     local num_requests="$3"
   157     local percent="$4"
   158     local code="$5"
   159     local op="$6"
   160     local rc=0
   161  
   162      # default
   163      #  server got at least one request
   164      #  all received requests were successfully served
   165      : ${haproxy_addr:="localhost:10888"}
   166      : ${server_name:="server1"}
   167      : ${num_requests:="1"}
   168      : ${percent:="100"}
   169      : ${code:="HTTP 2xx"}
   170      : ${op:="eq"}
   171  
   172     result=$(curl -s http://${haproxy_addr}/ |
   173       awk -v s="$server_name\"" '$0~s'|html2text|
   174          awk -v c="$code" '
   175             /Cum. sessions:/ {sessions=$NF}
   176             $0~c {gsub(/[(%)]/,"",$NF);status=$NF}
   177             END {print sessions" "status}')
   178     eval test "${result%% *}" -$op "$num_requests" 2>/dev/null; rc=$((rc+$?))
   179     eval test "${result##* }" -$op "$percent" 2>/dev/null; rc=$((rc+$?))
   180  
   181     return $rc
   182  }
   183  
   184  printAuth() {
   185     local CLIENTCERT="$1"
   186     local CLIENTKEY="$2"
   187  
   188     : ${CLIENTCERT:="$HOME/fabric-ca/cert.pem"}
   189     : ${CLIENTKEY:="$HOME/fabric-ca/key.pem"}
   190  
   191     echo CERT:
   192     openssl x509 -in $CLIENTCERT -text 2>&1 | sed 's/^/    /'
   193     type=$(cat $CLIENTKEY | head -n1 | awk '{print tolower($2)}')
   194     test -z "$type" && type=rsa
   195     echo KEY:
   196     openssl $type -in $CLIENTKEY -text 2>/dev/null| sed 's/^/    /'
   197  }
   198  
   199  startHttp() {
   200     local port="$1"
   201     local rootdir="$2"
   202     cd $rootdir
   203     python -m SimpleHTTPServer $port &
   204     HTTP_PID=$!
   205     pollServer python localhost "$HTTP_PORT" && return $HTTP_PID || return -1
   206  }
   207  
   208  keyCheck() {
   209     local cert="$1"
   210     local key="$2"
   211     local alg="$3"
   212     : ${alg:="rsa"}
   213     test -f "$cert" -a -f "$key" || return 1
   214  
   215     # check to see that the public/private key pair match
   216     case "$alg" in
   217     rsa|dsa)
   218         k_hash=$(openssl $alg -noout -modulus -in $key  2>&1| awk -F'=' '/=/ {print $2}' | openssl md5 | awk '{print $NF}')
   219         c_hash=$(openssl x509 -noout -modulus -in $cert 2>&1| awk -F'=' '/=/ {print $2}' | openssl md5 | awk '{print $NF}')
   220     ;;
   221     *)
   222         k_hash=$(openssl $alg        -pubout -in $key  2>/dev/null| openssl md5 | awk '{print $NF}')
   223         c_hash=$(openssl x509 -noout -pubkey -in $cert            | openssl md5 | awk '{print $NF}')
   224     ;;
   225     esac
   226  
