Adding restful interface to create certificate requests and issue certificates.

Refactored ProfileSubmitServlet to make the flow clearer.  Both the legacy servlets
and the new RESTful servlets use common ProfileProcessor objects that contain the main
business logic, so that the amount of duplicated code is minimized.

Refactored ProfileProcessServlet to use the new  common classes.
Addressed review comments. Removed an unneeded class and reverted some unneeded jaxb
annotations.  Added factory methods.

17 files changed, 955 insertions, 2255 deletions

diff --git a/base/common/src/com/netscape/cms/servlet/profile/ProfileProcessServlet.java b/base/common/src/com/netscape/cms/servlet/profile/ProfileProcessServlet.java
index 996b65d78..0f9f34144 100644
--- a/base/common/src/com/netscape/cms/servlet/profile/ProfileProcessServlet.java
+++ b/base/common/src/com/netscape/cms/servlet/profile/ProfileProcessServlet.java
@@ -17,52 +17,33 @@
 // --- END COPYRIGHT BLOCK ---
 package com.netscape.cms.servlet.profile;
 
-import java.security.cert.CertificateEncodingException;
-import java.security.cert.X509Certificate;
-import java.util.Date;
-import java.util.Enumeration;
 import java.util.Locale;
 
 import javax.servlet.ServletConfig;
 import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import netscape.security.x509.X509CertImpl;
-
 import com.netscape.certsrv.apps.CMS;
-import com.netscape.certsrv.authentication.IAuthToken;
-import com.netscape.certsrv.authority.IAuthority;
-import com.netscape.certsrv.authorization.AuthzToken;
-import com.netscape.certsrv.authorization.EAuthzAccessDenied;
+import com.netscape.certsrv.authentication.EAuthException;
+import com.netscape.certsrv.authorization.EAuthzException;
+import com.netscape.certsrv.base.BadRequestDataException;
 import com.netscape.certsrv.base.EBaseException;
-import com.netscape.certsrv.base.IConfigStore;
-import com.netscape.certsrv.base.Nonces;
-import com.netscape.certsrv.ca.ICertificateAuthority;
 import com.netscape.certsrv.logging.ILogger;
 import com.netscape.certsrv.profile.EDeferException;
 import com.netscape.certsrv.profile.EProfileException;
 import com.netscape.certsrv.profile.ERejectException;
-import com.netscape.certsrv.profile.IEnrollProfile;
-import com.netscape.certsrv.profile.IPolicyConstraint;
-import com.netscape.certsrv.profile.IPolicyDefault;
-import com.netscape.certsrv.profile.IProfile;
-import com.netscape.certsrv.profile.IProfileOutput;
-import com.netscape.certsrv.profile.IProfilePolicy;
-import com.netscape.certsrv.profile.IProfileSubsystem;
+import com.netscape.certsrv.property.Descriptor;
 import com.netscape.certsrv.property.EPropertyException;
-import com.netscape.certsrv.property.IDescriptor;
 import com.netscape.certsrv.request.IRequest;
-import com.netscape.certsrv.request.IRequestQueue;
-import com.netscape.certsrv.request.RequestId;
-import com.netscape.certsrv.request.RequestStatus;
 import com.netscape.certsrv.template.ArgList;
 import com.netscape.certsrv.template.ArgSet;
-import com.netscape.certsrv.util.IStatsSubsystem;
-import com.netscape.cms.profile.common.ProfilePolicy;
+import com.netscape.certsrv.template.ArgString;
+import com.netscape.cms.servlet.cert.RequestProcessor;
 import com.netscape.cms.servlet.common.CMSRequest;
-import com.netscape.cmsutil.util.Utils;
+import com.netscape.cms.servlet.profile.model.ProfileAttribute;
+import com.netscape.cms.servlet.profile.model.ProfileOutput;
+import com.netscape.cms.servlet.request.model.AgentEnrollmentRequestData;
 
 /**
  * This servlet approves profile-based request.
@@ -70,400 +51,91 @@ import com.netscape.cmsutil.util.Utils;
  * @version $Revision$, $Date$
  */
 public class ProfileProcessServlet extends ProfileServlet {
-    /**
-     *
-     */
-    private static final long serialVersionUID = 5244627530516577838L;
-    private static final String PROP_AUTHORITY_ID = "authorityId";
-    private String mAuthorityId = null;
-    private Nonces mNonces = null;
 
-    private final static String SIGNED_AUDIT_CERT_REQUEST_REASON =
-            "requestNotes";
-    private final static String LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED =
-            "LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED_5";
+    private static final long serialVersionUID = 5244627530516577838L;
 
     public ProfileProcessServlet() {
     }
 
     public void init(ServletConfig sc) throws ServletException {
         super.init(sc);
-        mAuthorityId = sc.getInitParameter(PROP_AUTHORITY_ID);
-
-        ICertificateAuthority authority = null;
-        if (mAuthorityId != null)
-            authority = (ICertificateAuthority) CMS.getSubsystem(mAuthorityId);
-
-        if (authority != null && authority.noncesEnabled()) {
-            mNonces = authority.getNonces();
-        }
     }
 
     public void process(CMSRequest cmsReq) throws EBaseException {
         HttpServletRequest request = cmsReq.getHttpReq();
         HttpServletResponse response = cmsReq.getHttpResp();
 
-        IStatsSubsystem statsSub = (IStatsSubsystem) CMS.getSubsystem("stats");
-        if (statsSub != null) {
-            statsSub.startTiming("approval", true /* main action */);
-        }
-
-        IAuthToken authToken = null;
-        ArgSet args = new ArgSet();
-
         Locale locale = getLocale(request);
+        ArgSet args = new ArgSet();
+        args.set(ARG_ERROR_CODE, "0");
+        args.set(ARG_ERROR_REASON, "");
 
-        if (mAuthMgr != null) {
-            try {
-                authToken = authenticate(cmsReq);
-            } catch (EBaseException e) {
-                CMS.debug("ProfileProcessServlet: " + e.toString());
-                log(ILogger.LL_FAILURE,
-                        CMS.getLogMessage("ADMIN_SRVLT_AUTH_FAILURE", e.toString()));
-                args.set(ARG_ERROR_CODE, "1");
-                args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                        "CMS_AUTHENTICATION_ERROR"));
-                outputTemplate(request, response, args);
-                if (statsSub != null) {
-                    statsSub.endTiming("approval");
-                }
-                return;
-            }
-        }
-
-        AuthzToken authzToken = null;
-
-        try {
-            authzToken = authorize(mAclMethod, authToken,
-                        mAuthzResourceName, "approve");
-        } catch (EAuthzAccessDenied e) {
-            log(ILogger.LL_FAILURE,
-                    CMS.getLogMessage("ADMIN_SRVLT_AUTH_FAILURE", e.toString()));
-        } catch (Exception e) {
-            log(ILogger.LL_FAILURE,
-                    CMS.getLogMessage("ADMIN_SRVLT_AUTH_FAILURE", e.toString()));
-        }
-
-        if (authzToken == null) {
-            args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_AUTHORIZATION_ERROR"));
-            outputTemplate(request, response, args);
-            if (statsSub != null) {
-                statsSub.endTiming("approval");
-            }
-            return;
-        }
-
-        if (mNonces != null) {
-            String requestNonce = request.getParameter(ARG_REQUEST_NONCE);
-            boolean nonceVerified = false;
-            if (requestNonce != null) {
-                long nonce = Long.parseLong(requestNonce.trim());
-                X509Certificate cert1 = mNonces.getCertificate(nonce);
-                X509Certificate cert2 = getSSLClientCertificate(request);
-                if (cert1 == null) {
-                    CMS.debug("ProfileProcessServlet:  Unknown nonce");
-                } else if (cert1 != null && cert2 != null && cert1.equals(cert2)) {
-                    nonceVerified = true;
-                    mNonces.removeNonce(nonce);
-                }
-            } else {
-                CMS.debug("ProfileProcessServlet:  Missing nonce");
-            }
-            CMS.debug("ProfileProcessServlet:  nonceVerified=" + nonceVerified);
-            if (!nonceVerified) {
-                args.set(ARG_ERROR_CODE, "1");
-                args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                        "CMS_AUTHORIZATION_ERROR"));
-                outputTemplate(request, response, args);
-                if (statsSub != null) {
-                    statsSub.endTiming("approval");
-                }
-                return;
-            }
-        }
-
-        CMS.debug("ProfileProcessServlet: start serving");
-
-        // (1) Read request from the database
-
-        // (2) Get profile id from the request
-        if (mProfileSubId == null || mProfileSubId.equals("")) {
-            mProfileSubId = IProfileSubsystem.ID;
-        }
-        CMS.debug("ProfileProcessServlet: SubId=" + mProfileSubId);
-        IProfileSubsystem ps = (IProfileSubsystem)
-                CMS.getSubsystem(mProfileSubId);
-
-        if (ps == null) {
-            CMS.debug("ProfileProcessServlet: ProfileSubsystem not found");
-            args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_INTERNAL_ERROR"));
-            outputTemplate(request, response, args);
-            if (statsSub != null) {
-                statsSub.endTiming("approval");
-            }
-            return;
-        }
-
-        // retrieve request
-        IAuthority authority = (IAuthority) CMS.getSubsystem(mAuthorityId);
-
-        if (authority == null) {
-            CMS.debug("ProfileProcessServlet: Authority " + mAuthorityId +
-                    " not found");
-            args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_INTERNAL_ERROR"));
-            outputTemplate(request, response, args);
-            if (statsSub != null) {
-                statsSub.endTiming("approval");
-            }
-            return;
-        }
-        IRequestQueue queue = authority.getRequestQueue();
+        RequestProcessor processor = new RequestProcessor("caProfileProcess", locale);
 
-        if (queue == null) {
-            CMS.debug("ProfileProcessServlet: Request Queue of " +
-                    mAuthorityId + " not found");
-            args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_INTERNAL_ERROR"));
-            outputTemplate(request, response, args);
-            if (statsSub != null) {
-                statsSub.endTiming("approval");
-            }
+        String op = request.getParameter("op");
+        if (op == null) {
+            CMS.debug("ProfileProcessServlet: No op found");
+            setError(args, CMS.getUserMessage(locale, "CMS_OP_NOT_FOUND"), request, response);
             return;
         }
 
         String requestId = request.getParameter("requestId");
-
         if (requestId == null || requestId.equals("")) {
             CMS.debug("ProfileProcessServlet: Request Id not found");
-            args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_REQUEST_ID_NOT_FOUND"));
-            outputTemplate(request, response, args);
-            if (statsSub != null) {
-                statsSub.endTiming("approval");
-            }
+            setError(args, CMS.getUserMessage(locale, "CMS_REQUEST_ID_NOT_FOUND"), request, response);
             return;
         }
 
-        IRequest req = null;
-
-        CMS.debug("ProfileProcessServlet: requestId=" + requestId);
-        try {
-            req = queue.findRequest(new RequestId(requestId));
-        } catch (EBaseException e) {
-            // request not found
-            CMS.debug("ProfileProcessServlet: request not found requestId=" +
-                    requestId + " " + e.toString());
-        }
+        IRequest req = processor.getRequest(requestId);
         if (req == null) {
-            args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_REQUEST_NOT_FOUND", requestId));
-            outputTemplate(request, response, args);
-            if (statsSub != null) {
-                statsSub.endTiming("approval");
-            }
-            return;
-        }
-
-        // check if the request is in one of the terminal states
-        if (!req.getRequestStatus().equals(RequestStatus.PENDING)) {
-            args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_REQUEST_NOT_PENDING", requestId));
-            args.set(ARG_REQUEST_ID, requestId);
-            outputTemplate(request, response, args);
-            if (statsSub != null) {
-                statsSub.endTiming("approval");
-            }
+            setError(args, CMS.getUserMessage(locale, "CMS_REQUEST_NOT_FOUND", requestId), request, response);
             return;
         }
 
         String profileId = req.getExtDataInString("profileId");
-
-        CMS.debug("ProfileProcessServlet: profileId=" + profileId);
         if (profileId == null || profileId.equals("")) {
             CMS.debug("ProfileProcessServlet: Profile Id not found");
-            args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_PROFILE_ID_NOT_FOUND"));
-            outputTemplate(request, response, args);
-            if (statsSub != null) {
-                statsSub.endTiming("approval");
-            }
-            return;
-        }
-
-        String op = request.getParameter("op");
-        if (op == null) {
-            CMS.debug("ProfileProcessServlet: No op found");
-            args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_OP_NOT_FOUND"));
-            outputTemplate(request, response, args);
-            if (statsSub != null) {
-                statsSub.endTiming("approval");
-            }
+            setError(args, CMS.getUserMessage(locale, "CMS_PROFILE_ID_NOT_FOUND"), request, response);
             return;
         }
+        CMS.debug("ProfileProcessServlet: profileId=" + profileId);
 
-        IProfile profile = null;
+        // set request in cmsReq for later retrieval
+        cmsReq.setIRequest(req);
 
