# wired_dot1x_eap_tls_manual

## Requirements
N/A

### Global config steps
1. Create dot1x_eap_tls_manual role

## Scenario steps
1. Create Root CA
1. Create RADIUS server certificate template
1. Create Web server certificate template
1. Create user certificate template
1. Generate RADIUS server certificate to be used by RADIUS services
1. Generate Web server certificate to be used by web admin and captive portal
1. Generate user certificate to be used by node01 with EAP-TLS
1. Install Root CA + RADIUS server certificates (public certificate and
   private key) on PacketFence
1. Configure OCSP to check certificate revocation against pfpki
1. Restart radiusd services
1. Install Root CA + Web server certificates (public certificate and private key) on PacketFence
1. Restart web services (only haproxy-portal and haproxy-admin)
1. Create EAPTLS source with conditions on user certificate that assign
   dot1x_eap_tls
1. Create connection profile with auto-registration, unreg_on_accounting_stop,
   EAPTLS source and specific filter
1. Perform Checkup (common test suite)
1. Copy Root CA in /etc/wpa_supplicant/eap_tls/
1. Install user certificates (public certificate and private key) on /etc/wpa_supplicant/eap_tls/
   with following paths:
   - ca_cert: /etc/wpa_supplicant/eap_tls/ca.pem
   - client_cert: /etc/wpa_supplicant/eap_tls/client.pem
   - private_key: /etc/wpa_supplicant/eap_tls/client.key
1. Start eapol_test with eap_tls configuration
1. Check RADIUS audit log for node01 (common)
1. Check node status for node01 (common)
1. Check VLAN assigned to node01 *on* eapol_test output

TODO: Add and modify the following steps with the eapo_test approach
1. Install certificates (HTTP and RADIUS), generated by pfpki, using API (in
   place of command line)
1. Revoke certificate
1. Kill wpasupplicant (common test suite)
1. Rerun wpasupplicant to have a reject authentication due to revoke certificate
1. Check RADIUS audit log for node01 (common) = reject
1. Check node status for node01 (common) = registered
1. Check VLAN assigned to node01 *on* switch01 (common) = NOT AUTHORIZED
1. Check Internet access *on* node01 (common) = down

## Teardown steps
1. Kill wpa_supplicant: an accounting stop will be generated if we wait
   EAP-TIMEOUT on the switch (not the case here due to next task). Access is
   still working until we run next task.
1. Check online status of node01: should be offline due to accounting stop
1. Check node status for node01
1. Wait `delete_windows` + 10 seconds before running `node_cleanup` task
1. Delete node by running `pfcron's node_cleanup` task
1. Check node has been deleted
1. Disable `node_cleanup` task
1. Restart `pfcron` to take change into account
1. Delete connection profile, EAPTLS source, OCSP profile and configuration
1. Restart RADIUS services (common test suite)

## Additional notes

Reauthentication is done by switch based on `eap_reauth_period` setting to
avoid node been unregistered when it reach unregdate and automatically deleted
by `pfcron` without running teardown steps.

`pid` of user created by 802.1X authentication is equals to CN attribute of
certificate because there is no Alt-Name-UPN in certificate created.