   227     test -z "$k_hash" -o -z "$c_hash" && return 1
   228     test "$k_hash" == "$c_hash" || return 1
   229  
   230     return 0
   231  }
   232  
   233  enroll() {
   234     # Input : username, password
   235     # Output: cert to filename1, key to filename2
   236     local username="$1"
   237     : ${username:="admin"}
   238     local userpswd="$2"
   239     : ${userpswd:="adminpw"}
   240     local FABRIC_CA_ENROLLMENT_DIR="$CA_CFG_PATH/$username"
   241     local FABRIC_CA_CERT_FILE="$FABRIC_CA_ENROLLMENT_DIR/$MSP_CERT_DIR/cert.pem"
   242     local FABRIC_CA_KEY_FILE="$FABRIC_CA_ENROLLMENT_DIR/$MSP_KEY_DIR/key.pem"
   243     local FABRIC_CA_CLIENT_HOME=$FABRIC_CA_ENROLLMENT_DIR
   244     local HOST="localhost"
   245     local PORT="$PROXY_PORT"
   246     local RC=0
   247     export FABRIC_CA_CLIENT_HOME
   248     export FABRIC_CA_ENROLLMENT_DIR
   249  
   250     test -d "$FABRIC_CA_ENROLLMENT_DIR" || mkdir -p "$FABRIC_CA_ENROLLMENT_DIR"
   251     ENROLLCONFIG="$FABRIC_CA_ENROLLMENT_DIR/enroll.yaml"
   252  
   253     # Determines the PROTO and TLSOPT values based on FABRIC_TLS setting
   254     setTLS
   255     $FABRIC_CA_CLIENTEXEC enroll -u "${PROTO}${username}:${userpswd}@${CA_HOST_ADDRESS}:$PROXY_PORT" $TLSOPT \
   256                           -c $ENROLLCONFIG \
   257                           --csr.hosts "$username@fab-client.raleigh.ibm.com" \
   258                           --csr.hosts "$username.fabric.raleigh.ibm.com,127.0.0.2"
   259     RC=$?
   260     if test -n "$FABRIC_CA_DEBUG"; then
   261        $(test "$RC" -eq 0 && $($FABRIC_CA_DEBUG)) && printAuth $FABRIC_CA_CERT_FILE $FABRIC_CA_KEY_FILE
   262     fi
   263     return $RC
   264  }
   265  
   266  reenroll() {
   267     local USERNAME="$1"
   268     : ${USERNAME:="admin"}
   269     local FABRIC_CA_ENROLLMENT_DIR="$CA_CFG_PATH/$USERNAME"
   270     local FABRIC_CA_CERT_FILE="$FABRIC_CA_ENROLLMENT_DIR/$MSP_CERT_DIR/cert.pem"
   271     local FABRIC_CA_KEY_FILE="$FABRIC_CA_ENROLLMENT_DIR/$MSP_KEY_DIR/key.pem"
   272     local FABRIC_CA_CLIENT_HOME=$FABRIC_CA_ENROLLMENT_DIR
   273     local HOST="localhost"
   274     local PORT="$PROXY_PORT"
   275     local RC=0
   276     export FABRIC_CA_CLIENT_HOME
   277     export FABRIC_CA_ENROLLMENT_DIR
   278  
   279     test -d "$FABRIC_CA_ENROLLMENT_DIR" || mkdir -p "$FABRIC_CA_ENROLLMENT_DIR"
   280     FABRIC_CA_CERT_FILE="$FABRIC_CA_CLIENT_HOME/$MSP_CERT_DIR/cert.pem"
   281     FABRIC_CA_KEY_FILE="$FABRIC_CA_CLIENT_HOME/$MSP_KEY_DIR/key.pem"
   282  
   283     : ${KEYTYPE="ecdsa"}
   284     : ${KEYLEN="256"}
   285     test -d "$FABRIC_CA_CLIENT_HOME" || mkdir -p "$FABRIC_CA_CLIENT_HOME"
