diff options
Diffstat (limited to 'base/tps')
54 files changed, 1223 insertions, 5909 deletions
diff --git a/base/tps/CMakeLists.txt b/base/tps/CMakeLists.txt index aa6ac8cb1..954146cb4 100644 --- a/base/tps/CMakeLists.txt +++ b/base/tps/CMakeLists.txt @@ -36,13 +36,12 @@ SET(CMAKE_INSTALL_RPATH "${LIB_INSTALL_DIR}/tps") # which point to directories outside the build tree to the install RPATH SET(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE) -add_subdirectory(java) add_subdirectory(src) add_subdirectory(tools) # install files +add_subdirectory(doc) add_subdirectory(setup) -add_subdirectory(shared/conf) # install systemd scripts install( @@ -214,19 +213,3 @@ install( DESTINATION ${SYSTEMD_ETC_INSTALL_DIR}/pki-tpsd.target.wants ) - -# install directories -install( - DIRECTORY - shared/ - DESTINATION - ${SHARE_INSTALL_PREFIX}/${APPLICATION_NAME}/${PROJECT_NAME} - PATTERN - "CMakeLists.txt" EXCLUDE - PATTERN - "etc/*" EXCLUDE - PATTERN - "conf/CS.cfg.in" EXCLUDE - PATTERN - "lib/*" EXCLUDE -) diff --git a/base/tps/shared/conf/CMakeLists.txt b/base/tps/doc/CMakeLists.txt index 419289d03..419289d03 100644 --- a/base/tps/shared/conf/CMakeLists.txt +++ b/base/tps/doc/CMakeLists.txt diff --git a/base/tps/shared/conf/CS.cfg.in b/base/tps/doc/CS.cfg.in index 1a392a119..d5c0f312e 100644 --- a/base/tps/shared/conf/CS.cfg.in +++ b/base/tps/doc/CS.cfg.in @@ -1,98 +1,123 @@ _000=## _001=## Token Processing System (TPS) Configuration File _002=## -accessEvaluator.impl.group.class=com.netscape.cms.evaluators.GroupAccessEvaluator -accessEvaluator.impl.ipaddress.class=com.netscape.cms.evaluators.IPAddressAccessEvaluator -accessEvaluator.impl.user.class=com.netscape.cms.evaluators.UserAccessEvaluator -applet._000=######################################### -applet._001=# applet information -applet._002=# SAF Key: -applet._003=# applet.aid.cardmgr_instance=A0000001510000 -applet._004=######################################### -applet.aid.cardmgr_instance=A0000000030000 -applet.aid.netkey_file=627601FF0000 -applet.aid.netkey_instance=627601FF000000 -applet.aid.netkey_old_file=A000000001 -applet.aid.netkey_old_instance=A00000000101 -applet.delete_old=true -applet.so_pin=000000000000 -auths._000=## -auths._001=## new authentication -auths._002=## -auths.impl._000=## -auths.impl._001=## authentication manager implementations -auths.impl._002=## -auths.impl.AgentCertAuth.class=com.netscape.cms.authentication.AgentCertAuthentication -auths.impl.CMCAuth.class=com.netscape.cms.authentication.CMCAuth -auths.impl.NISAuth.class=com.netscape.cms.authentication.NISAuth -auths.impl.PortalEnroll.class=com.netscape.cms.authentication.PortalEnroll -auths.impl.SSLclientCertAuth.class=com.netscape.cms.authentication.SSLclientCertAuthentication -auths.impl.TokenAuth.class=com.netscape.cms.authentication.TokenAuthentication -auths.impl.UdnPwdDirAuth.class=com.netscape.cms.authentication.UdnPwdDirAuthentication -auths.impl.UidPwdDirAuth.class=com.netscape.cms.authentication.UidPwdDirAuthentication -auths.impl.UidPwdPinDirAuth.class=com.netscape.cms.authentication.UidPwdPinDirAuthentication -auths.instance.AgentCertAuth.agentGroup=Certificate Manager Agents -auths.instance.AgentCertAuth.pluginName=AgentCertAuth -auths.instance.TokenAuth.pluginName=TokenAuth -auths.instance.ldap1.dnpattern= -auths.instance.ldap1.ldapByteAttributes= -auths.instance.ldap1.ldapStringAttributes=mail,cn,uid -auths.instance.ldap1.ldap.basedn=[LDAP_ROOT] -auths.instance.ldap1.ldap.maxConns=15 -auths.instance.ldap1.ldap.minConns=3 -auths.instance.ldap1.ldap.ldapauth.authtype=BasicAuth -auths.instance.ldap1.ldap.ldapauth.bindDN= -auths.instance.ldap1.ldap.ldapauth.bindPWPrompt=ldap1 -auths.instance.ldap1.ldap.ldapauth.clientCertNickname= -auths.instance.ldap1.ldap.ldapconn.host=[LDAP_HOST] -auths.instance.ldap1.ldap.ldapconn.port=[LDAP_PORT] -auths.instance.ldap1.ldap.ldapconn.secureConn=false -auths.instance.ldap1.ldap.ldapconn.version=3 -auths.instance.ldap1.pluginName=UidPwdDirAuth -auths.instance.SSLclientCertAuth.pluginName=SSLclientCertAuth -auths.revocationChecking.bufferSize=50 -authType=pwd -authz._000=## -authz._001=## new authorizatioin -authz._002=## -authz.evaluateOrder=deny,allow -authz.impl._000=## -authz.impl._001=## authorization manager implementations -authz.impl._002=## -authz.impl.BasicAclAuthz.class=com.netscape.cms.authorization.BasicAclAuthz -authz.impl.DirAclAuthz.class=com.netscape.cms.authorization.DirAclAuthz -authz.instance.BasicAclAuthz.pluginName=BasicAclAuthz -authz.instance.DirAclAuthz.ldap._000=## -authz.instance.DirAclAuthz.ldap._001=## Internal Database -authz.instance.DirAclAuthz.ldap._002=## -authz.instance.DirAclAuthz.ldap=internaldb -authz.instance.DirAclAuthz.pluginName=DirAclAuthz -authz.sourceType=ldap -channel._000=######################################### -channel._001=# channel.encryption: -channel._002=# -channel._003=# - enable encryption for all operation commands to token -channel._004=# - default is true -channel._005=# channel.blocksize=242 -channel._006=# channel.defKeyVersion=0 -channel._007=# channel.defKeyIndex=0 -channel._008=# -channel._009=# Config the size of memory managed memory in the applet -channel._010=# Default is 5000, try not go get close to the instanceSize -channel._011=# which defaults to 18000: -channel._012=# -channel._013=# * channel.instanceSize=18000 -channel._014=# * channel.appletMemorySize=5000 -channel._015=######################################### -channel.encryption=true -channel.blocksize=248 -channel.defKeyVersion=0 -channel.defKeyIndex=0 -cms.product.version=@APPLICATION_VERSION@ -cms.version=@APPLICATION_VERSION_MAJOR@.@APPLICATION_VERSION_MINOR@ -config.Generals.General.state=Enabled -config.Generals.General.timestamp=1280283607424406 -configurationRoot=/[PKI_SUBSYSTEM_TYPE]/conf/ +pidDir=[PKI_PIDDIR] +pkicreate.pki_instance_root=[PKI_INSTANCE_ROOT] +pkicreate.pki_instance_name=[PKI_INSTANCE_NAME] +pkicreate.subsystem_type=[PKI_SUBSYSTEM_TYPE] +pkicreate.secure_port=[PKI_SECURE_PORT] +pkicreate.non_clientauth_secure_port=[NON_CLIENTAUTH_SECURE_PORT] +pkicreate.unsecure_port=[PKI_UNSECURE_PORT] +pkicreate.user=[PKI_USER] +pkicreate.group=[PKI_GROUP] +pkiremove.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] +cs.type=TPS +selftests._000=## +selftests._001=## Self Tests +selftests._002=## +selftests._003=## The Self-Test plugin TPSSystemCertsVerification uses the +selftests._004=## following parameters (where certusage is optional): +selftests._005=## tps.cert.list = <list of cert tag names deliminated by ","> +selftests._006=## tps.cert.<cert tag name>.nickname +selftests._007=## tps.cert.<cert tag name>.certusage +selftests._008=## +selftests.container.logger.enable=true +selftests.container.logger.expirationTime=0 +selftests.container.logger.file.type=RollingLogFile +selftests.container.logger.fileName=[PKI_INSTANCE_PATH]/logs/selftests.log +selftests.container.logger.level=10 +selftests.container.logger.maxFileSize=2000 +selftests.container.logger.rolloverInterval=2592000 +selftests.container.order.startup=TPSPresence:critical, TPSSystemCertsVerification:critical +selftests.container.order.onDemand=TPSPresence:critical, TPSValidity:critical, TPSSystemCertsVerification:critical +selftests.plugin.TPSPresence.nickname=[HSM_LABEL][NICKNAME] +selftests.plugin.TPSValidity.nickname=[HSM_LABEL][NICKNAME] +service.machineName=[PKI_HOSTNAME] +service.instanceDir=[PKI_INSTANCE_PATH] +service.securePort=[PKI_SECURE_PORT] +service.non_clientauth_securePort=[NON_CLIENTAUTH_SECURE_PORT] +service.unsecurePort=[PKI_UNSECURE_PORT] +service.instanceID=[PKI_INSTANCE_NAME] +logging._000=######################################### +logging._001=# RA configuration File +logging._002=# +logging._003=# All <...> must be replaced with +logging._004=# appropriate values. +logging._005=######################################### +logging._006=######################################## +logging._007=# logging +logging._008=# +logging._009=# logging.debug.enable: +logging._010=# logging.audit.enable: +logging._011=# logging.error.enable: +logging._012=# - enable or disable the corresponding logging +logging._013=# logging.debug.filename: +logging._014=# logging.audit.filename: +logging._015=# logging.error.filename: +logging._016=# - name of the log file +logging._017=# logging.debug.level: +logging._018=# logging.audit.level: +logging._019=# logging.error.level: +logging._020=# - level of logging. (0-10) +logging._021=# 0 - no logging, +logging._022=# 4 - LL_PER_SERVER these messages will occur only once +logging._023=# during the entire invocation of the +logging._024=# server, e. g. at startup or shutdown +logging._025=# time., reading the conf parameters. +logging._026=# Perhaps other infrequent events +logging._027=# relating to failing over of CA, TKS, +logging._028=# too +logging._029=# 6 - LL_PER_CONNECTION these messages happen once per +logging._030=# connection - most of the log events +logging._031=# will be at this level +logging._032=# 8 - LL_PER_PDU these messages relate to PDU +logging._033=# processing. If you have something that +logging._034=# is done for every PDU, such as +logging._035=# applying the MAC, it should be logged +logging._036=# at this level +logging._037=# 9 - LL_ALL_DATA_IN_PDU dump all the data in the PDU - a more +logging._038=# chatty version of the above +logging._039=# 10 - all logging +logging._040=# logging.audit.buffer.size: # in bytes +logging._041=# logging.audit.flush.interval: # in seconds, 0 disables flush thread +logging._042=# logging.*.file.type: +logging._043=# - file type: RollingLogFile or LogFile +logging._044=# logging.*.rolloverInterval: +logging._045=# - interval to roll over logs (seconds), 0 to disable rollover +logging._046=# logging.*.maxFileSize: +logging._047=# - size at which file rollover occurs, in kB +logging._048=# logging.*.expirationTime: +logging._049=# - maximum age of log, older unmodified logs are deleted( in seconds, 0 to disable) +logging._050=######################################### +logging.debug.enable=true +logging.debug.filename=[PKI_INSTANCE_PATH]/logs/tps-debug.log +logging.debug.level=10 +logging.debug.file.type=RollingLogFile +logging.debug.maxFileSize=2000 +logging.debug.rolloverInterval=2592000 +logging.debug.expirationTime=0 +logging.audit.enable=true +logging.audit.filename=[PKI_INSTANCE_PATH]/logs/tps-audit.log +logging.audit.signedAuditFilename=[PKI_INSTANCE_PATH]/logs/signedAudit/tps_audit +logging.audit.level=10 +logging.audit.logSigning=false +logging.audit.signedAuditCertNickname=auditSigningCert cert-[PKI_INSTANCE_NAME] +logging.audit.selected.events=AUTHZ_SUCCESS,AUTHZ_FAIL,AUTH_FAIL,AUTH_SUCCESS,ROLE_ASSUME,ENROLLMENT,PIN_RESET,FORMAT,CONFIG,CONFIG_ROLE,CONFIG_TOKEN,CONFIG_PROFILE,CONFIG_AUDIT,APPLET_UPGRADE,KEY_CHANGEOVER,RENEWAL,CIMC_CERT_VERIFICATION +logging.audit.selectable.events=AUTHZ_SUCCESS,AUTHZ_FAIL,AUTH_FAIL,AUTH_SUCCESS,ROLE_ASSUME,ENROLLMENT,PIN_RESET,FORMAT,CONFIG,CONFIG_ROLE,CONFIG_TOKEN,CONFIG_PROFILE,CONFIG_AUDIT,APPLET_UPGRADE,KEY_CHANGEOVER,RENEWAL,CIMC_CERT_VERIFICATION +logging.audit.nonselectable.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,LOGGING_SIGNED_AUDIT_SIGNING +logging.audit.buffer.size=512 +logging.audit.flush.interval=5 +logging.audit.file.type=RollingLogFile +logging.audit.maxFileSize=2000 +logging.audit.rolloverInterval=2592000 +logging.audit.expirationTime=0 +logging.error.enable=true +logging.error.filename=[PKI_INSTANCE_PATH]/logs/tps-error.log +logging.error.level=10 +logging.error.file.type=RollingLogFile +logging.error.maxFileSize=2000 +logging.error.rolloverInterval=2592000 +logging.error.expirationTime=0 conn.ca1._000=######################################### conn.ca1._001=# CA connection conn.ca1._002=# @@ -124,51 +149,17 @@ conn.ca1._027=# conn.ca1._028=# where conn.ca1._029=# <n> - CA connection ID conn.ca1._030=######################################### -conn.ca1.clientNickname=[HSM_LABEL][NICKNAME] +failover.pod.enable=false conn.ca1.hostport=[PKI_CA_HOSTNAME]:[PKI_CA_PORT] -conn.ca1.keepAlive=true -conn.ca1.retryConnect=3 +conn.ca1.clientNickname=[HSM_LABEL][NICKNAME] conn.ca1.servlet.enrollment=/ca/ee/ca/profileSubmitSSLClient conn.ca1.servlet.renewal=/ca/ee/ca/profileSubmitSSLClient conn.ca1.servlet.revoke=/ca/ee/subsystem/ca/doRevoke conn.ca1.servlet.unrevoke=/ca/ee/subsystem/ca/doUnrevoke -conn.ca1.SSLOn=true +conn.ca1.retryConnect=3 conn.ca1.timeout=100 -conn.drm1._000=######################################### -conn.drm1._001=# DRM connection -conn.drm1._002=# -conn.drm1._003=#conn.drm.totalConns -conn.drm1._004=# - # of DRM connections -conn.drm1._005=#conn.drm<n>.hostport -conn.drm1._006=# - host name and port number of your DRM, the format is host:port -conn.drm1._007=#conn.drm<n>.clientNickname -conn.drm1._008=# - nickname of the client certificate for -conn.drm1._009=# authentication -conn.drm1._010=#conn.drm<n>.servlet.GenerateKeyPair -conn.drm1._011=# - servlet to generate key pairs and archive keys on DRM -conn.drm1._012=# - must be '/kra/GenerateKeyPair' -conn.drm1._013=#conn.drm<n>.servlet.TokenKeyRecovery=/kra/TokenKeyRecovery -conn.drm1._014=# - servlet to handle key recovery -conn.drm1._015=# - must be '/kra/TokenKeyRecovery' -conn.drm1._016=#conn.drm<n>.retryConnect=3 -conn.drm1._017=# - number of reconnection attempts on failure -conn.drm1._018=#conn.drm<n>.SSLOn=true -conn.drm1._019=# - enable SSL or not -conn.drm1._020=#conn.drm<n>.keepAlive=false -conn.drm1._021=# - enable keep alive or not -conn.drm1._022=# -conn.drm1._023=# where -conn.drm1._024=# <n> - DRM connection ID -conn.drm1._025=######################################### -conn.drm1.clientNickname=[HSM_LABEL][NICKNAME] -conn.drm1.hostport=[DRM_HOST]:[DRM_PORT] -conn.drm1.keepAlive=false -conn.drm1.retryConnect=3 -conn.drm1.servlet.GenerateKeyPair=/kra/agent/kra/GenerateKeyPair -conn.drm1.servlet.TokenKeyRecovery=/kra/agent/kra/TokenKeyRecovery -conn.drm1.SSLOn=true -conn.drm1.timeout=100 -conn.drm.totalConns=1 +conn.ca1.SSLOn=true +conn.ca1.keepAlive=true conn.tks1._000=######################################### conn.tks1._001=# TKS connection conn.tks1._002=# @@ -198,131 +189,275 @@ conn.tks1._025=# <n> - TKS connection ID conn.tks1._026=# conn.tks<n>.tksSharedSymKeyName: conn.tks1._027=# - set shared secret key name conn.tks1._028=######################################### +conn.tks1.hostport=[TKS_HOST]:[TKS_PORT] conn.tks1.clientNickname=[HSM_LABEL][NICKNAME] +conn.tks1.servlet.computeSessionKey=/tks/agent/tks/computeSessionKey +conn.tks1.servlet.encryptData=/tks/agent/tks/encryptData +conn.tks1.servlet.createKeySetData=/tks/agent/tks/createKeySetData +conn.tks1.servlet.computeRandomData=/tks/agent/tks/computeRandomData +conn.tks1.retryConnect=3 +conn.tks1.timeout=100 conn.tks1.generateHostChallenge=true -conn.tks1.hostport=[TKS_HOST]:[TKS_PORT] +conn.tks1.SSLOn=true conn.tks1.keepAlive=false conn.tks1.keySet=defKeySet -conn.tks1.retryConnect=3 conn.tks1.serverKeygen=[SERVER_KEYGEN] -conn.tks1.servlet.computeRandomData=/tks/agent/tks/computeRandomData -conn.tks1.servlet.computeSessionKey=/tks/agent/tks/computeSessionKey -conn.tks1.servlet.createKeySetData=/tks/agent/tks/createKeySetData -conn.tks1.servlet.encryptData=/tks/agent/tks/encryptData -conn.tks1.SSLOn=true -conn.tks1.timeout=100 conn.tks1.tksSharedSymKeyName=sharedSecret -cs.state=0 -cs.type=TPS -dbs.ldap=internaldb -dbs.newSchemaEntryAdded=true -debug.append=true -debug.enabled=true -debug.filename=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/debug -debug.hashkeytypes= -debug.level=0 -debug.showcaller=false -failover.pod.enable=false +conn.drm1._000=######################################### +conn.drm1._001=# DRM connection +conn.drm1._002=# +conn.drm1._003=#conn.drm.totalConns +conn.drm1._004=# - # of DRM connections +conn.drm1._005=#conn.drm<n>.hostport +conn.drm1._006=# - host name and port number of your DRM, the format is host:port +conn.drm1._007=#conn.drm<n>.clientNickname +conn.drm1._008=# - nickname of the client certificate for +conn.drm1._009=# authentication +conn.drm1._010=#conn.drm<n>.servlet.GenerateKeyPair +conn.drm1._011=# - servlet to generate key pairs and archive keys on DRM +conn.drm1._012=# - must be '/kra/GenerateKeyPair' +conn.drm1._013=#conn.drm<n>.servlet.TokenKeyRecovery=/kra/TokenKeyRecovery +conn.drm1._014=# - servlet to handle key recovery +conn.drm1._015=# - must be '/kra/TokenKeyRecovery' +conn.drm1._016=#conn.drm<n>.retryConnect=3 +conn.drm1._017=# - number of reconnection attempts on failure +conn.drm1._018=#conn.drm<n>.SSLOn=true +conn.drm1._019=# - enable SSL or not +conn.drm1._020=#conn.drm<n>.keepAlive=false +conn.drm1._021=# - enable keep alive or not +conn.drm1._022=# +conn.drm1._023=# where +conn.drm1._024=# <n> - DRM connection ID +conn.drm1._025=######################################### +conn.drm.totalConns=1 +conn.drm1.hostport=[DRM_HOST]:[DRM_PORT] +conn.drm1.clientNickname=[HSM_LABEL][NICKNAME] +conn.drm1.servlet.GenerateKeyPair=/kra/agent/kra/GenerateKeyPair +conn.drm1.servlet.TokenKeyRecovery=/kra/agent/kra/TokenKeyRecovery +conn.drm1.retryConnect=3 +conn.drm1.timeout=100 +conn.drm1.SSLOn=true +conn.drm1.keepAlive=false +auth.instance._000=######################################## +auth.instance._001=# publishing +auth.instance._002=# +auth.instance._003=# publisher.instance.