pki.views.owner_credentials

Views for Owner Credential (DevOwnerID) management.

Module Contents

class pki.views.owner_credentials.OwnerCredentialContextMixin

Bases: trustpoint.views.base.ContextDataMixin

Mixin which adds context_data for the PKI -> Issuing CAs pages.

context_page_category = 'pki'

context_page_name = 'owner_credentials'

class pki.views.owner_credentials.OwnerCredentialTableView

Bases: OwnerCredentialContextMixin, trustpoint.views.base.SortableTableMixin[pki.models.OwnerCredentialModel], django.views.generic.list.ListView[pki.models.OwnerCredentialModel]

Owner Credential Table View.

model

template_name = 'pki/owner_credentials/owner_credentials.html'

context_object_name = 'owner_credential'

paginate_by = 50

default_sort_param = 'unique_name'

class pki.views.owner_credentials.OwnerCredentialDetailView

Bases: trustpoint.logger.LoggerMixin, OwnerCredentialContextMixin, django.views.generic.detail.DetailView[pki.models.OwnerCredentialModel]

View to display the details of an Issuing CA.

http_method_names = ('get',)

model

success_url

ignore_url

template_name = 'pki/owner_credentials/details.html'

context_object_name = 'owner_credential'

get_context_data(**kwargs)

Adds the IDevID reference list to the context.

Each entry in idevid_refs is an IDevIDReferenceModel instance. The dev_owner_id_certificate FK on each ref points directly to the CertificateModel of the DevOwnerID certificate whose SAN contained this reference (or None for locally uploaded credentials where the certificate was not stored separately), so no extra DB lookup is needed here.

Parameters:

kwargs (Any)

Return type:

dict[str, Any]

class pki.views.owner_credentials.OwnerCredentialAddMethodSelectView

Bases: OwnerCredentialContextMixin, django.views.generic.edit.FormView[pki.forms.OwnerCredentialFileImportForm]

View to select the method for adding a new DevOwnerID.

template_name = 'pki/owner_credentials/add/method_select.html'

form_class

get(request, *args, **kwargs)

Render the method selection page (no form processing needed).

Parameters:

• request (django.http.HttpRequest)

• args (Any)

• kwargs (Any)

Return type:

django.http.HttpResponse

post(request, *_args, **_kwargs)

Redirect based on the chosen method.

Parameters:

• request (django.http.HttpRequest)

• _args (Any)

• _kwargs (Any)

Return type:

django.http.HttpResponse

class pki.views.owner_credentials.OwnerCredentialFileImportView

Bases: OwnerCredentialContextMixin, django.views.generic.edit.FormView[pki.forms.OwnerCredentialFileImportForm]

View to import a DevOwnerID from separate PEM files.

template_name = 'pki/owner_credentials/add/file_import.html'

form_class

success_url

form_valid(form)

Handle the case where the form is valid.

Parameters:

form (pki.forms.OwnerCredentialFileImportForm)

Return type:

django.http.HttpResponse

pki.views.owner_credentials.OwnerCredentialAddView

class pki.views.owner_credentials.OwnerCredentialAddRequestEstMethodSelectView

Bases: OwnerCredentialContextMixin, django.views.generic.edit.FormView[pki.forms.OwnerCredentialFileImportForm]

View to select between onboarding and no-onboarding for EST-based DevOwnerID enrollment.

template_name = 'pki/owner_credentials/add/est_method_select.html'

form_class

get(request, *args, **kwargs)

Render the EST method selection page.

Parameters:

• request (django.http.HttpRequest)

• args (Any)

• kwargs (Any)

Return type:

django.http.HttpResponse

post(request, *_args, **_kwargs)

Redirect based on whether onboarding or no-onboarding is chosen.