+        AgentEnrollmentRequestData data = null;
         try {
-            profile = ps.getProfile(profileId);
-        } catch (EProfileException e) {
-            // profile not found
-            CMS.debug("ProfileProcessServlet: profile not found " +
-                    " " + " profileId=" + profileId + " " + e.toString());
-        }
-        if (profile == null) {
-            args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_PROFILE_NOT_FOUND", profileId));
-            outputTemplate(request, response, args);
-            if (statsSub != null) {
-                statsSub.endTiming("approval");
-            }
+            data = processor.processRequest(cmsReq, req, op);
+        } catch (EAuthException e) {
+            log(ILogger.LL_FAILURE, CMS.getLogMessage("ADMIN_SRVLT_AUTH_FAILURE", e.toString()));
+            setError(args, e.getMessage(), request, response);
             return;
-        }
-
-        // if profile is currently disabled, dont do anything
-        if (!ps.isProfileEnable(profileId)) {
-            CMS.debug("ProfileProcessServlet: Profile Id not enabled");
-            args.set(ARG_OP, op);
-            args.set(ARG_REQUEST_ID, req.getRequestId().toString());
-            args.set(ARG_REQUEST_STATUS, req.getRequestStatus().toString());
-            args.set(ARG_REQUEST_TYPE, req.getRequestType());
-            args.set(ARG_PROFILE_ID, profileId);
-            args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_PROFILE_ID_NOT_ENABLED"));
-            outputTemplate(request, response, args);
-            if (statsSub != null) {
-                statsSub.endTiming("approval");
-            }
+        } catch (EAuthzException e) {
+            log(ILogger.LL_FAILURE, CMS.getLogMessage("ADMIN_SRVLT_AUTH_FAILURE", e.toString()));
+            setError(args, e.getMessage(), request, response);
+            return;
+        } catch (BadRequestDataException e) {
+            setError(args, e.getMessage(), request, response);
             return;
-        }
-
-        args.set(ARG_ERROR_CODE, "0");
-        args.set(ARG_ERROR_REASON, "");
-
-        try {
-            if (op.equals("assign")) {
-                String owner = req.getRequestOwner();
-
-                // assigned owner
-                if (owner != null && owner.length() > 0) {
-                    if (!grantPermission(req, authToken)) {
-                        CMS.debug("ProfileProcessServlet: Permission not granted to assign request.");
-                        args.set(ARG_OP, op);
-                        args.set(ARG_REQUEST_ID, req.getRequestId().toString());
-                        args.set(ARG_REQUEST_STATUS, req.getRequestStatus().toString());
-                        args.set(ARG_REQUEST_TYPE, req.getRequestType());
-                        args.set(ARG_PROFILE_ID, profileId);
-                        args.set(ARG_PROFILE_ID, profileId);
-                        args.set(ARG_ERROR_CODE, "1");
-                        args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale, "CMS_PROFILE_DENY_OPERATION"));
-                        outputTemplate(request, response, args);
-                        if (statsSub != null) {
-                            statsSub.endTiming("approval");
-                        }
-                        return;
-                    }
-                }
-                assignRequest(request, args, req, queue, profile, locale);
-            } else {
-                if (grantPermission(req, authToken)) {
-                    if (op.equals("approve")) {
-                        checkProfileVersion(profile, req, locale);
-                        updateValues(request, req, queue, profile, locale);
-                        updateNotes(request, req);
-                        approveRequest(request, args, req, queue, profile, locale);
-                    } else if (op.equals("reject")) {
-                        updateNotes(request, req);
-                        rejectRequest(request, args, req, queue, profile, locale);
-                    } else if (op.equals("cancel")) {
-                        updateNotes(request, req);
-                        cancelRequest(request, args, req, queue, profile, locale);
-                    } else if (op.equals("update")) {
-                        checkProfileVersion(profile, req, locale);
-                        updateValues(request, req, queue, profile, locale);
-                        updateNotes(request, req);
-                    } else if (op.equals("validate")) {
-                        updateValues(request, req, queue, profile, locale);
-                    } else if (op.equals("unassign")) {
-                        unassignRequest(request, args, req, queue, profile, locale);
-                    }
-                } else {
-                    CMS.debug("ProfileProcessServlet: Permission not granted to approve/reject/cancel/update/validate/unassign request.");
-                    args.set(ARG_OP, op);
-                    args.set(ARG_REQUEST_ID, req.getRequestId().toString());
-                    args.set(ARG_REQUEST_STATUS, req.getRequestStatus().toString());
-                    args.set(ARG_REQUEST_TYPE, req.getRequestType());
-                    args.set(ARG_PROFILE_ID, profileId);
-                    args.set(ARG_ERROR_CODE, "1");
-                    args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale, "CMS_PROFILE_DENY_OPERATION"));
-                    outputTemplate(request, response, args);
-                    if (statsSub != null) {
-                        statsSub.endTiming("approval");
-                    }
-                    return;
-                }
-            }
-
-            // commit request to the storage
-            if (!op.equals("validate")) {
-                try {
-                    if (op.equals("approve")) {
-                        queue.markAsServiced(req);
-                    } else {
-                        queue.updateRequest(req);
-                    }
-                } catch (EBaseException e) {
-                    CMS.debug("ProfileProcessServlet: Request commit error " +
-                            e.toString());
-                    // save request to disk
-                    args.set(ARG_ERROR_CODE, "1");
-                    args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                            "CMS_INTERNAL_ERROR"));
-                    outputTemplate(request, response, args);
-                    if (statsSub != null) {
-                        statsSub.endTiming("approval");
-                    }
-                    return;
-                }
-            }
         } catch (ERejectException e) {
-            CMS.debug("ProfileProcessServlet: execution rejected " +
-                    e.toString());
+            CMS.debug("ProfileProcessServlet: execution rejected " + e.toString());
             args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_PROFILE_REJECTED", e.toString()));
+            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale, "CMS_PROFILE_REJECTED", e.toString()));
         } catch (EDeferException e) {
-            CMS.debug("ProfileProcessServlet: execution defered " +
-                    e.toString());
+            CMS.debug("ProfileProcessServlet: execution defered " + e.toString());
             args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_PROFILE_DEFERRED", e.toString()));
+            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale, "CMS_PROFILE_DEFERRED", e.toString()));
         } catch (EPropertyException e) {
-            CMS.debug("ProfileProcessServlet: execution error " +
-                    e.toString());
+            CMS.debug("ProfileProcessServlet: execution error " + e.toString());
             args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_PROFILE_PROPERTY_ERROR", e.toString()));
+            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale, "CMS_PROFILE_PROPERTY_ERROR", e.toString()));
         } catch (EProfileException e) {
-            CMS.debug("ProfileProcessServlet: execution error " +
-                    e.toString());
+            CMS.debug("ProfileProcessServlet: execution error " + e.toString());
             args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_INTERNAL_ERROR"));
+            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale, "CMS_INTERNAL_ERROR"));
+        } catch (EBaseException e) {
+            setError(args, e.getMessage(), request, response);
+            return;
         }
 
         args.set(ARG_OP, op);
@@ -471,490 +143,33 @@ public class ProfileProcessServlet extends ProfileServlet {
         args.set(ARG_REQUEST_STATUS, req.getRequestStatus().toString());
         args.set(ARG_REQUEST_TYPE, req.getRequestType());
         args.set(ARG_PROFILE_ID, profileId);
-        outputTemplate(request, response, args);
-        if (statsSub != null) {
-            statsSub.endTiming("approval");
-        }
-    }
 
-    public boolean grantPermission(IRequest req, IAuthToken token) {
-
-        try {
-            boolean enable = CMS.getConfigStore().getBoolean("request.assignee.enable",
-                    false);
-            if (!enable)
-                return true;
-            String owner = req.getRequestOwner();
-
-            // unassigned owner
-            if (owner == null || owner.length() == 0)
-                return true;
-            String uid = token.getInString(IAuthToken.USER_ID);
-            if (uid.equals(owner))
-                return true;
-        } catch (Exception e) {
-        }
-
-        return false;
-    }
-
-    /**
-     * Check if the request creation time is older than the profile
-     * lastModified attribute.
-     */
-    protected void checkProfileVersion(IProfile profile, IRequest req,
-            Locale locale) throws EProfileException {
-        IConfigStore profileConfig = profile.getConfigStore();
-        if (profileConfig != null) {
-            String lastModified = null;
-            try {
-                lastModified = profileConfig.getString("lastModified", "");
-            } catch (EBaseException e) {
-                CMS.debug(e.toString());
-                throw new EProfileException(e.toString());
-            }
-            if (!lastModified.equals("")) {
-                Date profileModifiedAt = new Date(Long.parseLong(lastModified));
-                CMS.debug("ProfileProcessServlet: Profile Last Modified=" +
-                        profileModifiedAt);
-                Date reqCreatedAt = req.getCreationTime();
-                CMS.debug("ProfileProcessServlet: Request Created At=" +
-                        reqCreatedAt);
-                if (profileModifiedAt.after(reqCreatedAt)) {
-                    CMS.debug("Profile Newer Than Request");
-                    throw new ERejectException("Profile Newer Than Request");
-                }
-            }
-        }
-    }
-
-    protected void assignRequest(ServletRequest request, ArgSet args,
-            IRequest req,
-            IRequestQueue queue, IProfile profile, Locale locale)
-            throws EProfileException {
-
-        String id = auditSubjectID();
-        req.setRequestOwner(id);
-    }
-
-    protected void unassignRequest(ServletRequest request, ArgSet args,
-            IRequest req,
-            IRequestQueue queue, IProfile profile, Locale locale)
-            throws EProfileException {
-
-        req.setRequestOwner("");
-    }
-
-    /**
-     * Cancel request
-     * <P>
-     *
-     * (Certificate Request Processed - a manual "agent" profile based cert cancellation)
-     * <P>
-     *
-     * <ul>
-     * <li>signed.audit LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED used when a certificate request has just been
-     * through the approval process
-     * </ul>
-     *
-     * @param request the servlet request
-     * @param args argument set
-     * @param req the certificate request
-     * @param queue the certificate request queue
-     * @param profile this profile
-     * @param locale the system locale
-     * @exception EProfileException an error related to this profile has
-     *                occurred
-     */
-    protected void cancelRequest(ServletRequest request, ArgSet args,
-            IRequest req,
-            IRequestQueue queue, IProfile profile, Locale locale)
-            throws EProfileException {
-        String auditMessage = null;
-        String auditSubjectID = auditSubjectID();
-        String auditRequesterID = auditRequesterID(req);
-        String auditInfoValue = auditInfoValue(req);
-
-        // try {
-        req.setRequestStatus(RequestStatus.CANCELED);
-
-        // store a message in the signed audit log file
-        auditMessage = CMS.getLogMessage(
-                    LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED,
-                    auditSubjectID,
-                    ILogger.SUCCESS,
-                    auditRequesterID,
-                    ILogger.SIGNED_AUDIT_CANCELLATION,
-                    auditInfoValue);
-
-        audit(auditMessage);
-        // } catch( EProfileException eAudit1 ) {
-        //     // store a message in the signed audit log file
-        //     auditMessage = CMS.getLogMessage(
-        //                        LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED,
-        //                        auditSubjectID,
-        //                        ILogger.FAILURE,
-        //                        auditRequesterID,
-        //                        ILogger.SIGNED_AUDIT_CANCELLATION,
-        //                        auditInfoValue );
-        //
-        //     audit( auditMessage );
-        // }
-    }
-
-    /**
-     * Reject request
-     * <P>
-     *
-     * (Certificate Request Processed - a manual "agent" profile based cert rejection)
-     * <P>
-     *
-     * <ul>
-     * <li>signed.audit LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED used when a certificate request has just been
-     * through the approval process
-     * </ul>
-     *
-     * @param request the servlet request
-     * @param args argument set
-     * @param req the certificate request
-     * @param queue the certificate request queue
-     * @param profile this profile
-     * @param locale the system locale
-     * @exception EProfileException an error related to this profile has
-     *                occurred
-     */
-    protected void rejectRequest(ServletRequest request, ArgSet args,
-            IRequest req,
-            IRequestQueue queue, IProfile profile, Locale locale)
-            throws EProfileException {
-        String auditMessage = null;
-        String auditSubjectID = auditSubjectID();
-        String auditRequesterID = auditRequesterID(req);
-        String auditInfoValue = auditInfoValue(req);
-
-        // try {
-        req.setRequestStatus(RequestStatus.REJECTED);
-
-        // store a message in the signed audit log file
-        auditMessage = CMS.getLogMessage(
-                    LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED,
-                    auditSubjectID,
-                    ILogger.SUCCESS,
-                    auditRequesterID,
-                    ILogger.SIGNED_AUDIT_REJECTION,
-                    auditInfoValue);
-
-        audit(auditMessage);
-        // } catch( EProfileException eAudit1 ) {
-        //     // store a message in the signed audit log file
-        //     auditMessage = CMS.getLogMessage(
-        //                        LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED,
-        //                        auditSubjectID,
-        //                        ILogger.FAILURE,
-        //                        auditRequesterID,
-        //                        ILogger.SIGNED_AUDIT_REJECTION,
-        //                        auditInfoValue );
-        //
-        //     audit( auditMessage );
-        // }
-    }
-
-    /**
-     * Approve request
-     * <P>
-     *
-     * (Certificate Request Processed - a manual "agent" profile based cert acceptance)
-     * <P>
-     *
-     * <ul>
-     * <li>signed.audit LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED used when a certificate request has just been
-     * through the approval process
-     * </ul>
-     *
-     * @param request the servlet request
-     * @param args argument set
-     * @param req the certificate request
-     * @param queue the certificate request queue
-     * @param profile this profile
-     * @param locale the system locale
-     * @exception EProfileException an error related to this profile has
-     *                occurred
-     */
-    protected void approveRequest(ServletRequest request, ArgSet args,
-            IRequest req,
-            IRequestQueue queue, IProfile profile, Locale locale)
-            throws EProfileException {
-        String auditMessage = null;
-        String auditSubjectID = auditSubjectID();
-        String auditRequesterID = auditRequesterID(req);
-
-        try {
-            profile.execute(req);
-            req.setRequestStatus(RequestStatus.COMPLETE);
+        String errorCode = ((ArgString) args.get(ARG_ERROR_CODE)).getValue();
 
+        if (op.equals("approve") && errorCode.equals("0") && (data != null)) {
             ArgList outputlist = new ArgList();
-            Enumeration<String> outputIds = profile.getProfileOutputIds();
-
-            if (outputIds != null) {
-                while (outputIds.hasMoreElements()) {
-                    String outputId = outputIds.nextElement();
-                    IProfileOutput profileOutput = profile.getProfileOutput(
-                            outputId);
-
-                    Enumeration<String> outputNames = profileOutput.getValueNames();
-
-                    if (outputNames != null) {
-                        while (outputNames.hasMoreElements()) {
-                            ArgSet outputset = new ArgSet();
-                            String outputName =
-                                    outputNames.nextElement();
-                            IDescriptor outputDesc =
-                                    profileOutput.getValueDescriptor(locale,
-                                            outputName);
-
-                            if (outputDesc == null)
-                                continue;
-                            String outputSyntax = outputDesc.getSyntax();
-                            String outputConstraint =
-                                    outputDesc.getConstraint();
-                            String outputValueName =
-                                    outputDesc.getDescription(locale);
-                            String outputValue = null;
-
-                            try {
-                                outputValue = profileOutput.getValue(
-                                            outputName,
-                                            locale, req);
-                            } catch (EProfileException e) {
-                                CMS.debug("ProfileSubmitServlet: " +
-                                        e.toString());
-                            }
-
-                            outputset.set(ARG_OUTPUT_ID, outputName);
-                            outputset.set(ARG_OUTPUT_SYNTAX, outputSyntax);
-                            outputset.set(ARG_OUTPUT_CONSTRAINT,
-                                    outputConstraint);
-                            outputset.set(ARG_OUTPUT_NAME, outputValueName);
-                            outputset.set(ARG_OUTPUT_VAL, outputValue);
-                            outputlist.add(outputset);
-                        }
-                    }
+            for (ProfileOutput output: data.getOutputs()) {
+                for (ProfileAttribute attr: output.getAttrs()){
+                    ArgSet outputset = new ArgSet();
+                    Descriptor desc = attr.getDescriptor();
+                    outputset.set(ARG_OUTPUT_ID, attr.getName());
+                    outputset.set(ARG_OUTPUT_SYNTAX, desc.getSyntax());
+                    outputset.set(ARG_OUTPUT_CONSTRAINT, desc.getConstraint());
+                    outputset.set(ARG_OUTPUT_NAME, desc.getDescription(locale));
+                    outputset.set(ARG_OUTPUT_VAL, attr.getValue());
+                    outputlist.add(outputset);
                 }
             }
             args.set(ARG_OUTPUT_LIST, outputlist);
-
-            // retrieve the certificate
-            X509CertImpl theCert = req.getExtDataInCert(
-                    IEnrollProfile.REQUEST_ISSUED_CERT);
-
-            // store a message in the signed audit log file
-            auditMessage = CMS.getLogMessage(
-                        LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED,
-                        auditSubjectID,
-                        ILogger.SUCCESS,
-                        auditRequesterID,
-                        ILogger.SIGNED_AUDIT_ACCEPTANCE,
-                        auditInfoCertValue(theCert));
-
-            audit(auditMessage);
-
-        } catch (EProfileException eAudit1) {
-            // store a message in the signed audit log file
-            auditMessage = CMS.getLogMessage(
-                        LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED,
-                        auditSubjectID,
-                        ILogger.FAILURE,
-                        auditRequesterID,
-                        ILogger.SIGNED_AUDIT_ACCEPTANCE,
-                        ILogger.SIGNED_AUDIT_EMPTY_VALUE);
-
-            audit(auditMessage);
-
-            CMS.debug("ProfileProcessServlet: about to throw EProfileException because of bad profile execute.");
-            throw new EProfileException(eAudit1.toString());
-
-        }
-    }
-
-    protected void updateValues(ServletRequest request, IRequest req,
-            IRequestQueue queue, IProfile profile, Locale locale)
-            throws ERejectException, EDeferException, EPropertyException {
-        String profileSetId = req.getExtDataInString("profileSetId");
-
-        Enumeration<ProfilePolicy> policies = profile.getProfilePolicies(profileSetId);
-        int count = 0;
-
-        while (policies.hasMoreElements()) {
-            ProfilePolicy policy = policies.nextElement();
-
-            setValue(locale, count, policy, req, request);
-            count++;
-        }
-
-        policies = profile.getProfilePolicies(profileSetId);
-        count = 0;
-        while (policies.hasMoreElements()) {
-            ProfilePolicy policy = policies.nextElement();
-
-            validate(locale, count, policy, req, request);
-            count++;
         }
 
