Refactor TLS code

cmd/runmqserver/webserver.go

@@ -17,7 +17,6 @@ package main
 
 import (
 	"fmt"
-	"io"
 	"os"
 	"os/exec"
 	"os/user"
@@ -27,10 +26,12 @@ import (
 	"syscall"
 
 	"github.com/ibm-messaging/mq-container/internal/command"
+	"github.com/ibm-messaging/mq-container/internal/copy"
 	"github.com/ibm-messaging/mq-container/internal/mqtemplate"
+	"github.com/ibm-messaging/mq-container/internal/tls"
 )
 
-func startWebServer() error {
+func startWebServer(keystore, keystorepw string) error {
 	_, err := os.Stat("/opt/mqm/bin/strmqweb")
 	if err != nil && os.IsNotExist(err) {
 		log.Debug("Skipping web server, because it's not installed")
@@ -48,9 +49,9 @@ func startWebServer() error {
 	}
 
 	// TLS enabled
-	if webkeyStoreName != "" {
-		cmd.Env = append(cmd.Env, "AMQ_WEBKEYSTORE="+webkeyStoreName)
-		cmd.Env = append(cmd.Env, "AMQ_WEBKEYSTOREPW="+keyStorePasswords)
+	if keystore != "" {
+		cmd.Env = append(cmd.Env, "AMQ_WEBKEYSTORE="+keystore)
+		cmd.Env = append(cmd.Env, "AMQ_WEBKEYSTOREPW="+keystorepw)
 	}
 
 	uid, gid, err := command.LookupMQM()
@@ -78,34 +79,8 @@ func startWebServer() error {
 	log.Println("Started web server")
 	return nil
 }
-func CopyFileMode(src, dest string, perm os.FileMode) error {
-	log.Debugf("Copying file %v to %v", src, dest)
-	in, err := os.Open(src)
-	if err != nil {
-		return fmt.Errorf("failed to open %s for copy: %v", src, err)
-	}
-	defer in.Close()
 
-	out, err := os.OpenFile(dest, os.O_CREATE|os.O_WRONLY, perm)
-	if err != nil {
-		return fmt.Errorf("failed to open %s for copy: %v", dest, err)
-	}
-	defer out.Close()
-
-	_, err = io.Copy(out, in)
-	if err != nil {
-		return err
-	}
-	err = out.Close()
-	return err
-}
-
-// CopyFile copies the specified file
-func CopyFile(src, dest string) error {
-	return CopyFileMode(src, dest, 0770)
-}
-
-func configureSSO() error {
+func configureSSO(p12TrustStore tls.KeyStoreData) (string, error) {
 	// Ensure all required environment variables are set for SSO
 	requiredEnvVars := []string{
 		"MQ_WEB_ADMIN_USERS",
@@ -120,7 +95,7 @@ func configureSSO() error {
 	}
 	for _, envVar := range requiredEnvVars {
 		if len(os.Getenv(envVar)) == 0 {
-			return fmt.Errorf("%v must be set when MQ_BETA_ENABLE_SSO=true", envVar)
+			return "", fmt.Errorf("%v must be set when MQ_BETA_ENABLE_SSO=true", envVar)
 		}
 	}
 
@@ -129,41 +104,59 @@ func configureSSO() error {
 	_, err := os.Stat(mqwebDir)
 	if err != nil {
 		if os.IsNotExist(err) {
-			return nil
+			return "", nil
 		}
-		return err
+		return "", err
 	}
 
 	// Process SSO template for generating file mqwebuser.xml
 	adminUsers := strings.Split(os.Getenv("MQ_WEB_ADMIN_USERS"), "\n")
 	err = mqtemplate.ProcessTemplateFile(mqwebDir+"/mqwebuser.xml.tpl", mqwebDir+"/mqwebuser.xml", map[string][]string{"AdminUser": adminUsers}, log)
 	if err != nil {
-		return err
+		return "", err
 	}
 
 	// Configure SSO TLS
-	return ConfigureSSOTLS()
+	return configureSSOTLS(p12TrustStore)
 }
 
-func configureWebServer() error {
-	_, err := os.Stat("/opt/mqm/bin/strmqweb")
+func configureWebServer(keyLabel string, p12Trust tls.KeyStoreData) (string, error) {
+	var keystore string
+	// Configure TLS for Web Console first if we have a certificate to use
+	err := configureWebTLS(keyLabel)
+	if err != nil {
+		return keystore, err
+	}
+	if keyLabel != "" {
+		keystore = keyLabel + ".p12"
+	}
+
+	// Configure Single-Sign-On for the web server (if enabled)
+	enableSSO := os.Getenv("MQ_BETA_ENABLE_SSO")
+	if enableSSO == "true" || enableSSO == "1" {
+		keystore, err = configureSSO(p12Trust)
+		if err != nil {
+			return keystore, err
+		}
+	}
+	_, err = os.Stat("/opt/mqm/bin/strmqweb")
 	if err != nil {
 		if os.IsNotExist(err) {
-			return nil
+			return keystore, nil
 		}
-		return err
+		return keystore, err
 	}
 	const webConfigDir string = "/etc/mqm/web"
 	_, err = os.Stat(webConfigDir)
 	if err != nil {
 		if os.IsNotExist(err) {
-			return nil
+			return keystore, nil
 		}
-		return err
+		return keystore, err
 	}
 	uid, gid, err := command.LookupMQM()
 	if err != nil {
-		return err
+		return keystore, err
 	}
 	const prefix string = "/etc/mqm/web"
 	err = filepath.Walk(prefix, func(from string, info os.FileInfo, err error) error {
@@ -194,7 +187,7 @@ func configureWebServer() error {
 					return err
 				}
 			}
-			err := CopyFile(from, to)
+			err := copy.CopyFile(from, to)
 			if err != nil {
 				log.Error(err)
 				return err
@@ -206,5 +199,5 @@ func configureWebServer() error {
 		}
 		return nil
 	})
-	return err
+	return keystore, err
 }