   286     ENROLLCONFIG="$FABRIC_CA_CLIENT_HOME/enroll.yaml"
   287     export FABRIC_CA_CLIENT_HOME
   288     setTLS
   289     $FABRIC_CA_CLIENTEXEC reenroll -u $PROTO${CA_HOST_ADDRESS}:$PROXY_PORT $TLSOPT -c $ENROLLCONFIG
   290     RC=$?
   291     $($FABRIC_CA_DEBUG) && printAuth $FABRIC_CA_CERT_FILE $FABRIC_CA_KEY_FILE
   292     $SCRIPTDIR/fabric-ca_setup.sh -L -d $driver
   293     return $RC
   294  }
   295  
   296  
   297  register() {
   298     local REGISTRAR="$1"
   299     : ${REGISTRAR:="admin"}
   300     local USERNAME="$2"
   301     : ${USERNAME:="testuser"}
   302     local USERTYPE="$3"
   303     : ${USERTYPE:="client"}
   304     local USERGRP="$4"
   305     : ${USERGRP:="bank_a"}
   306     test "$USERGRP" = '[]' && USERGRP_OPT="" || USERGRP_OPT="--id.affiliation $USERGRP"
   307     local USERATTR="$5"
   308     : ${USERATTR:='test=testValue'}
   309     local FABRIC_CA_ENROLLMENT_DIR="$6"
   310  
   311     : ${FABRIC_CA_ENROLLMENT_DIR:="$CA_CFG_PATH/$REGISTRAR"}
   312     : ${FABRIC_CA_CLIENT_HOME:="$CA_CFG_PATH/$REGISTRAR"}
   313  
   314     export FABRIC_CA_ENROLLMENT_DIR
   315     setTLS
   316     $FABRIC_CA_CLIENTEXEC register -u "$PROTO${CA_HOST_ADDRESS}:$PROXY_PORT" $TLSOPT \
   317                             --id.name "$USERNAME" \
   318                             --id.type "$USERTYPE" \
   319                             --id.maxenrollments 1 \
   320                             $USERGRP_OPT \
   321                             --id.attrs "$USERATTR" \
   322                             -c $FABRIC_CA_CLIENT_HOME/fabric-ca-client-config.yaml
   323     local rc=$?
   324     return $rc
   325  }
   326  
   327  function genRunconfig() {
   328     local runconfig="$1"
   329     local driver="$2"
   330     local datasrc="$3"
   331     local serverCert="$4"
   332     local serverKey="$5"
   333     local maxEnroll="$6"
   334     local version="$7"
   335     : ${FABRIC_TLS:='false'}
   336     : ${FABRIC_CA_DEBUG:='false'}
   337     local registry=""
   338  
   339     case ${version:-"yaml"} in
   340        json) if ! $($LDAP_ENABLE); then registry="
   341     \"registry\": {
   342        \"maxEnrollments\": \"$maxEnroll\",
   343        \"identities\": [
   344           {
   345              \"name\": \"admin\",
   346              \"pass\": \"adminpw\",
   347              \"type\": \"client\",
   348              \"affiliation\": \"bank_a\",
   349              \"maxEnrollments\": \"$maxEnroll\",
   350              \"attrs\": {
   351                 \"hf.Registrar.Roles\": \"client,user,peer,validator,auditor,ca\",
   352                 \"hf.Registrar.DelegateRoles\": \"client,user,validator,auditor\",
   353                 \"hf.Revoker\": true
   354              }
   355           },
   356           {
   357              \"name\": \"admin2\",
   358              \"pass\": \"adminpw2\",
   359              \"type\": \"client\",
   360              \"affiliation\": \"bank_a\",
   361              \"maxEnrollments\": \"$maxEnroll\",
   362              \"attrs\": {
   363                 \"hf.Registrar.Roles\": \"client,user,peer,validator,auditor,ca\",
   364                 \"hf.Registrar.DelegateRoles\": \"client,user,validator,auditor\",
   365                 \"hf.Revoker\": true
   366              }
   367           },
   368           {
   369              \"name\": \"revoker\",
   370              \"pass\": \"revokerpw\",
   371              \"type\": \"client\",
   372              \"affiliation\": \"bank_a\",
   373              \"maxEnrollments\": \"$maxEnroll\",
   374              \"attrs\": {
   375                 \"hf.Revoker\": true
   376              }
   377           },
   378           {
   379              \"name\": \"revoker2\",
   380              \"pass\": \"revokerpw2\",
   381              \"type\": \"client\",
   382              \"affiliation\": \"bank_a\",
