fix #258: Private key decryption fails in py3

The base problem was that cryptodome's RSA.key.exportKey produces bytes, which in py3 have to be decoded to produce a string.  So first we decode them (using the 'ascii' decoder, because it's PEM data), and then (for py2 compatibility) we coerce the decode result to a string.

* Also fixed the example umapi config file to have the correct name for secure private keys (`secure_priv_key_data_key`), which was reported in the same bug.
* Also fixed the doc sources (in English only, because the translations hadn't yet picked up this section) not to include the same buggy example as the config file.
* Also fixed the handling of AssertionError not to expect the exception to have a `message` field.
* Also updated the version number and release notes in case we want to produce a release with only this fix.

Author: adobeDan

RELEASE_NOTES.md

@@ -1,6 +1,6 @@
-# Release Notes for User Sync Tool Version 2.2
+# Release Notes for User Sync Tool Version 2.2.1
 
-These notes apply to v2.2 of 2017-07-13.
+These notes apply to v2.2 of 2017-08-03.
 
 ## New Features
 
@@ -30,6 +30,8 @@ These notes apply to v2.2 of 2017-07-13.
 
 [#254](https://github.com/adobe-apiplatform/user-sync.py/issues/254): Update windows libraries, reduce use of custom builds.
 
+[#258](https://github.com/adobe-apiplatform/user-sync.py/issues/258): Correctly decrypt private keys in py3 (byte vs. str type compatibility).
+
 ## Compatibility with Prior Versions
 
 This version is fully backwards-compatible with version 2.1.1.  As mentioned above, there are new configuration settings for filtering group members and controlling network behavior, and there is a new command-line option for controlling the update strategy.  See [the docs](https://adobe-apiplatform.github.io/user-sync.py) for full details about configuration.

