diff options
Diffstat (limited to 'base/server/python')
3 files changed, 60 insertions, 9 deletions
diff --git a/base/server/python/pki/server/deployment/pkihelper.py b/base/server/python/pki/server/deployment/pkihelper.py index e8591398d..ab6562ba0 100644 --- a/base/server/python/pki/server/deployment/pkihelper.py +++ b/base/server/python/pki/server/deployment/pkihelper.py @@ -619,10 +619,17 @@ class ConfigurationFile: self.confirm_data_exists("pki_client_database_password") # Verify existence of Client PKCS #12 Password for Admin Cert self.confirm_data_exists("pki_client_pkcs12_password") + if self.clone: + # Verify existence of PKCS #12 Password (ONLY for non-HSM Clones) if not config.str2bool(self.mdict['pki_hsm_enable']): - self.confirm_data_exists("pki_clone_pkcs12_password") + + # If system certificates are already provided via pki_server_pkcs12 + # there's no need to provide pki_clone_pkcs12. + if not self.mdict['pki_server_pkcs12_path']: + self.confirm_data_exists("pki_clone_pkcs12_password") + # Verify absence of all PKCS #12 clone parameters for HSMs elif (os.path.exists(self.mdict['pki_clone_pkcs12_path']) or ('pki_clone_pkcs12_password' in self.mdict and @@ -632,6 +639,7 @@ class ConfigurationFile: extra=config.PKI_INDENTATION_LEVEL_2) raise Exception( log.PKIHELPER_HSM_CLONES_MUST_SHARE_HSM_MASTER_PRIVATE_KEYS) + # Verify existence of Security Domain Password # (ONLY for PKI KRA, PKI OCSP, PKI TKS, PKI TPS, Clones, or # Subordinate CA that will be automatically configured and @@ -736,11 +744,18 @@ class ConfigurationFile: self.confirm_data_exists("pki_http_port") self.confirm_data_exists("pki_https_port") self.confirm_data_exists("pki_tomcat_server_port") + + # Check clone parameters for non-HSM clone if not config.str2bool(self.mdict['pki_hsm_enable']): - # Check clone parameters for non-HSM clone - self.confirm_data_exists("pki_clone_pkcs12_path") - self.confirm_file_exists("pki_clone_pkcs12_path") + + # If system certificates are already provided via pki_server_pkcs12 + # there's no need to provide pki_clone_pkcs12. + if not self.mdict['pki_server_pkcs12_path']: + self.confirm_data_exists("pki_clone_pkcs12_path") + self.confirm_file_exists("pki_clone_pkcs12_path") + self.confirm_data_exists("pki_clone_replication_security") + elif self.external: # External CA if not self.external_step_two: @@ -3996,6 +4011,8 @@ class ConfigClient: # Issuing CA Information self.set_issuing_ca_parameters(data) + data.systemCertsImported = self.mdict['pki_server_pkcs12_path'] != '' + # Create system certs self.set_system_certs(data) @@ -4268,10 +4285,15 @@ class ConfigClient: def set_cloning_parameters(self, data): data.isClone = "true" data.cloneUri = self.mdict['pki_clone_uri'] + + # Set these clone parameters for non-HSM clones only if not config.str2bool(self.mdict['pki_hsm_enable']): - # Set these clone parameters for non-HSM clones only - data.p12File = self.mdict['pki_clone_pkcs12_path'] - data.p12Password = self.mdict['pki_clone_pkcs12_password'] + # If system certificates are already provided via pki_server_pkcs12 + # there's no need to provide pki_clone_pkcs12. + if not self.mdict['pki_server_pkcs12_path']: + data.p12File = self.mdict['pki_clone_pkcs12_path'] + data.p12Password = self.mdict['pki_clone_pkcs12_password'] + if config.str2bool(self.mdict['pki_clone_replicate_schema']): data.replicateSchema = "true" else: diff --git a/base/server/python/pki/server/deployment/pkiparser.py b/base/server/python/pki/server/deployment/pkiparser.py index e5e02a09e..755a5cdce 100644 --- a/base/server/python/pki/server/deployment/pkiparser.py +++ b/base/server/python/pki/server/deployment/pkiparser.py @@ -333,8 +333,10 @@ class PKIConfigParser: 'pki_client_pkcs12_password', 'pki_ds_password', 'pki_pin', - 'pki_replicationdb_password', - 'pki_security_domain_password') + 'pki_replication_password', + 'pki_security_domain_password', + 'pki_server_pkcs12_password', + 'pki_token_password') print 'Loading deployment configuration from ' + \ config.user_deployment_cfg + '.' diff --git a/base/server/python/pki/server/deployment/scriptlets/security_databases.py b/base/server/python/pki/server/deployment/scriptlets/security_databases.py index c3d4d9e49..947c9a740 100644 --- a/base/server/python/pki/server/deployment/scriptlets/security_databases.py +++ b/base/server/python/pki/server/deployment/scriptlets/security_databases.py @@ -19,6 +19,10 @@ # All rights reserved. # +from __future__ import absolute_import + +import pki.nssdb + # PKI Deployment Imports from .. import pkiconfig as config from .. import pkimessages as log @@ -35,8 +39,10 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet): config.pki_log.info(log.SKIP_SECURITY_DATABASES_SPAWN_1, __name__, extra=config.PKI_INDENTATION_LEVEL_1) return self.rv + config.pki_log.info(log.SECURITY_DATABASES_SPAWN_1, __name__, extra=config.PKI_INDENTATION_LEVEL_1) + if config.str2bool(deployer.mdict['pki_hsm_enable']): deployer.password.create_hsm_password_conf( deployer.mdict['pki_shared_password_conf'], @@ -46,6 +52,7 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet): deployer.password.create_password_conf( deployer.mdict['pki_shared_password_conf'], deployer.mdict['pki_pin']) + # Since 'certutil' does NOT strip the 'token=' portion of # the 'token=password' entries, create a temporary server 'pfile' # which ONLY contains the 'password' for the purposes of @@ -54,12 +61,14 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet): deployer.mdict['pki_shared_pfile'], deployer.mdict['pki_pin'], pin_sans_token=True) deployer.file.modify(deployer.mdict['pki_shared_password_conf']) + deployer.certutil.create_security_databases( deployer.mdict['pki_database_path'], deployer.mdict['pki_cert_database'], deployer.mdict['pki_key_database'], deployer.mdict['pki_secmod_database'], password_file=deployer.mdict['pki_shared_pfile']) + if config.str2bool(deployer.mdict['pki_hsm_enable']): deployer.modutil.register_security_module( deployer.mdict['pki_database_path'], @@ -75,6 +84,24 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet): deployer.mdict['pki_secmod_database'], perms=config.PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS) + pki_server_pkcs12_path = deployer.mdict['pki_server_pkcs12_path'] + + if pki_server_pkcs12_path: + + # importing system certificates + + pki_server_pkcs12_password = deployer.mdict['pki_server_pkcs12_password'] + if not pki_server_pkcs12_password: + raise Exception('Missing pki_server_pkcs12_password property.') + + nssdb = pki.nssdb.NSSDatabase( + directory=deployer.mdict['pki_database_path'], + password_file=deployer.mdict['pki_shared_pfile']) + + nssdb.import_pkcs12( + pkcs12_file=pki_server_pkcs12_path, + pkcs12_password=pki_server_pkcs12_password) + if len(deployer.instance.tomcat_instance_subsystems()) < 2: # only create a self signed cert for a new instance # |