summaryrefslogtreecommitdiffstats
path: root/base/common/src/com/netscape/cms/servlet/csadmin/DonePanel.java
diff options
context:
space:
mode:
Diffstat (limited to 'base/common/src/com/netscape/cms/servlet/csadmin/DonePanel.java')
-rw-r--r--base/common/src/com/netscape/cms/servlet/csadmin/DonePanel.java768
1 files changed, 78 insertions, 690 deletions
diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/DonePanel.java b/base/common/src/com/netscape/cms/servlet/csadmin/DonePanel.java
index 7729ea40e..f514a59f0 100644
--- a/base/common/src/com/netscape/cms/servlet/csadmin/DonePanel.java
+++ b/base/common/src/com/netscape/cms/servlet/csadmin/DonePanel.java
@@ -19,41 +19,21 @@ package com.netscape.cms.servlet.csadmin;
import java.io.IOException;
import java.math.BigInteger;
-import java.net.URLEncoder;
-import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
-import java.util.StringTokenizer;
import javax.servlet.ServletConfig;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import netscape.ldap.LDAPAttribute;
-import netscape.ldap.LDAPAttributeSet;
-import netscape.ldap.LDAPConnection;
-import netscape.ldap.LDAPEntry;
-import netscape.ldap.LDAPException;
-import netscape.ldap.LDAPModification;
-import netscape.security.x509.X509CertImpl;
-
import org.apache.velocity.context.Context;
-import org.mozilla.jss.CryptoManager;
import com.netscape.certsrv.apps.CMS;
import com.netscape.certsrv.base.IConfigStore;
-import com.netscape.certsrv.dbs.crldb.ICRLIssuingPointRecord;
-import com.netscape.certsrv.ocsp.IDefStore;
import com.netscape.certsrv.ocsp.IOCSPAuthority;
import com.netscape.certsrv.property.PropertySet;
-import com.netscape.certsrv.usrgrp.EUsrGrpException;
-import com.netscape.certsrv.usrgrp.IGroup;
import com.netscape.certsrv.usrgrp.IUGSubsystem;
import com.netscape.certsrv.usrgrp.IUser;
import com.netscape.cms.servlet.wizard.WizardServlet;
-import com.netscape.cmsutil.crypto.CryptoUtil;
-import com.netscape.cmsutil.password.IPasswordStore;
-import com.netscape.cmsutil.util.Cert;
import com.netscape.cmsutil.util.Utils;
public class DonePanel extends WizardPanelBase {
@@ -98,73 +78,10 @@ public class DonePanel extends WizardPanelBase {
return set;
}
- private LDAPConnection getLDAPConn(Context context)
- throws IOException {
- IConfigStore cs = CMS.getConfigStore();
-
- String host = "";
- String port = "";
- String pwd = null;
- String binddn = "";
- String security = "";
-
- IPasswordStore pwdStore = CMS.getPasswordStore();
-
- if (pwdStore != null) {
- CMS.debug("DonePanel: getLDAPConn: password store available");
- pwd = pwdStore.getPassword("internaldb");
- }
-
- if (pwd == null) {
- throw new IOException("DonePanel: Failed to obtain password from password store");
- }
-
- try {
- host = cs.getString("internaldb.ldapconn.host");
- port = cs.getString("internaldb.ldapconn.port");
- binddn = cs.getString("internaldb.ldapauth.bindDN");
- security = cs.getString("internaldb.ldapconn.secureConn");
- } catch (Exception e) {
- CMS.debug("DonePanel: getLDAPConn" + e.toString());
- throw new IOException(
- "Failed to retrieve LDAP information from CS.cfg.");
- }
-
- int p = -1;
-
- try {
- p = Integer.parseInt(port);
- } catch (Exception e) {
- CMS.debug("DonePanel getLDAPConn: " + e.toString());
- throw new IOException("Port is not valid");
- }
-
- LDAPConnection conn = null;
- if (security.equals("true")) {
- CMS.debug("DonePanel getLDAPConn: creating secure (SSL) connection for internal ldap");
- conn = new LDAPConnection(CMS.getLdapJssSSLSocketFactory());
- } else {
- CMS.debug("DonePanel getLDAPConn: creating non-secure (non-SSL) connection for internal ldap");
- conn = new LDAPConnection();
- }
-
- CMS.debug("DonePanel connecting to " + host + ":" + p);
- try {
- conn.connect(host, p, binddn, pwd);
- } catch (LDAPException e) {
- CMS.debug("DonePanel getLDAPConn: " + e.toString());
- throw new IOException("Failed to connect to the internal database.");
- }
-
- return conn;
- }
-
/**
* Display the panel.