+        outputTemplate(request, response, args);
     }
 
-    protected void updateNotes(ServletRequest request, IRequest req) {
-        String notes = request.getParameter(ARG_REQUEST_NOTES);
-
-        if (notes != null) {
-            req.setExtData("requestNotes", notes);
-        }
-    }
-
-    protected void validate(Locale locale, int count,
-            IProfilePolicy policy, IRequest req, ServletRequest request)
-            throws ERejectException, EDeferException {
-        IPolicyConstraint con = policy.getConstraint();
-
-        con.validate(req);
-    }
-
-    protected void setValue(Locale locale, int count,
-            IProfilePolicy policy, IRequest req, ServletRequest request)
-            throws EPropertyException {
-        // handle default policy
-        IPolicyDefault def = policy.getDefault();
-        Enumeration<String> defNames = def.getValueNames();
-
-        while (defNames.hasMoreElements()) {
-            String defName = defNames.nextElement();
-            String defValue = request.getParameter(defName);
-
-            def.setValue(defName, locale, req, defValue);
-        }
-    }
-
-    /**
-     * Signed Audit Log Requester ID
-     *
-     * This method is called to obtain the "RequesterID" for
-     * a signed audit log message.
-     * <P>
-     *
-     * @param request the actual request
-     * @return id string containing the signed audit log message RequesterID
-     */
-    private String auditRequesterID(IRequest request) {
-        // if no signed audit object exists, bail
-        if (mSignedAuditLogger == null) {
-            return null;
-        }
-
-        String requesterID = ILogger.UNIDENTIFIED;
-
-        if (request != null) {
-            // overwrite "requesterID" if and only if "id" != null
-            String id = request.getRequestId().toString();
-
-            if (id != null) {
-                requesterID = id.trim();
-            }
-        }
-
-        return requesterID;
-    }
-
-    /**
-     * Signed Audit Log Info Value
-     *
-     * This method is called to obtain the "reason" for
-     * a signed audit log message.
-     * <P>
-     *
-     * @param request the actual request
-     * @return reason string containing the signed audit log message reason
-     */
-    private String auditInfoValue(IRequest request) {
-        // if no signed audit object exists, bail
-        if (mSignedAuditLogger == null) {
-            return null;
-        }
-
-        String reason = ILogger.SIGNED_AUDIT_EMPTY_VALUE;
-
-        if (request != null) {
-            // overwrite "reason" if and only if "info" != null
-            String info =
-                    request.getExtDataInString(SIGNED_AUDIT_CERT_REQUEST_REASON);
-
-            if (info != null) {
-                reason = info.trim();
-
-                // overwrite "reason" if and only if "reason" is empty
-                if (reason.equals("")) {
-                    reason = ILogger.SIGNED_AUDIT_EMPTY_VALUE;
-                }
-            }
-        }
-
-        return reason;
-    }
-
-    /**
-     * Signed Audit Log Info Certificate Value
-     *
-     * This method is called to obtain the certificate from the passed in
-     * "X509CertImpl" for a signed audit log message.
-     * <P>
-     *
-     * @param x509cert an X509CertImpl
-     * @return cert string containing the certificate
-     */
-    private String auditInfoCertValue(X509CertImpl x509cert) {
-        // if no signed audit object exists, bail
-        if (mSignedAuditLogger == null) {
-            return null;
-        }
-
-        if (x509cert == null) {
-            return ILogger.SIGNED_AUDIT_EMPTY_VALUE;
-        }
-
-        byte rawData[] = null;
-
-        try {
-            rawData = x509cert.getEncoded();
-        } catch (CertificateEncodingException e) {
-            return ILogger.SIGNED_AUDIT_EMPTY_VALUE;
-        }
-
-        String cert = null;
-
-        // convert "rawData" into "base64Data"
-        if (rawData != null) {
-            String base64Data = null;
-
-            base64Data = Utils.base64encode(rawData).trim();
-
-            // extract all line separators from the "base64Data"
-            StringBuffer sb = new StringBuffer();
-            for (int i = 0; i < base64Data.length(); i++) {
-                if (!Character.isWhitespace(base64Data.charAt(i))) {
-                    sb.append(base64Data.charAt(i));
-                }
-            }
-            cert = sb.toString();
-        }
-
-        if (cert != null) {
-            cert = cert.trim();
-
-            if (cert.equals("")) {
-                return ILogger.SIGNED_AUDIT_EMPTY_VALUE;
-            } else {
-                return cert;
-            }
-        } else {
-            return ILogger.SIGNED_AUDIT_EMPTY_VALUE;
-        }
+    private void setError(ArgSet args, String reason, HttpServletRequest request, HttpServletResponse response)
+            throws EBaseException {
+        args.set(ARG_ERROR_CODE, "1");
+        args.set(ARG_ERROR_REASON, reason);
+        outputTemplate(request, response, args);
     }
 }
diff --git a/base/common/src/com/netscape/cms/servlet/profile/ProfileServlet.java b/base/common/src/com/netscape/cms/servlet/profile/ProfileServlet.java
index e975161da..be331d6ef 100644
--- a/base/common/src/com/netscape/cms/servlet/profile/ProfileServlet.java
+++ b/base/common/src/com/netscape/cms/servlet/profile/ProfileServlet.java
@@ -24,6 +24,7 @@ import java.io.IOException;
 import java.io.PrintStream;
 import java.io.PrintWriter;
 import java.util.Enumeration;
+import java.util.LinkedHashSet;
 import java.util.Locale;
 
 import javax.servlet.ServletConfig;
@@ -158,6 +159,9 @@ public class ProfileServlet extends CMSServlet {
 
     protected ILogger mSignedAuditLogger = CMS.getSignedAuditLogger();
 
+    // stats
+    protected LinkedHashSet<String> statEvents = new LinkedHashSet<String>();
+
     public ProfileServlet() {
         super();
     }
@@ -291,6 +295,55 @@ public class ProfileServlet extends CMSServlet {
         }
     }
 
+    public void outputTemplate(boolean isXML, HttpServletResponse response, ArgSet args)
+            throws EBaseException {
+        if (isXML) {
+            response.setContentType("text/xml");
+            ByteArrayOutputStream bos = new ByteArrayOutputStream();
+            outputThisAsXML(bos, args);
+            try {
+                response.setContentLength(bos.size());
+                bos.writeTo(response.getOutputStream());
+            } catch (Exception e) {
+                CMS.debug("outputTemplate error " + e);
+            }
+            return;
+        }
+        startTiming("output_template");
+
+        BufferedReader reader = null;
+        try {
+            reader = new BufferedReader(new FileReader(mTemplate));
+
+            response.setContentType("text/html; charset=UTF-8");
+
+            PrintWriter writer = response.getWriter();
+
+            // output template
+            String line = null;
+
+            do {
+                line = reader.readLine();
+                if (line != null) {
+                    if (line.indexOf("<CMS_TEMPLATE>") == -1) {
+                        writer.println(line);
+                    } else {
+                        // output javascript parameters
+                        writer.println("<script type=\"text/javascript\">");
+                        outputData(writer, args);
+                        writer.println("</script>");
+                    }
+                }
+            } while (line != null);
+            reader.close();
+        } catch (IOException e) {
+            CMS.debug(e);
+            throw new EBaseException(e.toString());
+        } finally {
+            endTiming("output_template");
+        }
+    }
+
     protected void outputArgList(PrintWriter writer, String name, ArgList list)
             throws IOException {
 
@@ -321,6 +374,22 @@ public class ProfileServlet extends CMSServlet {
         }
     }
 
+    public void startTiming(String event) {
+        IStatsSubsystem statsSub = (IStatsSubsystem) CMS.getSubsystem("stats");
+        if (statsSub != null) {
+            statsSub.startTiming(event, true);
+        }
+        statEvents.add(event);
+    }
+
+    public void endTiming(String event) {
+        IStatsSubsystem statsSub = (IStatsSubsystem) CMS.getSubsystem("stats");
+        if (statsSub != null) {
+            statsSub.endTiming(event);
+        }
+        statEvents.remove(event);
+    }
+
     protected String escapeJavaScriptString(String v) {
         int l = v.length();
         char in[] = new char[l];
diff --git a/base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitServlet.java b/base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitServlet.java
index 85ef4fa0f..7b0813d71 100644
--- a/base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitServlet.java
+++ b/base/common/src/com/netscape/cms/servlet/profile/ProfileSubmitServlet.java
@@ -17,58 +17,38 @@
 // --- END COPYRIGHT BLOCK ---
 package com.netscape.cms.servlet.profile;
 
-import java.math.BigInteger;
-import java.security.cert.CertificateEncodingException;
-import java.security.cert.X509Certificate;
-import java.util.Date;
 import java.util.Enumeration;
+import java.util.HashMap;
 import java.util.Locale;
-import java.util.StringTokenizer;
 
 import javax.servlet.ServletConfig;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import netscape.security.x509.BasicConstraintsExtension;
 import netscape.security.x509.X509CertImpl;
 import netscape.security.x509.X509CertInfo;
 
 import org.w3c.dom.Node;
 
 import com.netscape.certsrv.apps.CMS;
-import com.netscape.certsrv.authentication.IAuthToken;
-import com.netscape.certsrv.authority.IAuthority;
+import com.netscape.certsrv.authentication.EAuthException;
+import com.netscape.certsrv.authorization.EAuthzException;
+import com.netscape.certsrv.base.BadRequestDataException;
 import com.netscape.certsrv.base.EBaseException;
-import com.netscape.certsrv.base.MetaInfo;
-import com.netscape.certsrv.base.SessionContext;
-import com.netscape.certsrv.ca.ICertificateAuthority;
-import com.netscape.certsrv.dbs.certdb.ICertRecord;
-import com.netscape.certsrv.dbs.certdb.ICertificateRepository;
-import com.netscape.certsrv.logging.ILogger;
-import com.netscape.certsrv.profile.EDeferException;
 import com.netscape.certsrv.profile.EProfileException;
-import com.netscape.certsrv.profile.ERejectException;
 import com.netscape.certsrv.profile.IEnrollProfile;
 import com.netscape.certsrv.profile.IProfile;
-import com.netscape.certsrv.profile.IProfileAuthenticator;
-import com.netscape.certsrv.profile.IProfileContext;
-import com.netscape.certsrv.profile.IProfileInput;
 import com.netscape.certsrv.profile.IProfileOutput;
-import com.netscape.certsrv.profile.IProfileSubsystem;
 import com.netscape.certsrv.property.IDescriptor;
-import com.netscape.certsrv.request.INotify;
 import com.netscape.certsrv.request.IRequest;
-import com.netscape.certsrv.request.IRequestQueue;
-import com.netscape.certsrv.request.RequestId;
-import com.netscape.certsrv.request.RequestStatus;
 import com.netscape.certsrv.template.ArgList;
 import com.netscape.certsrv.template.ArgSet;
-import com.netscape.certsrv.util.IStatsSubsystem;
-import com.netscape.cms.servlet.common.AuthCredentials;
+import com.netscape.cms.servlet.cert.EnrollmentProcessor;
+import com.netscape.cms.servlet.cert.RenewalProcessor;
 import com.netscape.cms.servlet.common.CMSRequest;
+import com.netscape.cms.servlet.processors.Processor;
 import com.netscape.cmsutil.util.Cert;
-import com.netscape.cmsutil.util.Utils;
 import com.netscape.cmsutil.xml.XMLObject;
 
 /**
@@ -83,31 +63,9 @@ public class ProfileSubmitServlet extends ProfileServlet {
      *
      */
     private static final long serialVersionUID = 7557922703180866442L;
-    private static final String ARG_AUTH_TOKEN = "auth_token";
-    private static final String ARG_REQUEST_OWNER = "requestOwner";
-    private static final String PROP_PROFILE_ID = "profileId";
-    private static final String PROP_AUTHORITY_ID = "authorityId";
     private final static String SUCCESS = "0";
     private final static String FAILED = "1";
 
-    private String mProfileId = null;
-    private String mProfileSubId = null;
-    private String mAuthorityId = null;
-
-    private final static String[] SIGNED_AUDIT_AUTOMATED_REJECTION_REASON = new String[] {
-
-    /* 0 */"automated profile cert request rejection:  "
-            + "indeterminate reason for inability to process "
-            + "cert request due to an EBaseException"
-        };
-    private final static String LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED =
-            "LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED_5";
-
-    private final static String LOGGING_SIGNED_AUDIT_AUTH_FAIL =
-            "LOGGING_SIGNED_AUDIT_AUTH_FAIL_4";
-    private final static String LOGGING_SIGNED_AUDIT_AUTH_SUCCESS =
-            "LOGGING_SIGNED_AUDIT_AUTH_SUCCESS_3";
-
     public ProfileSubmitServlet() {
     }
 
@@ -123,273 +81,122 @@ public class ProfileSubmitServlet extends ProfileServlet {
      */
     public void init(ServletConfig sc) throws ServletException {
         super.init(sc);
-        mAuthorityId = sc.getInitParameter(PROP_AUTHORITY_ID);
-        mProfileId = sc.getInitParameter(PROP_PROFILE_ID);
-    }
-
-    private void setInputsIntoContext(HttpServletRequest request, IProfile profile, IProfileContext ctx) {
-        // passing inputs into context
-        Enumeration<String> inputIds = profile.getProfileInputIds();
-
-        if (inputIds != null) {
-            while (inputIds.hasMoreElements()) {
-                String inputId = inputIds.nextElement();
-                IProfileInput profileInput = profile.getProfileInput(inputId);
-                Enumeration<String> inputNames = profileInput.getValueNames();
-
-                while (inputNames.hasMoreElements()) {
-                    String inputName = inputNames.nextElement();
-                    if (request.getParameter(inputName) != null) {
-                        // all subject name parameters start with sn_, no other input parameters do
-                        if (inputName.matches("^sn_.*")) {
-                            ctx.set(inputName, escapeValueRfc1779(request.getParameter(inputName), false).toString());
-                        } else {
-                            ctx.set(inputName, request.getParameter(inputName));
-                        }
-                    }
-                }
-            }
-        }
-
     }
 