   383              \"maxEnrollments\": \"$maxEnroll\",
   384              \"attrs\": {
   385                 \"hf.Revoker\": true
   386              }
   387           },
   388           {
   389              \"name\": \"nonrevoker\",
   390              \"pass\": \"nonrevokerpw\",
   391              \"type\": \"client\",
   392              \"affiliation\": \"bank_a\",
   393              \"maxEnrollments\": \"$maxEnroll\"
   394           },
   395           {
   396              \"name\": \"nonrevoker2\",
   397              \"pass\": \"nonrevokerpw2\",
   398              \"type\": \"client\",
   399              \"affiliation\": \"bank_a\",
   400              \"maxEnrollments\": \"$maxEnroll\"
   401           },
   402           {
   403              \"name\": \"notadmin\",
   404              \"pass\": \"pass\",
   405              \"type\": \"client\",
   406              \"affiliation\": \"bank_a\",
   407              \"maxEnrollments\": \"$maxEnroll\",
   408              \"attrs\": {
   409                 \"hf.Registrar.Roles\": \"client,user,peer,validator,auditor,ca\",
   410                 \"hf.Registrar.DelegateRoles\": \"client\"
   411              }
   412           },
   413           {
   414              \"name\": \"expiryUser\",
   415              \"pass\": \"expirypw\",
   416              \"type\": \"client\",
   417              \"affiliation\": \"bank_a\",
   418              \"maxEnrollments\": \"$maxEnroll\"
   419           },
   420           {
   421              \"name\": \"testUser\",
   422              \"pass\": \"user1\",
   423              \"type\": \"client\",
   424              \"affiliation\": \"bank_b\",
   425              \"maxEnrollments\": \"$maxEnroll\",
   426              \"attrs\": []
   427           },
   428           {
   429              \"name\": \"testUser2\",
   430              \"pass\": \"user2\",
   431              \"type\": \"client\",
   432              \"affiliation\": \"bank_c\",
   433              \"maxEnrollments\": \"$maxEnroll\",
   434              \"attrs\": []
   435           },
   436           {
   437              \"name\": \"testUser3\",
   438              \"pass\": \"user3\",
   439              \"type\": \"client\",
   440              \"affiliation\": \"bank_a\",
   441              \"maxEnrollments\": \"$maxEnroll\",
   442              \"attrs\": []
   443           }
   444        ]
   445     },
   446  "
   447  fi
   448  cat > $runconfig <<EOF
   449  {
   450     "address": "$CA_HOST_ADDRESS",
   451     "port": $CA_DEFAULT_PORT,
   452     "debug": "$FABRIC_CA_DEBUG",
   453     "db": {
   454        "type": "$driver",
   455        "datasource": "$datasrc",
   456         "tls": {
   457            "enabled": "$TLS_ON",
   458            "certfiles": [ "$TLS_ROOTCERT", $TLS_RACERT, $TLS_SUBCACERT ],
   459            "client": {
   460               "certfile": "$TLS_CLIENTCERT",
   461               "keyfile": "$TLS_CLIENTKEY"
   462            }
   463         }
   464     },
   465     "tls": {
   466        "enabled": "$TLS_ON",
   467        "certfile": "$TLS_SERVERCERT",
   468        "keyfile": "$TLS_SERVERKEY"
   469     },
   470     "ca": {
   471        "certfile": "$serverCert",
   472        "keyfile": "$serverKey"
   473     },
   474     $registry
   475     "ldap": {
   476        "enabled": $LDAP_ENABLE,
   477        "url": "${LDAP_PROTO}CN=admin,dc=example,dc=com:adminpw@localhost:$LDAP_PORT/dc=example,dc=com",
   478        "tls": {
   479           "certfiles": [ "$TLS_ROOTCERT", $TLS_RACERT, $TLS_SUBCACERT ],
   480           "client": {
   481              "certfile": "$TLS_CLIENTCERT",
   482              "keyfile": "$TLS_CLIENTKEY"
   483           }
   484        }
   485     },
   486     "affiliations": {
   487        "bank_a": [
   488           "department1"
   489        ],
   490        "bank_b": [
   491           "department1"