<n>.libraryName: +auth.instance._004=# - name of the library specified with a fully qualified path name +auth.instance._005=# publisher.instance.<n>.libraryFactory: +auth.instance._006=# - the name of the function which instantiates the publisher +auth.instance._007=# publisher.instance.<n>.publisherId: +auth.instance._008=# - the publisher ID +auth.instance._009=# +auth.instance._010=# where +auth.instance._011=# <n> - publisher connection ID +auth.instance._012=######################################## +auth.instance._013=######################################### +auth.instance._014=# authentication +auth.instance._015=# +auth.instance._016=# auth.instance.<n>.libraryName: +auth.instance._017=# - name of the library specified with a fully qualified path name +auth.instance._018=# auth.instance.<n>.libraryFactory: +auth.instance._019=# - the name of the function which instantiates the authentication +auth.instance._020=# auth.instance.<n>.authId +auth.instance._021=# - the authentication ID +auth.instance._022=# auth.instance.<n>.hostport +auth.instance._023=# - parameter specific to the given authentication, +auth.instance._024=# i. e., LDAPAuthentication (id=ldap1) +auth.instance._025=# - host name and port number, host:port +auth.instance._026=# - for failover, provide multiple host:port designations +auth.instance._027=# separated by " " +auth.instance._028=# auth.instance.<n>.SSLOn: +auth.instance._029=# - parameter specific to the given authentication, +auth.instance._030=# i. e., LDAPAuthentication (id=ldap1) +auth.instance._031=# - use SSL or not for LDAP service +auth.instance._032=# auth.instance.<n>.retries: +auth.instance._033=# - parameter specific to the given authentication, +auth.instance._034=# i. e., LDAPAuthentication (id=ldap1) +auth.instance._035=# - number of authentication re-attempts when authentication failed +auth.instance._036=# auth.instance.<n>.retryConnect: +auth.instance._037=# - parameter specific to the given authentication, +auth.instance._038=# i. e., LDAPAuthentication (id=ldap1) +auth.instance._039=# - number of connection re-attempts when connection failed +auth.instance._040=# +auth.instance._041=# where +auth.instance._042=# <n> - authentication connection ID +auth.instance._043=######################################### +auth.instance.0.type=LDAP_Authentication +auth.instance.0.libraryName=[SYSTEM_USER_LIBRARIES]/tps/[LIB_PREFIX]ldapauth[OBJ_EXT] +auth.instance.0.libraryFactory=GetAuthentication +auth.instance.0.authId=ldap1 +auth.instance.0.hostport=[LDAP_HOST]:[LDAP_PORT] +auth.instance.0.SSLOn=false +auth.instance.0.retries=1 +auth.instance.0.retryConnect=3 +auth.instance.0.baseDN=[LDAP_ROOT] +auth.instance.0.ssl=false +auth.instance.0.attributes._001=############################################## +auth.instance.0.attributes._002=# attributes will be available +auth.instance.0.attributes._003=# as $auth.<attribute>$ +auth.instance.0.attributes._004=############################################## +auth.instance.0.attributes=mail,cn,uid +auth.instance.0.ui.title.en=LDAP Authentication +auth.instance.0.ui.description.en=This authenticates user against the LDAP directory. +auth.instance.0.ui.id.UID.name.en=LDAP User ID +auth.instance.0.ui.id.PASSWORD.name.en=LDAP Password +auth.instance.0.ui.id.UID.description.en=LDAP User ID +auth.instance.0.ui.id.PASSWORD.description.en=LDAP Password +auth.instance.1.type=LDAP_Authentication +auth.instance.1.libraryName=[SYSTEM_USER_LIBRARIES]/tps/[LIB_PREFIX]ldapauth[OBJ_EXT] +auth.instance.1.libraryFactory=GetAuthentication +auth.instance.1.authId=ldap2 +auth.instance.1.bindDN=cn=Directory Manager +auth.instance.1.bindPWD=[PKI_INSTANCE_PATH]/conf/password.conf +auth.instance.1.hostport=[TOKENDB_HOST]:[TOKENDB_PORT] +auth.instance.1.SSLOn=false +auth.instance.1.retries=1 +auth.instance.1.retryConnect=3 +auth.instance.1.baseDN=[TOKENDB_ROOT] +auth.instance.1.ssl=false +auth.instance.1.attributes._001=############################################## +auth.instance.1.attributes._002=# attributes will be available +auth.instance.1.attributes._003=# as $auth.<attribute>$ +auth.instance.1.attributes._004=############################################## +auth.instance.1.attributes=mail,cn,uid +auth.instance.1.ui.title.en=LDAP Authentication +auth.instance.1.ui.description.en=This authenticates user against the LDAP directory. +auth.instance.1.ui.id.UID.name.en=LDAP User ID +auth.instance.1.ui.id.PASSWORD.name.en=LDAP Password +auth.instance.1.ui.id.UID.description.en=LDAP User ID +auth.instance.1.ui.id.PASSWORD.description.en=LDAP Password +applet._000=######################################### +applet._001=# applet information +applet._002=# SAF Key: +applet._003=# applet.aid.cardmgr_instance=A0000001510000 +applet._004=######################################### +applet.aid.cardmgr_instance=A0000000030000 +applet.aid.netkey_instance=627601FF000000 +applet.aid.netkey_file=627601FF0000 +applet.aid.netkey_old_instance=A00000000101 +applet.aid.netkey_old_file=A000000001 +applet.so_pin=000000000000 +applet.delete_old=true +general.verifyProof=1 general.applet_ext=ijc -general.pwlength.min=16 -general.search.sizelimit.default=100 general.search.sizelimit.max=2000 -general.search.timelimit.default=10 +general.search.sizelimit.default=100 general.search.timelimit.max=10 -general.verifyProof=1 -installDate=[INSTALL_TIME] -instanceId=[PKI_INSTANCE_NAME] -instanceRoot=[PKI_INSTANCE_PATH] -internaldb._000=## -internaldb._001=## Internal Database -internaldb._002=## -internaldb.ldapauth.authtype=BasicAuth -internaldb.ldapauth.bindDN=cn=Directory Manager -internaldb.ldapauth.bindPWPrompt=Internal LDAP Database -internaldb.ldapauth.clientCertNickname= -internaldb.ldapconn.host= -internaldb.ldapconn.port= -internaldb.ldapconn.secureConn=false -internaldb.maxConns=15 -internaldb.minConns=3 -internaldb.multipleSuffix.enable=false -jss._000=## -jss._001=## JSS -jss._002=## -jss.configDir=[PKI_INSTANCE_PATH]/alias/ -jss.enable=true -jss.ocspcheck.enable=false -jss.secmodName=secmod.db -jss.ssl.cipherfortezza=true -jss.ssl.cipherpref= -jss.ssl.cipherversion=cipherdomestic -keys.ecc.curve.default=nistp256 -keys.ecc.curve.display.list=nistp256 (secp256r1),nistp384 (secp384r1),nistp521 (secp521r1),nistk163 (sect163k1),sect163r1,nistb163 (sect163r2),sect193r1,sect193r2,nistk233 (sect233k1),nistb233 (sect233r1),sect239k1,nistk283 (sect283k1),nistb283 (sect283r1),nistk409 (sect409k1),nistb409 (sect409r1),nistk571 (sect571k1),nistb571 (sect571r1),secp160k1,secp160r1,secp160r2,secp192k1,nistp192 (secp192r1, prime192v1),secp224k1,nistp224 (secp224r1),secp256k1,prime192v2,prime192v3,prime239v1,prime239v2,prime239v3,c2pnb163v1,c2pnb163v2,c2pnb163v3,c2pnb176v1,c2tnb191v1,c2tnb191v2,c2tnb191v3,c2pnb208w1,c2tnb239v1,c2tnb239v2,c2tnb239v3,c2pnb272w1,c2pnb304w1,c2tnb359w1,c2pnb368w1,c2tnb431r1,secp112r1,secp112r2,secp128r1,secp128r2,sect113r1,sect113r2,sect131r1,sect131r2 -keys.ecc.curve.list=nistp256,nistp384,nistp521,sect163k1,nistk163,sect163r1,sect163r2,nistb163,sect193r1,sect193r2,sect233k1,nistk233,sect233r1,nistb233,sect239k1,sect283k1,nistk283,sect283r1,nistb283,sect409k1,nistk409,sect409r1,nistb409,sect571k1,nistk571,sect571r1,nistb571,secp160k1,secp160r1,secp160r2,secp192k1,secp192r1,nistp192,secp224k1,secp224r1,nistp224,secp256k1,secp256r1,secp384r1,secp521r1,prime192v1,prime192v2,prime192v3,prime239v1,prime239v2,prime239v3,c2pnb163v1,c2pnb163v2,c2pnb163v3,c2pnb176v1,c2tnb191v1,c2tnb191v2,c2tnb191v3,c2pnb208w1,c2tnb239v1,c2tnb239v2,c2tnb239v3,c2pnb272w1,c2pnb304w1,c2tnb359w1,c2pnb368w1,c2tnb431r1,secp112r1,secp112r2,secp128r1,secp128r2,sect113r1,sect113r2,sect131r1,sect131r2 -keys.rsa.keysize.default=2048 -log._000=## -log._001=## Logging -log._002=## -logAudit.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/access -logError.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/error -log.impl.file.class=com.netscape.cms.logging.RollingLogFile -log.instance.SignedAudit._000=## -log.instance.SignedAudit._001=## Signed Audit Logging -log.instance.SignedAudit._002=## -log.instance.SignedAudit._003=## -log.instance.SignedAudit._004=## Available Audit events: -log.instance.SignedAudit._005=## AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE,OCSP_ADD_CA_REQUEST,OCSP_ADD_CA_REQUEST_PROCESSED,OCSP_REMOVE_CA_REQUEST,OCSP_REMOVE_CA_REQUEST_PROCESSED_SUCCESS,OCSP_REMOVE_CA_REQUEST_PROCESSED_FAILURE,COMPUTE_RANDOM_DATA_REQUEST,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE,CIMC_CERT_VERIFICATION -log.instance.SignedAudit._006=## -log.instance.SignedAudit.bufferSize=512 -log.instance.SignedAudit.enable=true -log.instance.SignedAudit.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE,OCSP_ADD_CA_REQUEST,OCSP_ADD_CA_REQUEST_PROCESSED,OCSP_REMOVE_CA_REQUEST,OCSP_REMOVE_CA_REQUEST_PROCESSED_SUCCESS,OCSP_REMOVE_CA_REQUEST_PROCESSED_FAILURE,COMPUTE_RANDOM_DATA_REQUEST,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE,CIMC_CERT_VERIFICATION,LOGGING_SIGNED_AUDIT_SIGNING,ENROLLMENT,PIN_RESET,FORMAT,CONFIG,CONFIG_TOKEN,CONFIG_PROFILE,APPLET_UPGRADE,KEY_CHANGEOVER,RENEWAL,CIMC_CERT_VERIFICATION -log.instance.SignedAudit.expirationTime=0 -log.instance.SignedAudit.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/signedAudit/tps_cert-tps_audit -log.instance.SignedAudit.flushInterval=5 -log.instance.SignedAudit.level=1 -log.instance.SignedAudit.logSigning=false -log.instance.SignedAudit.maxFileSize=2000 -log.instance.SignedAudit.pluginName=file -log.instance.SignedAudit.rolloverInterval=2592000 -log.instance.SignedAudit.signedAudit:_000=## -log.instance.SignedAudit.signedAudit:_001=## Fill in the nickname of a trusted signing certificate to allow TPS audit logs to be signed -log.instance.SignedAudit.signedAudit:_002=## -log.instance.SignedAudit.signedAuditCertNickname=auditSigningCert cert-[PKI_INSTANCE_NAME] -log.instance.SignedAudit.type=signedAudit -log.instance.System._000=## -log.instance.System._001=## System Logging -log.instance.System._002=## -log.instance.System.bufferSize=512 -log.instance.System.enable=true -log.instance.System.expirationTime=0 -log.instance.System.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/system -log.instance.System.flushInterval=5 -log.instance.System.level=3 -log.instance.System.maxFileSize=2000 -log.instance.System.pluginName=file -log.instance.System.rolloverInterval=2592000 -log.instance.System.type=system -log.instance.Transactions._000=## -log.instance.Transactions._001=## Transaction Logging -log.instance.Transactions._002=## -log.instance.Transactions.bufferSize=512 -log.instance.Transactions.enable=true -log.instance.Transactions.expirationTime=0 -log.instance.Transactions.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/transactions -log.instance.Transactions.flushInterval=5 -log.instance.Transactions.level=1 -log.instance.Transactions.maxFileSize=2000 -log.instance.Transactions.pluginName=file -log.instance.Transactions.rolloverInterval=2592000 -log.instance.Transactions.type=transaction -machineName=[PKI_HOSTNAME] -multiroles._000=## -multiroles._001=## multiroles -multiroles._002=## -multiroles.enable=true -multiroles.false.groupEnforceList=Administrators,Auditors,Trusted Managers,Certificate Manager Agents,Registration Manager Agents,Data Recovery Manager Agents,Online Certificate Status Manager Agents,Token Key Service Manager Agents,Enterprise CA Administrators,Enterprise KRA Administrators,Enterprise OCSP Administrators,Enterprise RA Administrators,Enterprise TKS Administrators,Enterprise TPS Administrators,Security Domain Administrators,Subsystem Group,ClonedSubsystems -multiroles.false.groupEnforceList=Administrators,Auditors,Trusted Managers,Certificate Manager Agents,Registration Manager Agents,Data Recovery Manager Agents,Online Certificate Status Manager Agents,Token Key Service Manager Agents,Enterprise CA Administrators,Enterprise KRA Adminstrators,Enterprise OCSP Administrators,Enterprise RA Administrators,Enterprise TKS Administrators,Enterprise TPS Administrators,Security Domain Administrators,Subsystem Group -multiroles=true +general.search.timelimit.default=10 +general.pwlength.min=16 +channel._000=######################################### +channel._001=# channel.encryption: +channel._002=# +channel._003=# - enable encryption for all operation commands to token +channel._004=# - default is true +channel._005=# channel.blocksize=242 +channel._006=# channel.defKeyVersion=0 +channel._007=# channel.defKeyIndex=0 +channel._008=######################################### +channel.encryption=true +channel.blocksize=248 +channel.defKeyVersion=0 +channel.defKeyIndex=0 +# NOTE: Since the following comments will be 'scrubbed' from any TPS +# instance's configuration file, they will ONLY be viewable in +# the '/usr/share/pki/tps/conf/CS.cfg' TPS subsystem template! +# +# Config the size of memory managed memory in the applet +# Default is 5000, try not go get close to the instanceSize +# which defaults to 18000: +# +# * channel.instanceSize=18000 +# * channel.appletMemorySize=5000 +# +preop.pin=[PKI_RANDOM_NUMBER] +cms.product.version=@APPLICATION_VERSION@ +preop.cert._000=######################################### +preop.cert._001=# Installation configuration "preop" certs parameters +preop.cert._002=######################################### +preop.cert.list=sslserver,subsystem,audit_signing +tps.cert.audit_signing.certusage=ObjectSigner +tps.cert.sslserver.certusage=SSLServer +tps.cert.subsystem.certusage=SSLClient +preop.cert.sslserver.enable=true +preop.cert.subsystem.enable=true +preop.cert.audit_signing.enable=false +preop.cert.sslserver.defaultSigningAlgorithm=SHA256withRSA +preop.cert.sslserver.dn=CN=[PKI_HOSTNAME], OU=[PKI_INSTANCE_NAME] +preop.cert.sslserver.keysize.customsize=2048 +preop.cert.sslserver.keysize.size=2048 +preop.cert.sslserver.keysize.select=default +preop.cert.sslserver.nickname=Server-Cert cert-[PKI_INSTANCE_NAME] +preop.cert.sslserver.profile=caInternalAuthServerCert +preop.cert.sslserver.subsystem=tps +preop.cert._003=#preop.cert.sslserver.type=local +preop.cert.sslserver.userfriendlyname=SSL Server Certificate +preop.cert._004=#preop.cert.sslserver.cncomponent.override=false +preop.cert.subsystem.defaultSigningAlgorithm=SHA256withRSA +preop.cert.subsystem.dn=CN=TPS Subsystem Certificate, OU=[PKI_INSTANCE_NAME] +preop.cert.subsystem.keysize.customsize=2048 +preop.cert.subsystem.keysize.size=2048 +preop.cert.subsystem.keysize.select=default +preop.