-    /*
-     * fill input info from "request" to context.
-     * This is expected to be used by renewal where the request
-     * is retrieved from request record
+    /**
+     * Process the HTTP request
+     * <P>
+     *
+     * (Certificate Request Processed - either an automated "EE" profile based cert acceptance, or an automated "EE"
+     * profile based cert rejection)
+     * <P>
+     *
+     * <ul>
+     * <li>http.param profileId ID of profile to use to process request
+     * <li>signed.audit LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED used when a certificate request has just been
+     * through the approval process
+     * </ul>
+     *
+     * @param cmsReq the object holding the request and response information
+     * @exception EBaseException an error has occurred
      */
-    private void setInputsIntoContext(IRequest request, IProfile profile, IProfileContext ctx, Locale locale) {
-        // passing inputs into context
-        Enumeration<String> inputIds = profile.getProfileInputIds();
-
-        if (inputIds != null) {
-            while (inputIds.hasMoreElements()) {
-                String inputId = inputIds.nextElement();
-                IProfileInput profileInput = profile.getProfileInput(inputId);
-                Enumeration<String> inputNames = profileInput.getValueNames();
-
-                while (inputNames.hasMoreElements()) {
-                    String inputName = inputNames.nextElement();
-                    String inputValue = "";
-                    CMS.debug("ProfileSubmitServlet: setInputsIntoContext() getting input name= " + inputName);
-                    try {
-                        inputValue = profileInput.getValue(inputName, locale, request);
-                    } catch (Exception e) {
-                        CMS.debug("ProfileSubmitServlet: setInputsIntoContext() getvalue() failed: " + e.toString());
-                    }
-
-                    if (inputValue != null) {
-                        CMS.debug("ProfileSubmitServlet: setInputsIntoContext() setting value in ctx:" + inputValue);
-                        ctx.set(inputName, inputValue);
-                    } else {
-                        CMS.debug("ProfileSubmitServlet: setInputsIntoContext() value null");
-                    }
-                }
-            }
-        }
 
-    }
-
-    private void setCredentialsIntoContext(HttpServletRequest request, IProfileAuthenticator authenticator,
-            IProfileContext ctx) {
-        Enumeration<String> authIds = authenticator.getValueNames();
-
-        if (authIds != null) {
-            CMS.debug("ProfileSubmitServlet:setCredentialsIntoContext() authNames not null");
-            while (authIds.hasMoreElements()) {
-                String authName = authIds.nextElement();
+    public void process(CMSRequest cmsReq) throws EBaseException {
+        HttpServletRequest request = cmsReq.getHttpReq();
+        HttpServletResponse response = cmsReq.getHttpResp();
+        boolean xmlOutput = getXMLOutput(request);
 
-                CMS.debug("ProfileSubmitServlet:setCredentialsIntoContext() authName:" +
-                        authName);
-                if (request.getParameter(authName) != null) {
-                    CMS.debug("ProfileSubmitServlet:setCredentialsIntoContext() authName found in request");
-                    ctx.set(authName, request.getParameter(authName));
-                } else {
-                    CMS.debug("ProfileSubmitServlet:setCredentialsIntoContext() authName not found in request");
-                }
-            }
-        } else {
-            CMS.debug("ProfileSubmitServlet:setCredentialsIntoContext() authIds` null");
-        }
-    }
+        Locale locale = getLocale(request);
 
-    String getUidFromDN(String userdn) {
-        StringTokenizer st = new StringTokenizer(userdn, ",");
-        while (st.hasMoreTokens()) {
-            String t = st.nextToken();
-            int i = t.indexOf("=");
+        HashMap<String, Object> results = null;
+        String renewal = request.getParameter("renewal");
 
-            if (i == -1) {
-                continue;
-            }
-            String n = t.substring(0, i);
-            if (n.equalsIgnoreCase("uid")) {
-                String v = t.substring(i + 1);
-                CMS.debug("ProfileSubmitServlet:: getUidFromDN(): uid found:" + v);
-                return v;
+        try {
+            if ((renewal != null) && (renewal.equalsIgnoreCase("true"))) {
+                CMS.debug("ProfileSubmitServlet: isRenewal true");
+                RenewalProcessor processor = new RenewalProcessor("caProfileSubmit", locale);
+                results = processor.processRenewal(cmsReq);
             } else {
-                continue;
+                CMS.debug("ProfileSubmitServlet: isRenewal false");
+                EnrollmentProcessor processor = new EnrollmentProcessor("caProfileSubmit", locale);
+                results = processor.processEnrollment(cmsReq);
             }
+        } catch (BadRequestDataException e) {
+            CMS.debug("ProfileSubmitServlet: bad data provided in processing request: " + e.toString());
+            errorExit(response, xmlOutput, e.getMessage(), null);
+            return;
+        } catch (EAuthzException e) {
+            CMS.debug("ProfileSubmitServlet: authorization error in processing request: " + e.toString());
+            errorExit(response, xmlOutput, e.getMessage(), null);
+            return;
+        } catch (EAuthException e) {
+            CMS.debug("ProfileSubmitServlet: authentication error in processing request: " + e.toString());
+            errorExit(response, xmlOutput, e.getMessage(), null);
+            return;
+        } catch (EBaseException e) {
+            e.printStackTrace();
+            CMS.debug("ProfileSubmitServlet: error in processing request: " + e.toString());
+            errorExit(response, xmlOutput, e.getMessage(), null);
+            return;
         }
-        return null;
-    }
 
-    /*
-     *   authenticate for renewal - more to add necessary params/values
-     *   to the session context
-     */
-    public IAuthToken authenticate(IProfileAuthenticator authenticator,
-            HttpServletRequest request, IRequest origReq, SessionContext context)
-            throws EBaseException {
-        IAuthToken authToken = authenticate(authenticator, request);
-        // For renewal, fill in necessary params
-        if (authToken != null) {
-            String ouid = origReq.getExtDataInString("auth_token.uid");
-            // if the orig cert was manually approved, then there was
-            // no auth token uid.  Try to get the uid from the cert dn
-            // itself, if possible
-            if (ouid == null) {
-                String sdn = (String) context.get("origSubjectDN");
-                if (sdn != null) {
-                    ouid = getUidFromDN(sdn);
-                    if (ouid != null)
-                        CMS.debug("ProfileSubmitServlet: renewal: authToken original uid not found");
-                }
-            } else {
-                CMS.debug("ProfileSubmitServlet: renewal: authToken original uid found in orig request auth_token");
-            }
-            String auid = authToken.getInString("uid");
-            if (auid != null) { // not through ssl client auth
-                CMS.debug("ProfileSubmitServlet: renewal: authToken uid found:" + auid);
-                // authenticated with uid
-                // put "orig_req.auth_token.uid" so that authz with
-                // UserOrigReqAccessEvaluator will work
-                if (ouid != null) {
-                    context.put("orig_req.auth_token.uid", ouid);
-                    CMS.debug("ProfileSubmitServlet: renewal: authToken original uid found:" + ouid);
-                } else {
-                    CMS.debug("ProfileSubmitServlet: renewal: authToken original uid not found");
-                }
-            } else { // through ssl client auth?
-                CMS.debug("ProfileSubmitServlet: renewal: authToken uid not found:");
-                // put in orig_req's uid
-                if (ouid != null) {
-                    CMS.debug("ProfileSubmitServlet: renewal: origReq uid not null:" + ouid + ". Setting authtoken");
-                    authToken.set("uid", ouid);
-                    context.put(SessionContext.USER_ID, ouid);
-                } else {
-                    CMS.debug("ProfileSubmitServlet: renewal: origReq uid not found");
-                    //                      throw new EBaseException("origReq uid not found");
+        IRequest[] reqs = (IRequest []) results.get(Processor.ARG_REQUESTS);
+        String errorCode = (String) results.get(Processor.ARG_ERROR_CODE);
+        String errorReason = (String) results.get(Processor.ARG_ERROR_REASON);
+        IProfile profile = (IProfile) results.get(Processor.ARG_PROFILE);
+        ArgSet args = new ArgSet();
+
+        if (errorCode != null) {
+            if (xmlOutput) {
+                String requestIds = "";
+                for (IRequest req : reqs) {
+                    requestIds += "  " + req.getRequestId().toString();
                 }
-            }
 
-            String userdn = origReq.getExtDataInString("auth_token.userdn");
-            if (userdn != null) {
-                CMS.debug("ProfileSubmitServlet: renewal: origReq userdn not null:" + userdn + ". Setting authtoken");
-                authToken.set("userdn", userdn);
+                outputError(response, errorCode, errorReason, requestIds);
             } else {
-                CMS.debug("ProfileSubmitServlet: renewal: origReq userdn not found");
-                //                      throw new EBaseException("origReq userdn not found");
-            }
-        } else {
-            CMS.debug("ProfileSubmitServlet: renewal: authToken null");
-        }
-        return authToken;
-    }
-
-    public IAuthToken authenticate(IProfileAuthenticator authenticator,
-            HttpServletRequest request) throws EBaseException {
-        AuthCredentials credentials = new AuthCredentials();
-
-        // build credential
-        Enumeration<String> authNames = authenticator.getValueNames();
-
-        if (authNames != null) {
-            while (authNames.hasMoreElements()) {
-                String authName = authNames.nextElement();
+                ArgList requestlist = new ArgList();
 
-                credentials.set(authName, request.getParameter(authName));
+                for (IRequest req : reqs) {
+                    ArgSet requestset = new ArgSet();
+                    requestset.set(ARG_REQUEST_ID, req.getRequestId().toString());
+                    requestlist.add(requestset);
+                }
+                args.set(ARG_REQUEST_LIST, requestlist);
+                args.set(ARG_ERROR_CODE, errorCode);
+                args.set(ARG_ERROR_REASON, errorReason);
+                outputTemplate(request, response, args);
             }
+            return;
         }
 
-        credentials.set("clientHost", request.getRemoteHost());
-        IAuthToken authToken = authenticator.authenticate(credentials);
+        if (xmlOutput) {
+            xmlOutput(response, profile, locale, reqs);
+        } else {
+            ArgList outputlist = new ArgList();
+            for (int k = 0; k < reqs.length; k++) {
 
-        SessionContext sc = SessionContext.getContext();
-        if (sc != null) {
-            sc.put(SessionContext.AUTH_MANAGER_ID, authenticator.getName());
-            String userid = authToken.getInString(IAuthToken.USER_ID);
-            if (userid != null) {
-                sc.put(SessionContext.USER_ID, userid);
+                setOutputIntoArgs(profile, outputlist, locale, reqs[k]);
+                args.set(ARG_OUTPUT_LIST, outputlist);
             }
-        }
-
-        return authToken;
-    }
 
-    private void setInputsIntoRequest(HttpServletRequest request, IProfile profile, IRequest req) {
-        Enumeration<String> inputIds = profile.getProfileInputIds();
+            CMS.debug("ProfileSubmitServlet: done serving");
 
-        if (inputIds != null) {
-            while (inputIds.hasMoreElements()) {
-                String inputId = inputIds.nextElement();
-                IProfileInput profileInput = profile.getProfileInput(inputId);
-                Enumeration<String> inputNames = profileInput.getValueNames();
+            ArgList requestlist = new ArgList();
 
-                if (inputNames != null) {
-                    while (inputNames.hasMoreElements()) {
-                        String inputName = inputNames.nextElement();
+            for (int k = 0; k < reqs.length; k++) {
+                ArgSet requestset = new ArgSet();
 
-                        if (request.getParameter(inputName) != null) {
-                            // special characters in subject names parameters must be escaped
-                            if (inputName.matches("^sn_.*")) {
-                                req.setExtData(inputName, escapeValueRfc1779(request.getParameter(inputName), false)
-                                        .toString());
-                            } else {
-                                req.setExtData(inputName, request.getParameter(inputName));
-                            }
-                        }
-                    }
-                }
+                requestset.set(ARG_REQUEST_ID,
+                        reqs[k].getRequestId().toString());
+                requestlist.add(requestset);
             }
-        }
-    }
-
-    /*
-     * fill input info from orig request to the renew request.
-     * This is expected to be used by renewal where the request
-     * is retrieved from request record
-     */
-    private void setInputsIntoRequest(IRequest request, IProfile profile, IRequest req, Locale locale) {
-        // passing inputs into request
-        Enumeration<String> inputIds = profile.getProfileInputIds();
-
-        if (inputIds != null) {
-            while (inputIds.hasMoreElements()) {
-                String inputId = inputIds.nextElement();
-                IProfileInput profileInput = profile.getProfileInput(inputId);
-                Enumeration<String> inputNames = profileInput.getValueNames();
+            args.set(ARG_REQUEST_LIST, requestlist);
+            args.set(ARG_ERROR_CODE, "0");
+            args.set(ARG_ERROR_REASON, "");
 
-                while (inputNames.hasMoreElements()) {
-                    String inputName = inputNames.nextElement();
-                    String inputValue = "";
-                    CMS.debug("ProfileSubmitServlet: setInputsIntoRequest() getting input name= " + inputName);
-                    try {
-                        inputValue = profileInput.getValue(inputName, locale, request);
-                    } catch (Exception e) {
-                        CMS.debug("ProfileSubmitServlet: setInputsIntoRequest() getvalue() failed: " + e.toString());
-                    }
-
-                    if (inputValue != null) {
-                        CMS.debug("ProfileSubmitServlet: setInputsIntoRequest() setting value in ctx:" + inputValue);
-                        req.setExtData(inputName, inputValue);
-                    } else {
-                        CMS.debug("ProfileSubmitServlet: setInputsIntoRequest() value null");
-                    }
-                }
-            }
+            outputTemplate(request, response, args);
         }
-
     }
 
     private void setOutputIntoArgs(IProfile profile, ArgList outputlist, Locale locale, IRequest req) {
@@ -418,7 +225,7 @@ public class ProfileSubmitServlet extends ProfileServlet {
 
                         try {
                             outputValue = profileOutput.getValue(outputName,
-                                        locale, req);
+                                    locale, req);
                         } catch (EProfileException e) {
                             CMS.debug("ProfileSubmitServlet: " + e.toString());
                         }
@@ -435,26 +242,23 @@ public class ProfileSubmitServlet extends ProfileServlet {
         }
     }
 
-    /**
-     * Process the HTTP request
-     * <P>
-     *
-     * (Certificate Request Processed - either an automated "EE" profile based cert acceptance, or an automated "EE"
-     * profile based cert rejection)
-     * <P>
-     *
-     * <ul>
-     * <li>http.param profileId ID of profile to use to process request
-     * <li>signed.audit LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED used when a certificate request has just been
-     * through the approval process
-     * </ul>
-     *
-     * @param cmsReq the object holding the request and response information
-     * @exception EBaseException an error has occurred
-     */
-    public void process(CMSRequest cmsReq) throws EBaseException {
-        HttpServletRequest request = cmsReq.getHttpReq();
-        HttpServletResponse response = cmsReq.getHttpResp();
+    private void errorExit(HttpServletResponse response, boolean xmlOutput, String message, String requestId)
+            throws EBaseException {
+        if (xmlOutput) {
+            outputError(response, FAILED, message, requestId);
+        } else {
+            ArgSet args = new ArgSet();
+            args.set(ARG_ERROR_CODE, "1");
+            args.set(ARG_ERROR_REASON, message);
+            outputTemplate(xmlOutput, response, args);
+        }
+
+        for (String event : statEvents) {
+            endTiming(event);
+        }
+    }
+
+    private boolean getXMLOutput(HttpServletRequest request) {
         boolean xmlOutput = false;
 