*/
- public void display(HttpServletRequest request,
- HttpServletResponse response,
- Context context) {
+ public void display(HttpServletRequest request, HttpServletResponse response, Context context) {
CMS.debug("DonePanel: display()");
// update session id
@@ -175,26 +92,24 @@ public class DonePanel extends WizardPanelBase {
}
IConfigStore cs = CMS.getConfigStore();
- String ownport = CMS.getEENonSSLPort();
- String ownsport = CMS.getEESSLPort();
- String owneeclientauthsport = CMS.getEEClientAuthSSLPort();
- String ownhost = CMS.getEESSLHost();
- String ownagentsport = CMS.getAgentPort();
- String ownagenthost = CMS.getAgentHost();
- String ownadminsport = CMS.getAdminPort();
- String ownadminhost = CMS.getAdminHost();
- String select = "";
+ String select = "";
String type = "";
String instanceId = "";
String instanceRoot = "";
String systemdService = "";
+ String ca_host = "";
+ String sdtype = "";
+ int state = 0;
try {
type = cs.getString("cs.type", "");
instanceId = cs.getString("instanceId");
instanceRoot = cs.getString("instanceRoot");
select = cs.getString("preop.subsystem.select", "");
systemdService = cs.getString("pkicreate.systemd.servicename", "");
+ ca_host = cs.getString("preop.ca.hostname", "");
+ sdtype = cs.getString("securitydomain.select", "");
+ state = cs.getInteger("cs.state");
} catch (Exception e) {
}
@@ -224,651 +139,124 @@ public class DonePanel extends WizardPanelBase {
}
context.put("title", "Done");
context.put("panel", "admin/console/config/donepanel.vm");
- context.put("host", ownadminhost);
- context.put("port", ownadminsport);
- String subsystemType = toLowerCaseSubsystemType(type);
- context.put("systemType", subsystemType);
-
- try {
- int state = cs.getInteger("cs.state");
- if (state == 1) {
- context.put("csstate", "1");
- return;
- } else
- context.put("csstate", "0");
+ context.put("host", CMS.getAdminHost());
+ context.put("port", CMS.getAdminPort());
+ context.put("systemType", type.toLowerCase());
- } catch (Exception e) {
- }
-
- String sd_agent_port = "";
- String sd_admin_port = "";
- String sd_host = "";
- String ca_host = "";
- try {
- sd_host = cs.getString("securitydomain.host", "");
- sd_agent_port = cs.getString("securitydomain.httpsagentport", "");
- sd_admin_port = cs.getString("securitydomain.httpsadminport", "");
- ca_host = cs.getString("preop.ca.hostname", "");
- } catch (Exception e) {
- }
+ if (state == 1) {
+ context.put("csstate", "1");
+ return;
+ } else
+ context.put("csstate", "0");
if (ca_host.equals(""))
context.put("externalCA", "true");
else
context.put("externalCA", "false");
- // update security domain
- String sdtype = "";
- String subsystemName = "";
- try {
- sdtype = cs.getString("securitydomain.select", "");
- subsystemName = cs.getString("preop.subsystem.name", "");
- } catch (Exception e) {
- }
-
- boolean cloneMaster = false;
-
- if (select.equals("clone") && type.equalsIgnoreCase("CA") && isSDHostDomainMaster(cs)) {
- cloneMaster = true;
- CMS.debug("Cloning a domain master");
- }
-
- String s = getSubsystemNodeName(type);
- if (sdtype.equals("new")) {
- try {
- LDAPConnection conn = getLDAPConn(context);
-
- String basedn = cs.getString("internaldb.basedn");
- String secdomain = cs.getString("securitydomain.name");
-
- try {
- // Create security domain ldap entry