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] +preop.cert.subsystem.profile=caInternalAuthSubsystemCert +preop.cert.subsystem.subsystem=tps +preop.cert._005=#preop.cert.subsystem.type=local +preop.cert.subsystem.userfriendlyname=Subsystem Certificate +preop.cert._006=#preop.cert.subsystem.cncomponent.override=true +preop.cert.audit_signing.defaultSigningAlgorithm=SHA256withRSA +preop.cert.audit_signing.dn=CN=TPS Audit Signing Certificate, OU=[PKI_INSTANCE_NAME] +preop.cert.audit_signing.keysize.customsize=2048 +preop.cert.audit_signing.keysize.size=2048 +preop.cert.audit_signing.keysize.select=default +preop.cert.audit_signing.nickname=auditSigningCert cert-[PKI_INSTANCE_NAME] +preop.cert.audit_signing.profile=caInternalAuthAuditSigningCert +preop.cert.audit_signing.subsystem=tps +preop.cert._005=#preop.cert.audit_signing.type=local +preop.cert.audit_signing.userfriendlyname=Audit Log Signing Certificate +preop.cert._006=#preop.cert.audit_signing.cncomponent.override=true +preop.configModules._000=######################################### +preop.configModules._001=# Installation configuration "preop" module parameters +preop.configModules._002=######################################### +preop.configModules.count=3 +preop.configModules.module0.commonName=NSS Internal PKCS #11 Module +preop.configModules.module0.imagePath=/pki/images/clearpixel.gif +preop.configModules.module0.userFriendlyName=NSS Internal PKCS #11 Module +preop.configModules.module1.commonName=nfast +preop.configModules.module1.imagePath=/pki/images/clearpixel.gif +preop.configModules.module1.userFriendlyName=nCipher's nFast Token Hardware Module +preop.configModules.module2.commonName=lunasa +preop.configModules.module2.imagePath=/pki/images/clearpixel.gif +preop.configModules.module2.userFriendlyName=SafeNet's LunaSA Token Hardware Module +preop.module.token=NSS Certificate DB +preop.keysize._000=######################################### +preop.keysize._001=# Installation configuration "preop" keysize parameters +preop.keysize._002=######################################### +preop.keysize.customsize=2048 +preop.keysize.select=default +preop.keysize.size=2048 +preop.keysize.ecc.size=256 +preop.adminauth.done=false +preop.adminpanel.done=false +preop.agentauth.done=false +preop.authdb.done=false +preop.cainfo.done=false +preop.certprettyprint.done=false +preop.certrequest.done=false +preop.confighsmlogin.done=false +preop.confighsm.done=false +preop.database.done=false +preop.displaycertchain2.done=false +preop.displaycertchain.done=false +preop.donepanel.done=false +preop.drminfo.done=false +preop.importadmincert.done=false +preop.loginpanel.done=false +preop.ModulePanel.done=false +preop.namepanel.done=false +preop.securitydomain.done=false +preop.SizePanel.done=false +preop.subsystemtype.done=false +preop.tksinfo.done=false +preop.welcome.done=false op.enroll._000=######################################### op.enroll._001=# Default Operations op.enroll._002=# @@ -358,311 +493,85 @@ op.enroll._031=# op.enroll._032=# Token ATR: op.enroll._033=# Web Store - 3B759400006202020201 op.enroll._034=######################################### -op.enroll.allowUnknownToken=true -op.enroll.mapping.0.filter.appletMajorVersion=1 -op.enroll.mapping.0.filter.appletMinorVersion= +op.enroll.mapping.order=0,1,2 +op.enroll.mapping.0.filter.tokenType=userKey op.enroll.mapping.0.filter.tokenATR= -op.enroll.mapping.0.filter.tokenCUID.end= op.enroll.mapping.0.filter.tokenCUID.start= -op.enroll.mapping.0.filter.tokenType=userKey +op.enroll.mapping.0.filter.tokenCUID.end= +op.enroll.mapping.0.filter.appletMajorVersion=1 +op.enroll.mapping.0.filter.appletMinorVersion= op.enroll.mapping.0.target.tokenType=userKey -op.enroll.mapping.1.filter.appletMajorVersion= -op.enroll.mapping.1.filter.appletMinorVersion= +op.enroll.mapping.1.filter.tokenType=soKey op.enroll.mapping.1.filter.tokenATR= -op.enroll.mapping.1.filter.tokenCUID.end= op.enroll.mapping.1.filter.tokenCUID.start= -op.enroll.mapping.1.filter.tokenType=soKey +op.enroll.mapping.1.filter.tokenCUID.end= +op.enroll.mapping.1.filter.appletMajorVersion= +op.enroll.mapping.1.filter.appletMinorVersion= op.enroll.mapping.1.target.tokenType=soKey -op.enroll.mapping.2.filter.appletMajorVersion= -op.enroll.mapping.2.filter.appletMinorVersion= +op.enroll.mapping.2.filter.tokenType= op.enroll.mapping.2.filter.tokenATR= -op.enroll.mapping.2.filter.tokenCUID.end= op.enroll.mapping.2.filter.tokenCUID.start= -op.enroll.mapping.2.filter.tokenType= +op.enroll.mapping.2.filter.tokenCUID.end= +op.enroll.mapping.2.filter.appletMajorVersion= +op.enroll.mapping.2.filter.appletMinorVersion= op.enroll.mapping.2.target.tokenType=userKey -op.enroll.mapping.order=0,1,2 -op.enroll.soKey._079=#op.enroll.userKey.keyGen.signing.publisherId=fileBasedPublisher -op.enroll.soKey.auth.enable=true -op.enroll.soKey.auth.id=ldap2 -op.enroll.soKey.cardmgr_instance=A0000000030000 -op.enroll.soKey.issuerinfo.enable=true -op.enroll.soKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/so/index.cgi -op.enroll.soKey.keyGen.encryption.ca.conn=ca1 -op.enroll.soKey.keyGen.encryption.ca.profileId=caTokenUserEncryptionKeyEnrollment -op.enroll.soKey.keyGen.encryption.certAttrId=c2 -op.enroll.soKey.keyGen.encryption.certId=C2 -op.enroll.soKey.keyGen.encryption.cuid_label=$cuid$ -op.enroll.soKey.keyGen.encryption.keySize=1024 -op.enroll.soKey.keyGen.encryption.keyUsage=0 -op.enroll.soKey.keyGen.encryption.keyUser=0 -op.enroll.soKey.keyGen.encryption.label=encryption key for $userid$ -op.enroll.soKey.keyGen.encryption.overwrite=true -op.enroll.soKey.keyGen.encryption.privateKeyAttrId=k4 -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.decrypt=true -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.derive=false -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.encrypt=false -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.private=true -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.sensitive=true -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.sign=false -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.signRecover=false -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.token=true -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.unwrap=true -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.verify=false -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.verifyRecover=false -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.wrap=false -op.enroll.soKey.keyGen.encryption.privateKeyNumber=4 -op.enroll.soKey.keyGen.encryption.publicKeyAttrId=k5 -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.decrypt=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.derive=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.encrypt=true -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.private=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.sensitive=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.sign=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.signRecover=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.token=true -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.unwrap=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.verify=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.verifyRecover=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.wrap=true -op.enroll.soKey.keyGen.encryption.publicKeyNumber=5 -op.enroll.soKey.keyGen.encryption.recovery.destroyed.revokeCert=false -op.enroll.soKey.keyGen.encryption.recovery.destroyed.revokeCert.reason=0 -op.enroll.soKey.keyGen.encryption.recovery.destroyed.scheme=RecoverLast -op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.revokeCert.reason=1 -op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.revokeCert=true -op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.scheme=GenerateNewKey -op.enroll.soKey.keyGen.encryption.recovery.onHold.revokeCert.reason=6 -op.enroll.soKey.keyGen.encryption.recovery.onHold.revokeCert=true -op.enroll.soKey.keyGen.encryption.recovery.onHold.scheme=GenerateNewKey -op.enroll.soKey.keyGen.encryption.serverKeygen.archive=true -op.enroll.soKey.keyGen.encryption.serverKeygen.drm.conn=drm1 -op.enroll.soKey.keyGen.encryption.serverKeygen.enable=[SERVER_KEYGEN] -op.enroll.soKey.keyGen.keyType.num=2 -op.enroll.soKey.keyGen.keyType.value.0=signing -op.enroll.soKey.keyGen.keyType.value.1=encryption -op.enroll.soKey.keyGen.recovery.destroyed.keyType.num=2 -op.enroll.soKey.keyGen.recovery.destroyed.keyType.value.0=signing -op.enroll.soKey.keyGen.recovery.destroyed.keyType.value.1=encryption -op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.num=2 -op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.value.0=signing -op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.value.1=encryption -op.enroll.soKey.keyGen.recovery.onHold.keyType.num=2 -op.enroll.soKey.keyGen.recovery.onHold.keyType.value.0=signing -op.enroll.soKey.keyGen.recovery.onHold.keyType.value.1=encryption -op.enroll.soKey.keyGen.signing.ca.conn=ca1 -op.enroll.soKey.keyGen.signing.ca.profileId=caTokenUserSigningKeyEnrollment -op.enroll.soKey.keyGen.signing.certAttrId=c1 -op.enroll.soKey.keyGen.signing.certId=C1 -op.enroll.soKey.keyGen.signing.cuid_label=$cuid$ -op.enroll.soKey.keyGen.signing.keySize=1024 -op.enroll.soKey.keyGen.signing.keyUsage=0 -op.enroll.soKey.keyGen.signing.keyUser=0 -op.enroll.soKey.keyGen.signing.label=signing key for $userid$ -op.enroll.soKey.keyGen.signing.overwrite=true -op.enroll.soKey.keyGen.signing.privateKeyAttrId=k2 -op.enroll.soKey.keyGen.signing.private.keyCapabilities.decrypt=false -op.enroll.soKey.keyGen.signing.private.keyCapabilities.derive=false -op.enroll.soKey.keyGen.signing.private.keyCapabilities.encrypt=false -op.enroll.soKey.keyGen.signing.private.keyCapabilities.private=true -op.enroll.soKey.keyGen.signing.private.keyCapabilities.sensitive=true -op.enroll.soKey.keyGen.signing.private.keyCapabilities.signRecover=true -op.enroll.soKey.keyGen.signing.private.keyCapabilities.sign=true -op.enroll.soKey.keyGen.signing.private.keyCapabilities.token=true -op.enroll.soKey.keyGen.signing.private.keyCapabilities.unwrap=false -op.enroll.soKey.keyGen.signing.private.keyCapabilities.verify=false -op.enroll.soKey.keyGen.signing.private.keyCapabilities.verifyRecover=false -op.enroll.soKey.keyGen.signing.private.keyCapabilities.wrap=false -op.enroll.soKey.keyGen.signing.privateKeyNumber=2 -op.enroll.soKey.keyGen.signing.publicKeyAttrId=k3 -op.enroll.soKey.keyGen.signing.public.keyCapabilities.decrypt=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.derive=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.encrypt=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.private=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.sensitive=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.sign=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.signRecover=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.token=true -op.enroll.soKey.keyGen.signing.public.keyCapabilities.unwrap=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.verifyRecover=true -op.enroll.soKey.keyGen.signing.public.keyCapabilities.verify=true -op.enroll.soKey.keyGen.signing.public.keyCapabilities.wrap=false -op.enroll.soKey.keyGen.signing.publicKeyNumber=3 -op.enroll.soKey.keyGen.signing.recovery.destroyed.revokeCert.reason=0 -op.enroll.soKey.keyGen.signing.recovery.destroyed.revokeCert=true -op.enroll.soKey.keyGen.signing.recovery.destroyed.scheme=GenerateNewKey -op.enroll.soKey.keyGen.signing.recovery.keyCompromise.revokeCert.reason=1 -op.enroll.soKey.keyGen.signing.recovery.keyCompromise.revokeCert=true -op.enroll.soKey.keyGen.signing.recovery.keyCompromise.scheme=GenerateNewKey -op.enroll.soKey.keyGen.signing.recovery.onHold.revokeCert.reason=6 -op.enroll.soKey.keyGen.signing.recovery.onHold.revokeCert=true -op.enroll.soKey.keyGen.signing.recovery.onHold.scheme=GenerateNewKey -op.enroll.soKey.keyGen.tokenName=$auth.cn$ -op.enroll.soKey.loginRequest.enable=true -op.enroll.soKey.pinReset.enable=true -op.enroll.soKey.pinReset.pin.maxLen=10 -op.enroll.soKey.pinReset.pin.maxRetries=127 -op.enroll.soKey.pinReset.pin.minLen=4 -op.enroll.soKey.pkcs11obj.compress.enable=true -op.enroll.soKey.pkcs11obj.enable=true -op.enroll.soKeyTemporary.auth.enable=true -op.enroll.soKeyTemporary.auth.id=ldap2 -op.enroll.soKeyTemporary.cardmgr_instance=A0000000030000 -op.enroll.soKeyTemporary.keyGen.auth.ca.conn=ca1 -op.enroll.soKeyTemporary.keyGen.auth.ca.profileId=caTempTokenDeviceKeyEnrollment -op.enroll.soKeyTemporary.keyGen.auth.certAttrId=c0 -op.enroll.soKeyTemporary.keyGen.auth.certId=C0 -op.enroll.soKeyTemporary.keyGen.auth.cuid_label=$cuid$ -op.enroll.soKeyTemporary.keyGen.auth.keySize=1024 -op.enroll.soKeyTemporary.keyGen.auth.keyUsage=0 -op.enroll.soKeyTemporary.keyGen.auth.keyUser=15 -op.enroll.soKeyTemporary.keyGen.auth.label=Temporary Key for $userid$ -op.enroll.soKeyTemporary.keyGen.auth.overwrite=false -op.enroll.soKeyTemporary.keyGen.auth.privateKeyAttrId=k0 -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.decrypt=false -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.derive=false -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.encrypt=false -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.private=false -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.sensitive=true -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.signRecover=true -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.sign=true -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.token=true -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.unwrap=false -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.verifyRecover=true -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.verify=true -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.wrap=false -op.enroll.soKeyTemporary.keyGen.auth.privateKeyNumber=0 -op.enroll.soKeyTemporary.keyGen.auth.publicKeyAttrId=k1 -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.decrypt=false -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.derive=false -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.encrypt=false -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.private=false -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.sensitive=true -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.signRecover=true -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.sign=true -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.token=true -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.unwrap=false -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.verifyRecover=true -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.verify=true -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.wrap=false -op.enroll.soKeyTemporary.keyGen.auth.publicKeyNumber=1 -op.enroll.soKeyTemporary.keyGen.encryption.ca.conn=ca1 -op.enroll.soKeyTemporary.keyGen.encryption.ca.profileId=caTempTokenUserEncryptionKeyEnrollment -op.enroll.soKeyTemporary.keyGen.encryption.certAttrId=c2 -op.enroll.soKeyTemporary.keyGen.encryption.certId=C2 -op.enroll.soKeyTemporary.keyGen.encryption.cuid_label=$cuid$ -op.enroll.soKeyTemporary.keyGen.encryption.keySize=1024 -op.enroll.soKeyTemporary.keyGen.encryption.keyUsage=0 -op.enroll.soKeyTemporary.keyGen.encryption.keyUser=0 -op.enroll.soKeyTemporary.keyGen.encryption.label=encryption key for $userid$ -op.enroll.soKeyTemporary.keyGen.encryption.overwrite=true -op.enroll.soKeyTemporary.keyGen.encryption.privateKeyAttrId=k4 -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.decrypt=true -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.derive=false -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.encrypt=false -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.private=true -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.sensitive=true -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.sign=false -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.signRecover=false -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.token=true -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.unwrap=true -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.verify=false -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.verifyRecover=false -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.wrap=false -op.enroll.soKeyTemporary.keyGen.encryption.privateKeyNumber=4 -op.enroll.soKeyTemporary.keyGen.encryption.publicKeyAttrId=k5 -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.decrypt=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.derive=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.encrypt=true -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.private=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.sensitive=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.sign=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.signRecover=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.token=true -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.unwrap=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.verify=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.verifyRecover=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.wrap=true -op.enroll.soKeyTemporary.keyGen.encryption.publicKeyNumber=5 -op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert.reason=0 -op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert=true -op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.scheme=RecoverLast -op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.archive=true -op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.drm.conn=drm1 -op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.enable=true -op.enroll.soKeyTemporary.keyGen.keyType.num=3 -op.enroll.soKeyTemporary.keyGen.keyType.value.0=auth -op.enroll.soKeyTemporary.keyGen.keyType.value.1=signing -op.enroll.soKeyTemporary.keyGen.keyType.value.2=encryption -op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.num=2 -op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.value.0=signing -op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.value.1=encryption -op.enroll.soKeyTemporary.keyGen.signing.ca.conn=ca1 -op.enroll.soKeyTemporary.keyGen.signing.ca.profileId=caTempTokenUserSigningKeyEnrollment -op.enroll.soKeyTemporary.keyGen.signing.certAttrId=c1 -op.enroll.soKeyTemporary.keyGen.signing.certId=C1 -op.enroll.soKeyTemporary.keyGen.signing.cuid_label=$cuid$ -op.enroll.soKeyTemporary.keyGen.signing.keySize=1024 -op.enroll.soKeyTemporary.keyGen.signing.keyUsage=0 -op.enroll.soKeyTemporary.keyGen.signing.keyUser=0 -op.enroll.soKeyTemporary.keyGen.signing.label=signing key for $userid$ -op.enroll.soKeyTemporary.keyGen.signing.overwrite=true -op.enroll.soKeyTemporary.keyGen.signing.privateKeyAttrId=k2 -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.decrypt=false -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.derive=false -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.encrypt=false -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.private=true -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.sensitive=true -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.signRecover=true -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.sign=true -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.token=true -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.unwrap=false -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.verify=false -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.verifyRecover=false -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.wrap=false -op.enroll.soKeyTemporary.keyGen.signing.privateKeyNumber=2 -op.enroll.soKeyTemporary.keyGen.signing.publicKeyAttrId=k3 -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.decrypt=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.derive=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.encrypt=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.private=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.sensitive=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.sign=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.signRecover=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.token=true -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.unwrap=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.verifyRecover=true -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.verify=true -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.wrap=false -op.enroll.soKeyTemporary.keyGen.signing.publicKeyNumber=3 -op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.revokeCert.reason=0 -op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.revokeCert=true -op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.scheme=GenerateNewKey -op.enroll.soKeyTemporary.keyGen.tokenName=$auth.cn$ (Temporary) -op.enroll.soKeyTemporary.loginRequest.enable=true -op.enroll.soKeyTemporary.pinReset.enable=true -op.enroll.soKeyTemporary.pinReset.pin.maxLen=10 -op.enroll.soKeyTemporary.pinReset.pin.maxRetries=127 -op.enroll.soKeyTemporary.pinReset.pin.minLen=4 -op.enroll.soKeyTemporary.pkcs11obj.compress.enable=true -op.enroll.soKeyTemporary.pkcs11obj.enable=true -op.enroll.soKeyTemporary.tks.conn=tks1 -op.enroll.soKeyTemporary.tks.keySet=defKeyset -op.enroll.soKey.temporaryToken.tokenType=soKeyTemporary -op.enroll.soKeyTemporary.update.applet.directory=[TPS_DIR]/applets -op.enroll.soKeyTemporary.update.applet.emptyToken.enable=true -op.enroll.soKeyTemporary.update.applet.enable=true -op.enroll.soKeyTemporary.update.applet.encryption=true -op.enroll.soKeyTemporary.update.applet.requiredVersion=1.4.4d40a449 -op.enroll.soKeyTemporary.update.symmetricKeys.enable=false -op.enroll.soKeyTemporary.update.symmetricKeys.requiredVersion=1 -op.enroll.soKey.tks.conn=tks1 -op.enroll.soKey.update.applet.directory=[TPS_DIR]/applets -op.enroll.soKey.update.applet.emptyToken.enable=true -op.enroll.soKey.update.applet.enable=true -op.enroll.soKey.update.applet.encryption=true -op.enroll.soKey.update.applet.requiredVersion=1.4.4d40a449 -op.enroll.soKey.update.symmetricKeys.enable=false -op.enroll.soKey.update.symmetricKeys.requiredVersion=1 +op.pinReset.mapping.order=0 +op.pinReset.mapping.0.filter.tokenType= +op.pinReset.mapping.0.filter.tokenATR= +op.pinReset.mapping.0.filter.tokenCUID.start= +op.pinReset.mapping.0.filter.tokenCUID.end= +op.pinReset.mapping.0.filter.appletMajorVersion= +op.pinReset.mapping.0.filter.appletMinorVersion= +op.pinReset.mapping.0.target.tokenType=userKey +op.format.mapping.order=0,1,2,3,4,5,6 +op.format.mapping.0.filter.tokenType=soCleanUserToken +op.format.mapping.0.filter.tokenATR= +op.format.mapping.0.filter.tokenCUID.start= +op.format.mapping.0.filter.tokenCUID.end= +op.format.mapping.0.filter.appletMajorVersion= +op.format.mapping.0.filter.appletMinorVersion= +op.format.mapping.0.target.tokenType=soCleanUserToken +op.format.mapping.1.filter.tokenType=soUserKey +op.format.mapping.1.filter.tokenATR= +op.format.mapping.1.filter.tokenCUID.start= +op.format.mapping.1.filter.tokenCUID.end= +op.format.mapping.1.filter.appletMajorVersion= +op.format.mapping.1.filter.appletMinorVersion= +op.format.mapping.1.target.tokenType=soUserKey +op.format.mapping.2.filter.tokenType=soKey +op.format.mapping.2.filter.tokenATR= +op.format.mapping.2.filter.tokenCUID.start= +op.format.mapping.2.filter.tokenCUID.end= +op.format.mapping.2.filter.appletMajorVersion= +op.format.mapping.2.filter.appletMinorVersion= +op.format.mapping.2.target.tokenType=soKey +op.format.mapping.3.filter.tokenType=userKey +op.format.mapping.3.filter.tokenATR= +op.format.mapping.3.filter.tokenCUID.start= +op.format.mapping.3.filter.tokenCUID.end= +op.format.mapping.3.filter.appletMajorVersion= +op.format.mapping.3.filter.appletMinorVersion= +op.format.mapping.3.target.tokenType=userKey +op.format.mapping.4.filter.tokenType=soCleanSOToken +op.format.mapping.4.filter.tokenATR= +op.format.mapping.4.filter.tokenCUID.start= +op.format.mapping.4.filter.tokenCUID.end= +op.format.mapping.4.filter.appletMajorVersion= +op.format.mapping.4.filter.appletMinorVersion= +op.format.mapping.5.filter.tokenType=cleanToken +op.format.mapping.5.filter.tokenATR= +op.format.mapping.5.filter.tokenCUID.start= +op.format.mapping.5.filter.tokenCUID.end= +op.format.mapping.5.filter.appletMajorVersion= +op.format.mapping.5.filter.appletMinorVersion= +op.format.mapping.5.target.tokenType=cleanToken +op.format.mapping.4.target.tokenType=soCleanSOToken +op.format.mapping.6.filter.tokenATR= +op.format.mapping.6.filter.tokenCUID.start= +op.format.mapping.6.filter.tokenCUID.end= +op.format.mapping.6.filter.appletMajorVersion= +op.format.mapping.6.filter.appletMinorVersion= +op.format.mapping.6.target.tokenType=tokenKey op.enroll.userKey._000=######################################### op.enroll.userKey._001=# Enrollment Operation For CoolKey op.enroll.userKey._002=# @@ -742,10 +651,8 @@ op.enroll.userKey._075=# There is a special case of tokenType userKeyTemporary. op.enroll.userKey._076=# Make sure the profile specified by the profileId to have op.enroll.userKey._077=# short validity period (eg, 7 days) for the certificate. op.enroll.userKey._078=# -op.enroll.userKey._079=#op.enroll.userKey.keyGen.signing.publisherId=fileBasedPublisher op.enroll.userKey._079=# The three recovery schemes supported are: op.enroll.userKey._080=# -op.enroll.userKey._080=#op.enroll.userKeyTemporary.keyGen.signing.publisherId=fileBasedPublisher op.enroll.userKey._081=# * GenerateNewKey - Generate a new op.enroll.userKey._082=# cert for the op.enroll.userKey._083=# encryption cert. @@ -756,128 +663,289 @@ op.enroll.userKey._087=# * GenerateNewKeyandRecoverLast - Generate new cert AND op.enroll.userKey._088=# recover last for op.enroll.userKey._089=# encryption cert. op.enroll.userKey._090=######################################### -op.enroll.userKey.auth.enable=true -op.enroll.userKey.auth.id=ldap1 -op.enroll.userKey.cardmgr_instance=A0000000030000 -op.enroll.userKey.issuerinfo.enable=true -op.enroll.userKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi -op.enroll.userKey.keyGen.encryption.ca.conn=ca1 -op.enroll.userKey.keyGen.encryption.ca.profileId=caTokenUserEncryptionKeyEnrollment -op.enroll.userKey.keyGen.encryption.certAttrId=c2 -op.enroll.userKey.keyGen.encryption.certId=C2 -op.enroll.userKey.keyGen.encryption.cuid_label=$cuid$ -op.enroll.userKey.keyGen.encryption.keySize=1024 -op.enroll.userKey.keyGen.encryption.keyUsage=0 -op.enroll.userKey.keyGen.encryption.keyUser=0 -op.enroll.userKey.keyGen.encryption.label=encryption key for $userid$ -op.enroll.userKey.keyGen.encryption.overwrite=true -op.enroll.userKey.keyGen.encryption.privateKeyAttrId=k4 -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.decrypt=true -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.derive=false -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.encrypt=false -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.private=true -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.sensitive=true -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.sign=false -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.signRecover=false -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.token=true -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.unwrap=true -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.verify=false -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.verifyRecover=false -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.wrap=false -op.enroll.userKey.keyGen.encryption.privateKeyNumber=4 -op.enroll.userKey.keyGen.encryption.publicKeyAttrId=k5 -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.decrypt=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.derive=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.encrypt=true -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.private=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.sensitive=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.sign=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.signRecover=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.token=true -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.unwrap=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.verify=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.verifyRecover=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.wrap=true -op.enroll.userKey.keyGen.encryption.publicKeyNumber=5 -op.enroll.userKey.keyGen.encryption.recovery.destroyed.revokeCert=false -op.enroll.userKey.keyGen.encryption.recovery.destroyed.revokeCert.reason=0 -op.enroll.userKey.keyGen.encryption.recovery.destroyed.scheme=RecoverLast -op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.revokeCert.reason=1 -op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.revokeCert=true -op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.scheme=GenerateNewKey -op.enroll.userKey.keyGen.encryption.recovery.onHold.revokeCert.reason=6 -op.enroll.userKey.keyGen.encryption.recovery.onHold.revokeCert=true -op.enroll.userKey.keyGen.encryption.recovery.onHold.scheme=GenerateNewKey -op.enroll.userKey.keyGen.encryption.serverKeygen.archive=true -op.enroll.userKey.keyGen.encryption.serverKeygen.drm.conn=drm1 -op.enroll.userKey.keyGen.encryption.serverKeygen.enable=[SERVER_KEYGEN] -op.enroll.userKey.keyGen.keyType.num=2 -op.enroll.userKey.keyGen.keyType.value.0=signing -op.enroll.userKey.keyGen.keyType.value.1=encryption +op.enroll.allowUnknownToken=true +op.enroll.userKey.temporaryToken.tokenType=userKeyTemporary op.enroll.userKey.keyGen.recovery.destroyed.keyType.num=2 op.enroll.userKey.keyGen.recovery.destroyed.keyType.value.0=signing op.enroll.userKey.keyGen.recovery.destroyed.keyType.value.1=encryption +op.enroll.userKey.keyGen.signing.recovery.destroyed.scheme=GenerateNewKey +op.enroll.userKey.keyGen.signing.recovery.destroyed.revokeCert=true +op.enroll.userKey.keyGen.signing.recovery.destroyed.revokeCert.reason=0 +op.enroll.userKey.keyGen.encryption.recovery.destroyed.scheme=RecoverLast +op.enroll.userKey.keyGen.encryption.recovery.destroyed.revokeCert=false +op.enroll.userKey.keyGen.encryption.recovery.destroyed.revokeCert.reason=0 op.enroll.userKey.keyGen.recovery.keyCompromise.keyType.num=2 op.enroll.userKey.keyGen.recovery.keyCompromise.keyType.value.0=signing op.enroll.userKey.keyGen.recovery.keyCompromise.keyType.value.1=encryption +op.enroll.userKey.keyGen.signing.recovery.keyCompromise.scheme=GenerateNewKey +op.enroll.userKey.keyGen.signing.recovery.keyCompromise.revokeCert=true +op.enroll.userKey.keyGen.signing.recovery.keyCompromise.revokeCert.reason=1 +op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.scheme=GenerateNewKey +op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.revokeCert=true +op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.revokeCert.reason=1 op.enroll.userKey.keyGen.recovery.onHold.keyType.num=2 op.enroll.userKey.keyGen.recovery.onHold.keyType.value.0=signing op.enroll.userKey.keyGen.recovery.onHold.keyType.value.1=encryption -op.enroll.userKey.keyGen.signing.ca.conn=ca1 -op.enroll.userKey.keyGen.signing.ca.profileId=caTokenUserSigningKeyEnrollment -op.enroll.userKey.keyGen.signing.certAttrId=c1 -op.enroll.userKey.keyGen.signing.certId=C1 -op.enroll.userKey.keyGen.signing.cuid_label=$cuid$ +op.enroll.userKey.keyGen.signing.recovery.onHold.scheme=GenerateNewKey +op.enroll.userKey.keyGen.signing.recovery.onHold.revokeCert=true +op.enroll.userKey.keyGen.signing.recovery.onHold.revokeCert.reason=6 +op.enroll.userKey.keyGen.encryption.recovery.onHold.scheme=GenerateNewKey +op.enroll.userKey.keyGen.encryption.recovery.onHold.revokeCert=true +op.enroll.userKey.keyGen.encryption.recovery.onHold.revokeCert.reason=6 +op.enroll.userKey.keyGen.tokenName=$auth.cn$ +op.enroll.userKey.keyGen.keyType.num=2 +op.enroll.userKey.keyGen.keyType.value.0=signing +op.enroll.userKey.keyGen.keyType.value.1=encryption op.enroll.userKey.keyGen.signing.keySize=1024 -op.enroll.userKey.keyGen.signing.keyUsage=0 -op.enroll.userKey.keyGen.signing.keyUser=0 -op.enroll.userKey.keyGen.signing.label=signing key for $userid$ -op.enroll.userKey.keyGen.signing.overwrite=true -op.enroll.userKey.keyGen.signing.privateKeyAttrId=k2 -op.enroll.userKey.keyGen.signing.private.keyCapabilities.decrypt=false -op.enroll.userKey.keyGen.signing.private.keyCapabilities.derive=false -op.enroll.userKey.keyGen.signing.private.keyCapabilities.encrypt=false -op.enroll.userKey.keyGen.signing.private.keyCapabilities.private=true -op.enroll.userKey.keyGen.signing.private.keyCapabilities.sensitive=true -op.enroll.userKey.keyGen.signing.private.keyCapabilities.signRecover=true -op.enroll.userKey.keyGen.signing.private.keyCapabilities.sign=true -op.enroll.userKey.keyGen.signing.private.keyCapabilities.token=true -op.enroll.userKey.keyGen.signing.private.keyCapabilities.unwrap=false -op.enroll.userKey.keyGen.signing.private.keyCapabilities.verify=false -op.enroll.userKey.keyGen.signing.private.keyCapabilities.verifyRecover=false -op.enroll.userKey.keyGen.signing.private.keyCapabilities.wrap=false -op.enroll.userKey.keyGen.signing.privateKeyNumber=2 -op.enroll.userKey.keyGen.signing.publicKeyAttrId=k3 -op.enroll.userKey.keyGen.signing.public.keyCapabilities.decrypt=false -op.enroll.userKey.keyGen.signing.public.keyCapabilities.derive=false op.enroll.userKey.keyGen.signing.public.keyCapabilities.encrypt=false -op.enroll.userKey.keyGen.signing.public.keyCapabilities.private=false -op.enroll.userKey.keyGen.signing.public.keyCapabilities.sensitive=false op.enroll.userKey.keyGen.signing.public.keyCapabilities.sign=false op.enroll.userKey.keyGen.signing.public.keyCapabilities.signRecover=false -op.enroll.userKey.keyGen.signing.public.keyCapabilities.token=true +op.enroll.userKey.keyGen.signing.public.keyCapabilities.decrypt=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.derive=false op.enroll.userKey.keyGen.signing.public.keyCapabilities.unwrap=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.wrap=false op.enroll.userKey.keyGen.signing.public.keyCapabilities.verifyRecover=true op.enroll.userKey.keyGen.signing.public.keyCapabilities.verify=true -op.enroll.userKey.keyGen.signing.public.keyCapabilities.wrap=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.sensitive=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.private=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.token=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.encrypt=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.sign=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.signRecover=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.decrypt=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.derive=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.unwrap=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.wrap=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.verifyRecover=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.verify=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.sensitive=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.private=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.token=true +op.enroll.userKey.keyGen.signing.label=signing key for $userid$ +op.enroll.userKey.keyGen.signing.cuid_label=$cuid$ +op.enroll.userKey.keyGen.signing.overwrite=true +op.enroll.userKey.keyGen.signing.certId=C1 +op.enroll.userKey.keyGen.signing.certAttrId=c1 +op.enroll.userKey.keyGen.signing.privateKeyAttrId=k2 +op.enroll.userKey.keyGen.signing.publicKeyAttrId=k3 +op.enroll.userKey.keyGen.signing.keyUsage=0 +op.enroll.userKey.keyGen.signing.keyUser=0 +op.enroll.userKey.keyGen.signing.privateKeyNumber=2 op.enroll.userKey.keyGen.signing.publicKeyNumber=3 -op.enroll.userKey.keyGen.signing.recovery.destroyed.revokeCert.reason=0 -op.enroll.userKey.keyGen.signing.recovery.destroyed.revokeCert=true -op.enroll.userKey.keyGen.signing.recovery.destroyed.scheme=GenerateNewKey -op.enroll.userKey.keyGen.signing.recovery.keyCompromise.revokeCert.reason=1 -op.enroll.userKey.keyGen.signing.recovery.keyCompromise.revokeCert=true -op.enroll.userKey.keyGen.signing.recovery.keyCompromise.scheme=GenerateNewKey -op.enroll.userKey.keyGen.signing.recovery.onHold.revokeCert.reason=6 -op.enroll.userKey.keyGen.signing.recovery.onHold.revokeCert=true -op.enroll.userKey.keyGen.signing.recovery.onHold.scheme=GenerateNewKey -op.enroll.userKey.keyGen.tokenName=$auth.cn$ +op.enroll.userKey.keyGen.signing.ca.profileId=caTokenUserSigningKeyEnrollment +op.enroll.userKey.keyGen.signing.ca.conn=ca1 +op.enroll.userKey._079=#op.enroll.userKey.keyGen.signing.publisherId=fileBasedPublisher +op.enroll.userKey.keyGen.encryption.keySize=1024 +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.encrypt=true +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.sign=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.signRecover=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.decrypt=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.derive=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.unwrap=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.wrap=true +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.verifyRecover=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.verify=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.sensitive=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.private=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.token=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.encrypt=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.sign=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.signRecover=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.decrypt=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.derive=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.unwrap=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.wrap=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.verifyRecover=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.verify=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.sensitive=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.private=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.token=true +op.enroll.userKey.keyGen.encryption.label=encryption key for $userid$ +op.enroll.userKey.keyGen.encryption.cuid_label=$cuid$ +op.enroll.userKey.keyGen.encryption.overwrite=true +op.enroll.userKey.keyGen.encryption.certId=C2 +op.enroll.userKey.keyGen.encryption.certAttrId=c2 +op.enroll.userKey.keyGen.encryption.privateKeyAttrId=k4 +op.enroll.userKey.keyGen.encryption.publicKeyAttrId=k5 +op.enroll.userKey.keyGen.encryption.keyUsage=0 +op.enroll.userKey.keyGen.encryption.keyUser=0 +op.enroll.userKey.keyGen.encryption.privateKeyNumber=4 +op.enroll.userKey.keyGen.encryption.publicKeyNumber=5 +op.enroll.userKey.keyGen.encryption.ca.profileId=caTokenUserEncryptionKeyEnrollment +op.enroll.userKey.keyGen.encryption.ca.conn=ca1 +op.enroll.userKey.pkcs11obj.enable=true +op.enroll.userKey.pkcs11obj.compress.enable=true +op.enroll.userKey.update.applet.emptyToken.enable=true +op.enroll.userKey.update.applet.enable=true +op.enroll.userKey.update.applet.requiredVersion=1.4.4d40a449 +op.enroll.userKey.update.applet.directory=[TPS_DIR]/applets +op.enroll.userKey.update.applet.encryption=true +op.enroll.userKey.update.symmetricKeys.enable=false +op.enroll.userKey.update.symmetricKeys.requiredVersion=1 op.enroll.userKey.loginRequest.enable=true op.enroll.userKey.pinReset.enable=true -op.enroll.userKey.pinReset.pin.maxLen=10 op.enroll.userKey.pinReset.pin.maxRetries=127 op.enroll.userKey.pinReset.pin.minLen=4 -op.enroll.userKey.pkcs11obj.compress.enable=true -op.enroll.userKey.pkcs11obj.enable=true +op.enroll.userKey.pinReset.pin.maxLen=10 +op.enroll.userKey.cardmgr_instance=A0000000030000 +op.enroll.userKey.tks.conn=tks1 +op.enroll.userKey.auth.id=ldap1 +op.enroll.userKey.auth.enable=true +op.enroll.userKey.issuerinfo.enable=true +op.enroll.userKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi +op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.num=2 +op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.value.0=signing +op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.value.1=encryption +op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.scheme=GenerateNewKey +op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.revokeCert=true +op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.revokeCert.reason=0 +op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.scheme=RecoverLast +op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert=true +op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert.reason=0 +op.enroll.userKey.keyGen.encryption.serverKeygen.enable=[SERVER_KEYGEN] +op.enroll.userKey.keyGen.encryption.serverKeygen.drm.conn=drm1 +op.enroll.userKey.keyGen.encryption.serverKeygen.archive=true +op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.enable=true +op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.drm.conn=drm1 +op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.archive=true +op.enroll.userKeyTemporary.keyGen.tokenName=$auth.cn$ (Temporary) +op.enroll.userKeyTemporary.keyGen.keyType.num=3 +op.enroll.userKeyTemporary.keyGen.keyType.value.0=auth +op.enroll.userKeyTemporary.keyGen.keyType.value.1=signing +op.enroll.userKeyTemporary.keyGen.keyType.value.2=encryption +op.enroll.userKeyTemporary.keyGen.auth.keySize=1024 +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.sign=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.signRecover=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.verifyRecover=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.verify=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.sensitive=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.private=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.sign=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.signRecover=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.verifyRecover=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.verify=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.sensitive=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.private=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.auth.label=Temporary Key for $userid$ +op.enroll.userKeyTemporary.keyGen.auth.cuid_label=$cuid$ +op.enroll.userKeyTemporary.keyGen.auth.overwrite=false +op.enroll.userKeyTemporary.keyGen.auth.certId=C0 +op.enroll.userKeyTemporary.keyGen.auth.certAttrId=c0 +op.enroll.userKeyTemporary.keyGen.auth.privateKeyAttrId=k0 +op.enroll.userKeyTemporary.keyGen.auth.publicKeyAttrId=k1 +op.enroll.userKeyTemporary.keyGen.auth.keyUsage=0 +op.enroll.userKeyTemporary.keyGen.auth.keyUser=15 +op.enroll.userKeyTemporary.keyGen.auth.privateKeyNumber=0 +op.enroll.userKeyTemporary.keyGen.auth.publicKeyNumber=1 +op.enroll.userKeyTemporary.keyGen.auth.ca.profileId=caTempTokenDeviceKeyEnrollment +op.enroll.userKeyTemporary.keyGen.auth.ca.conn=ca1 +op.enroll.userKeyTemporary.keyGen.signing.keySize=1024 +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.sign=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.signRecover=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.verifyRecover=true +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.verify=true +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.sensitive=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.private=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.sign=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.signRecover=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.verifyRecover=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.verify=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.sensitive=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.private=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.signing.label=signing key for $userid$ +op.enroll.userKeyTemporary.keyGen.signing.cuid_label=$cuid$ +op.enroll.userKeyTemporary.keyGen.signing.overwrite=true +op.enroll.userKeyTemporary.keyGen.signing.certId=C1 +op.enroll.userKeyTemporary.keyGen.signing.certAttrId=c1 +op.enroll.userKeyTemporary.keyGen.signing.privateKeyAttrId=k2 +op.enroll.userKeyTemporary.keyGen.signing.publicKeyAttrId=k3 +op.enroll.userKeyTemporary.keyGen.signing.keyUsage=0 +op.enroll.userKeyTemporary.keyGen.signing.keyUser=0 +op.enroll.userKeyTemporary.keyGen.signing.privateKeyNumber=2 +op.enroll.userKeyTemporary.keyGen.signing.publicKeyNumber=3 +op.enroll.userKeyTemporary.keyGen.signing.ca.profileId=caTempTokenUserSigningKeyEnrollment +op.enroll.userKeyTemporary.keyGen.signing.ca.conn=ca1 +op.enroll.userKey._080=#op.enroll.userKeyTemporary.keyGen.signing.publisherId=fileBasedPublisher +op.enroll.userKeyTemporary.keyGen.encryption.keySize=1024 +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.encrypt=true +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.sign=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.signRecover=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.wrap=true +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.verifyRecover=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.verify=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.sensitive=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.private=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.sign=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.signRecover=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.decrypt=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.unwrap=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.verifyRecover=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.verify=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.sensitive=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.private=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.encryption.label=encryption key for $userid$ +op.enroll.userKeyTemporary.keyGen.encryption.cuid_label=$cuid$ +op.enroll.userKeyTemporary.keyGen.encryption.overwrite=true +op.enroll.userKeyTemporary.keyGen.encryption.certId=C2 +op.enroll.userKeyTemporary.keyGen.encryption.certAttrId=c2 +op.enroll.userKeyTemporary.keyGen.encryption.privateKeyAttrId=k4 +op.enroll.userKeyTemporary.keyGen.encryption.publicKeyAttrId=k5 +op.enroll.userKeyTemporary.keyGen.encryption.keyUsage=0 +op.enroll.userKeyTemporary.keyGen.encryption.keyUser=0 +op.enroll.userKeyTemporary.keyGen.encryption.privateKeyNumber=4 +op.enroll.userKeyTemporary.keyGen.encryption.publicKeyNumber=5 +op.enroll.userKeyTemporary.keyGen.encryption.ca.profileId=caTempTokenUserEncryptionKeyEnrollment +op.enroll.userKeyTemporary.keyGen.encryption.ca.conn=ca1 +op.enroll.userKeyTemporary.pkcs11obj.enable=true +op.enroll.userKeyTemporary.pkcs11obj.compress.enable=true +op.enroll.userKeyTemporary.update.applet.emptyToken.enable=true +op.enroll.userKeyTemporary.update.applet.enable=true +op.enroll.userKeyTemporary.update.applet.requiredVersion=1.4.4d40a449 +op.enroll.userKeyTemporary.update.applet.directory=[TPS_DIR]/applets +op.enroll.userKeyTemporary.update.applet.encryption=true +op.enroll.userKeyTemporary.update.symmetricKeys.enable=false +op.enroll.userKeyTemporary.update.symmetricKeys.requiredVersion=1 +op.enroll.userKeyTemporary.loginRequest.enable=true +op.enroll.userKeyTemporary.pinReset.enable=true +op.enroll.userKeyTemporary.pinReset.pin.maxRetries=127 +op.enroll.userKeyTemporary.pinReset.pin.minLen=4 +op.enroll.userKeyTemporary.pinReset.pin.maxLen=10 +op.enroll.userKeyTemporary.tks.conn=tks1 +op.enroll.userKeyTemporary.cardmgr_instance=A0000000030000 +op.enroll.userKeyTemporary.auth.id=ldap1 +op.enroll.userKeyTemporary.auth.enable=true op.enroll.userKey.renewal._000=######################################### op.enroll.userKey.renewal._001=# Token Renewal. op.enroll.userKey.renewal._002=# @@ -896,348 +964,307 @@ op.enroll.userKey.renewal._014=# values are for completeness only, server op.enroll.userKey.renewal._015=# code calculates actual values used. op.enroll.userKey.renewal._016=# op.enroll.userKey.renewal._017=######################################### -op.enroll.userKey.renewal.encryption.ca.conn=ca1 -op.enroll.userKey.renewal.encryption.ca.profileId=caTokenUserEncryptionKeyRenewal -op.enroll.userKey.renewal.encryption.certAttrId=c2 -op.enroll.userKey.renewal.encryption.certId=C2 -op.enroll.userKey.renewal.encryption.enable=true -op.enroll.userKey.renewal.encryption.gracePeriod.after=30 -op.enroll.userKey.renewal.encryption.gracePeriod.before=30 -op.enroll.userKey.renewal.encryption.gracePeriod.enable=false op.enroll.userKey.renewal.keyType.num=2 op.enroll.userKey.renewal.keyType.value.0=signing op.enroll.userKey.renewal.keyType.value.1=encryption -op.enroll.userKey.renewal.signing.ca.conn=ca1 -op.enroll.userKey.renewal.signing.ca.profileId=caTokenUserSigningKeyRenewal -op.enroll.userKey.renewal.signing.certAttrId=c1 -op.enroll.userKey.renewal.signing.certId=C1 op.enroll.userKey.renewal.signing.enable=true -op.enroll.userKey.renewal.signing.gracePeriod.after=30 -op.enroll.userKey.renewal.signing.gracePeriod.before=30 op.enroll.userKey.renewal.signing.gracePeriod.enable=false -op.enroll.userKeyTemporary.auth.enable=true -op.enroll.userKeyTemporary.auth.id=ldap1 -op.enroll.userKeyTemporary.cardmgr_instance=A0000000030000 -op.enroll.userKeyTemporary.keyGen.auth.ca.conn=ca1 -op.enroll.userKeyTemporary.keyGen.auth.ca.profileId=caTempTokenDeviceKeyEnrollment -op.enroll.userKeyTemporary.keyGen.auth.certAttrId=c0 -op.enroll.userKeyTemporary.keyGen.auth.certId=C0 -op.enroll.userKeyTemporary.keyGen.auth.cuid_label=$cuid$ -op.enroll.userKeyTemporary.keyGen.auth.keySize=1024 -op.enroll.userKeyTemporary.keyGen.auth.keyUsage=0 -op.enroll.userKeyTemporary.keyGen.auth.keyUser=15 -op.enroll.userKeyTemporary.keyGen.auth.label=Temporary Key for $userid$ -op.enroll.userKeyTemporary.keyGen.auth.overwrite=false -op.enroll.userKeyTemporary.keyGen.auth.privateKeyAttrId=k0 -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.decrypt=false -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.derive=false -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.encrypt=false -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.private=false -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.sensitive=true -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.signRecover=true -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.sign=true -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.token=true -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.unwrap=false -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.verifyRecover=true -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.verify=true -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.wrap=false -op.enroll.userKeyTemporary.keyGen.auth.privateKeyNumber=0 -op.enroll.userKeyTemporary.keyGen.auth.publicKeyAttrId=k1 -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.decrypt=false -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.derive=false -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.encrypt=false -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.private=false -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.sensitive=true -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.signRecover=true -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.sign=true -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.token=true -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.unwrap=false -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.verifyRecover=true -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.verify=true -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.wrap=false -op.enroll.userKeyTemporary.keyGen.auth.publicKeyNumber=1 -op.enroll.userKeyTemporary.keyGen.encryption.ca.conn=ca1 -op.enroll.userKeyTemporary.keyGen.encryption.ca.profileId=caTempTokenUserEncryptionKeyEnrollment -op.enroll.userKeyTemporary.keyGen.encryption.certAttrId=c2 -op.enroll.userKeyTemporary.keyGen.encryption.certId=C2 -op.enroll.userKeyTemporary.keyGen.encryption.cuid_label=$cuid$ -op.enroll.userKeyTemporary.keyGen.encryption.keySize=1024 -op.enroll.userKeyTemporary.keyGen.encryption.keyUsage=0 -op.enroll.userKeyTemporary.keyGen.encryption.keyUser=0 -op.enroll.userKeyTemporary.keyGen.encryption.label=encryption key for $userid$ -op.enroll.userKeyTemporary.keyGen.encryption.overwrite=true -op.enroll.userKeyTemporary.keyGen.encryption.privateKeyAttrId=k4 -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.decrypt=true -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.derive=false -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.encrypt=false -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.private=true -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.sensitive=true -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.sign=false -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.signRecover=false -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.token=true -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.unwrap=true -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.verify=false -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.verifyRecover=false -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.wrap=false -op.enroll.userKeyTemporary.keyGen.encryption.privateKeyNumber=4 -op.enroll.userKeyTemporary.keyGen.encryption.publicKeyAttrId=k5 -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.decrypt=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.derive=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.encrypt=true -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.private=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.sensitive=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.sign=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.signRecover=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.token=true -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.unwrap=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.verify=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.verifyRecover=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.wrap=true -op.enroll.userKeyTemporary.keyGen.encryption.publicKeyNumber=5 -op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert.reason=0 -op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert=true -op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.scheme=RecoverLast -op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.archive=true -op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.drm.conn=drm1 -op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.enable=true -op.enroll.userKeyTemporary.keyGen.keyType.num=3 -op.enroll.userKeyTemporary.keyGen.keyType.value.0=auth -op.enroll.userKeyTemporary.keyGen.keyType.value.1=signing -op.enroll.userKeyTemporary.keyGen.keyType.value.2=encryption -op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.num=2 -op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.value.0=signing -op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.value.1=encryption -op.enroll.userKeyTemporary.keyGen.signing.ca.conn=ca1 -op.enroll.userKeyTemporary.keyGen.signing.ca.profileId=caTempTokenUserSigningKeyEnrollment -op.enroll.userKeyTemporary.keyGen.signing.certAttrId=c1 -op.enroll.userKeyTemporary.keyGen.signing.certId=C1 -op.enroll.userKeyTemporary.keyGen.signing.cuid_label=$cuid$ -op.enroll.userKeyTemporary.keyGen.signing.keySize=1024 -op.enroll.userKeyTemporary.keyGen.signing.keyUsage=0 -op.enroll.userKeyTemporary.keyGen.signing.keyUser=0 -op.enroll.userKeyTemporary.keyGen.signing.label=signing key for $userid$ -op.enroll.userKeyTemporary.keyGen.signing.overwrite=true -op.enroll.userKeyTemporary.keyGen.signing.privateKeyAttrId=k2 -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.decrypt=false -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.derive=false -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.encrypt=false -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.private=true -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.sensitive=true -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.signRecover=true -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.sign=true -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.token=true -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.unwrap=false -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.verify=false -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.verifyRecover=false -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.wrap=false -op.enroll.userKeyTemporary.keyGen.signing.privateKeyNumber=2 -op.enroll.userKeyTemporary.keyGen.signing.publicKeyAttrId=k3 -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.decrypt=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.derive=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.encrypt=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.private=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.sensitive=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.sign=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.signRecover=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.token=true -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.unwrap=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.verifyRecover=true -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.verify=true -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.wrap=false -op.enroll.userKeyTemporary.keyGen.signing.publicKeyNumber=3 -op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.revokeCert.reason=0 -op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.revokeCert=true -op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.scheme=GenerateNewKey -op.enroll.userKeyTemporary.keyGen.tokenName=$auth.cn$ (Temporary) -op.enroll.userKeyTemporary.loginRequest.enable=true -op.enroll.userKeyTemporary.pinReset.enable=true -op.enroll.userKeyTemporary.pinReset.pin.maxLen=10 -op.enroll.userKeyTemporary.pinReset.pin.maxRetries=127 -op.enroll.userKeyTemporary.pinReset.pin.minLen=4 -op.enroll.userKeyTemporary.pkcs11obj.compress.enable=true -op.enroll.userKeyTemporary.pkcs11obj.enable=true -op.enroll.userKeyTemporary.tks.conn=tks1 -op.enroll.userKey.temporaryToken.tokenType=userKeyTemporary -op.enroll.userKeyTemporary.update.applet.directory=[TPS_DIR]/applets -op.enroll.userKeyTemporary.update.applet.emptyToken.enable=true -op.enroll.userKeyTemporary.update.applet.enable=true -op.enroll.userKeyTemporary.update.applet.encryption=true -op.enroll.userKeyTemporary.update.applet.requiredVersion=1.4.4d40a449 -op.enroll.userKeyTemporary.update.symmetricKeys.enable=false -op.enroll.userKeyTemporary.update.symmetricKeys.requiredVersion=1 -op.enroll.userKey.tks.conn=tks1 -op.enroll.userKey.update.applet.directory=[TPS_DIR]/applets -op.enroll.userKey.update.applet.emptyToken.enable=true -op.enroll.userKey.update.applet.enable=true -op.enroll.userKey.update.applet.encryption=true -op.enroll.userKey.update.applet.requiredVersion=1.4.4d40a449 -op.enroll.userKey.update.symmetricKeys.enable=false -op.enroll.userKey.update.symmetricKeys.requiredVersion=1 -op.format._000=######################################### -op.format._001=# Format Operation For tokenKey -op.format._002=# -op.format._003=# op.format.tokenKey.update.applet.emptyToken.enable=false -op.format._004=# - update applet or not if token is empty -op.format._005=# -op.format._006=# - applicable to CoolKey -op.format._007=# - applicable to HouseKey -op.format._008=# - applicable to HouseKey with Legacy Applet -op.format._009=######################################### -op.format.allowUnknownToken=true -op.format.cleanToken.auth.enable=false -op.format.cleanToken.auth.id=ldap1 -op.format.cleanToken.ca.conn=ca1 -op.format.cleanToken.cardmgr_instance=A0000000030000 -op.format.cleanToken.issuerinfo.enable=true -op.format.cleanToken.issuerinfo.value= -op.format.cleanToken.loginRequest.enable=true -op.format.cleanToken.revokeCert=true -op.format.cleanToken.tks.conn=tks1 -op.format.cleanToken.update.applet.directory=[TPS_DIR]/applets -op.format.cleanToken.update.applet.emptyToken.enable=true -op.format.cleanToken.update.applet.encryption=true -op.format.cleanToken.update.applet.requiredVersion=1.4.4d40a449 -op.format.cleanToken.update.symmetricKeys.enable=false -op.format.cleanToken.update.symmetricKeys.requiredVersion=1 -op.format.mapping.0.filter.appletMajorVersion= -op.format.mapping.0.filter.appletMinorVersion= -op.format.mapping.0.filter.tokenATR= -op.format.mapping.0.filter.tokenCUID.end= -op.format.mapping.0.filter.tokenCUID.start= -op.format.mapping.0.filter.tokenType=soCleanUserToken -op.format.mapping.0.target.tokenType=soCleanUserToken -op.format.mapping.1.filter.appletMajorVersion= -op.format.mapping.1.filter.appletMinorVersion= -op.format.mapping.1.filter.tokenATR= -op.format.mapping.1.filter.tokenCUID.end= -op.format.mapping.1.filter.tokenCUID.start= -op.format.mapping.1.filter.tokenType=soUserKey -op.format.mapping.1.target.tokenType=soUserKey -op.format.mapping.2.filter.appletMajorVersion= -op.format.mapping.2.filter.appletMinorVersion= -op.format.mapping.2.filter.tokenATR= -op.format.mapping.2.filter.tokenCUID.end= -op.format.mapping.2.filter.tokenCUID.start= -op.format.mapping.2.filter.tokenType=soKey -op.format.mapping.2.target.tokenType=soKey -op.format.mapping.3.filter.appletMajorVersion= -op.format.mapping.3.filter.appletMinorVersion= -op.format.mapping.3.filter.tokenATR= -op.format.mapping.3.filter.tokenCUID.end= -op.format.mapping.3.filter.tokenCUID.start= -op.format.mapping.3.filter.tokenType=userKey -op.format.mapping.3.target.tokenType=userKey -op.format.mapping.4.filter.appletMajorVersion= -op.format.mapping.4.filter.appletMinorVersion= -op.format.mapping.4.filter.tokenATR= -op.format.mapping.4.filter.tokenCUID.end= -op.format.mapping.4.filter.tokenCUID.start= -op.format.mapping.4.filter.tokenType=soCleanSOToken -op.format.mapping.4.target.tokenType=soCleanSOToken -op.format.mapping.5.filter.appletMajorVersion= -op.format.mapping.5.filter.appletMinorVersion= -op.format.mapping.5.filter.tokenATR= -op.format.mapping.5.filter.tokenCUID.end= -op.format.mapping.5.filter.tokenCUID.start= -op.format.mapping.5.filter.tokenType=cleanToken -op.format.mapping.5.target.tokenType=cleanToken -op.format.mapping.6.filter.appletMajorVersion= -op.format.mapping.6.filter.appletMinorVersion= -op.format.mapping.6.filter.tokenATR= -op.format.mapping.6.filter.tokenCUID.end= -op.format.mapping.6.filter.tokenCUID.start= -op.format.mapping.6.target.tokenType=tokenKey -op.format.mapping.order=0,1,2,3,4,5,6 -op.format.soCleanSOToken.auth.enable=false -op.format.soCleanSOToken.auth.id=ldap1 -op.format.soCleanSOToken.ca.conn=ca1 -op.format.soCleanSOToken.cardmgr_instance=A0000000030000 -op.format.soCleanSOToken.issuerinfo.enable=true -op.format.soCleanSOToken.issuerinfo.value= -op.format.soCleanSOToken.loginRequest.enable=false -op.format.soCleanSOToken.revokeCert=true -op.format.soCleanSOToken.tks.conn=tks1 -op.format.soCleanSOToken.update.applet.directory=[TPS_DIR]/applets -op.format.soCleanSOToken.update.applet.emptyToken.enable=true -op.format.soCleanSOToken.update.applet.encryption=true -op.format.soCleanSOToken.update.applet.requiredVersion=1.4.4d40a449 -op.format.soCleanSOToken.update.symmetricKeys.enable=false -op.format.soCleanSOToken.update.symmetricKeys.requiredVersion=1 -op.format.soCleanUserToken.auth.enable=false -op.format.soCleanUserToken.auth.id=ldap1 -op.format.soCleanUserToken.ca.conn=ca1 -op.format.soCleanUserToken.cardmgr_instance=A0000000030000 -op.format.soCleanUserToken.issuerinfo.enable=true -op.format.soCleanUserToken.issuerinfo.value= -op.format.soCleanUserToken.loginRequest.enable=false -op.format.soCleanUserToken.revokeCert=true -op.format.soCleanUserToken.tks.conn=tks1 -op.format.soCleanUserToken.update.applet.directory=[TPS_DIR]/applets -op.format.soCleanUserToken.update.applet.emptyToken.enable=true -op.format.soCleanUserToken.update.applet.encryption=true -op.format.soCleanUserToken.update.applet.requiredVersion=1.4.4d40a449 -op.format.soCleanUserToken.update.symmetricKeys.enable=false -op.format.soCleanUserToken.update.symmetricKeys.requiredVersion=1 -op.format.soKey.auth.enable=true -op.format.soKey.auth.id=ldap2 -op.format.soKey.ca.conn=ca1 -op.format.soKey.cardmgr_instance=A0000000030000 -op.format.soKey.issuerinfo.enable=true -op.format.soKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/so/index.cgi -op.format.soKey.loginRequest.enable=true -op.format.soKey.revokeCert=true -op.format.soKey.tks.conn=tks1 -op.format.soKey.update.applet.directory=[TPS_DIR]/applets -op.format.soKey.update.applet.emptyToken.enable=true -op.format.soKey.update.applet.encryption=true -op.format.soKey.update.applet.requiredVersion=1.4.4d40a449 -op.format.soKey.update.symmetricKeys.enable=false -op.format.soKey.update.symmetricKeys.requiredVersion=1 -op.format.soUserKey.auth.enable=false -op.format.soUserKey.auth.id=ldap1 -op.format.soUserKey.ca.conn=ca1 -op.format.soUserKey.cardmgr_instance=A0000000030000 -op.format.soUserKey.issuerinfo.enable=true -op.format.soUserKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi -op.format.soUserKey.loginRequest.enable=false -op.format.soUserKey.revokeCert=true -op.format.soUserKey.tks.conn=tks1 -op.format.soUserKey.update.applet.directory=[TPS_DIR]/applets -op.format.soUserKey.update.applet.emptyToken.enable=true -op.format.soUserKey.update.applet.encryption=true -op.format.soUserKey.update.applet.requiredVersion=1.4.4d40a449 -op.format.soUserKey.update.symmetricKeys.enable=false -op.format.soUserKey.update.symmetricKeys.requiredVersion=1 -op.format.tokenKey.auth.enable=true -op.format.tokenKey.auth.id=ldap1 -op.format.tokenKey.ca.conn=ca1 -op.format.tokenKey.cardmgr_instance=A0000000030000 -op.format.tokenKey.issuerinfo.enable=true -op.format.tokenKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi -op.format.tokenKey.loginRequest.enable=true -op.format.tokenKey.revokeCert=true -op.format.tokenKey.tks.conn=tks1 -op.format.tokenKey.update.applet.directory=[TPS_DIR]/applets -op.format.tokenKey.update.applet.emptyToken.enable=true -op.format.tokenKey.update.applet.encryption=true -op.format.tokenKey.update.applet.requiredVersion=1.4.4d40a449 -op.format.tokenKey.update.symmetricKeys.enable=false -op.format.tokenKey.update.symmetricKeys.requiredVersion=1 -op.format.userKey.auth.enable=true -op.format.userKey.auth.id=ldap1 -op.format.userKey.ca.conn=ca1 -op.format.userKey.cardmgr_instance=A0000000030000 -op.format.userKey.issuerinfo.enable=true -op.format.userKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi -op.format.userKey.loginRequest.enable=true -op.format.userKey.revokeCert=true -op.format.userKey.tks.conn=tks1 -op.format.userKey.update.applet.directory=[TPS_DIR]/applets -op.format.userKey.update.applet.emptyToken.enable=true -op.format.userKey.update.applet.encryption=true -op.format.userKey.update.applet.requiredVersion=1.4.4d40a449 -op.format.userKey.update.symmetricKeys.enable=false -op.format.userKey.update.symmetricKeys.requiredVersion=1 +op.enroll.userKey.renewal.signing.gracePeriod.before=30 +op.enroll.userKey.renewal.signing.gracePeriod.after=30 +op.enroll.userKey.renewal.signing.certId=C1 +op.enroll.userKey.renewal.encryption.certId=C2 +op.enroll.userKey.renewal.signing.certAttrId=c1 +op.enroll.userKey.renewal.encryption.certAttrId=c2 +op.enroll.userKey.renewal.encryption.enable=true +op.enroll.userKey.renewal.encryption.gracePeriod.enable=false +op.enroll.userKey.renewal.encryption.gracePeriod.before=30 +op.enroll.userKey.renewal.encryption.gracePeriod.after=30 +op.enroll.userKey.renewal.signing.ca.conn=ca1 +op.enroll.userKey.renewal.encryption.ca.conn=ca1 +op.enroll.userKey.renewal.signing.ca.profileId=caTokenUserSigningKeyRenewal +op.enroll.userKey.renewal.encryption.ca.profileId=caTokenUserEncryptionKeyRenewal +op.enroll.soKey.temporaryToken.tokenType=soKeyTemporary +op.enroll.soKey.keyGen.recovery.destroyed.keyType.num=2 +op.enroll.soKey.keyGen.recovery.destroyed.keyType.value.0=signing +op.enroll.soKey.keyGen.recovery.destroyed.keyType.value.1=encryption +op.enroll.soKey.keyGen.signing.recovery.destroyed.scheme=GenerateNewKey +op.enroll.soKey.keyGen.signing.recovery.destroyed.revokeCert=true +op.enroll.soKey.keyGen.signing.recovery.destroyed.revokeCert.reason=0 +op.enroll.soKey.keyGen.encryption.recovery.destroyed.scheme=RecoverLast +op.enroll.soKey.keyGen.encryption.recovery.destroyed.revokeCert=false +op.enroll.soKey.keyGen.encryption.recovery.destroyed.revokeCert.reason=0 +op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.num=2 +op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.value.0=signing +op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.value.1=encryption +op.enroll.soKey.keyGen.signing.recovery.keyCompromise.scheme=GenerateNewKey +op.enroll.soKey.keyGen.signing.recovery.keyCompromise.revokeCert=true +op.enroll.soKey.keyGen.signing.recovery.keyCompromise.revokeCert.reason=1 +op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.scheme=GenerateNewKey +op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.revokeCert=true +op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.revokeCert.reason=1 +op.enroll.soKey.keyGen.recovery.onHold.keyType.num=2 +op.enroll.soKey.keyGen.recovery.onHold.keyType.value.0=signing +op.enroll.soKey.keyGen.recovery.onHold.keyType.value.1=encryption +op.enroll.soKey.keyGen.signing.recovery.onHold.scheme=GenerateNewKey +op.enroll.soKey.keyGen.signing.recovery.onHold.revokeCert=true +op.enroll.soKey.keyGen.signing.recovery.onHold.revokeCert.reason=6 +op.enroll.soKey.keyGen.encryption.recovery.onHold.scheme=GenerateNewKey +op.enroll.soKey.keyGen.encryption.recovery.onHold.revokeCert=true +op.enroll.soKey.keyGen.encryption.recovery.onHold.revokeCert.reason=6 +op.enroll.soKey.keyGen.tokenName=$auth.cn$ +op.enroll.soKey.keyGen.keyType.num=2 +op.enroll.soKey.keyGen.keyType.value.0=signing +op.enroll.soKey.keyGen.keyType.value.1=encryption +op.enroll.soKey.keyGen.signing.keySize=1024 +op.enroll.soKey.keyGen.signing.public.keyCapabilities.encrypt=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.sign=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.signRecover=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.decrypt=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.derive=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.unwrap=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.wrap=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.verifyRecover=true +op.enroll.soKey.keyGen.signing.public.keyCapabilities.verify=true +op.enroll.soKey.keyGen.signing.public.keyCapabilities.sensitive=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.private=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.token=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.encrypt=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.sign=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.signRecover=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.decrypt=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.derive=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.unwrap=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.wrap=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.verifyRecover=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.verify=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.sensitive=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.private=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.token=true +op.enroll.soKey.keyGen.signing.label=signing key for $userid$ +op.enroll.soKey.keyGen.signing.cuid_label=$cuid$ +op.enroll.soKey.keyGen.signing.overwrite=true +op.enroll.soKey.keyGen.signing.certId=C1 +op.enroll.soKey.keyGen.signing.certAttrId=c1 +op.enroll.soKey.keyGen.signing.privateKeyAttrId=k2 +op.enroll.soKey.keyGen.signing.publicKeyAttrId=k3 +op.enroll.soKey.keyGen.signing.keyUsage=0 +op.enroll.soKey.keyGen.signing.keyUser=0 +op.enroll.soKey.keyGen.signing.privateKeyNumber=2 +op.enroll.soKey.keyGen.signing.publicKeyNumber=3 +op.enroll.soKey.keyGen.signing.ca.profileId=caTokenUserSigningKeyEnrollment +op.enroll.soKey.keyGen.signing.ca.conn=ca1 +op.enroll.soKey._079=#op.enroll.userKey.keyGen.signing.publisherId=fileBasedPublisher +op.enroll.soKey.keyGen.encryption.keySize=1024 +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.encrypt=true +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.sign=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.signRecover=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.decrypt=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.derive=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.unwrap=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.wrap=true +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.verifyRecover=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.verify=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.sensitive=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.private=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.token=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.encrypt=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.sign=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.signRecover=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.decrypt=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.derive=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.unwrap=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.wrap=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.verifyRecover=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.verify=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.sensitive=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.private=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.token=true +op.enroll.soKey.keyGen.encryption.label=encryption key for $userid$ +op.enroll.soKey.keyGen.encryption.cuid_label=$cuid$ +op.enroll.soKey.keyGen.encryption.overwrite=true +op.enroll.soKey.keyGen.encryption.certId=C2 +op.enroll.soKey.keyGen.encryption.certAttrId=c2 +op.enroll.soKey.keyGen.encryption.privateKeyAttrId=k4 +op.enroll.soKey.keyGen.encryption.publicKeyAttrId=k5 +op.enroll.soKey.keyGen.encryption.keyUsage=0 +op.enroll.soKey.keyGen.encryption.keyUser=0 +op.enroll.soKey.keyGen.encryption.privateKeyNumber=4 +op.enroll.soKey.keyGen.encryption.publicKeyNumber=5 +op.enroll.soKey.keyGen.encryption.ca.profileId=caTokenUserEncryptionKeyEnrollment +op.enroll.soKey.keyGen.encryption.ca.conn=ca1 +op.enroll.soKey.pkcs11obj.enable=true +op.enroll.soKey.pkcs11obj.compress.enable=true +op.enroll.soKey.update.applet.emptyToken.enable=true +op.enroll.soKey.update.applet.enable=true +op.enroll.soKey.update.applet.requiredVersion=1.4.4d40a449 +op.enroll.soKey.update.applet.directory=[TPS_DIR]/applets +op.enroll.soKey.update.applet.encryption=true +op.enroll.soKey.update.symmetricKeys.enable=false +op.enroll.soKey.update.symmetricKeys.requiredVersion=1 +op.enroll.soKey.loginRequest.enable=true +op.enroll.soKey.pinReset.enable=true +op.enroll.soKey.pinReset.pin.maxRetries=127 +op.enroll.soKey.pinReset.pin.minLen=4 +op.enroll.soKey.pinReset.pin.maxLen=10 +op.enroll.soKey.cardmgr_instance=A0000000030000 +op.enroll.soKey.tks.conn=tks1 +op.enroll.soKey.auth.id=ldap2 +op.enroll.soKey.auth.enable=true +op.enroll.soKey.issuerinfo.enable=true +op.enroll.soKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/so/index.cgi +op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.num=2 +op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.value.0=signing +op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.value.1=encryption +op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.scheme=GenerateNewKey +op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.revokeCert=true +op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.revokeCert.reason=0 +op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.scheme=RecoverLast +op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert=true +op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert.reason=0 +op.enroll.soKey.keyGen.encryption.serverKeygen.enable=[SERVER_KEYGEN] +op.enroll.soKey.keyGen.encryption.serverKeygen.drm.conn=drm1 +op.enroll.soKey.keyGen.encryption.serverKeygen.archive=true +op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.enable=true +op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.drm.conn=drm1 +op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.archive=true +op.enroll.soKeyTemporary.keyGen.tokenName=$auth.cn$ (Temporary) +op.enroll.soKeyTemporary.keyGen.keyType.num=3 +op.enroll.soKeyTemporary.keyGen.keyType.value.0=auth +op.enroll.soKeyTemporary.keyGen.keyType.value.1=signing +op.enroll.soKeyTemporary.keyGen.keyType.value.2=encryption +op.enroll.soKeyTemporary.keyGen.auth.keySize=1024 +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.sign=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.signRecover=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.verifyRecover=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.verify=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.sensitive=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.private=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.sign=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.signRecover=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.verifyRecover=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.verify=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.sensitive=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.private=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.auth.label=Temporary Key for $userid$ +op.enroll.soKeyTemporary.keyGen.auth.cuid_label=$cuid$ +op.enroll.soKeyTemporary.keyGen.auth.overwrite=false +op.enroll.soKeyTemporary.keyGen.auth.certId=C0 +op.enroll.soKeyTemporary.keyGen.auth.certAttrId=c0 +op.enroll.soKeyTemporary.keyGen.auth.privateKeyAttrId=k0 +op.enroll.soKeyTemporary.keyGen.auth.publicKeyAttrId=k1 +op.enroll.soKeyTemporary.keyGen.auth.keyUsage=0 +op.enroll.soKeyTemporary.keyGen.auth.keyUser=15 +op.enroll.soKeyTemporary.keyGen.auth.privateKeyNumber=0 +op.enroll.soKeyTemporary.keyGen.auth.publicKeyNumber=1 +op.enroll.soKeyTemporary.keyGen.auth.ca.profileId=caTempTokenDeviceKeyEnrollment +op.enroll.soKeyTemporary.keyGen.auth.ca.conn=ca1 +op.enroll.soKeyTemporary.keyGen.signing.keySize=1024 +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.sign=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.signRecover=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.verifyRecover=true +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.verify=true +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.sensitive=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.private=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.sign=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.signRecover=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.verifyRecover=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.verify=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.sensitive=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.private=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.signing.label=signing key for $userid$ +op.enroll.soKeyTemporary.keyGen.signing.cuid_label=$cuid$ +op.enroll.soKeyTemporary.keyGen.signing.overwrite=true +op.enroll.soKeyTemporary.keyGen.signing.certId=C1 +op.enroll.soKeyTemporary.keyGen.signing.certAttrId=c1 +op.enroll.soKeyTemporary.keyGen.signing.privateKeyAttrId=k2 +op.enroll.soKeyTemporary.keyGen.signing.publicKeyAttrId=k3 +op.enroll.soKeyTemporary.keyGen.signing.keyUsage=0 +op.enroll.soKeyTemporary.keyGen.signing.keyUser=0 +op.enroll.soKeyTemporary.keyGen.signing.privateKeyNumber=2 +op.enroll.soKeyTemporary.keyGen.signing.publicKeyNumber=3 +op.enroll.soKeyTemporary.keyGen.signing.ca.profileId=caTempTokenUserSigningKeyEnrollment +op.enroll.soKeyTemporary.keyGen.signing.ca.conn=ca1 +op.enroll.soKeyTemporary.keyGen.encryption.keySize=1024 +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.encrypt=true +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.sign=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.signRecover=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.wrap=true +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.verifyRecover=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.verify=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.sensitive=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.private=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.sign=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.signRecover=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.decrypt=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.unwrap=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.verifyRecover=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.verify=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.sensitive=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.private=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.encryption.label=encryption key for $userid$ +op.enroll.soKeyTemporary.keyGen.encryption.cuid_label=$cuid$ +op.enroll.soKeyTemporary.keyGen.encryption.overwrite=true +op.enroll.soKeyTemporary.keyGen.encryption.certId=C2 +op.enroll.soKeyTemporary.keyGen.encryption.certAttrId=c2 +op.enroll.soKeyTemporary.keyGen.encryption.privateKeyAttrId=k4 +op.enroll.soKeyTemporary.keyGen.encryption.publicKeyAttrId=k5 +op.enroll.soKeyTemporary.keyGen.encryption.keyUsage=0 +op.enroll.soKeyTemporary.keyGen.encryption.keyUser=0 +op.enroll.soKeyTemporary.keyGen.encryption.privateKeyNumber=4 +op.enroll.soKeyTemporary.keyGen.encryption.publicKeyNumber=5 +op.enroll.soKeyTemporary.keyGen.encryption.ca.profileId=caTempTokenUserEncryptionKeyEnrollment +op.enroll.soKeyTemporary.keyGen.encryption.ca.conn=ca1 +op.enroll.soKeyTemporary.pkcs11obj.enable=true +op.enroll.soKeyTemporary.pkcs11obj.compress.enable=true +op.enroll.soKeyTemporary.update.applet.emptyToken.enable=true +op.enroll.soKeyTemporary.update.applet.enable=true +op.enroll.soKeyTemporary.update.applet.requiredVersion=1.4.4d40a449 +op.enroll.soKeyTemporary.update.applet.directory=[TPS_DIR]/applets +op.enroll.soKeyTemporary.update.applet.encryption=true +op.enroll.soKeyTemporary.update.symmetricKeys.enable=false +op.enroll.soKeyTemporary.update.symmetricKeys.requiredVersion=1 +op.enroll.soKeyTemporary.loginRequest.enable=true +op.enroll.soKeyTemporary.pinReset.enable=true +op.enroll.soKeyTemporary.pinReset.pin.maxRetries=127 +op.enroll.soKeyTemporary.pinReset.pin.minLen=4 +op.enroll.soKeyTemporary.pinReset.pin.maxLen=10 +op.enroll.soKeyTemporary.cardmgr_instance=A0000000030000 +op.enroll.soKeyTemporary.tks.conn=tks1 +op.enroll.soKeyTemporary.tks.keySet=defKeyset +op.enroll.soKeyTemporary.auth.id=ldap2 +op.enroll.soKeyTemporary.auth.enable=true op.pinReset._000=######################################### op.pinReset._001=# Certificate Chain Imports op.pinReset._002=# @@ -1257,194 +1284,136 @@ op.pinReset._015=# op.pinReset._016=# - N/A for HouseKey op.pinReset._017=# - N/A for HouseKey with Legacy Applet op.pinReset._018=######################################### -op.pinReset.mapping.0.filter.appletMajorVersion= -op.pinReset.mapping.0.filter.appletMinorVersion= -op.pinReset.mapping.0.filter.tokenATR= -op.pinReset.mapping.0.filter.tokenCUID.end= -op.pinReset.mapping.0.filter.tokenCUID.start= -op.pinReset.mapping.0.filter.tokenType= -op.pinReset.mapping.0.target.tokenType=userKey -op.pinReset.mapping.order=0 -op.pinReset.userKey.auth.enable=true -op.pinReset.userKey.auth.id=ldap1 -op.pinReset.userKey.cardmgr_instance=A0000000030000 -op.pinReset.userKey.loginRequest.enable=true -op.pinReset.userKey.pinReset.pin.maxLen=10 -op.pinReset.userKey.pinReset.pin.minLen=4 -op.pinReset.userKey.tks.conn=tks1 -op.pinReset.userKey.update.applet.directory=[TPS_DIR]/applets op.pinReset.userKey.update.applet.emptyToken.enable=true op.pinReset.userKey.update.applet.enable=false -op.pinReset.userKey.update.applet.encryption=true op.pinReset.userKey.update.applet.requiredVersion=1.4.4d40a449 +op.pinReset.userKey.update.applet.directory=[TPS_DIR]/applets +op.pinReset.userKey.update.applet.encryption=true op.pinReset.userKey.update.symmetricKeys.enable=false op.pinReset.userKey.update.symmetricKeys.requiredVersion=1 -os.serverName=cert-[PKI_INSTANCE_NAME] -os.userid=nobody -passwordClass=com.netscape.cmsutil.password.PlainPasswordFile -passwordFile=[PKI_INSTANCE_PATH]/conf/password.conf -pidDir=[PKI_PIDDIR] -pkicreate.admin_secure_port=[PKI_ADMIN_SECURE_PORT] -pkicreate.agent_secure_port=[PKI_AGENT_SECURE_PORT] -pkicreate.ee_secure_port=[PKI_EE_SECURE_PORT] -pkicreate.group=[PKI_GROUP] -pkicreate.pki_instance_name=[PKI_INSTANCE_NAME] -pkicreate.pki_instance_root=[PKI_INSTANCE_ROOT] -pkicreate.secure_port=[PKI_SECURE_PORT] -pkicreate.subsystem_type=[PKI_SUBSYSTEM_TYPE] -pkicreate.systemd.servicename=[PKI_SYSTEMD_SERVICENAME] -pkicreate.tomcat_server_port=[TOMCAT_SERVER_PORT] -pkicreate.unsecure_port=[PKI_UNSECURE_PORT] -pkicreate.user=[PKI_USER] -pkiremove.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] -preop.admincert.profile=caAdminCert -preop.admin.group=TUS Agents,TUS Operators,TUS Administrators,TUS Officers -preop.admin.name=Token Processing Service Manager Administrator -preop.cert.admin.defaultSigningAlgorithm=SHA256withRSA -preop.cert.admin.dn=uid=admin,cn=admin -preop.cert.admin.keysize.custom_size=2048 -preop.cert.admin.keysize.size=2048 -preop.cert.admin.profile=adminCert.profile -preop.cert.audit_signing.cncomponent.override=true -preop.cert.audit_signing.defaultSigningAlgorithm=SHA256withRSA -preop.cert.audit_signing.dn=CN=TPS Audit Signing Certificate -preop.cert.audit_signing.enable=true -preop.cert.audit_signing.keysize.custom_size=2048 -preop.cert.audit_signing.keysize.size=2048 -preop.cert.audit_signing.nickname=auditSigningCert cert-[PKI_INSTANCE_NAME] -preop.cert.audit_signing.profile=caInternalAuthAuditSigningCert -preop.cert.audit_signing.signing.required=false -preop.cert.audit_signing.subsystem=tps -preop.cert.audit_signing.type=remote -preop.cert.audit_signing.userfriendlyname=TPS Audit Signing Certificate -preop.cert.list=sslserver,subsystem,audit_signing -preop.cert.rsalist=audit_signing -preop.cert.sslserver.cncomponent.override=false -preop.cert.sslserver.defaultSigningAlgorithm=SHA256withRSA -preop.cert.sslserver.dn=CN=[PKI_HOSTNAME] -preop.cert.sslserver.enable=true -preop.cert.sslserver.keysize.custom_size=2048 -preop.cert.sslserver.keysize.size=2048 -preop.cert.sslserver.nickname=[PKI_SSL_SERVER_NICKNAME] -preop.cert.sslserver.profile=caInternalAuthServerCert -preop.cert.sslserver.signing.required=false -preop.cert.sslserver.subsystem=tps -preop.cert.sslserver.type=remote -preop.cert.sslserver.userfriendlyname=SSL Server Certificate -preop.cert.subsystem.cncomponent.override=true -preop.cert.subsystem.defaultSigningAlgorithm=SHA256withRSA -preop.cert.subsystem.dn=CN=TPS Subsystem Certificate -preop.cert.subsystem.enable=true -preop.cert.subsystem.keysize.custom_size=2048 -preop.cert.subsystem.keysize.size=2048 -preop.