         String v = request.getParameter("xml");
@@ -470,1002 +274,7 @@ public class ProfileSubmitServlet extends ProfileServlet {
         } else {
             CMS.debug("xmlOutput false");
         }
-
-        IStatsSubsystem statsSub = (IStatsSubsystem) CMS.getSubsystem("stats");
-        if (statsSub != null) {
-            statsSub.startTiming("enrollment", true /* main action */);
-        }
-
-        Locale locale = getLocale(request);
-        ArgSet args = new ArgSet();
-
-        if (CMS.debugOn()) {
-            CMS.debug("Start of ProfileSubmitServlet Input Parameters");
-            @SuppressWarnings("unchecked")
-            Enumeration<String> paramNames = request.getParameterNames();
-
-            while (paramNames.hasMoreElements()) {
-                String paramName = paramNames.nextElement();
-                // added this facility so that password can be hidden,
-                // all sensitive parameters should be prefixed with
-                // __ (double underscores); however, in the event that
-                // a security parameter slips through, we perform multiple
-                // additional checks to insure that it is NOT displayed
-                if (paramName.startsWith("__") ||
-                        paramName.endsWith("password") ||
-                        paramName.endsWith("passwd") ||
-                        paramName.endsWith("pwd") ||
-                        paramName.equalsIgnoreCase("admin_password_again") ||
-                        paramName.equalsIgnoreCase("directoryManagerPwd") ||
-                        paramName.equalsIgnoreCase("bindpassword") ||
-                        paramName.equalsIgnoreCase("bindpwd") ||
-                        paramName.equalsIgnoreCase("passwd") ||
-                        paramName.equalsIgnoreCase("password") ||
-                        paramName.equalsIgnoreCase("pin") ||
-                        paramName.equalsIgnoreCase("pwd") ||
-                        paramName.equalsIgnoreCase("pwdagain") ||
-                        paramName.equalsIgnoreCase("uPasswd")) {
-                    CMS.debug("ProfileSubmitServlet Input Parameter " +
-                              paramName + "='(sensitive)'");
-                } else {
-                    CMS.debug("ProfileSubmitServlet Input Parameter " +
-                              paramName + "='" +
-                              request.getParameter(paramName) + "'");
-                }
-            }
-            CMS.debug("End of ProfileSubmitServlet Input Parameters");
-        }
-
-        CMS.debug("ProfileSubmitServlet: start serving");
-
-        if (mProfileSubId == null || mProfileSubId.equals("")) {
-            mProfileSubId = IProfileSubsystem.ID;
-        }
-        CMS.debug("ProfileSubmitServlet: SubId=" + mProfileSubId);
-        IProfileSubsystem ps = (IProfileSubsystem)
-                CMS.getSubsystem(mProfileSubId);
-
-        if (ps == null) {
-            CMS.debug("ProfileSubmitServlet: ProfileSubsystem not found");
-            if (xmlOutput) {
-                outputError(response, CMS.getUserMessage(locale,
-                        "CMS_INTERNAL_ERROR"));
-            } else {
-                args.set(ARG_ERROR_CODE, "1");
-                args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                        "CMS_INTERNAL_ERROR"));
-                outputTemplate(request, response, args);
-            }
-            if (statsSub != null) {
-                statsSub.endTiming("enrollment");
-            }
-            return;
-        }
-
-        /*
-         * Renewal - Renewal is retrofitted into the Profile Enrollment
-         * Framework.  The authentication and authorization are taken from
-         * the renewal profile, while the input (with requests)  and grace
-         * period constraint are taken from the original cert's request record.
-         *
-         * Things to note:
-         * * the renew request will contain the original profile instead
-         *   of the new
-         * * there is no request for system and admin certs generated at
-         *   time of installation configuration.
-         */
-        String renewal = request.getParameter("renewal");
-        boolean isRenewal = false;
-        if ((renewal != null) && (renewal.equalsIgnoreCase("true"))) {
-            CMS.debug("ProfileSubmitServlet: isRenewal true");
-            isRenewal = true;
-            request.setAttribute("reqType", "renewal");
-        } else {
-            CMS.debug("ProfileSubmitServlet: isRenewal false");
-        }
-
-        String renewProfileId = null;
-        IRequest origReq = null;
-        Integer origSeqNum = 0;
-
-        // if we did not configure profileId in xml file,
-        // then accept the user-provided one
-        String profileId = null;
-
-        if (mProfileId == null) {
-            profileId = request.getParameter("profileId");
-        } else {
-            profileId = mProfileId;
-        }
-
-        CMS.debug("ProfileSubmitServlet: profileId " + profileId);
-        // This is the expiration date of the orig. cert that will
-        // be used in the RenewGracePeriodConstraint
-        Date origNotAfter = null;
-        String origSubjectDN = null;
-
-        if (isRenewal) {
-            // dig up the original request to "clone"
-            renewProfileId = profileId;
-            CMS.debug("ProfileSubmitServlet: renewProfileId =" + renewProfileId);
-            IAuthority authority = (IAuthority) CMS.getSubsystem(mAuthorityId);
-            if (authority == null) {
-                CMS.debug("ProfileSubmitServlet: renewal: Authority " + mAuthorityId +
-                        " not found");
-                args.set(ARG_ERROR_CODE, "1");
-                args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                        "CMS_INTERNAL_ERROR"));
-                outputTemplate(request, response, args);
-                return;
-            }
-            IRequestQueue queue = authority.getRequestQueue();
-
-            if (queue == null) {
-                CMS.debug("ProfileSubmitServlet: renewal: Request Queue of " +
-                        mAuthorityId + " not found");
-                args.set(ARG_ERROR_CODE, "1");
-                args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                        "CMS_INTERNAL_ERROR"));
-                outputTemplate(request, response, args);
-                return;
-            }
-
-            String serial = request.getParameter("serial_num");
-            BigInteger certSerial = null;
-            // if serial number is sent with request, then the authentication
-            // method is not ssl client auth.  In this case, an alternative
-            // authentication method is used (default: ldap based)
-            if (serial != null) {
-                CMS.debug("ProfileSubmitServlet: renewal: found serial_num");
-                certSerial = new BigInteger(serial);
-                // usr_origreq evaluator should be used to authorize ownership
-                // of the cert
-            } else {
-                CMS.debug("ProfileSubmitServlet: renewal: serial_num not found, must do ssl client auth");
-                // ssl client auth is to be used
-                // this is not authentication. Just use the cert to search
-                // for orig request and find the right profile
-                SSLClientCertProvider sslCCP = new SSLClientCertProvider(request);
-                X509Certificate[] certs = sslCCP.getClientCertificateChain();
-                certSerial = null;
-                if (certs == null || certs.length == 0) {
-                    CMS.debug("ProfileSubmitServlet: renewal: no ssl client cert chain");
-                    args.set(ARG_ERROR_CODE, "1");
-                    args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                            "CMS_INTERNAL_ERROR"));
-                    outputTemplate(request, response, args);
-                    return;
-                } else { // has ssl client cert
-                    CMS.debug("ProfileSubmitServlet: renewal: has ssl client cert chain");
-                    // shouldn't expect leaf cert to be always at the
-                    // same location
-                    X509Certificate clientCert = null;
-                    for (int i = 0; i < certs.length; i++) {
-                        clientCert = certs[i];
-                        byte[] extBytes = clientCert.getExtensionValue("2.5.29.19");
-                        // try to see if this is a leaf cert
-                        // look for BasicConstraint extension
-                        if (extBytes == null) {
-                            // found leaf cert
-                            CMS.debug("ProfileSubmitServlet: renewal: found leaf cert");
-                            break;
-                        } else {
-                            CMS.debug("ProfileSubmitServlet: renewal: found cert having BasicConstraints ext");
-                            // it's got BasicConstraints extension
-                            // so it's not likely to be a leaf cert,
-                            // however, check the isCA field regardless
-                            try {
-                                BasicConstraintsExtension bce =
-                                        new BasicConstraintsExtension(true, extBytes);
-                                if (bce != null) {
-                                    if (!(Boolean) bce.get("is_ca")) {
-                                        CMS.debug("ProfileSubmitServlet: renewal: found CA cert in chain");
-                                        break;
-                                    } // else found a ca cert, continue
-                                }
-                            } catch (Exception e) {
-                                CMS.debug("ProfileSubmitServlet: renewal: exception:" +
-                                        e.toString());
-                                args.set(ARG_ERROR_CODE, "1");
-                                args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                                        "CMS_INTERNAL_ERROR"));
-                                outputTemplate(request, response, args);
-                                return;
-                            }
-                        }
-                    }
-                    if (clientCert == null) {
-                        CMS.debug("ProfileSubmitServlet: renewal: no client cert in chain");
-                        args.set(ARG_ERROR_CODE, "1");
-                        args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                                "CMS_INTERNAL_ERROR"));
-                        outputTemplate(request, response, args);
-                        return;
-                    }
-                    // convert to java X509 cert interface
-                    try {
-                        byte[] certEncoded = clientCert.getEncoded();
-
-                        clientCert = new X509CertImpl(certEncoded);
-                    } catch (Exception e) {
-                        CMS.debug("ProfileSubmitServlet: renewal: exception:" + e.toString());
-                        args.set(ARG_ERROR_CODE, "1");
-                        args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                                "CMS_INTERNAL_ERROR"));
-                        outputTemplate(request, response, args);
-                        return;
-                    }
-
-                    certSerial = clientCert.getSerialNumber();
-                }
-            }
-
-            CMS.debug("ProfileSubmitServlet: renewal: serial number of cert to renew:" + certSerial.toString());
-
-            try {
-                ICertificateRepository certDB = null;
-                if (authority instanceof ICertificateAuthority) {
-                    certDB = ((ICertificateAuthority) authority).getCertificateRepository();
-                }
-                if (certDB == null) {
-                    args.set(ARG_ERROR_CODE, "1");
-                    args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                            "CMS_INTERNAL_ERROR"));
-                    outputTemplate(request, response, args);
-                    return;
-                }
-                ICertRecord rec = certDB.readCertificateRecord(certSerial);
-                if (rec == null) {
-                    CMS.debug("ProfileSubmitServlet: renewal cert record not found for serial number "
-                            + certSerial.toString());
-                    args.set(ARG_ERROR_CODE, "1");
-                    args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                            "CMS_INTERNAL_ERROR"));
-                    outputTemplate(request, response, args);
-                    return;
-                } else {
-                    CMS.debug("ProfileSubmitServlet: renewal cert record found for serial number:"
-                            + certSerial.toString());
-                    // check to see if the cert is revoked or revoked_expired
-                    if ((rec.getStatus().equals(ICertRecord.STATUS_REVOKED))
-                            || (rec.getStatus().equals(ICertRecord.STATUS_REVOKED_EXPIRED))) {
-                        CMS.debug("ProfileSubmitServlet: renewal cert found to be revoked. Serial number = "
-                                + certSerial.toString());
-                        args.set(ARG_ERROR_CODE, "1");
-                        args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                                "CMS_CA_CANNOT_RENEW_REVOKED_CERT", certSerial.toString()));
-                        outputTemplate(request, response, args);
-                        return;
-                    }
-                    MetaInfo metaInfo = (MetaInfo) rec.get(ICertRecord.ATTR_META_INFO);
-                    // note: CA's internal certs don't have request ids
-                    // so some other way needs to be done
-                    if (metaInfo != null) {
-                        String rid = (String) metaInfo.get(ICertRecord.META_REQUEST_ID);
-
-                        if (rid != null) {
-                            origReq = queue.findRequest(new RequestId(rid));
-                            if (origReq != null) {
-                                CMS.debug("ProfileSubmitServlet: renewal: found original enrollment request id:" + rid);
-                                // debug: print the extData keys
-                                /*
-                                Enumeration<String> en = origReq.getExtDataKeys();
-                                                                CMS.debug("ProfileSubmitServlet: renewal: origRequest extdata key print BEGINS");
-                                                                while (en.hasMoreElements()) {
-                                                                  String next = (String) en.nextElement();
-                                                                  CMS.debug("ProfileSubmitServlet: renewal: origRequest extdata key:"+ next);
-                                                                }
-                                                                CMS.debug("ProfileSubmitServlet: renewal: origRequest extdata key print ENDS");
-                                */
-                                String requestorE = origReq.getExtDataInString("requestor_email");
-                                CMS.debug("ProfileSubmitServlet: renewal original requestor email=" + requestorE);
-                                profileId = origReq.getExtDataInString("profileId");
-                                if (profileId != null)
-                                    CMS.debug("ProfileSubmitServlet: renewal original profileId=" + profileId);
-                                else {
-                                    CMS.debug("ProfileSubmitServlet: renewal original profileId not found");
-                                    args.set(ARG_ERROR_CODE, "1");
-                                    args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                                            "CMS_INTERNAL_ERROR"));
-                                    outputTemplate(request, response, args);
-                                    return;
-                                }
-                                origSeqNum = origReq.getExtDataInInteger(IEnrollProfile.REQUEST_SEQ_NUM);
-
-                            } else { //if origReq
-                                CMS.debug("ProfileSubmitServlet: renewal original request not found for request id "
-                                        + rid);
-                                args.set(ARG_ERROR_CODE, "1");
-                                args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                                        "CMS_INTERNAL_ERROR"));
-                                outputTemplate(request, response, args);
-                                return;
-                            }
-                        } else {
-                            CMS.debug("ProfileSubmitServlet: renewal: cert record locating request id in MetaInfo failed for serial number "
-                                    + certSerial.toString());
-                            CMS.debug("ProfileSubmitServlet: renewal: cert may be bootstrapped system cert during installation/configuration - no request record exists");
-                            args.set(ARG_ERROR_CODE, "1");
-                            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                                    "CMS_INTERNAL_ERROR" + ": original request not found"));
-                            outputTemplate(request, response, args);
-                            return;
-                        }
-                    } else {
-                        CMS.debug("ProfileSubmitServlet: renewal: cert record locating MetaInfo failed for serial number "
-                                + certSerial.toString());
-                        args.set(ARG_ERROR_CODE, "1");
-                        args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                                "CMS_INTERNAL_ERROR"));
-                        outputTemplate(request, response, args);
-                        return;
-                    }
-                    // get orig cert expiration date
-                    CMS.debug("ProfileSubmitServlet: renewal: before getting origNotAfter");
-                    X509CertImpl origCert = rec.getCertificate();
-                    origNotAfter = origCert.getNotAfter();
-                    CMS.debug("ProfileSubmitServlet: renewal: origNotAfter =" +
-                            origNotAfter.toString());
-                    origSubjectDN = origCert.getSubjectDN().getName();
-                    CMS.debug("ProfileSubmitServlet: renewal: orig subj dn =" +
-                            origSubjectDN);
-                }
-            } catch (Exception e) {
-                CMS.debug("ProfileSubmitServlet: renewal: exception:" + e.toString());
-                args.set(ARG_ERROR_CODE, "1");
-                args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                        "CMS_INTERNAL_ERROR"));
-                outputTemplate(request, response, args);
-                return;
-            }
-        } // end isRenewal
-
-        IProfile profile = null;
-        IProfile renewProfile = null;
-
-        try {
-            profile = ps.getProfile(profileId);
-            if (isRenewal) {
-                // in case of renew, "profile" is the orig profile
-                // while "renewProfile" is the current profile used for renewal
-                renewProfile = ps.getProfile(renewProfileId);
-            }
-        } catch (EProfileException e) {
-            if (profile == null) {
-                CMS.debug("ProfileSubmitServlet: profile not found profileId " +
-                        profileId + " " + e.toString());
-            }
-            if (renewProfile == null) {
-                CMS.debug("ProfileSubmitServlet: profile not found renewProfileId " +
-                        renewProfileId + " " + e.toString());
-            }
-        }
-        if (profile == null) {
-            if (xmlOutput) {
-                outputError(response, CMS.getUserMessage(locale, "CMS_PROFILE_NOT_FOUND", profileId));
-            } else {
-                args.set(ARG_ERROR_CODE, "1");
-                args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                        "CMS_PROFILE_NOT_FOUND", profileId));
-                outputTemplate(request, response, args);
-            }
-            return;
-        }
-        if (isRenewal && (renewProfile == null)) {
-            if (xmlOutput) {
-                outputError(response, CMS.getUserMessage(locale, "CMS_PROFILE_NOT_FOUND", renewProfileId));
-            } else {
-                args.set(ARG_ERROR_CODE, "1");
-                args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                        "CMS_PROFILE_NOT_FOUND", renewProfileId));
-                outputTemplate(request, response, args);
-            }
-            return;
-        }
-
-        if (!ps.isProfileEnable(profileId)) {
-            CMS.debug("ProfileSubmitServlet: Profile " + profileId +
-                    " not enabled");
-            if (xmlOutput) {
-                outputError(response, CMS.getUserMessage(locale, "CMS_PROFILE_NOT_FOUND", profileId));
-            } else {
-                args.set(ARG_ERROR_CODE, "1");
-                args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                        "CMS_PROFILE_NOT_FOUND", profileId));
-                outputTemplate(request, response, args);
-            }
-            if (statsSub != null) {
-                statsSub.endTiming("enrollment");
-            }
-            return;
-        }
-
-        if (isRenewal) {
-            if (!ps.isProfileEnable(renewProfileId)) {
-                CMS.debug("ProfileSubmitServlet: renewal Profile " + renewProfileId +
-                        " not enabled");
-                if (xmlOutput) {
-                    outputError(response, CMS.getUserMessage(locale, "CMS_PROFILE_NOT_FOUND", renewProfileId));
-                } else {
-                    args.set(ARG_ERROR_CODE, "1");
-                    args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                            "CMS_PROFILE_NOT_FOUND", renewProfileId));
-                    outputTemplate(request, response, args);
-                }
-                return;
-            }
-        }
-
-        IProfileContext ctx = profile.createContext();
-        // passing auths into context
-        IProfileAuthenticator authenticator = null;
-        IProfileAuthenticator origAuthenticator = null;
-
-        try {
-            if (isRenewal) {
-                authenticator = renewProfile.getAuthenticator();
-                origAuthenticator = profile.getAuthenticator();
-            } else {
-                authenticator = profile.getAuthenticator();
-            }
-        } catch (EProfileException e) {
-            // authenticator not installed correctly
-            CMS.debug("ProfileSubmitServlet: renewal: exception:" + e.toString());
-            args.set(ARG_ERROR_CODE, "1");
-            args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                    "CMS_INTERNAL_ERROR"));
-            outputTemplate(request, response, args);
-            return;
-        }
-        if (authenticator == null) {
-            CMS.debug("ProfileSubmitServlet: authenticator not found");
-        } else {
-            CMS.debug("ProfileSubmitServlet: authenticator " +
-                    authenticator.getName() + " found");
-            setCredentialsIntoContext(request, authenticator, ctx);
-        }
-
-        // for renewal, this will override or add auth info to the profile context
-        if (isRenewal) {