   492        ],
   493        "bank_c": [
   494           "department1"
   495        ],
   496        "org1": [
   497           "department1",
   498           "department2"
   499        ],
   500        "org2": [
   501           "department1",
   502           "department2"
   503        ],
   504        "org3": [
   505           "department1",
   506           "department2"
   507        ]
   508     },
   509     "signing": {
   510        "profiles": null,
   511        "default": {
   512           "usage": [
   513              "cert sign",
   514              "crl sign",
   515              "digital signature",
   516              "key encipherment",
   517              "timestamping"
   518           ],
   519           "expiry": "8000h",
   520           "crlurl": "http://localhost:3755/TestCRL.crl",
   521           "caconstraint": {
   522              "isca": true,
   523              "maxpathlen": 1,
   524              "ocspnocheck": true,
   525              "notbefore": "2016-12-30T00:00:00.000Z"
   526           }
   527        }
   528     },
   529     "csr": {
   530        "cn": "fabric-ca-server",
   531        "names": [
   532           {
   533              "C": "US",
   534              "ST": "North Carolina",
   535              "L": null,
   536              "O": "Hyperledger",
   537              "OU": "Fabric"
   538           }
   539        ],
   540        "hosts": [
   541           "fabricCa.hyperledger.example.com"
   542        ],
   543        "ca": {
   544           "pathlen": null,
   545           "pathlenzero": null,
   546           "expiry": null
   547        }
   548     },
   549     "crypto": {
   550        "software": {
   551           "hash_family": "SHA2",
   552           "security_level": 256,
   553           "ephemeral": false,
   554           "key_store_dir": "keys"
   555        }
   556     }
   557  }
   558  EOF
   559     ;;
   560        yaml) if ! $($LDAP_ENABLE); then registry="
   561  registry:
   562    maxEnrollments: $maxEnroll
   563    identities:
   564  $(for i in {1..16}; do
   565  echo "    - name: intermediateCa$i
   566        pass: intermediateCa${i}pw
   567        type: client
   568        affiliation: \"\"
   569        maxenrollments: $maxEnroll
   570        attrs:
   571           hf.Registrar.Roles: \"client,user,peer,validator,auditor\"
   572           hf.Registrar.DelegateRoles: \"client,user,validator,auditor\"
   573           hf.Revoker: true
   574           hf.IntermediateCA: true"
   575  done)
   576      - name: admin
   577        pass: adminpw
   578        type: client
   579        affiliation: bank_a
   580        maxEnrollments: $maxEnroll
   581        attrs:
   582          hf.Registrar.Roles: \"client,user,peer,validator,auditor,ca\"
   583          hf.Registrar.DelegateRoles: \"client,user,validator,auditor\"
   584          hf.Revoker: true
   585          hf.IntermediateCA: true
   586      - name: admin2
   587        pass: adminpw2
   588        type: client
   589        affiliation: bank_a
   590        maxEnrollments: $maxEnroll
   591        attrs:
   592          hf.Registrar.Roles: \"client,user,peer,validator,auditor,ca\"
   593          hf.Registrar.DelegateRoles: \"client,user,validator,auditor\"
   594          hf.Revoker: true
   595      - name: revoker
   596        pass: revokerpw
   597        type: client
   598        affiliation: bank_a
   599        maxEnrollments: $maxEnroll
   600        attrs:
   601          hf.Revoker: true
   602      - name: revoker2
   603        pass: revokerpw2
   604        type: client
   605        affiliation: bank_a
   606        maxEnrollments: $maxEnroll
   607        attrs:
   608          hf.Revoker: true
   609      - name: nonrevoker
   610        pass: nonrevokerpw
   611        type: client
   612        affiliation: bank_a
   613        maxEnrollments: $maxEnroll