- String dn = "ou=Security Domain," + basedn;
- CMS.debug("DonePanel: creating ldap entry : " + dn);
-
- LDAPEntry entry = null;
- LDAPAttributeSet attrs = null;
- attrs = new LDAPAttributeSet();
- attrs.add(new LDAPAttribute("objectclass", "top"));
- attrs.add(new LDAPAttribute("objectclass", "pkiSecurityDomain"));
- if (secdomain.equals("")) {
- // this should not happen - just in case
- CMS.debug("DonePanel display(): Security domain is an empty string!");
- throw new IOException("Security domain is an empty string!");
- } else {
- attrs.add(new LDAPAttribute("name", secdomain));
- }
- attrs.add(new LDAPAttribute("ou", "Security Domain"));
- entry = new LDAPEntry(dn, attrs);
- conn.add(entry);
- } catch (Exception e) {
- CMS.debug("Unable to create security domain");
- throw e;
- }
-
- try {
- // create list containers
- String clist[] = { "CAList", "OCSPList", "KRAList", "RAList", "TKSList", "TPSList" };
- for (int i = 0; i < clist.length; i++) {
- LDAPEntry entry = null;
- LDAPAttributeSet attrs = null;
- String dn = "cn=" + clist[i] + ",ou=Security Domain," + basedn;
- attrs = new LDAPAttributeSet();
- attrs.add(new LDAPAttribute("objectclass", "top"));
- attrs.add(new LDAPAttribute("objectclass", "pkiSecurityGroup"));
- attrs.add(new LDAPAttribute("cn", clist[i]));
- entry = new LDAPEntry(dn, attrs);
- conn.add(entry);
- }
- } catch (Exception e) {
- CMS.debug("Unable to create security domain list groups");
- throw e;
- }
+ // Create or update security domain
- try {
- // Add this host (only CA can create new domain)
- String cn = ownhost + ":" + ownadminsport;
- String dn = "cn=" + cn + ",cn=CAList,ou=Security Domain," + basedn;
- LDAPEntry entry = null;
- LDAPAttributeSet attrs = null;
- attrs = new LDAPAttributeSet();
- attrs.add(new LDAPAttribute("objectclass", "top"));
- attrs.add(new LDAPAttribute("objectclass", "pkiSubsystem"));
- attrs.add(new LDAPAttribute("Host", ownhost));
- attrs.add(new LDAPAttribute("SecurePort", ownsport));
- attrs.add(new LDAPAttribute("SecureAgentPort",
- ownagentsport));
- attrs.add(new LDAPAttribute("SecureAdminPort",
- ownadminsport));
- if (owneeclientauthsport != null) {
- attrs.add(new LDAPAttribute("SecureEEClientAuthPort",
- owneeclientauthsport));
- }
- attrs.add(new LDAPAttribute("UnSecurePort", ownport));
- attrs.add(new LDAPAttribute("Clone", "FALSE"));
- attrs.add(new LDAPAttribute("SubsystemName", subsystemName));
- attrs.add(new LDAPAttribute("cn", cn));
- attrs.add(new LDAPAttribute("DomainManager", "TRUE"));
- entry = new LDAPEntry(dn, attrs);
- conn.add(entry);
- } catch (Exception e) {
- CMS.debug("Unable to create host entry in security domain");
- throw e;
- }
- CMS.debug("DonePanel display: finish updating domain info");
- conn.disconnect();
- } catch (Exception e) {
- CMS.debug("DonePanel display: " + e.toString());
- }
-
- int sd_admin_port_int = -1;
- try {
- sd_admin_port_int = Integer.parseInt(sd_admin_port);
- } catch (Exception e) {
- }
-
- try {
- // Fetch the "new" security domain and display it
- CMS.debug("Dump contents of new Security Domain . . .");
- @SuppressWarnings("unused")
- String c = getDomainXML(sd_host, sd_admin_port_int, true);
- } catch (Exception e) {
- }
-
- // Since this instance is a new Security Domain,
- // create an empty file to designate this fact.