docs/Gemfile.lock

@@ -1,13 +1,12 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (4.2.7)
+    activesupport (4.2.8)
       i18n (~> 0.7)
-      json (~> 1.7, >= 1.7.7)
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
       tzinfo (~> 1.1)
-    addressable (2.5.0)
+    addressable (2.5.1)
       public_suffix (~> 2.0, >= 2.0.2)
     coffee-script (2.4.1)
       coffee-script-source
@@ -17,65 +16,64 @@ GEM
     ethon (0.10.1)
       ffi (>= 1.3.0)
     execjs (2.7.0)
-    faraday (0.11.0)
+    faraday (0.12.2)
       multipart-post (>= 1.2, < 3)
     ffi (1.9.18)
     forwardable-extended (2.6.0)
     gemoji (3.0.0)
-    github-pages (127)
-      activesupport (= 4.2.7)
-      github-pages-health-check (= 1.3.3)
-      jekyll (= 3.4.1)
+    github-pages (146)
+      activesupport (= 4.2.8)
+      github-pages-health-check (= 1.3.5)
+      jekyll (= 3.4.5)
       jekyll-avatar (= 0.4.2)
       jekyll-coffeescript (= 1.0.1)
       jekyll-default-layout (= 0.1.4)
-      jekyll-feed (= 0.9.1)
+      jekyll-feed (= 0.9.2)
       jekyll-gist (= 1.4.0)
-      jekyll-github-metadata (= 2.3.1)
+      jekyll-github-metadata (= 2.5.1)
       jekyll-mentions (= 1.2.0)
-      jekyll-optional-front-matter (= 0.1.2)
+      jekyll-optional-front-matter (= 0.2.0)
       jekyll-paginate (= 1.1.0)
-      jekyll-readme-index (= 0.0.4)
+      jekyll-readme-index (= 0.1.0)
       jekyll-redirect-from (= 0.12.1)
-      jekyll-relative-links (= 0.3.0)
+      jekyll-relative-links (= 0.4.1)
       jekyll-sass-converter (= 1.5.0)
-      jekyll-seo-tag (= 2.1.0)
+      jekyll-seo-tag (= 2.2.3)
       jekyll-sitemap (= 1.0.0)
       jekyll-swiss (= 0.4.0)
-      jekyll-theme-architect (= 0.0.3)
-      jekyll-theme-cayman (= 0.0.3)
-      jekyll-theme-dinky (= 0.0.3)
-      jekyll-theme-hacker (= 0.0.3)
-      jekyll-theme-leap-day (= 0.0.3)
-      jekyll-theme-merlot (= 0.0.3)
-      jekyll-theme-midnight (= 0.0.3)
-      jekyll-theme-minimal (= 0.0.3)
-      jekyll-theme-modernist (= 0.0.3)
-      jekyll-theme-primer (= 0.1.7)
-      jekyll-theme-slate (= 0.0.3)
-      jekyll-theme-tactile (= 0.0.3)
-      jekyll-theme-time-machine (= 0.0.3)
-      jekyll-titles-from-headings (= 0.1.4)
+      jekyll-theme-architect (= 0.0.4)
+      jekyll-theme-cayman (= 0.0.4)
+      jekyll-theme-dinky (= 0.0.4)
+      jekyll-theme-hacker (= 0.0.4)
+      jekyll-theme-leap-day (= 0.0.4)
+      jekyll-theme-merlot (= 0.0.4)
+      jekyll-theme-midnight (= 0.0.4)
+      jekyll-theme-minimal (= 0.0.4)
+      jekyll-theme-modernist (= 0.0.4)
+      jekyll-theme-primer (= 0.3.1)
+      jekyll-theme-slate (= 0.0.4)
+      jekyll-theme-tactile (= 0.0.4)
+      jekyll-theme-time-machine (= 0.0.4)
+      jekyll-titles-from-headings (= 0.2.0)
       jemoji (= 0.8.0)
       kramdown (= 1.13.2)
       liquid (= 3.0.6)
       listen (= 3.0.6)
       mercenary (~> 0.3)
-      minima (= 2.0.0)
-      nokogiri (= 1.6.8.1)
+      minima (= 2.1.1)
       rouge (= 1.11.1)
       terminal-table (~> 1.4)
-    github-pages-health-check (1.3.3)
+    github-pages-health-check (1.3.5)
       addressable (~> 2.3)
       net-dns (~> 0.8)
       octokit (~> 4.0)
       public_suffix (~> 2.0)
       typhoeus (~> 0.7)
-    html-pipeline (2.5.0)
+    html-pipeline (2.6.0)
       activesupport (>= 2)
       nokogiri (>= 1.4)
-    i18n (0.8.1)
-    jekyll (3.4.1)
+    i18n (0.8.6)
+    jekyll (3.4.5)
       addressable (~> 2.4)
       colorator (~> 1.0)
       jekyll-sass-converter (~> 1.0)
@@ -92,60 +90,60 @@ GEM
       coffee-script (~> 2.2)
     jekyll-default-layout (0.1.4)
       jekyll (~> 3.0)
-    jekyll-feed (0.9.1)
+    jekyll-feed (0.9.2)
       jekyll (~> 3.3)
     jekyll-gist (1.4.0)
       octokit (~> 4.2)
-    jekyll-github-metadata (2.3.1)
+    jekyll-github-metadata (2.5.1)
       jekyll (~> 3.1)
       octokit (~> 4.0, != 4.4.0)
     jekyll-mentions (1.2.0)
       activesupport (~> 4.0)
       html-pipeline (~> 2.3)
       jekyll (~> 3.0)
-    jekyll-optional-front-matter (0.1.2)
+    jekyll-optional-front-matter (0.2.0)
       jekyll (~> 3.0)
     jekyll-paginate (1.1.0)
-    jekyll-readme-index (0.0.4)
+    jekyll-readme-index (0.1.0)
       jekyll (~> 3.0)
     jekyll-redirect-from (0.12.1)
       jekyll (~> 3.3)
-    jekyll-relative-links (0.3.0)
+    jekyll-relative-links (0.4.1)
       jekyll (~> 3.3)
     jekyll-sass-converter (1.5.0)
       sass (~> 3.4)
-    jekyll-seo-tag (2.1.0)
+    jekyll-seo-tag (2.2.3)
       jekyll (~> 3.3)
     jekyll-sitemap (1.0.0)
       jekyll (~> 3.3)
     jekyll-swiss (0.4.0)
-    jekyll-theme-architect (0.0.3)
+    jekyll-theme-architect (0.0.4)
       jekyll (~> 3.3)
-    jekyll-theme-cayman (0.0.3)
+    jekyll-theme-cayman (0.0.4)
       jekyll (~> 3.3)
-    jekyll-theme-dinky (0.0.3)
+    jekyll-theme-dinky (0.0.4)
       jekyll (~> 3.3)
-    jekyll-theme-hacker (0.0.3)
+    jekyll-theme-hacker (0.0.4)
       jekyll (~> 3.3)
-    jekyll-theme-leap-day (0.0.3)
+    jekyll-theme-leap-day (0.0.4)
       jekyll (~> 3.3)
-    jekyll-theme-merlot (0.0.3)
+    jekyll-theme-merlot (0.0.4)
       jekyll (~> 3.3)
-    jekyll-theme-midnight (0.0.3)
+    jekyll-theme-midnight (0.0.4)
       jekyll (~> 3.3)
-    jekyll-theme-minimal (0.0.3)
+    jekyll-theme-minimal (0.0.4)
       jekyll (~> 3.3)
-    jekyll-theme-modernist (0.0.3)
+    jekyll-theme-modernist (0.0.4)
       jekyll (~> 3.3)
-    jekyll-theme-primer (0.1.7)
+    jekyll-theme-primer (0.3.1)
       jekyll (~> 3.3)
-    jekyll-theme-slate (0.0.3)
+    jekyll-theme-slate (0.0.4)
       jekyll (~> 3.3)
-    jekyll-theme-tactile (0.0.3)
+    jekyll-theme-tactile (0.0.4)
       jekyll (~> 3.3)
-    jekyll-theme-time-machine (0.0.3)
+    jekyll-theme-time-machine (0.0.4)
       jekyll (~> 3.3)
-    jekyll-titles-from-headings (0.1.4)
+    jekyll-titles-from-headings (0.2.0)
       jekyll (~> 3.3)
     jekyll-watch (1.5.0)
       listen (~> 3.0, < 3.1)
@@ -154,42 +152,46 @@ GEM
       gemoji (~> 3.0)
       html-pipeline (~> 2.2)
       jekyll (>= 3.0)
-    json (1.8.6)
     kramdown (1.13.2)
     liquid (3.0.6)
     listen (3.0.6)
       rb-fsevent (>= 0.9.3)
       rb-inotify (>= 0.9.7)
     mercenary (0.3.6)
-    mini_portile2 (2.1.0)
-    minima (2.0.0)
-    minitest (5.10.1)
+    mini_portile2 (2.2.0)
+    minima (2.1.1)
+      jekyll (~> 3.3)
+    minitest (5.10.3)
     multipart-post (2.0.0)
     net-dns (0.8.0)
-    nokogiri (1.6.8.1)
-      mini_portile2 (~> 2.1.0)
-    octokit (4.6.2)
+    nokogiri (1.8.0)
+      mini_portile2 (~> 2.2.0)
+    octokit (4.7.0)
       sawyer (~> 0.8.0, >= 0.5.3)
     pathutil (0.14.0)
       forwardable-extended (~> 2.6)
     public_suffix (2.0.5)
-    rb-fsevent (0.9.8)
-    rb-inotify (0.9.8)
-      ffi (>= 0.5.0)
+    rb-fsevent (0.10.2)
+    rb-inotify (0.9.10)
+      ffi (>= 0.5.0, < 2)
     rouge (1.11.1)
     safe_yaml (1.0.4)
-    sass (3.4.23)
+    sass (3.5.1)
+      sass-listen (~> 4.0.0)
+    sass-listen (4.0.0)
+      rb-fsevent (~> 0.9, >= 0.9.4)
+      rb-inotify (~> 0.9, >= 0.9.7)
     sawyer (0.8.1)
       addressable (>= 2.3.5, < 2.6)
       faraday (~> 0.8, < 1.0)
-    terminal-table (1.7.3)
-      unicode-display_width (~> 1.1.1)
+    terminal-table (1.8.0)
+      unicode-display_width (~> 1.1, >= 1.1.1)
     thread_safe (0.3.6)
     typhoeus (0.8.0)
       ethon (>= 0.8.0)
-    tzinfo (1.2.2)
+    tzinfo (1.2.3)
       thread_safe (~> 0.1)
-    unicode-display_width (1.1.3)
+    unicode-display_width (1.3.0)
 