   614      - name: nonrevoker2
   615        pass: nonrevokerpw2
   616        type: client
   617        affiliation: bank_a
   618        maxEnrollments: $maxEnroll
   619      - name: notadmin
   620        pass: pass
   621        type: client
   622        affiliation: bank_a
   623        maxEnrollments: $maxEnroll
   624        attrs:
   625          hf.Registrar.Roles: \"client,user,peer,validator,auditor,ca\"
   626          hf.Registrar.DelegateRoles: \"client\"
   627      - name: expiryUser
   628        pass: expirypw
   629        type: client
   630        affiliation: bank_a
   631        maxEnrollments: $maxEnroll
   632      - name: testUser
   633        pass: user1
   634        type: client
   635        affiliation: bank_b
   636        maxEnrollments: $maxEnroll
   637        attrs: []
   638      - name: testUser2
   639        pass: user2
   640        type: client
   641        affiliation: bank_c
   642        maxEnrollments: $maxEnroll
   643        attrs: []
   644      - name: testUser3
   645        pass: user3
   646        type: client
   647        affiliation: bank_a
   648        maxEnrollments: $maxEnroll
   649        attrs: []"
   650  fi
   651  cat > $runconfig <<EOF
   652  address: $CA_HOST_ADDRESS
   653  port: $CA_DEFAULT_PORT
   654  debug: $FABRIC_CA_DEBUG
   655  db:
   656    type: $driver
   657    datasource: $datasrc
   658    tls:
   659       enabled: $TLS_ON
   660       certfiles:
   661         - $TLS_ROOTCERT
   662       client:
   663         certfile: $TLS_CLIENTCERT
   664         keyfile: $TLS_CLIENTKEY
   665  tls:
   666    enabled: $TLS_ON
   667    certfile: $TLS_SERVERCERT
   668    keyfile: $TLS_SERVERKEY
   669  ca:
   670    name:
   671    certfile: $serverCert
   672    keyfile: $serverKey
   673  $registry
   674  ldap:
   675    enabled: $LDAP_ENABLE
   676    url: ${LDAP_PROTO}CN=admin,dc=example,dc=com:adminpw@localhost:$LDAP_PORT/dc=example,dc=com
   677    tls:
   678      certfiles:
   679        - $TLS_ROOTCERT
   680      client:
   681        certfile: $TLS_CLIENTCERT
   682        keyfile: $TLS_CLIENTKEY
   683  affiliations:
   684    bank_a:
   685      - department1
   686    bank_b:
   687      - department1
   688    bank_c:
   689      - department1
   690    org1:
   691      - department1
   692      - department2
   693    org2:
   694      - department1
   695      - department2
   696  signing:
   697      default:
   698      usage:
   699        - cert sign
   700        - crl sign
   701        - digital signature
   702        - key encipherment
   703        - timestamping
   704      expiry: 17520h
   705      caconstraint:
   706        isca: true
   707        maxpathlen: 1
   708        ocspnocheck: true
   709        notbefore: 2016-12-30T00:00:00Z
   710    profiles:
   711       ca:
   712         usage:
   713           - cert sign
   714           - crl sign
   715         expiry: 17520h
   716         caconstraint:
   717           isca: true
   718           maxpathlen: 0
   719           ocspnocheck: true
   720           notbefore: 2016-12-30T00:00:00Z
   721  csr:
   722    names:
   723      - C: US
   724        ST: "North Carolina"
   725        L:
   726        O: Hyperledger
   727        OU: Fabric
   728    hosts:
   729      - fabricCa.hyperledger.example.com
   730      - localhost
   731    ca:
   732      expiry: 131400h
   733      pathlength: 1
   734  bccsp:
   735    default: SW
   736    sw:
   737      hash: SHA2
   738      security: 256
   739      filekeystore:
   740        keystore:
   741  cacount:
   742  cafiles:
   743  intermediate:
   744    parentserver:
   745      url:
   746      caname:
   747    enrollment:
   748      hosts:
   749      profile:
   750      label:
   751    tls:
   752      certfiles:
   753      client:
   754        certfile:
   755        keyfile:
   756  EOF
   757     ;;
   758     esac
   759  }