- String security_domain = instanceRoot + "/conf/"
- + PKI_SECURITY_DOMAIN;
- if (!Utils.isNT()) {
- Utils.exec("touch " + security_domain);
- Utils.exec("chmod 00660 " + security_domain);
- }
-
- } else { //existing domain
- int sd_agent_port_int = -1;
- int sd_admin_port_int = -1;
- try {
- sd_agent_port_int = Integer.parseInt(sd_agent_port);
- sd_admin_port_int = Integer.parseInt(sd_admin_port);
- } catch (Exception e) {
- }
-
- try {
- String cloneStr = "";
- if (select.equals("clone"))
- cloneStr = "&clone=true";
- else
- cloneStr = "&clone=false";
-
- String domainMasterStr = "";
- if (cloneMaster)
- domainMasterStr = "&dm=true";
- else
- domainMasterStr = "&dm=false";
- String eecaStr = "";
- if (owneeclientauthsport != null)
- eecaStr = "&eeclientauthsport=" + owneeclientauthsport;
-
- updateDomainXML(sd_host, sd_agent_port_int, true,
- "/ca/agent/ca/updateDomainXML",
- "list=" + s
- + "&type=" + type
- + "&host=" + ownhost
- + "&name=" + subsystemName
- + "&sport=" + ownsport
- + domainMasterStr
- + cloneStr
- + "&agentsport=" + ownagentsport
- + "&adminsport=" + ownadminsport
- + eecaStr
- + "&httpport=" + ownport);
-
- // Fetch the "updated" security domain and display it
- CMS.debug("Dump contents of updated Security Domain . . .");
- @SuppressWarnings("unused")
- String c = getDomainXML(sd_host, sd_admin_port_int, true);
- } catch (Exception e) {
- context.put("errorString", "Failed to update the security domain on the domain master.");
- //return;
+ try {
+ if (sdtype.equals("new")) {
+ ConfigurationUtils.createSecurityDomain();
+ } else { //existing domain
+ ConfigurationUtils.updateSecurityDomain();
}
- }
- // add service.securityDomainPort to CS.cfg in case pkiremove
- // needs to remove system reference from the security domain
- try {
- cs.putString("service.securityDomainPort", ownagentsport);
+ cs.putString("service.securityDomainPort", CMS.getAgentPort());
cs.putString("securitydomain.store", "ldap");
cs.commit(false);
} catch (Exception e) {
- CMS.debug("DonePanel: exception in adding service.securityDomainPort to CS.cfg" + e);
- }
-
- // need to push connector information to the CA
- if (type.equals("KRA") && !ca_host.equals("")) {
- try {
- updateConnectorInfo(ownagenthost, ownagentsport);
- } catch (IOException e) {
- context.put("errorString", "Failed to update connector information.");
- return;
- }
- setupClientAuthUser();
- } // if KRA
-
- // import the CA certificate into the OCSP
- // configure the CRL Publishing to OCSP in CA
- if (type.equals("OCSP") && !ca_host.equals("")) {
- try {
- CMS.reinit(IOCSPAuthority.ID);
- importCACertToOCSP();
- } catch (Exception e) {
- CMS.debug("DonePanel display: Failed to import the CA certificate into OCSP.");
- }
-
- try {
- updateOCSPConfig(response);
- } catch (Exception e) {
- CMS.debug("DonePanel display: Failed to update OCSP information in CA.");
- }
-
- setupClientAuthUser();
- }
-
- if (!select.equals("clone")) {
- if (type.equals("CA") || type.equals("KRA")) {
- String endRequestNumStr = "";
- String endSerialNumStr = "";
-
- try {
- endRequestNumStr = cs.getString("dbs.endRequestNumber", "");
- endSerialNumStr = cs.getString("dbs.endSerialNumber", "");
- BigInteger endRequestNum = new BigInteger(endRequestNumStr);
- BigInteger endSerialNum = new BigInteger(endSerialNumStr);
- BigInteger oneNum = new BigInteger("1");
-
- // update global next range entries
- LDAPConnection conn = getLDAPConn(context);
- String basedn = cs.getString("internaldb.basedn");
-
- String serialdn = "";
- if (type.equals("CA")) {
- serialdn = "ou=certificateRepository,ou=" + type.toLowerCase() + "," + basedn;
- } else {
- serialdn = "ou=keyRepository,ou=" + type.toLowerCase() + "," + basedn;
- }
- LDAPAttribute attrSerialNextRange =
- new LDAPAttribute("nextRange", endSerialNum.add(oneNum).toString());
- LDAPModification serialmod = new LDAPModification(LDAPModification.REPLACE, attrSerialNextRange);
- conn.modify(serialdn, serialmod);
-
- String requestdn = "ou=" + type.toLowerCase() + ",ou=requests," + basedn;
- LDAPAttribute attrRequestNextRange =
- new LDAPAttribute("nextRange", endRequestNum.add(oneNum).toString());