-            if (origAuthenticator != null) {
-                CMS.debug("ProfileSubmitServlet: for renewal, original authenticator " +
-                        origAuthenticator.getName() + " found");
-                setCredentialsIntoContext(request, origAuthenticator, ctx);
-            } else {
-                CMS.debug("ProfileSubmitServlet: for renewal, original authenticator not found");
-            }
-        }
-
-        CMS.debug("ProfileSubmistServlet: set Inputs into profile Context");
-        if (isRenewal) {
-            // for renewal, input needs to be retrieved from the orig req record
-            CMS.debug("ProfileSubmitServlet: set original Inputs into profile Context");
-            setInputsIntoContext(origReq, profile, ctx, locale);
-            ctx.set(IEnrollProfile.CTX_RENEWAL, "true");
-            ctx.set("renewProfileId", renewProfileId);
-            ctx.set(IEnrollProfile.CTX_RENEWAL_SEQ_NUM, origSeqNum.toString());
-        } else {
-            setInputsIntoContext(request, profile, ctx);
-        }
-
-        // before creating the request, authenticate the request
-
-        IAuthToken authToken = null;
-
-        // for ssl authentication; pass in servlet for retrieving
-        // ssl client certificates
-        SessionContext context = SessionContext.getContext();
-
-        // insert profile context so that input parameter can be retrieved
-        context.put("profileContext", ctx);
-        context.put("sslClientCertProvider",
-                new SSLClientCertProvider(request));
-        CMS.debug("ProfileSubmitServlet: set sslClientCertProvider");
-        if ((isRenewal == true) && (origSubjectDN != null))
-            context.put("origSubjectDN", origSubjectDN);
-        if (statsSub != null) {
-            statsSub.startTiming("profile_authentication");
-        }
-
-        if (authenticator != null) {
-
-            CMS.debug("ProfileSubmitServlet: authentication required.");
-            String uid_cred = "Unidentified";
-            String uid_attempted_cred = "Unidentified";
-            Enumeration<String> authIds = authenticator.getValueNames();
-            //Attempt to possibly fetch attemped uid, may not always be available.
-            if (authIds != null) {
-                while (authIds.hasMoreElements()) {
-                    String authName = authIds.nextElement();
-                    String value = request.getParameter(authName);
-                    if (value != null) {
-                        if (authName.equals("uid")) {
-                            uid_attempted_cred = value;
-                        }
-                    }
-                }
-            }
-
-            String authSubjectID = auditSubjectID();
-
-            String authMgrID = authenticator.getName();
-            String auditMessage = null;
-            try {
-                if (isRenewal) {
-                    CMS.debug("ProfileSubmitServlet: renewal authenticate begins");
-                    authToken = authenticate(authenticator, request, origReq, context);
-                    CMS.debug("ProfileSubmitServlet: renewal authenticate ends");
-                } else {
-                    authToken = authenticate(authenticator, request);
-                }
-            } catch (EBaseException e) {
-                CMS.debug("ProfileSubmitServlet: authentication error " +
-                        e.toString());
-                // authentication error
-                if (xmlOutput) {
-                    outputError(response, CMS.getUserMessage(locale, "CMS_AUTHENTICATION_ERROR"));
-                } else {
-                    args.set(ARG_ERROR_CODE, "1");
-                    args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                            "CMS_AUTHENTICATION_ERROR"));
-                    outputTemplate(request, response, args);
-                }
-                if (statsSub != null) {
-                    statsSub.endTiming("authentication");
-                }
-                if (statsSub != null) {
-                    statsSub.endTiming("enrollment");
-                }
-
-                //audit log our authentication failure
-
-                authSubjectID += " : " + uid_cred;
-                auditMessage = CMS.getLogMessage(
-                        LOGGING_SIGNED_AUDIT_AUTH_FAIL,
-                        authSubjectID,
-                        ILogger.FAILURE,
-                        authMgrID,
-                        uid_attempted_cred);
-                audit(auditMessage);
-
-                return;
-            }
-
-            //Log successful authentication
-
-            //Attempt to get uid from authToken, most tokens respond to the "uid" cred.
-            uid_cred = authToken.getInString("uid");
-
-            if (uid_cred == null || uid_cred.length() == 0) {
-                uid_cred = "Unidentified";
-            }
-
-            authSubjectID = authSubjectID + " : " + uid_cred;
-
-            // store a message in the signed audit log file
-            auditMessage = CMS.getLogMessage(
-                        LOGGING_SIGNED_AUDIT_AUTH_SUCCESS,
-                        authSubjectID,
-                        ILogger.SUCCESS,
-                        authMgrID);
-
-            audit(auditMessage);
-
-        }
-        if (statsSub != null) {
-            statsSub.endTiming("profile_authentication");
-        }
-
-        // authentication success
-        if (authToken != null) {
-            CMS.debug("ProfileSubmitServlet authToken not null");
-            // do profile authorization
-            String acl = null;
-            if (isRenewal)
-                acl = renewProfile.getAuthzAcl();
-            else
-                acl = profile.getAuthzAcl();
-            CMS.debug("ProfileSubmitServlet: authz using acl: " + acl);
-            if (acl != null && acl.length() > 0) {
-                try {
-                    String resource = profileId + ".authz.acl";
-                    authorize(mAclMethod, resource, authToken, acl);
-                } catch (Exception e) {
-                    CMS.debug("ProfileSubmitServlet authorize: " + e.toString());
-                    if (xmlOutput) {
-                        outputError(response, CMS.getUserMessage(locale,
-                                "CMS_AUTHORIZATION_ERROR"));
-                    } else {
-                        args.set(ARG_ERROR_CODE, "1");
-                        args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                                "CMS_AUTHORIZATION_ERROR"));
-                        outputTemplate(request, response, args);
-                    }
-
-                    return;
-                }
-            }
-        }
-
-        IRequest reqs[] = null;
-
-        if (statsSub != null) {
-            statsSub.startTiming("request_population");
-        }
-        ///////////////////////////////////////////////
-        // create request
-        ///////////////////////////////////////////////
-        try {
-            reqs = profile.createRequests(ctx, locale);
-        } catch (EProfileException e) {
-            CMS.debug(e);
-            CMS.debug("ProfileSubmitServlet: createRequests " + e.toString());
-            if (xmlOutput) {
-                outputError(response, e.toString());
-            } else {
-                args.set(ARG_ERROR_CODE, "1");
-                args.set(ARG_ERROR_REASON, e.toString());
-                outputTemplate(request, response, args);
-            }
-            if (statsSub != null) {
-                statsSub.endTiming("request_population");
-                statsSub.endTiming("enrollment");
-            }
-            return;
-        } catch (Throwable e) {
-            CMS.debug(e);
-            CMS.debug("ProfileSubmitServlet: createRequests " + e.toString());
-            if (xmlOutput) {
-                outputError(response, CMS.getUserMessage(locale, "CMS_INTERNAL_ERROR"));
-            } else {
-                args.set(ARG_ERROR_CODE, "1");
-                args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                        "CMS_INTERNAL_ERROR"));
-                outputTemplate(request, response, args);
-            }
-            if (statsSub != null) {
-                statsSub.endTiming("request_population");
-                statsSub.endTiming("enrollment");
-            }
-            return;
-        }
-
-        String errorCode = null;
-        String errorReason = null;
-
-        ///////////////////////////////////////////////
-        // populate request
-        ///////////////////////////////////////////////
-        for (int k = 0; k < reqs.length; k++) {
-            boolean fromRA = false;
-            String uid = "";
-
-            // adding parameters to request
-            if (isRenewal) {
-                setInputsIntoRequest(origReq, profile, reqs[k], locale);
-                // set orig expiration date to be used in Validity constraint
-                reqs[k].setExtData("origNotAfter",
-                        BigInteger.valueOf(origNotAfter.getTime()));
-                // set subjectDN to be used in subject name default
-                reqs[k].setExtData(IProfileAuthenticator.AUTHENTICATED_NAME, origSubjectDN);
-                // set request type
-                reqs[k].setRequestType("renewal");
-            } else
-                setInputsIntoRequest(request, profile, reqs[k]);
-
-            // serial auth token into request
-            if (authToken != null) {
-                Enumeration<String> tokenNames = authToken.getElements();
-                while (tokenNames.hasMoreElements()) {
-                    String tokenName = tokenNames.nextElement();
-                    String[] tokenVals = authToken.getInStringArray(tokenName);
-                    if (tokenVals != null) {
-                        for (int i = 0; i < tokenVals.length; i++) {
-                            reqs[k].setExtData(ARG_AUTH_TOKEN + "." +
-                                    tokenName + "[" + i + "]", tokenVals[i]);
-                        }
-                    } else {
-                        String tokenVal = authToken.getInString(tokenName);
-                        if (tokenVal != null) {
-                            reqs[k].setExtData(ARG_AUTH_TOKEN + "." + tokenName,
-                                    tokenVal);
-                            // if RA agent, auto assign the request
-                            if (tokenName.equals("uid"))
-                                uid = tokenVal;
-                            if (tokenName.equals("group") &&
-                                    tokenVal.equals("Registration Manager Agents")) {
-                                fromRA = true;
-                            }
-                        }
-                    }
-                }
-            }
-
-            if (fromRA) {
-                CMS.debug("ProfileSubmitServlet: request from RA: " + uid);
-                reqs[k].setExtData(ARG_REQUEST_OWNER, uid);
-            }
-
-            // put profile framework parameters into the request
-            reqs[k].setExtData(ARG_PROFILE, "true");
-            reqs[k].setExtData(ARG_PROFILE_ID, profileId);
-            if (isRenewal)
-                reqs[k].setExtData(ARG_RENEWAL_PROFILE_ID, request.getParameter("profileId"));
-            reqs[k].setExtData(ARG_PROFILE_APPROVED_BY, profile.getApprovedBy());
-            String setId = profile.getPolicySetId(reqs[k]);
-
-            if (setId == null) {
-                // no profile set found
-                CMS.debug("ProfileSubmitServlet: no profile policy set found");
-                if (xmlOutput) {
-                    outputError(response, FAILED, CMS.getUserMessage("CMS_PROFILE_NO_POLICY_SET_FOUND"),
-                            reqs[k].getRequestId().toString());
-                } else {
-                    args.set(ARG_ERROR_CODE, "1");
-                    args.set(ARG_ERROR_REASON,
-                            CMS.getUserMessage("CMS_PROFILE_NO_POLICY_SET_FOUND"));
-                    outputTemplate(request, response, args);
-                }
-                if (statsSub != null) {
-                    statsSub.endTiming("request_population");
-                    statsSub.endTiming("enrollment");
-                }
-                return;
-            }
-
-            CMS.debug("ProfileSubmitServlet profileSetid=" + setId);
-            reqs[k].setExtData(ARG_PROFILE_SET_ID, setId);
-            reqs[k].setExtData(ARG_PROFILE_REMOTE_HOST, request.getRemoteHost());
-            reqs[k].setExtData(ARG_PROFILE_REMOTE_ADDR, request.getRemoteAddr());
-
-            CMS.debug("ProfileSubmitServlet: request " +
-                    reqs[k].getRequestId().toString());
-
-            try {
-                CMS.debug("ProfileSubmitServlet: populating request inputs");
-                // give authenticator a chance to populate the request
-                if (authenticator != null) {
-                    authenticator.populate(authToken, reqs[k]);
-                }
-                profile.populateInput(ctx, reqs[k]);
-                profile.populate(reqs[k]);
-            } catch (EProfileException e) {
-                CMS.debug("ProfileSubmitServlet: populate " + e.toString());
-                if (xmlOutput) {
-                    outputError(response, FAILED, e.toString(), reqs[k].getRequestId().toString());
-                } else {
-                    args.set(ARG_ERROR_CODE, "1");
-                    args.set(ARG_ERROR_REASON, e.toString());
-                    outputTemplate(request, response, args);
-                }
-                if (statsSub != null) {
-                    statsSub.endTiming("request_population");
-                    statsSub.endTiming("enrollment");
-                }
-                return;
-            } catch (Throwable e) {
-                CMS.debug("ProfileSubmitServlet: populate " + e.toString());
-                //  throw new IOException("Profile " + profileId +
-                //          " cannot populate");
-                if (xmlOutput) {
-                    outputError(response, FAILED, CMS.getUserMessage(locale, "CMS_INTERNAL_ERROR"),
-                            reqs[k].getRequestId().toString());
-                } else {
-                    args.set(ARG_ERROR_CODE, "1");
-                    args.set(ARG_ERROR_REASON, CMS.getUserMessage(locale,
-                            "CMS_INTERNAL_ERROR"));
-                    outputTemplate(request, response, args);
-                }
-                if (statsSub != null) {
-                    statsSub.endTiming("request_population");
-                    statsSub.endTiming("enrollment");
-                }
-                return;
-            }
-        }
-        if (statsSub != null) {
-            statsSub.endTiming("request_population");
-        }
-
-        String auditMessage = null;
-        String auditSubjectID = auditSubjectID();
-        String auditRequesterID = ILogger.UNIDENTIFIED;
-        String auditInfoCertValue = ILogger.SIGNED_AUDIT_EMPTY_VALUE;
-
-        try {
-            ///////////////////////////////////////////////
-            // submit request
-            ///////////////////////////////////////////////
-            String requestIds = ""; // deliminated with double space
-            for (int k = 0; k < reqs.length; k++) {
-                try {
-                    // reset the "auditRequesterID"
-                    auditRequesterID = auditRequesterID(reqs[k]);
-
-                    // print request debug
-                    if (reqs[k] != null) {
-                        requestIds += "  " + reqs[k].getRequestId().toString();
-                        Enumeration<String> reqKeys = reqs[k].getExtDataKeys();
-                        while (reqKeys.hasMoreElements()) {
-                            String reqKey = reqKeys.nextElement();
-                            String reqVal = reqs[k].getExtDataInString(reqKey);
-                            if (reqVal != null) {
-                                CMS.debug("ProfileSubmitServlet: key=$request." + reqKey + "$ value=" + reqVal);
-                            }
-                        }
-                    }
-
-                    profile.submit(authToken, reqs[k]);
-                    reqs[k].setRequestStatus(RequestStatus.COMPLETE);
-
-                    // reset the "auditInfoCertValue"
-                    auditInfoCertValue = auditInfoCertValue(reqs[k]);
-
-                    if (auditInfoCertValue != null) {
-                        if (!(auditInfoCertValue.equals(
-                                    ILogger.SIGNED_AUDIT_EMPTY_VALUE))) {
-                            // store a message in the signed audit log file
-                            auditMessage = CMS.getLogMessage(
-                                        LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED,
-                                        auditSubjectID,
-                                        ILogger.SUCCESS,
-                                        auditRequesterID,
-                                        ILogger.SIGNED_AUDIT_ACCEPTANCE,
-                                        auditInfoCertValue);
-
-                            audit(auditMessage);
-                        }
-                    }
-                } catch (EDeferException e) {
-                    // return defer message to the user
-                    reqs[k].setRequestStatus(RequestStatus.PENDING);
-                    // need to notify
-                    INotify notify = profile.getRequestQueue().getPendingNotify();
-                    if (notify != null) {
-                        notify.notify(reqs[k]);
-                    }
-
-                    CMS.debug("ProfileSubmitServlet: submit " + e.toString());
-                    errorCode = "2";
-                    errorReason = CMS.getUserMessage(locale,
-                                "CMS_PROFILE_DEFERRED",
-                                e.toString());
-                } catch (ERejectException e) {
-                    // return error to the user
-                    reqs[k].setRequestStatus(RequestStatus.REJECTED);
-                    CMS.debug("ProfileSubmitServlet: submit " + e.toString());
-                    errorCode = "3";
-                    errorReason = CMS.getUserMessage(locale,
-                                "CMS_PROFILE_REJECTED",
-                                e.toString());
-                } catch (Throwable e) {
-                    // return error to the user
-                    CMS.debug("ProfileSubmitServlet: submit " + e.toString());
-                    errorCode = "1";
-                    errorReason = CMS.getUserMessage(locale,
-                                "CMS_INTERNAL_ERROR");
-                }
-
-                try {
-                    if (errorCode == null) {
-                        profile.getRequestQueue().markAsServiced(reqs[k]);
-                    } else {
-                        profile.getRequestQueue().updateRequest(reqs[k]);
-                    }
-                } catch (EBaseException e) {
-                    CMS.debug("ProfileSubmitServlet: updateRequest " +
-                            e.toString());
-                }
-
-                if (errorCode != null) {
-                    if (errorCode.equals("1")) {
-                        // store a message in the signed audit log file
-                        auditMessage = CMS.getLogMessage(
-                                    LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED,
-                                    auditSubjectID,
-                                    ILogger.FAILURE,
-                                    auditRequesterID,
-                                    ILogger.SIGNED_AUDIT_REJECTION,
-                                    errorReason);
-
-                        audit(auditMessage);
-                    } else if (errorCode.equals("2")) {
-                        // do NOT store a message in the signed audit log file
-                        // as this errorCode indicates that a process has been
-                        // deferred for manual acceptance/cancellation/rejection
-                    } else if (errorCode.equals("3")) {
-                        // store a message in the signed audit log file
-                        auditMessage = CMS.getLogMessage(
-                                    LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED,
-                                    auditSubjectID,
-                                    ILogger.FAILURE,
-                                    auditRequesterID,
-                                    ILogger.SIGNED_AUDIT_REJECTION,
-                                    errorReason);
-
-                        audit(auditMessage);
-                    }
-                }
-            }
-
-            if (errorCode != null) {
-                if (xmlOutput) {
-                    // when errorCode is not null, requestIds should have >=1
-                    outputError(response, errorCode, errorReason, requestIds);
-                } else {
-                    ArgList requestlist = new ArgList();
-
-                    for (int k = 0; k < reqs.length; k++) {
-                        ArgSet requestset = new ArgSet();
-
-                        requestset.set(ARG_REQUEST_ID,
-                                reqs[k].getRequestId().toString());
-                        requestlist.add(requestset);
-                    }
-                    args.set(ARG_REQUEST_LIST, requestlist);
-                    args.set(ARG_ERROR_CODE, errorCode);
-                    args.set(ARG_ERROR_REASON, errorReason);
-                    outputTemplate(request, response, args);
-                }
-                if (statsSub != null) {
-                    statsSub.endTiming("enrollment");
-                }
-                return;
-            }
-
-            ///////////////////////////////////////////////
-            // output output list
-            ///////////////////////////////////////////////
-            if (xmlOutput) {
-                xmlOutput(response, profile, locale, reqs);
-            } else {
-                ArgList outputlist = new ArgList();
-                for (int k = 0; k < reqs.length; k++) {
-
-                    setOutputIntoArgs(profile, outputlist, locale, reqs[k]);
-                    args.set(ARG_OUTPUT_LIST, outputlist);
-                }
-
-                CMS.debug("ProfileSubmitServlet: done serving");
-
-                ArgList requestlist = new ArgList();
-
-                for (int k = 0; k < reqs.length; k++) {
-                    ArgSet requestset = new ArgSet();
-
-                    requestset.set(ARG_REQUEST_ID,
-                            reqs[k].getRequestId().toString());
-                    requestlist.add(requestset);
-                }
-                args.set(ARG_REQUEST_LIST, requestlist);
-                args.set(ARG_ERROR_CODE, "0");
-                args.set(ARG_ERROR_REASON, "");
-
-                outputTemplate(request, response, args);
-            }
-        } catch (EBaseException eAudit1) {
-            // store a message in the signed audit log file
-            // (automated cert request processed - "rejected")
-            auditMessage = CMS.getLogMessage(
-                        LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED,
-                        auditSubjectID,
-                        ILogger.FAILURE,
-                        auditRequesterID,
-                        ILogger.SIGNED_AUDIT_REJECTION,
-                        SIGNED_AUDIT_AUTOMATED_REJECTION_REASON[0]);
-
-            audit(auditMessage);
-
-            if (statsSub != null) {
-                statsSub.endTiming("enrollment");
-            }
-            throw eAudit1;
-        } finally {
-            SessionContext.releaseContext();
-        }
-        if (statsSub != null) {
-            statsSub.endTiming("enrollment");
-        }
+        return xmlOutput;
     }
 