 PLATFORMS
   ruby

docs/en/user-manual/deployment_best_practices.md

@@ -121,11 +121,11 @@ private key file, respectively:
 	  secure_api_key_key: umapi_api_key
 	  secure_client_secret_key: umapi_client_secret
 	  tech_acct: your tech [email protected]
-	  secure_priv_pass_key: umapi_private_key_passphrase
+	  secure_priv_key_pass_key: umapi_private_key_passphrase
 	  priv_key_path: private-encrypted.key
 
 Finally, add the passphrase to the secure store as an entry with the username or url as the org Id, the key
-name as `umapi_private_key_passphrase` to match the `secure_priv_pass_key` config file entry, and the value
+name as `umapi_private_key_passphrase` to match the `secure_priv_key_pass_key` config file entry, and the value
 as the passphrase.  (You can also inline the encrypted private key by placing the data in the
 connector-umapi.yml file under the key `priv_key_data` instead of using `priv_key_path`.)
 

examples/config files - basic/2 connector-umapi.yml

@@ -73,4 +73,4 @@ enterprise:
   # For better security, you should save your passphrase into the secure credential store
   # on your platform (username = your org ID, service/internet address = "umapi_private_key_passphrase")
   # and then uncomment this setting:
-  #secure_priv_pass_key: umapi_private_key_passphrase
+  #secure_priv_key_pass_key: umapi_private_key_passphrase

user_sync/app.py

@@ -367,7 +367,7 @@ def main():
 
     except AssertionException as e:
         if not e.is_reported():
-            logger.critical(e.message)
+            logger.critical("%s", e)
             e.set_reported()
     except KeyboardInterrupt:
         try:

user_sync/connector/umapi.py

@@ -103,7 +103,7 @@ def __init__(self, name, caller_options):
         passphrase = enterprise_config.get_credential('priv_key_pass', org_id, True)
         if passphrase:
             try:
-                key_data = RSA.importKey(key_data, passphrase=passphrase).exportKey()
+                key_data = str(RSA.importKey(key_data, passphrase=passphrase).exportKey().decode('ascii'))
             except (ValueError, IndexError, TypeError) as e:
                 raise AssertionException('%s: Error decrypting private key, either the password is wrong or: %s' %
                                          (enterprise_config.get_full_scope(), e))

user_sync/version.py

@@ -18,4 +18,4 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
 
-__version__ = '2.2'
+__version__ = '2.2.1'