- LDAPModification requestmod = new LDAPModification(LDAPModification.REPLACE, attrRequestNextRange);
- conn.modify(requestdn, requestmod);
-
- conn.disconnect();
- } catch (Exception e) {
- CMS.debug("Unable to update global next range numbers: " + e);
- }
- }
- }
-
- if (cloneMaster) {
- // cloning a domain master CA, the clone is also master of its domain
- try {
- cs.putString("securitydomain.host", ownhost);
- cs.putString("securitydomain.httpport", ownport);
- cs.putString("securitydomain.httpsadminport", ownadminsport);
- cs.putString("securitydomain.httpsagentport", ownagentsport);
- cs.putString("securitydomain.httpseeport", ownsport);
- cs.putString("securitydomain.select", "new");
- } catch (Exception e) {
- CMS.debug("Caught exception trying to save security domain parameters for clone of a domain master");
- }
+ CMS.debug("DonePanel - update(): Error while updating security domain: " + e);
+ e.printStackTrace();
}
- String dbuser = null;
+ // push connector information to the CA
try {
- dbuser = cs.getString("cs.type") + "-" + cs.getString("machineName") + "-" + cs.getString("service.securePort");
- if (! sdtype.equals("new")) {
- setupDBUser(dbuser);
+ if (type.equals("KRA") && !ca_host.equals("")) {
+ ConfigurationUtils.updateConnectorInfo(CMS.getAgentHost(), CMS.getAgentPort());
+ ConfigurationUtils.setupClientAuthUser();
}
- IUGSubsystem system = (IUGSubsystem) (CMS.getSubsystem(IUGSubsystem.ID));
- IUser user = system.getUser(dbuser);
- system.addCertSubjectDN(user);
} catch (Exception e) {
+ CMS.debug("DonePanel - update(): Error while pushing KRA connectot information to the CA: " + e);
e.printStackTrace();
- CMS.debug("Unable to create or update dbuser" + e);
}
- cs.putInteger("cs.state", 1);
+ // import the CA certificate into the OCSP
+ // configure the CRL Publishing to OCSP in CA
try {
- // save variables needed for cloning and remove preop
- String list = cs.getString("preop.cert.list", "");
- StringTokenizer st = new StringTokenizer(list, ",");
-
- while (st.hasMoreTokens()) {
- String ss = st.nextToken();
- if (ss.equals("sslserver"))
- continue;
- cs.putString("cloning." + ss + ".nickname", cs.getString("preop.cert." + ss + ".nickname", ""));
- cs.putString("cloning." + ss + ".dn", cs.getString("preop.cert." + ss + ".dn", ""));
- cs.putString("cloning." + ss + ".keytype", cs.getString("preop.cert." + ss + ".keytype", ""));
- cs.putString("cloning." + ss + ".keyalgorithm", cs.getString("preop.cert." + ss + ".keyalgorithm", ""));
- cs.putString("cloning." + ss + ".privkey.id", cs.getString("preop.cert." + ss + ".privkey.id", ""));
- cs.putString("cloning." + ss + ".pubkey.exponent",
- cs.getString("preop.cert." + ss + ".pubkey.exponent", ""));
- cs.putString("cloning." + ss + ".pubkey.modulus",
- cs.getString("preop.cert." + ss + ".pubkey.modulus", ""));
- cs.putString("cloning." + ss + ".pubkey.encoded",
- cs.getString("preop.cert." + ss + ".pubkey.encoded", ""));
- }
- cs.putString("cloning.module.token", cs.getString("preop.module.token", ""));
- cs.putString("cloning.list", list);
-
- // more cloning variables needed for non-ca clones
-
- if (!type.equals("CA")) {
- String val = cs.getString("preop.ca.hostname", "");
- if (val.compareTo("") != 0)
- cs.putString("cloning.ca.hostname", val);
-
- val = cs.getString("preop.ca.httpport", "");
- if (val.compareTo("") != 0)
- cs.putString("cloning.ca.httpport", val);
-
- val = cs.getString("preop.ca.httpsport", "");
- if (val.compareTo("") != 0)
- cs.putString("cloning.ca.httpsport", val);
-
- val = cs.getString("preop.ca.list", "");
- if (val.compareTo("") != 0)
- cs.putString("cloning.ca.list", val);
-
- val = cs.getString("preop.ca.pkcs7", "");
- if (val.compareTo("") != 0)
- cs.putString("cloning.ca.pkcs7", val);
-
- val = cs.getString("preop.ca.type", "");
- if (val.compareTo("") != 0)
- cs.putString("cloning.ca.type", val);
- }
-
- // save EC type for sslserver cert (if present)
- cs.putString("jss.ssl.sslserver.ectype", cs.getString("preop.cert.sslserver.ec.type", "ECDHE"));
-
- cs.removeSubStore("preop");
- cs.commit(false);
-
- // Create an empty file that designates the fact that although
- // this server instance has been configured, it has NOT yet
- // been restarted!
