Add accept-invalid-certs option for cli

libs/client/src/lib.rs

@@ -94,7 +94,7 @@ pub struct KanidmClientConfigInstance {
     pub verify_hostnames: Option<bool>,
     /// Whether to verify the Certificate Authority details of the server's TLS certificate, defaults to `true`.
     ///
-    /// Environment variable is slightly inverted - `KANIDM_SKIP_HOSTNAME_VERIFICATION`.
+    /// Environment variable is slightly inverted - `KANIDM_ACCEPT_INVALID_CERTS`.
     pub verify_ca: Option<bool>,
     /// Optionally you can specify the path of a CA certificate to use for verifying the server, if you're not using one trusted by your system certificate store.
     ///

tools/cli/src/cli/common.rs

@@ -91,6 +91,16 @@ impl CommonOpt {
             false => client_builder,
         };
 
+        let client_builder = match self.accept_invalid_certs {
+            true => {
+                warn!(
+                    "TLS Certificate Verification disabled!!! This can lead to credential and account compromise!!!"
+                );
+                client_builder.danger_accept_invalid_certs(true)
+            }
+            false => client_builder,
+        };
+
         client_builder.build().unwrap_or_else(|e| {
             error!("Failed to build client instance -- {:?}", e);
             std::process::exit(1);

tools/cli/src/opt/kanidm.rs

@@ -87,6 +87,13 @@ pub struct CommonOpt {
         default_value_t = false
     )]
     skip_hostname_verification: bool,
+    /// Don't verify CA
+    #[clap(
+        long = "accept-invalid-certs",
+        env = "KANIDM_ACCEPT_INVALID_CERTS",
+        default_value_t = false
+    )]
+    accept_invalid_certs: bool,
     /// Path to a file to cache tokens in, defaults to ~/.cache/kanidm_tokens
     #[clap(short, long, env = "KANIDM_TOKEN_CACHE_PATH", hide = true, default_value = None,
     value_parser = clap::builder::NonEmptyStringValueParser::new())]