Parameters:

• request (django.http.HttpRequest)

• _args (Any)

• _kwargs (Any)

Return type:

django.http.HttpResponse

class pki.views.owner_credentials.OwnerCredentialAddRequestEstNoOnboardingView

Bases: OwnerCredentialContextMixin, django.views.generic.edit.FormView[pki.forms.OwnerCredentialAddRequestEstNoOnboardingForm]

View to request a DevOwnerID via EST using username/password (no IDevID onboarding).

template_name = 'pki/owner_credentials/add/est_request.html'

form_class

success_url

get_context_data(**kwargs)

Add heading context.

Parameters:

kwargs (Any)

Return type:

dict[str, Any]

form_valid(form)

Save the OwnerCredentialModel with its EST configuration.

The key pair and IssuedCredentialModel are created later when the user triggers an actual DevOwnerID issuance via the CLM page.

Parameters:

form (pki.forms.OwnerCredentialAddRequestEstNoOnboardingForm)

Return type:

django.http.HttpResponse

form_invalid(form)

Show form-level errors as Django messages.

Parameters:

form (pki.forms.OwnerCredentialAddRequestEstNoOnboardingForm)

Return type:

django.http.HttpResponse

class pki.views.owner_credentials.OwnerCredentialAddRequestEstOnboardingView

Bases: OwnerCredentialContextMixin, django.views.generic.edit.FormView[pki.forms.OwnerCredentialAddRequestEstOnboardingForm]

View to request a DevOwnerID via EST using IDevID-based onboarding (mTLS client certificate).

template_name = 'pki/owner_credentials/add/est_request.html'

form_class

success_url

get_context_data(**kwargs)

Add heading context.

Parameters:

kwargs (Any)

Return type:

dict[str, Any]

form_valid(form)

Save the OwnerCredentialModel with its EST onboarding configuration.

Creates the OwnerCredentialModel with all remote-endpoint fields and redirects to the truststore-association step, mirroring the no-onboarding workflow.

Parameters:

form (pki.forms.OwnerCredentialAddRequestEstOnboardingForm)

Return type:

django.http.HttpResponse

form_invalid(form)

Show form-level errors as Django messages.

Parameters:

form (pki.forms.OwnerCredentialAddRequestEstOnboardingForm)

Return type:

django.http.HttpResponse

class pki.views.owner_credentials.OwnerCredentialTruststoreAssociationView

Bases: OwnerCredentialContextMixin, django.views.generic.edit.FormView[pki.forms.OwnerCredentialTruststoreAssociationForm]

View for associating a TLS truststore with a DevOwnerID EST no-onboarding configuration.

form_class

template_name = 'pki/owner_credentials/truststore_association.html'

get_owner_credential()

Get the OwnerCredentialModel from the URL pk.

Return type:

pki.models.OwnerCredentialModel

get_form_kwargs()

Pass the OwnerCredentialModel instance to the form.

Return type:

dict[str, Any]

post(request, *args, **kwargs)

Handle both association and truststore-import form submissions.

Parameters:

• request (django.http.HttpRequest)

• args (Any)

• kwargs (Any)

Return type:

django.http.HttpResponse

get_context_data(**kwargs)

Add the owner credential and import form to the context.

Parameters:

kwargs (Any)

Return type:

dict[str, Any]

form_valid(form)

Associate the selected truststore and redirect to the credential list.

Parameters:

form (pki.forms.OwnerCredentialTruststoreAssociationForm)

Return type:

django.http.HttpResponse

class pki.views.owner_credentials.OwnerCredentialCLMView

Bases: OwnerCredentialContextMixin, django.views.generic.detail.DetailView[pki.models.OwnerCredentialModel]

Certificate Lifecycle Management view for a DevOwnerID credential.

http_method_names = ('get',)

model

template_name = 'pki/owner_credentials/clm.html'

context_object_name = 'owner_credential'

get_context_data(**kwargs)

Adds issued credentials with computed display fields to the context.