- String restart_server = instanceRoot + "/conf/"
- + RESTART_SERVER_AFTER_CONFIGURATION;
- if (!Utils.isNT()) {
- Utils.exec("touch " + restart_server);
- Utils.exec("chmod 00660 " + restart_server);
+ if (type.equals("OCSP") && !ca_host.equals("")) {
+ CMS.reinit(IOCSPAuthority.ID);
+ ConfigurationUtils.importCACertToOCSP();
+ ConfigurationUtils.updateOCSPConfig();
+ ConfigurationUtils.setupClientAuthUser();
}
-
} catch (Exception e) {
- CMS.debug("Caught exception saving preop variables: " + e);
+ CMS.debug("DonePanel - update(): Error while configuring OCSP publishing on the CA: " + e);
+ e.printStackTrace();
}
- context.put("csstate", "1");
- }
-
- private void setupClientAuthUser() {
- IConfigStore cs = CMS.getConfigStore();
-
- // retrieve CA subsystem certificate from the CA
- IUGSubsystem system =
- (IUGSubsystem) (CMS.getSubsystem(IUGSubsystem.ID));
- String id = "";
try {
- String b64 = getCASubsystemCert();
- if (b64 != null) {
- int num = cs.getInteger("preop.subsystem.count", 0);
- id = getCAUserId();
- num++;
- cs.putInteger("preop.subsystem.count", num);
- cs.putInteger("subsystem.count", num);
- IUser user = system.createUser(id);
- user.setFullName(id);
- user.setEmail("");
- user.setPassword("");
- user.setUserType("agentType");
- user.setState("1");
- user.setPhone("");
- X509CertImpl[] certs = new X509CertImpl[1];
- certs[0] = new X509CertImpl(CMS.AtoB(b64));
- user.setX509Certificates(certs);
- system.addUser(user);
- CMS.debug("DonePanel display: successfully add the user");
- system.addUserCert(user);
- CMS.debug("DonePanel display: successfully add the user certificate");
- cs.commit(false);
- }
- } catch (Exception e) {
- }
+ if (!select.equals("clone")) {
+ if (type.equals("CA") || type.equals("KRA")) {
+ ConfigurationUtils.updateNextRanges();
- try {
- String groupName = "Trusted Managers";
- IGroup group = system.getGroupFromName(groupName);
- if (!group.isMember(id)) {
- group.addMemberName(id);
- system.modifyGroup(group);
- CMS.debug("DonePanel display: successfully added the user to the group.");
+ }
}
} catch (Exception e) {
- }
- }
-
- private void setupDBUser(String dbuser) throws CertificateException, EUsrGrpException, LDAPException {
- IUGSubsystem system =
- (IUGSubsystem) (CMS.getSubsystem(IUGSubsystem.ID));
-
- String b64 = getSubsystemCert();
- if (b64 == null) {
- CMS.debug("DonePanel setupDBUser: failed to fetch subsystem cert");
- return;
- }
-
- IUser user = system.createUser(dbuser);
- user.setFullName(dbuser);
- user.setEmail("");
- user.setPassword("");
- user.setUserType("agentType");
- user.setState("1");
- user.setPhone("");
- X509CertImpl[] certs = new X509CertImpl[1];
- certs[0] = new X509CertImpl(CMS.AtoB(b64));
- user.setX509Certificates(certs);
- system.addUser(user);
- CMS.debug("DonePanel setupDBUser: successfully add the user");
- system.addUserCert(user);
- CMS.debug("DonePanel setupDBUser: successfully add the user certificate");
- }
-
- private String getSubsystemCert() {
- IConfigStore cs = CMS.getConfigStore();
- String nickname = "";
- try {
- nickname = cs.getString("preop.cert.subsystem.nickname", "");
- String tokenname = cs.getString("preop.module.token", "");
- if (!tokenname.equals("internal") && !tokenname.equals("Internal Key Storage Token")
- && !tokenname.equals(""))
- nickname = tokenname + ":" + nickname;
- } catch (Exception e) {
+ CMS.debug("DonePanel - update(): Error while updating serial number next ranges: " + e);