     private void xmlOutput(HttpServletResponse httpResp, IProfile profile, Locale locale, IRequest[] reqs) {
@@ -1535,96 +344,4 @@ public class ProfileSubmitServlet extends ProfileServlet {
         }
     }
 
-    /**
-     * Signed Audit Log Requester ID
-     *
-     * This method is called to obtain the "RequesterID" for
-     * a signed audit log message.
-     * <P>
-     *
-     * @param request the actual request
-     * @return id string containing the signed audit log message RequesterID
-     */
-    private String auditRequesterID(IRequest request) {
-        // if no signed audit object exists, bail
-        if (mSignedAuditLogger == null) {
-            return null;
-        }
-
-        String requesterID = ILogger.UNIDENTIFIED;
-
-        if (request != null) {
-            // overwrite "requesterID" if and only if "id" != null
-            String id = request.getRequestId().toString();
-
-            if (id != null) {
-                requesterID = id.trim();
-            }
-        }
-
-        return requesterID;
-    }
-
-    /**
-     * Signed Audit Log Info Certificate Value
-     *
-     * This method is called to obtain the certificate from the passed in
-     * "X509CertImpl" for a signed audit log message.
-     * <P>
-     *
-     * @param request request containing an X509CertImpl
-     * @return cert string containing the certificate
-     */
-    private String auditInfoCertValue(IRequest request) {
-        // if no signed audit object exists, bail
-        if (mSignedAuditLogger == null) {
-            return null;
-        }
-
-        X509CertImpl x509cert = request.getExtDataInCert(
-                IEnrollProfile.REQUEST_ISSUED_CERT);
-
-        if (x509cert == null) {
-            return ILogger.SIGNED_AUDIT_EMPTY_VALUE;
-        }
-
-        byte rawData[] = null;
-
-        try {
-            rawData = x509cert.getEncoded();
-        } catch (CertificateEncodingException e) {
-            return ILogger.SIGNED_AUDIT_EMPTY_VALUE;
-        }
-
-        String cert = null;
-
-        // convert "rawData" into "base64Data"
-        if (rawData != null) {
-            String base64Data = null;
-
-            base64Data = Utils.base64encode(rawData).trim();
-
-            // extract all line separators from the "base64Data"
-            StringBuffer sb = new StringBuffer();
-            for (int i = 0; i < base64Data.length(); i++) {
-                if (!Character.isWhitespace(base64Data.charAt(i))) {
-                    sb.append(base64Data.charAt(i));
-
-                }
-            }
-            cert = sb.toString();
-        }
-
-        if (cert != null) {
-            cert = cert.trim();
-
-            if (cert.equals("")) {
-                return ILogger.SIGNED_AUDIT_EMPTY_VALUE;
-            } else {
-                return cert;
-            }
-        } else {
-            return ILogger.SIGNED_AUDIT_EMPTY_VALUE;
-        }
-    }
 }
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/PolicyConstraint.java b/base/common/src/com/netscape/cms/servlet/profile/model/PolicyConstraint.java
new file mode 100644
index 000000000..588431a83
--- /dev/null
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/PolicyConstraint.java
@@ -0,0 +1,73 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+package com.netscape.cms.servlet.profile.model;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAttribute;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlRootElement;
+
+@XmlRootElement
+@XmlAccessorType(XmlAccessType.FIELD)
+public class PolicyConstraint {
+    @XmlAttribute(name="id")
+    private String name;
+
+    @XmlElement(name="description")
+    private String text;
+
+    @XmlElement(name = "constraint")
+    private List<PolicyConstraintValue> constraints = new ArrayList<PolicyConstraintValue>();
+
+    public PolicyConstraint() {
+        // required for jaxb
+    }
+
+    public void addConstraint(PolicyConstraintValue constraint) {
+        constraints.add(constraint);
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getText() {
+        return text;
+    }
+
+    public void setText(String text) {
+        this.text = text;
+    }
+
+    public List<PolicyConstraintValue> getConstraints() {
+        return constraints;
+    }
+
+    public void setConstraints(List<PolicyConstraintValue> constraints) {
+        this.constraints = constraints;
+    }
+
+}
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/PolicyConstraintFactory.java b/base/common/src/com/netscape/cms/servlet/profile/model/PolicyConstraintFactory.java
new file mode 100644
index 000000000..bd361a752
--- /dev/null
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/PolicyConstraintFactory.java
@@ -0,0 +1,42 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+package com.netscape.cms.servlet.profile.model;
+
+import java.util.Enumeration;
+import java.util.Locale;
+
+import com.netscape.certsrv.profile.IPolicyConstraint;
+import com.netscape.certsrv.property.Descriptor;
+
+public class PolicyConstraintFactory {
+
+    public static PolicyConstraint create(Locale locale, IPolicyConstraint cons) {
+        PolicyConstraint ret = new PolicyConstraint();
+        ret.setName(cons.getName(locale));
+        ret.setText(cons.getText(locale));
+
+        Enumeration<String> conNames = cons.getConfigNames();
+        while (conNames.hasMoreElements()) {
+            String conName = conNames.nextElement();
+            PolicyConstraintValue dataVal =
+                    new PolicyConstraintValue(conName, (Descriptor) cons.getConfigDescriptor(locale, conName));
+            ret.addConstraint(dataVal);
+        }
+        return ret;
+    }
+}
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/PolicyConstraintValue.java b/base/common/src/com/netscape/cms/servlet/profile/model/PolicyConstraintValue.java
new file mode 100644
index 000000000..7b60e7ea6
--- /dev/null
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/PolicyConstraintValue.java
@@ -0,0 +1,61 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+package com.netscape.cms.servlet.profile.model;
+
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAttribute;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlRootElement;
+
+import com.netscape.certsrv.property.Descriptor;
+
+@XmlRootElement
+@XmlAccessorType(XmlAccessType.FIELD)
+public class PolicyConstraintValue {
+    @XmlAttribute(name="id")
+    private String name;
+
+    @XmlElement
+    private Descriptor descriptor;
+
+    public PolicyConstraintValue() {
+        // required for jax-b
+    }
+
+    public PolicyConstraintValue(String name, Descriptor descriptor) {
+        this.name = name;
+        this.descriptor = descriptor;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public Descriptor getDescriptor() {
+        return descriptor;
+    }
+
+    public void setDescriptor(Descriptor descriptor) {
+        this.descriptor = descriptor;
+    }
+}
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/PolicyDefault.java b/base/common/src/com/netscape/cms/servlet/profile/model/PolicyDefault.java
new file mode 100644
index 000000000..2c66fc9dc
--- /dev/null
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/PolicyDefault.java
@@ -0,0 +1,73 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+package com.netscape.cms.servlet.profile.model;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAttribute;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlRootElement;
+
+@XmlRootElement
+@XmlAccessorType(XmlAccessType.FIELD)
+public class PolicyDefault {
+    @XmlAttribute(name="id")
+    private String name;
+
+    @XmlElement(name="description")
+    private String text;
+
+    @XmlElement(name="policyAttribute")
+    private List<ProfileAttribute> attributes = new ArrayList<ProfileAttribute>();
+
+    public PolicyDefault() {
+        // required for jaxb
+    }
+
+    public void addAttribute(ProfileAttribute attr) {
+        attributes.add(attr);
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getText() {
+        return text;
+    }
+
+    public void setText(String text) {
+        this.text = text;
+    }
+
+    public List<ProfileAttribute> getAttributes() {
+        return attributes;
+    }
+
+    public void setAttributes(List<ProfileAttribute> attributes) {
+        this.attributes = attributes;
+    }
+
+}
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/PolicyDefaultFactory.java b/base/common/src/com/netscape/cms/servlet/profile/model/PolicyDefaultFactory.java
new file mode 100644
index 000000000..6b9379f0b
--- /dev/null
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/PolicyDefaultFactory.java
@@ -0,0 +1,65 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+package com.netscape.cms.servlet.profile.model;
+
+import java.util.Enumeration;
+import java.util.Locale;
+
+import com.netscape.certsrv.base.IArgBlock;
+import com.netscape.certsrv.profile.IPolicyDefault;
+import com.netscape.certsrv.property.Descriptor;
+import com.netscape.certsrv.property.EPropertyException;
+import com.netscape.certsrv.request.IRequest;
+
+public class PolicyDefaultFactory {
+
+    public static PolicyDefault create(IRequest request, Locale locale, IPolicyDefault def) throws EPropertyException {
+        PolicyDefault ret = new PolicyDefault();
+        ret.setName(def.getName(locale));
+        ret.setText(def.getText(locale));
+
+        Enumeration<String> defNames  = def.getValueNames();
+        while (defNames.hasMoreElements()) {
+            String defName = defNames.nextElement();
+            ProfileAttribute attr = new ProfileAttribute(
+                    defName,
+                    def.getValue(defName, locale, request),
+                    (Descriptor) def.getValueDescriptor(locale, defName));
+            ret.addAttribute(attr);
+        }
+        return ret;
+    }
+
+    public static PolicyDefault create(IArgBlock params, Locale locale, IPolicyDefault def) throws EPropertyException {
+        PolicyDefault ret = new PolicyDefault();
+        ret.setName(def.getName(locale));
+        ret.setText(def.getText(locale));
+
+        Enumeration<String> defNames  = def.getValueNames();
+        while (defNames.hasMoreElements()) {
+            String defName = defNames.nextElement();
+            ProfileAttribute attr = new ProfileAttribute(
+                    defName,
+                    params.getValueAsString(defName, ""),
+                    (Descriptor) def.getValueDescriptor(locale, defName));
+            ret.addAttribute(attr);
+        }
+        return ret;
+    }
+
+}
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/ProfileAttribute.java b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileAttribute.java
new file mode 100644
index 000000000..616c0695d
--- /dev/null
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileAttribute.java
@@ -0,0 +1,80 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2012 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+package com.netscape.cms.servlet.profile.model;
+
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAttribute;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlRootElement;
+
+import com.netscape.certsrv.property.Descriptor;
+
+@XmlRootElement
+@XmlAccessorType(XmlAccessType.FIELD)
+public class ProfileAttribute {
+
+    @XmlAttribute
+    private String name;
+
+    @XmlElement
+    private String value;
+
+    @XmlElement
+    private Descriptor descriptor;
+
+    public ProfileAttribute() {
+        // required for jax-b
+    }
+
+    public ProfileAttribute(String name, String value, Descriptor descriptor) {
+        this.name = name;
+        this.value = value;
+        this.descriptor = descriptor;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+    public Descriptor getDescriptor() {
+        return descriptor;
+    }
+
+    public void setDescriptor(Descriptor descriptor) {
+        this.descriptor = descriptor;
+    }
+
+    @Override
+    public String toString() {
+        return "PolicyAttribute [name=" + name + ", value=" + value + ", descriptor=" + descriptor + "]";
+    }
+
+}
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/ProfileData.java b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileData.java
index 22a59c470..7f7f26b29 100644
--- a/base/common/src/com/netscape/cms/servlet/profile/model/ProfileData.java
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileData.java
@@ -41,6 +41,7 @@ public class ProfileData {
 
