Added TPS scripts.

4 files changed, 124 insertions, 0 deletions

diff --git a/scripts/tps-configure.sh b/scripts/tps-configure.sh
new file mode 100755
index 0000000..d3a4fe8
--- /dev/null
+++ b/scripts/tps-configure.sh
@@ -0,0 +1,61 @@
+#!/bin/sh -x
+
+. ./tps-include.sh
+
+PIN=`grep preop.pin= $INSTANCE_ROOT/$TPS_INSTANCE_NAME/conf/CS.cfg | awk -F= '{ print $2; }'`
+
+CERTS=$SRC_DIR/pki-dev/certs/tps
+rm -rf $CERTS
+mkdir -p $CERTS
+
+if [ "$TPS_SECURE_PORT" == "" ]; then
+    PORT="$TPS_ADMIN_SECURE_PORT"
+else
+    PORT="$TPS_SECURE_PORT"
+fi
+
+pkisilent ConfigureTPS \
+        -cs_hostname $HOSTNAME \
+        -cs_port $PORT \
+        -cs_clientauth_port $PORT \
+        -preop_pin $PIN \
+        -client_certdb_dir "$CERTS" \
+        -client_certdb_pwd "$PASSWORD" \
+        -token_name "internal" \
+        -sd_hostname "$HOSTNAME" \
+        -sd_admin_port 9443 \
+        -sd_ssl_port 9443 \
+        -sd_agent_port 9443 \
+        -sd_admin_name "caadmin" \
+        -sd_admin_password "$PASSWORD" \
+        -domain_name "$REALM" \
+        -subsystem_name "$TPS_SUBSYSTEM_NAME" \
+        -ldap_host "$TPS_LDAP_HOST" \
+        -ldap_port "$TPS_LDAP_PORT" \
+        -base_dn "$TPS_LDAP_BASE_DN" \
+        -db_name "$TPS_LDAP_DATABASE" \
+        -bind_dn "$TPS_LDAP_BIND_DN" \
+        -bind_password "$TPS_LDAP_PASSWORD" \
+        -key_type rsa \
+        -key_size 2048 \
+        -tps_server_cert_subject_name "$TPS_SERVER_CERT_SUBJECT_NAME" \
+        -tps_subsystem_cert_subject_name "$TPS_SUBSYSTEM_CERT_SUBJECT_NAME" \
+        -tps_audit_signing_cert_subject_name "$TPS_AUDIT_SIGNING_CERT_SUBJECT_NAME" \
+        -ca_hostname "$HOSTNAME" \
+        -ca_port 9180 \
+        -ca_ssl_port 9443 \
+        -ca_admin_port 9443 \
+        -drm_hostname "$HOSTNAME" \
+        -drm_ssl_port 12443 \
+        -admin_user "$CA_ADMIN_USER" \
+        -agent_name "$CA_ADMIN_NAME" \
+        -admin_email "$CA_ADMIN_EMAIL" \
+        -admin_password "$CA_ADMIN_PASSWORD" \
+        -agent_key_size 2048 \
+        -agent_key_type rsa \
+        -agent_cert_subject "$CA_ADMIN_CERT_SUBJECT"
+
+echo $PASSWORD > "$CERTS/password.txt"
+PKCS12Export -d "$CERTS" -o "$CERTS/ca-client-certs.p12" -p "$CERTS/password.txt" -w "$CERTS/password.txt"
+
+systemctl restart pki-cad@$CA_INSTANCE_NAME.service
diff --git a/scripts/tps-create.sh b/scripts/tps-create.sh
new file mode 100755
index 0000000..24e444c
--- /dev/null
+++ b/scripts/tps-create.sh
@@ -0,0 +1,15 @@
+#!/bin/sh -x
+
+. ./tps-include.sh
+
+pkicreate -pki_instance_root=$INSTANCE_ROOT             \
+             -pki_instance_name=$TPS_INSTANCE_NAME      \
+             -subsystem_type=$TPS_SUBSYSTEM_TYPE        \
+             -secure_port=$TPS_SECURE_PORT              \
+             -non_clientauth_secure_port=$TPS_NON_CLIENTAUTH_SECURE_PORT \
+             -unsecure_port=$TPS_UNSECURE_PORT          \
+             -user=$INSTANCE_USER                       \
+             -group=$INSTANCE_GROUP                     \
+             -redirect conf=/etc/$TPS_INSTANCE_NAME     \
+             -redirect logs=/var/log/$TPS_INSTANCE_NAME \
+             -verbose
diff --git a/scripts/tps-include.sh b/scripts/tps-include.sh
new file mode 100755
index 0000000..0b9daba
--- /dev/null
+++ b/scripts/tps-include.sh
@@ -0,0 +1,40 @@
+#!/bin/sh -x
+
+SRC_DIR="`cd ../.. ; pwd`"
+
+DOMAIN="example.com"
+REALM="EXAMPLE-COM"
+PASSWORD="Secret123"
+
+INSTANCE_ROOT="/var/lib"
+INSTANCE_USER="pkiuser"
+INSTANCE_GROUP="pkiuser"
+
+TPS_INSTANCE_NAME="pki-tps"
+
+TPS_SUBSYSTEM_TYPE="tps"
+TPS_SUBSYSTEM_NAME="TPS"
+
+TPS_SECURE_PORT="7889"
+TPS_NON_CLIENTAUTH_SECURE_PORT="7890"
+TPS_UNSECURE_PORT="7888"
+TPS_TOMCAT_SERVER_PORT="15701"
+
+TPS_LDAP_HOST="$HOSTNAME"
+TPS_LDAP_PORT="389"
+TPS_LDAP_DATABASE="$DOMAIN-$INSTANCE_NAME"
+TPS_LDAP_BASE_DN="dc=tps,dc=example,dc=com"
+TPS_LDAP_BIND_DN="cn=Directory Manager"
+TPS_LDAP_PASSWORD="$PASSWORD"
+
+TPS_SIGN_CERT_SUBJECT_NAME="CN=$TPS_SUBSYSTEM_NAME,O=$REALM"
+TPS_OCSP_CERT_SUBJECT_NAME="CN=OCSP Signing Certificate,O=$REALM"
+TPS_SERVER_CERT_SUBJECT_NAME="CN=$HOSTNAME,O=$REALM"
+TPS_SUBSYSTEM_CERT_SUBJECT_NAME="CN=TPS Subsystem Certificate,O=$REALM"
+TPS_AUDIT_SIGNING_CERT_SUBJECT_NAME="CN=TPS Audit Signing Certificate,O=$REALM"
+
+TPS_ADMIN_USER="tpsadmin"
+TPS_ADMIN_NAME="$TPS_ADMIN_USER"
+TPS_ADMIN_EMAIL="$TPS_ADMIN_USER@$DOMAIN"
+TPS_ADMIN_PASSWORD="$PASSWORD"
+TPS_ADMIN_CERT_SUBJECT="CN=$TPS_ADMIN_NAME,UID=$TPS_ADMIN_USER,E=$TPS_ADMIN_EMAIL,O=$REALM"
diff --git a/scripts/tps-remove.sh b/scripts/tps-remove.sh
new file mode 100755
index 0000000..8d6848d
--- /dev/null
+++ b/scripts/tps-remove.sh
@@ -0,0 +1,8 @@
+#!/bin/sh -x
+
+. ./tps-include.sh
+
+pkiremove -pki_instance_root=$INSTANCE_ROOT     \
+          -pki_instance_name=$TPS_INSTANCE_NAME \
+          -force                                \
+          -verbose