+ e.printStackTrace();
}
- CMS.debug("DonePanel getSubsystemCert: nickname=" + nickname);
- String s = null;
try {
- CryptoManager cm = CryptoManager.getInstance();
- org.mozilla.jss.crypto.X509Certificate cert = cm.findCertByNickname(nickname);
-
- if (cert == null) {
- CMS.debug("DonePanel getSubsystemCert: subsystem cert is null");
- return null;
+ if (select.equals("clone") && type.equalsIgnoreCase("CA") && ConfigurationUtils.isSDHostDomainMaster(cs)) {
+ // cloning a domain master CA, the clone is also master of its domain
+ CMS.debug("Cloning a domain master");
+ cs.putString("securitydomain.host", CMS.getEESSLHost());
+ cs.putString("securitydomain.httpport", CMS.getEENonSSLPort());
+ cs.putString("securitydomain.httpsadminport", CMS.getAdminPort());
+ cs.putString("securitydomain.httpsagentport", CMS.getAgentPort());
+ cs.putString("securitydomain.httpseeport", CMS.getEESSLPort());
+ cs.putString("securitydomain.select", "new");
}
-
- byte[] bytes = cert.getEncoded();
- s = CryptoUtil.normalizeCertStr(CryptoUtil.base64Encode(bytes));
- } catch (Exception e) {
- CMS.debug("DonePanel getSubsystemCert: exception: " + e.toString());
- }
- return s;
- }
-
- private void updateOCSPConfig(HttpServletResponse response)
- throws IOException {
- IConfigStore config = CMS.getConfigStore();
- String cahost = "";
- int caport = -1;
-
- try {
- cahost = config.getString("preop.ca.hostname", "");
- caport = config.getInteger("preop.ca.httpsport", -1);
} catch (Exception e) {
+ CMS.debug("DonePanel - update(): Error in determining if security domain host is a master CA: " + e);
+ e.printStackTrace();
}
- String ocsphost = CMS.getAgentHost();
- int ocspport = Integer.parseInt(CMS.getAgentPort());
- String session_id = CMS.getConfigSDSessionId();
- String content = "xmlOutput=true&sessionID=" + session_id + "&ocsp_host=" + ocsphost + "&ocsp_port=" + ocspport;
-
- updateOCSPConfig(cahost, caport, true, content, response);
- }
-
- private void importCACertToOCSP() throws IOException {
- IConfigStore config = CMS.getConfigStore();
-
- // get certificate chain from CA
+ String dbuser = null;
try {
- String b64 = config.getString("preop.ca.pkcs7", "");
-
- if (b64.equals(""))
- throw new IOException("Failed to get certificate chain.");
-
- try {
- // this could be a chain
- X509Certificate[] certs = Cert.mapCertFromPKCS7(b64);
- X509Certificate leafCert = null;
- if (certs != null && certs.length > 0) {
- if (certs[0].getSubjectDN().getName().equals(certs[0].getIssuerDN().getName())) {
- leafCert = certs[certs.length - 1];
- } else {
- leafCert = certs[0];
- }
-
- IOCSPAuthority ocsp =
- (IOCSPAuthority) CMS.getSubsystem(IOCSPAuthority.ID);
- IDefStore defStore = ocsp.getDefaultStore();
-
- // (1) need to normalize (sort) the chain
-
- // (2) store certificate (and certificate chain) into
- // database
- ICRLIssuingPointRecord rec = defStore.createCRLIssuingPointRecord(
- leafCert.getSubjectDN().getName(),
- BIG_ZERO,
- MINUS_ONE, null, null);
-
- try {
- rec.set(ICRLIssuingPointRecord.ATTR_CA_CERT, leafCert.getEncoded());
- } catch (Exception e) {
- // error
- }
- defStore.addCRLIssuingPoint(leafCert.getSubjectDN().getName(), rec);
- //log(ILogger.EV_AUDIT, AuditFormat.LEVEL, "Added CA certificate " + leafCert.getSubjectDN().getName());
-
- CMS.debug("DonePanel importCACertToOCSP: Added CA certificate.");
- }
- } catch (Exception e) {
- throw new IOException("Failed to encode the certificate chain");