Parameters:

kwargs (Any)

Return type:

dict[str, Any]

class pki.views.owner_credentials.OwnerCredentialBulkDeleteConfirmView

Bases: OwnerCredentialContextMixin, trustpoint.views.base.BulkDeleteView

View to confirm the deletion of multiple owner credentials.

model

success_url

ignore_url

template_name = 'pki/owner_credentials/confirm_delete.html'

context_object_name = 'owner_credentials'

get(request, *args, **kwargs)

Handle GET requests.

Parameters:

• request (django.http.HttpRequest)

• args (Any)

• kwargs (Any)

Return type:

django.http.HttpResponse

form_valid(form)

Delete the selected credentials on valid form.

Parameters:

form (django.forms.Form)

Return type:

django.http.HttpResponse

class pki.views.owner_credentials.IssuedCredentialDeleteView

Bases: trustpoint.logger.LoggerMixin, OwnerCredentialContextMixin, django.views.generic.detail.DetailView[pki.models.RemoteIssuedCredentialModel]

Confirm and delete a single RemoteIssuedCredentialModel (DEV_OWNER_ID or DOMAIN_CREDENTIAL).

Only credentials owned by an OwnerCredentialModel are accessible via this view. The parent OwnerCredentialModel is resolved from the URL owner_pk parameter so the back-link can always return to the correct CLM page.

http_method_names = ('get', 'post')

model

template_name = 'pki/owner_credentials/confirm_delete_issued_credential.html'

context_object_name = 'issued_credential'

dispatch(request, *args, **kwargs)

Verify the RemoteIssuedCredential belongs to the given OwnerCredential.

Parameters:

• request (django.http.HttpRequest)

• args (Any)

• kwargs (Any)

Return type:

django.http.HttpResponse

get_object(queryset=None)

Return the pre-fetched issued credential.

Parameters:

queryset (Any)

Return type:

pki.models.RemoteIssuedCredentialModel

get_context_data(**kwargs)

Add the parent OwnerCredential to the template context.

Parameters:

kwargs (Any)

Return type:

dict[str, Any]

post(request, *_args, **_kwargs)

Delete the issued credential and redirect back to the CLM page.

Parameters:

• request (django.http.HttpRequest)

• _args (Any)

• _kwargs (Any)

Return type:

django.http.HttpResponse

class pki.views.owner_credentials.OwnerCredentialDefineCertContentEstView

Bases: trustpoint.logger.LoggerMixin, OwnerCredentialContextMixin, django.views.generic.edit.FormView[pki.forms.CertificateIssuanceForm]

Step 1 - Define the certificate content for a new DevOwnerID EST enrollment.

On every GET/POST a fresh EC P-256 key pair is generated and a key-only IssuedCredentialModel (type DEV_OWNER_ID) is created. Its primary key is stored in the session together with the certificate content so that Step 2 can fetch exactly this credential.

Loads the selected certificate profile (defaulting to dev_owner_id), renders the CertificateIssuanceForm, and stores the validated field values in the session under dev_owner_id_cert_content_<pk>.

form_class

template_name = 'pki/owner_credentials/define_cert_content_est.html'

available_profiles: list[pki.models.cert_profile.CertificateProfileModel]

dispatch(request, *args, **kwargs)

Resolve the OwnerCredentialModel and the selected certificate profile.

On each visit a fresh key-only RemoteIssuedCredentialModel is created. If there is already a pending (certificate-less) credential from a previous visit its pk is reused so we do not accumulate orphan credentials.

Parameters:

• request (django.http.HttpRequest)

• args (Any)

• kwargs (Any)

Return type:

django.http.HttpResponse

get_form_kwargs()

Inject the profile into the form.

Return type:

dict[str, Any]

get_context_data(**kwargs)

Add owner credential, profile and profile list to template context.

Parameters:

kwargs (Any)

Return type:

dict[str, Any]

form_invalid(form)

Show field errors as Django messages.