     @XmlElement
     protected String id;
+
     @XmlElement
     protected String name;
 
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/ProfileDataInfo.java b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileDataInfo.java
index 63f005b54..d5083c7a4 100644
--- a/base/common/src/com/netscape/cms/servlet/profile/model/ProfileDataInfo.java
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileDataInfo.java
@@ -1,5 +1,3 @@
-package com.netscape.cms.servlet.profile.model;
-
 //--- BEGIN COPYRIGHT BLOCK ---
 //This program is free software; you can redistribute it and/or modify
 //it under the terms of the GNU General Public License as published by
@@ -17,18 +15,16 @@ package com.netscape.cms.servlet.profile.model;
 //(C) 2011 Red Hat, Inc.
 //All rights reserved.
 //--- END COPYRIGHT BLOCK ---
-/**
- * 
- */
 
+package com.netscape.cms.servlet.profile.model;
 import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
 import javax.xml.bind.annotation.XmlElement;
 import javax.xml.bind.annotation.XmlRootElement;
-import javax.xml.bind.annotation.XmlAccessorType;
 
 /**
  * @author alee
- * 
+ *
  */
 @XmlRootElement(name = "ProfileDataInfo")
 @XmlAccessorType(XmlAccessType.FIELD)
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/ProfileInput.java b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileInput.java
index a0aea9fd4..631a013cc 100644
--- a/base/common/src/com/netscape/cms/servlet/profile/model/ProfileInput.java
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileInput.java
@@ -30,12 +30,17 @@ import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
 
 public class ProfileInput {
 
+    public ProfileInput() {
+        // required for jaxb
+    }
+
     @XmlElement
     public String getInputId() {
         return inputId;
     }
 
     private String inputId;
+
     @XmlJavaTypeAdapter(InputAttrsAdapter.class)
     public Map<String, String> InputAttrs = new LinkedHashMap<String, String>();
 
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/ProfileInputFactory.java b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileInputFactory.java
new file mode 100644
index 000000000..67d3e9a2c
--- /dev/null
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileInputFactory.java
@@ -0,0 +1,40 @@
+package com.netscape.cms.servlet.profile.model;
+
+import java.util.Enumeration;
+import java.util.Locale;
+
+import com.netscape.certsrv.base.IArgBlock;
+import com.netscape.certsrv.profile.EProfileException;
+import com.netscape.certsrv.profile.IProfileInput;
+import com.netscape.certsrv.request.IRequest;
+
+public class ProfileInputFactory {
+
+    public static ProfileInput create(IProfileInput input, IRequest request, Locale locale) throws EProfileException  {
+        ProfileInput ret = new ProfileInput();
+        ret.setInputId(input.getName(locale));
+        Enumeration<String> names = input.getValueNames();
+        while (names.hasMoreElements()) {
+            String name = names.nextElement();
+            String value = input.getValue(name, locale, request);
+            if (value != null) {
+                ret.setInputAttr(name, value);
+            }
+        }
+        return ret;
+    }
+
+    public static ProfileInput create(IProfileInput input, IArgBlock params, Locale locale) throws EProfileException {
+        ProfileInput ret = new ProfileInput();
+        ret.setInputId(input.getName(locale));
+        Enumeration<String> names = input.getValueNames();
+        while (names.hasMoreElements()) {
+            String name = names.nextElement();
+            String value = params.getValueAsString(name, null);
+            if (value != null) {
+                ret.setInputAttr(name, value);
+            }
+        }
+        return ret;
+    }
+}
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/ProfileOutput.java b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileOutput.java
new file mode 100644
index 000000000..f27db4101
--- /dev/null
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileOutput.java
@@ -0,0 +1,84 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2007 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+package com.netscape.cms.servlet.profile.model;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlRootElement;
+
+@XmlRootElement
+@XmlAccessorType(XmlAccessType.FIELD)
+public class ProfileOutput {
+
+    public ProfileOutput() {
+        // required for jaxb
+    }
+
+    @XmlElement
+    private String outputId;
+
+    @XmlElement(name = "attributes")
+    private List<ProfileAttribute> attrs = new ArrayList<ProfileAttribute>();
+
+    @XmlElement
+    private String name;
+
+    @XmlElement
+    private String text;
+
+    public String getOutputId() {
+        return outputId;
+    }
+
+    public void setOutputId(String OutputId) {
+        this.outputId = OutputId;
+    }
+
+    public List<ProfileAttribute> getAttrs() {
+        return attrs;
+    }
+
+    public void setAttrs(List<ProfileAttribute> attrs) {
+        this.attrs = attrs;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getText() {
+        return text;
+    }
+
+    public void setText(String text) {
+        this.text = text;
+    }
+
+    public void addAttribute(ProfileAttribute attr) {
+        attrs.add(attr);
+    }
+
+}
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/ProfileOutputFactory.java b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileOutputFactory.java
new file mode 100644
index 000000000..93bbaa2c5
--- /dev/null
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/ProfileOutputFactory.java
@@ -0,0 +1,47 @@
+//--- BEGIN COPYRIGHT BLOCK ---
+//This program is free software; you can redistribute it and/or modify
+//it under the terms of the GNU General Public License as published by
+//the Free Software Foundation; version 2 of the License.
+//
+//This program is distributed in the hope that it will be useful,
+//but WITHOUT ANY WARRANTY; without even the implied warranty of
+//MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//GNU General Public License for more details.
+//
+//You should have received a copy of the GNU General Public License along
+//with this program; if not, write to the Free Software Foundation, Inc.,
+//51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+//(C) 2012 Red Hat, Inc.
+//All rights reserved.
+//--- END COPYRIGHT BLOCK ---
+package com.netscape.cms.servlet.profile.model;
+
+import java.util.Enumeration;
+import java.util.Locale;
+
+import com.netscape.certsrv.profile.EProfileException;
+import com.netscape.certsrv.profile.IProfileOutput;
+import com.netscape.certsrv.property.Descriptor;
+import com.netscape.certsrv.request.IRequest;
+
+public class ProfileOutputFactory {
+
+    public static ProfileOutput create(IProfileOutput output, IRequest request, Locale locale) throws EProfileException {
+        ProfileOutput ret = new ProfileOutput();
+        ret.setName(output.getName(locale));
+        ret.setText(output.getText(locale));
+
+        Enumeration<String> attrNames  = output.getValueNames();
+        while (attrNames.hasMoreElements()) {
+            String attrName = attrNames.nextElement();
+            ProfileAttribute attr = new ProfileAttribute(
+                    attrName,
+                    output.getValue(attrName, locale, request),
+                    (Descriptor) output.getValueDescriptor(locale, attrName));
+            ret.addAttribute(attr);
+        }
+        return ret;
+    }
+
+}
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/ProfilePolicy.java b/base/common/src/com/netscape/cms/servlet/profile/model/ProfilePolicy.java
new file mode 100644
index 000000000..a24f93619
--- /dev/null
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/ProfilePolicy.java
@@ -0,0 +1,82 @@
+//--- BEGIN COPYRIGHT BLOCK ---
+//This program is free software; you can redistribute it and/or modify
+//it under the terms of the GNU General Public License as published by
+//the Free Software Foundation; version 2 of the License.
+//
+//This program is distributed in the hope that it will be useful,
+//but WITHOUT ANY WARRANTY; without even the implied warranty of
+//MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//GNU General Public License for more details.
+//
+//You should have received a copy of the GNU General Public License along
+//with this program; if not, write to the Free Software Foundation, Inc.,
+//51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+//(C) 2012 Red Hat, Inc.
+//All rights reserved.
+//--- END COPYRIGHT BLOCK ---
+package com.netscape.cms.servlet.profile.model;
+
+import java.io.ByteArrayOutputStream;
+
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.Marshaller;
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlAttribute;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlRootElement;
+
+@XmlRootElement
+@XmlAccessorType(XmlAccessType.FIELD)
+public class ProfilePolicy {
+    @XmlAttribute
+    private String id = null;
+
+    @XmlElement
+    private PolicyDefault def = null;
+
+    @XmlElement
+    private PolicyConstraint constraint = null;
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public PolicyDefault getDef() {
+        return def;
+    }
+
+    public void setDef(PolicyDefault def) {
+        this.def = def;
+    }
+
+    public PolicyConstraint getConstraint() {
+        return constraint;
+    }
+
+    public void setConstraint(PolicyConstraint constraint) {
+        this.constraint = constraint;
+    }
+
+    public String toString() {
+        try {
+            JAXBContext context = JAXBContext.newInstance(ProfilePolicy.class);
+            Marshaller marshaller = context.createMarshaller();
+            marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true);
+
+            ByteArrayOutputStream stream = new ByteArrayOutputStream();
+
+            marshaller.marshal(this, stream);
+            return stream.toString();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        return null;
+    }
+
+}
diff --git a/base/common/src/com/netscape/cms/servlet/profile/model/ProfilePolicySet.java b/base/common/src/com/netscape/cms/servlet/profile/model/ProfilePolicySet.java
new file mode 100644
index 000000000..784f5670d
--- /dev/null
+++ b/base/common/src/com/netscape/cms/servlet/profile/model/ProfilePolicySet.java
@@ -0,0 +1,50 @@
+//--- BEGIN COPYRIGHT BLOCK ---
+//This program is free software; you can redistribute it and/or modify
+//it under the terms of the GNU General Public License as published by
+//the Free Software Foundation; version 2 of the License.
+//
+//This program is distributed in the hope that it will be useful,
+//but WITHOUT ANY WARRANTY; without even the implied warranty of
+//MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//GNU General Public License for more details.
+//
+//You should have received a copy of the GNU General Public License along
+//with this program; if not, write to the Free Software Foundation, Inc.,
+//51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+//(C) 2012 Red Hat, Inc.
+//All rights reserved.
+//--- END COPYRIGHT BLOCK ---
+package com.netscape.cms.servlet.profile.model;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlRootElement;
+
+@XmlRootElement
+@XmlAccessorType(XmlAccessType.FIELD)
+public class ProfilePolicySet {
+    @XmlElement
+    protected List<ProfilePolicy> policies = new ArrayList<ProfilePolicy>();
+
+    public List<ProfilePolicy> getPolicies() {
+        return policies;
+    }
+
+    public void setPolicies(List<ProfilePolicy> policies) {
+        this.policies = policies;
+    }
+
+    public void addPolicy(ProfilePolicy policy) {
+        policies.add(policy);
+    }
+
+    public void removePolicy(ProfilePolicy policy) {
+        policies.remove(policy);
+    }
+
+}