+ dbuser = cs.getString("cs.type") + "-" + cs.getString("machineName") + "-"
+ + cs.getString("service.securePort");
+ if (!sdtype.equals("new")) {
+ ConfigurationUtils.setupDBUser(dbuser);
}
- } catch (IOException e) {
- throw e;
- } catch (Exception e) {
- CMS.debug("DonePanel importCACertToOCSP: Failed to import the certificate chain into the OCSP");
- throw new IOException("Failed to import the certificate chain into the OCSP");
- }
- }
-
- private String getCASubsystemCert() throws IOException {
- IConfigStore cs = CMS.getConfigStore();
- String host = "";
- int port = -1;
- try {
- host = cs.getString("preop.ca.hostname", "");
- port = cs.getInteger("preop.ca.httpsadminport", -1);
- } catch (Exception e) {
- }
-
- return getSubsystemCert(host, port, true);
- }
-
- private String getCAUserId() throws IOException {
- IConfigStore cs = CMS.getConfigStore();
- String host = "";
- int port = -1;
- try {
- host = cs.getString("preop.ca.hostname", "");
- port = cs.getInteger("preop.ca.httpsport", -1);
+ IUGSubsystem system = (IUGSubsystem) (CMS.getSubsystem(IUGSubsystem.ID));
+ IUser user = system.getUser(dbuser);
+ system.addCertSubjectDN(user);
} catch (Exception e) {
+ e.printStackTrace();
+ CMS.debug("DonePanel - update(): Unable to create or update dbuser" + e);
}
- return "CA-" + host + "-" + port;
- }
-
- private void updateConnectorInfo(String ownagenthost, String ownagentsport)
- throws IOException {
- IConfigStore cs = CMS.getConfigStore();
- int port = -1;
- String url = "";
- String host = null;
- String transportCert = "";
+ cs.putInteger("cs.state", 1);
try {
- url = cs.getString("preop.ca.url", "");
- if (!url.equals("")) {
- host = cs.getString("preop.ca.hostname", "");
- port = cs.getInteger("preop.ca.httpsadminport", -1);
- transportCert = cs.getString("kra.transport.cert", "");
- }
+ ConfigurationUtils.removePreopConfigEntries();
} catch (Exception e) {
+ CMS.debug("DonePanel - update(): Caught exception saving preop variables: " + e);
}
- if (host == null) {
- CMS.debug("DonePanel: preop.ca.url is not defined. External CA selected. No transport certificate setup is required");
- } else {
- CMS.debug("DonePanel: Transport certificate is being setup in " + url);
- String session_id = CMS.getConfigSDSessionId();
- String content =
- "ca.connector.KRA.enable=true&ca.connector.KRA.local=false&ca.connector.KRA.timeout=30&ca.connector.KRA.uri=/kra/agent/kra/connector&ca.connector.KRA.host="
- + ownagenthost
- + "&ca.connector.KRA.port="
- + ownagentsport
- + "&ca.connector.KRA.transportCert="
- + URLEncoder.encode(transportCert, "UTF-8")
- + "&sessionID="
- + session_id;
-
- updateConnectorInfo(host, port, true, content);
+ // Create an empty file that designates the fact that although
+ // this server instance has been configured, it has NOT yet
+ // been restarted!
+ String restart_server = instanceRoot + "/conf/"
+ + RESTART_SERVER_AFTER_CONFIGURATION;
+ if (!Utils.isNT()) {
+ Utils.exec("touch " + restart_server);
+ Utils.exec("chmod 00660 " + restart_server);
}
- }
- private String getSubsystemNodeName(String type) {
- if (type.equals("CA")) {
- return "CAList";
- } else if (type.equals("KRA")) {
- return "KRAList";
- } else if (type.equals("TKS")) {
- return "TKSList";
- } else if (type.equals("OCSP")) {
- return "OCSPList";
- }
-
- return "";
+ context.put("csstate", "1");
}
/**
generated by cgit (git 2.34.1) at 2024-05-25 22:58:21 +0000