Parameters:

form (pki.forms.CertificateIssuanceForm)

Return type:

django.http.HttpResponse

form_valid(form)

Store certificate content and pending credential pk in session, then proceed to Step 2.

Parameters:

form (pki.forms.CertificateIssuanceForm)

Return type:

django.http.HttpResponse

class pki.views.owner_credentials.OwnerCredentialRequestCertEstView

Bases: trustpoint.logger.LoggerMixin, OwnerCredentialContextMixin, django.views.generic.detail.DetailView[pki.models.OwnerCredentialModel]

Step 2 - Review and trigger the EST enrollment for a new DevOwnerID certificate.

Reads the certificate content stored by OwnerCredentialDefineCertContentEstView, builds a CSR using the dev_owner_id profile, signs it with the existing DevOwnerID key, sends it to the configured EST server and stores the issued certificate back in the IssuedCredentialModel.

http_method_names = ('get', 'post')

model

template_name = 'pki/owner_credentials/request_cert_est.html'

context_object_name = 'owner_credential'

get_context_data(**kwargs)

Add cert-content summary and profile to the template context.

Parameters:

kwargs (Any)

Return type:

dict[str, Any]

post(request, *_args, **_kwargs)

Perform the EST enrollment and redirect to the CLM view.

Parameters:

• request (django.http.HttpRequest)

• _args (Any)

• _kwargs (Any)

Return type:

django.http.HttpResponse

class pki.views.owner_credentials.OwnerCredentialDefineCertContentDomainCredentialEstView

Bases: trustpoint.logger.LoggerMixin, OwnerCredentialContextMixin, django.views.generic.edit.FormView[pki.forms.CertificateIssuanceForm]

Step 1 - Define the certificate content for a new Domain Credential EST enrollment.

Only available for REMOTE_EST_ONBOARDING owner credentials. The user can select any available certificate profile via a dropdown. Defaults to devownerid_domain_credential when present.

form_class

template_name = 'pki/owner_credentials/define_cert_content_domain_credential_est.html'

available_profiles: list[pki.models.cert_profile.CertificateProfileModel]

dispatch(request, *args, **kwargs)

Resolve the OwnerCredentialModel and the selected certificate profile.

Parameters:

• request (django.http.HttpRequest)

• args (Any)

• kwargs (Any)

Return type:

django.http.HttpResponse

get_form_kwargs()

Inject the profile into the form.

Return type:

dict[str, Any]

get_context_data(**kwargs)

Add owner credential, profile and profile list to template context.

Parameters:

kwargs (Any)

Return type:

dict[str, Any]

form_invalid(form)

Show field errors as Django messages.

Parameters:

form (pki.forms.CertificateIssuanceForm)

Return type:

django.http.HttpResponse

form_valid(form)

Store certificate content, selected profile and pending credential pk in session.

Parameters:

form (pki.forms.CertificateIssuanceForm)

Return type:

django.http.HttpResponse

class pki.views.owner_credentials.OwnerCredentialRequestDomainCredentialEstView

Bases: trustpoint.logger.LoggerMixin, OwnerCredentialContextMixin, django.views.generic.detail.DetailView[pki.models.OwnerCredentialModel]

Step 2 - Review and trigger the EST enrollment for a new Domain Credential.

Uses remote_path_domain_credential from OwnerCredentialModel, trust_store from OnboardingConfigModel, est_username from OwnerCredentialModel, est_password from OnboardingConfigModel.

http_method_names = ('get', 'post')

model

template_name = 'pki/owner_credentials/request_domain_credential_est.html'

context_object_name = 'owner_credential'

get_context_data(**kwargs)

Add cert-content summary and profile to the template context.

Parameters:

kwargs (Any)

Return type:

dict[str, Any]

post(request, *_args, **_kwargs)

Perform the EST enrollment and redirect to the CLM view.

Parameters:

• request (django.http.HttpRequest)

• _args (Any)

• _kwargs (Any)

Return type:

django.http.HttpResponse