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] -preop.cert.subsystem.profile=caInternalAuthSubsystemCert -preop.cert.subsystem.signing.required=false -preop.cert.subsystem.subsystem=tps -preop.cert.subsystem.type=remote -preop.cert.subsystem.userfriendlyname=Subsystem Certificate -preop.configModules.count=3 -preop.configModules.module0.commonName=NSS Internal PKCS #11 Module -preop.configModules.module0.imagePath=/pki/images/clearpixel.gif -preop.configModules.module0.userFriendlyName=NSS Internal PKCS #11 Module -preop.configModules.module1.commonName=nfast -preop.configModules.module1.imagePath=/pki/images/clearpixel.gif -preop.configModules.module1.userFriendlyName=nCipher's nFast Token Hardware Module -preop.configModules.module2.commonName=lunasa -preop.configModules.module2.imagePath=/pki/images/clearpixel.gif -preop.configModules.module2.userFriendlyName=SafeNet's LunaSA Token Hardware Module -preop.hierarchy.profile=caCert.profile -preop.internaldb.data_ldif=/usr/share/pki/tps/conf/db.ldif -preop.internaldb.index_ldif=/usr/share/pki/tps/conf/index.ldif -preop.internaldb.ldif=/usr/share/pki/tps/conf/database.ldif -preop.internaldb.manager_ldif=/usr/share/pki/tps/conf/manager.ldif -preop.internaldb.post_ldif=/usr/share/pki/tps/conf/vlv.ldif,/usr/share/pki/tps/conf/vlvtasks.ldif -preop.internaldb.schema.ldif=/usr/share/pki/tps/conf/schema.ldif -preop.internaldb.wait_dn=cn=index1160528734, cn=index, cn=tasks, cn=config -preop.module.token=Internal Key Storage Token -preop.pin=[PKI_RANDOM_NUMBER] -preop.product.name=CS -preop.securitydomain.admin_url=https://[PKI_HOSTNAME]:8443 -preop.system.fullname=Token Key Service -preop.system.name=TPS -preop.wizard.name=TPS Setup Wizard -proxy.securePort=[PKI_PROXY_SECURE_PORT] -proxy.unsecurePort=[PKI_PROXY_UNSECURE_PORT] -registry.file=[PKI_INSTANCE_PATH]/conf/registry.cfg -selftests._000=## -selftests._001=## Self Tests -selftests._002=## -selftests._003=## The Self-Test plugin TPSSystemCertsVerification uses the -selftests._004=## following parameters (where certusage is optional): -selftests._005=## tps.cert.list = <list of cert tag names deliminated by ","> -selftests._006=## tps.cert.<cert tag name>.nickname -selftests._007=## tps.cert.<cert tag name>.certusage -selftests._008=## -selftests.container.instance.SystemCertsVerification=com.netscape.cms.selftests.common.SystemCertsVerification -selftests.container.logger.bufferSize=512 -selftests.container.logger.class=com.netscape.cms.logging.RollingLogFile -selftests.container.logger.enable=true -selftests.container.logger.expirationTime=0 -selftests.container.logger.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/selftests.log -selftests.container.logger.flushInterval=5 -selftests.container.logger.level=1 -selftests.container.logger.maxFileSize=2000 -selftests.container.logger.register=false -selftests.container.logger.rolloverInterval=2592000 -selftests.container.logger.type=transaction -selftests.container.order.onDemand=SystemCertsVerification:critical -selftests.container.order.startup=SystemCertsVerification:critical -selftests.plugin.SystemCertsVerification.SubId=tps -service.instanceDir=[PKI_INSTANCE_ROOT] -service.instanceID=[PKI_INSTANCE_NAME] -service.machineName=[PKI_HOSTNAME] -service.non_clientauth_securePort=[PKI_EE_SECURE_PORT] -service.securePort=[PKI_AGENT_SECURE_PORT] -service.unsecurePort=[PKI_UNSECURE_PORT] -smtp.host=localhost -smtp.port=25 -subsystem.0.class=org.dogtagpki.tps.server.TPSSubsystem -subsystem.0.id=tps -subsystem.1.class=com.netscape.cmscore.selftests.SelfTestSubsystem -subsystem.1.id=selftests -subsystem.2.class=com.netscape.cmscore.util.StatsSubsystem -subsystem.2.id=stats -target._000=######################################### -target._001=# entries to enable configuration of parameter sets through the TPS UI agent and admin tabs -target._002=# -target._003=# target.configure.list = comma separated lists of all parameter sets that can be configured by the admin. -target._004=# Each entry will show up (with underscore replaced by space) under Advanced Configuration on the admin tab. -target._005=# -target._006=# target.agent_approve.list = comma separated subset of above list. Parameter sets in this list -target._007=# will show up in the agent tab (under advanced configuration) and will require agent involvement -target._008=# (enable/ disable) to be edited. -target._009=# -target._010=# For the wording to display correctly, the values in the above list should be plurals. -target._011=# -target._012=# Each parameter set in the lists above requires three parameters: -target._013=# target.<type name>.list : list of choices of this parameter set type (will display in the drop down box) -target._014=# target.<type name>.pattern : the regular expression to select parameters in CS.cfg for this parameter set. -target._015=# target.<type_name>.displayname: used in the UI display text. This should be the singular form of <type_name>. -target._016=# -target._017=# The exception is the parameter set Generals, which has only a pattern and displayname defined. -target._018=# -target._019=######################################## -target.agent_approve.list=Profiles -target.Authentication_Sources.displayname=Authentication Source -target.Authentication_Sources.list=0,1 -target.Authentication_Sources.pattern=auth\.instance\.$name\..* -target.configure.list=Profiles,Subsystem_Connections,Profile_Mappings,Authentication_Sources -target.Generals.displayname=General -target.Generals.pattern=^applet\..*\|^general\..*\|^failover.pod.enable\|^channel\..* -target.Profile_Mappings.displayname=Profile Mapping -target.Profile_Mappings.list=enroll,format,pinReset -target.Profile_Mappings.pattern=op\.$name\.mapping\..* -target.Profiles.displayname=Profile -target.Profiles.list=userKey,soKey,soCleanUserToken,soUserKey,cleanToken,soCleanSoToken,tokenKey -target.Profiles.pattern=op\..*\.$name\..* -target.Subsystem_Connections.displayname=Subsystem Connection -target.Subsystem_Connections.list=ca1,drm1,tks1 -target.Subsystem_Connections.pattern=conn\.$name\..* +op.pinReset.userKey.loginRequest.enable=true +op.pinReset.userKey.pinReset.pin.minLen=4 +op.pinReset.userKey.pinReset.pin.maxLen=10 +op.pinReset.userKey.tks.conn=tks1 +op.pinReset.userKey.cardmgr_instance=A0000000030000 +op.pinReset.userKey.auth.id=ldap1 +op.pinReset.userKey.auth.enable=true +op.format._000=######################################### +op.format._001=# Format Operation For tokenKey +op.format._002=# +op.format._003=# op.format.tokenKey.update.applet.emptyToken.enable=false +op.format._004=# - update applet or not if token is empty +op.format._005=# +op.format._006=# - applicable to CoolKey +op.format._007=# - applicable to HouseKey +op.format._008=# - applicable to HouseKey with Legacy Applet +op.format._009=######################################### +op.format.allowUnknownToken=true +op.format.soCleanUserToken.update.applet.emptyToken.enable=true +op.format.soCleanUserToken.update.applet.requiredVersion=1.4.4d40a449 +op.format.soCleanUserToken.update.applet.directory=[TPS_DIR]/applets +op.format.soCleanUserToken.update.applet.encryption=true +op.format.soCleanUserToken.update.symmetricKeys.enable=false +op.format.soCleanUserToken.update.symmetricKeys.requiredVersion=1 +op.format.soCleanUserToken.revokeCert=true +op.format.soCleanUserToken.ca.conn=ca1 +op.format.soCleanUserToken.loginRequest.enable=false +op.format.soCleanUserToken.cardmgr_instance=A0000000030000 +op.format.soCleanUserToken.tks.conn=tks1 +op.format.soCleanUserToken.auth.id=ldap1 +op.format.soCleanUserToken.auth.enable=false +op.format.soCleanUserToken.issuerinfo.enable=true +op.format.soCleanUserToken.issuerinfo.value= +op.format.soCleanSOToken.update.applet.emptyToken.enable=true +op.format.soCleanSOToken.update.applet.requiredVersion=1.4.4d40a449 +op.format.soCleanSOToken.update.applet.directory=[TPS_DIR]/applets +op.format.soCleanSOToken.update.applet.encryption=true +op.format.soCleanSOToken.update.symmetricKeys.enable=false +op.format.soCleanSOToken.update.symmetricKeys.requiredVersion=1 +op.format.soCleanSOToken.revokeCert=true +op.format.soCleanSOToken.ca.conn=ca1 +op.format.soCleanSOToken.loginRequest.enable=false +op.format.soCleanSOToken.cardmgr_instance=A0000000030000 +op.format.soCleanSOToken.tks.conn=tks1 +op.format.soCleanSOToken.auth.id=ldap1 +op.format.soCleanSOToken.auth.enable=false +op.format.soCleanSOToken.issuerinfo.enable=true +op.format.soCleanSOToken.issuerinfo.value= +op.format.cleanToken.update.applet.emptyToken.enable=true +op.format.cleanToken.update.applet.requiredVersion=1.4.4d40a449 +op.format.cleanToken.update.applet.directory=[TPS_DIR]/applets +op.format.cleanToken.update.applet.encryption=true +op.format.cleanToken.update.symmetricKeys.enable=false +op.format.cleanToken.update.symmetricKeys.requiredVersion=1 +op.format.cleanToken.revokeCert=true +op.format.cleanToken.ca.conn=ca1 +op.format.cleanToken.loginRequest.enable=true +op.format.cleanToken.cardmgr_instance=A0000000030000 +op.format.cleanToken.tks.conn=tks1 +op.format.cleanToken.auth.id=ldap1 +op.format.cleanToken.auth.enable=false +op.format.cleanToken.issuerinfo.enable=true +op.format.cleanToken.issuerinfo.value= +op.format.soUserKey.update.applet.emptyToken.enable=true +op.format.soUserKey.update.applet.requiredVersion=1.4.4d40a449 +op.format.soUserKey.update.applet.directory=[TPS_DIR]/applets +op.format.soUserKey.update.applet.encryption=true +op.format.soUserKey.update.symmetricKeys.enable=false +op.format.soUserKey.update.symmetricKeys.requiredVersion=1 +op.format.soUserKey.revokeCert=true +op.format.soUserKey.ca.conn=ca1 +op.format.soUserKey.loginRequest.enable=false +op.format.soUserKey.cardmgr_instance=A0000000030000 +op.format.soUserKey.tks.conn=tks1 +op.format.soUserKey.auth.id=ldap1 +op.format.soUserKey.auth.enable=false +op.format.soUserKey.issuerinfo.enable=true +op.format.soUserKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi +op.format.soKey.update.applet.emptyToken.enable=true +op.format.soKey.update.applet.requiredVersion=1.4.4d40a449 +op.format.soKey.update.applet.directory=[TPS_DIR]/applets +op.format.soKey.update.applet.encryption=true +op.format.soKey.update.symmetricKeys.enable=false +op.format.soKey.update.symmetricKeys.requiredVersion=1 +op.format.soKey.revokeCert=true +op.format.soKey.ca.conn=ca1 +op.format.soKey.loginRequest.enable=true +op.format.soKey.cardmgr_instance=A0000000030000 +op.format.soKey.tks.conn=tks1 +op.format.soKey.auth.id=ldap2 +op.format.soKey.auth.enable=true +op.format.soKey.issuerinfo.enable=true +op.format.soKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/so/index.cgi +op.format.userKey.update.applet.emptyToken.enable=true +op.format.userKey.update.applet.requiredVersion=1.4.4d40a449 +op.format.userKey.update.applet.directory=[TPS_DIR]/applets +op.format.userKey.update.applet.encryption=true +op.format.userKey.update.symmetricKeys.enable=false +op.format.userKey.update.symmetricKeys.requiredVersion=1 +op.format.userKey.revokeCert=true +op.format.userKey.ca.conn=ca1 +op.format.userKey.loginRequest.enable=true +op.format.userKey.cardmgr_instance=A0000000030000 +op.format.userKey.tks.conn=tks1 +op.format.userKey.auth.id=ldap1 +op.format.userKey.auth.enable=true +op.format.userKey.issuerinfo.enable=true +op.format.userKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi +op.format.tokenKey.update.applet.emptyToken.enable=true +op.format.tokenKey.update.applet.requiredVersion=1.4.4d40a449 +op.format.tokenKey.update.applet.directory=[TPS_DIR]/applets +op.format.tokenKey.update.applet.encryption=true +op.format.tokenKey.update.symmetricKeys.enable=false +op.format.tokenKey.update.symmetricKeys.requiredVersion=1 +op.format.tokenKey.revokeCert=true +op.format.tokenKey.ca.conn=ca1 +op.format.tokenKey.loginRequest.enable=true +op.format.tokenKey.cardmgr_instance=A0000000030000 +op.format.tokenKey.tks.conn=tks1 +op.format.tokenKey.auth.id=ldap1 +op.format.tokenKey.auth.enable=true +op.format.tokenKey.issuerinfo.enable=true +op.format.tokenKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi tokendb._000=######################################### tokendb._001=# tokendb.auditLog: tokendb._002=# - audit log path @@ -1521,59 +1490,100 @@ tokendb._072=# TOKEN_FOUND =4, tokendb._073=# TOKEN_TEMP_LOST_PERM_LOST =5, tokendb._074=# TOKEN_TERMINATED = 6 tokendb._075=######################################### -tokendb.activityBaseDN=ou=Activities,[TOKENDB_ROOT] -tokendb.addConfigTemplate=addConfig.template -tokendb.addResultTemplate=addResults.template -tokendb.agentSelectConfigTemplate=agentSelectConfig.template -tokendb.agentViewConfigTemplate=agentViewConfig.template -tokendb.allowedTransitions=0:1,0:2,0:3,0:4,0:5,0:6,3:4,3:5,3:6,4:1,4:2,4:3,4:6 -tokendb.auditAdminTemplate=auditAdmin.template tokendb.auditLog=[PKI_INSTANCE_PATH]/logs/tokendb-audit.log -tokendb.baseDN=ou=Tokens,[TOKENDB_ROOT] +tokendb.hostport=[TOKENDB_HOST]:[TOKENDB_PORT] +tokendb.ssl=false tokendb.bindDN=cn=Directory Manager tokendb.bindPassPath=[PKI_INSTANCE_PATH]/conf/password.conf +tokendb.templateDir=[PKI_INSTANCE_PATH]/docroot/tus +tokendb.userBaseDN=[TOKENDB_ROOT] +tokendb.baseDN=ou=Tokens,[TOKENDB_ROOT] +tokendb.activityBaseDN=ou=Activities,[TOKENDB_ROOT] tokendb.certBaseDN=ou=Certificates,[TOKENDB_ROOT] -tokendb.confirmConfigChangesTemplate=confirmConfigChanges.template -tokendb.confirmDeleteConfigTemplate=confirmDeleteConfig.template -tokendb.defaultPolicy=RE_ENROLL=YES -tokendb.deleteResultTemplate=deleteResults.template -tokendb.deleteTemplate=delete.template -tokendb.doTokenConfirmTemplate=doTokenConfirm.template -tokendb.doTokenTemplate=doToken.template -tokendb.editConfigTemplate=editConfig.template -tokendb.editResultTemplate=editResults.template -tokendb.editTemplate=edit.template -tokendb.editUserTemplate=editUser.template -tokendb.errorTemplate=error.template -tokendb.hostport=[TOKENDB_HOST]:[TOKENDB_PORT] -tokendb.indexAdminTemplate=indexAdmin.template -tokendb.indexOperatorTemplate=indexOperator.template tokendb.indexTemplate=index.template +tokendb.indexAdminTemplate=indexAdmin.template tokendb.newTemplate=new.template -tokendb.newUserTemplate=newUser.template -tokendb.revokeTemplate=revoke.template -tokendb.searchActivityAdminResultTemplate=searchActivityAdminResults.template -tokendb.searchActivityAdminTemplate=searchActivityAdmin.template -tokendb.searchActivityResultTemplate=searchActivityResults.template -tokendb.searchActivityTemplate=searchActivity.template -tokendb.searchAdminResultTemplate=searchAdminResults.template -tokendb.searchAdminTemplate=searchAdmin.template +tokendb.showTemplate=show.template +tokendb.showCertTemplate=showCert.template +tokendb.errorTemplate=error.template +tokendb.searchTemplate=search.template +tokendb.searchResultTemplate=searchResults.template tokendb.searchCertificateResultTemplate=searchCertificateResults.template +tokendb.editTemplate=edit.template +tokendb.editResultTemplate=editResults.template +tokendb.addResultTemplate=addResults.template +tokendb.deleteTemplate=delete.template +tokendb.deleteResultTemplate=deleteResults.template +tokendb.searchActivityTemplate=searchActivity.template tokendb.searchCertificateTemplate=searchCertificate.template -tokendb.searchResultTemplate=searchResults.template -tokendb.searchTemplate=search.template +tokendb.searchActivityResultTemplate=searchActivityResults.template +tokendb.searchActivityAdminTemplate=searchActivityAdmin.template +tokendb.searchActivityAdminResultTemplate=searchActivityAdminResults.template +tokendb.showAdminTemplate=showAdmin.template +tokendb.doTokenTemplate=doToken.template +tokendb.doTokenConfirmTemplate=doTokenConfirm.template +tokendb.revokeTemplate=revoke.template +tokendb.searchAdminTemplate=searchAdmin.template +tokendb.searchAdminResultTemplate=searchAdminResults.template +tokendb.defaultPolicy=RE_ENROLL=YES +tokendb.newUserTemplate=newUser.template +tokendb.userDeleteTemplate=userDelete.template tokendb.searchUserResultTemplate=searchUserResults.template tokendb.searchUserTemplate=searchUser.template -tokendb.selectConfigTemplate=selectConfig.template -tokendb.selfTestResultsTemplate=selfTestResults.template +tokendb.editUserTemplate=editUser.template +tokendb.indexOperatorTemplate=indexOperator.template tokendb.selfTestTemplate=selfTest.template -tokendb.showAdminTemplate=showAdmin.template -tokendb.showCertTemplate=showCert.template -tokendb.showTemplate=show.template -tokendb.ssl=false -tokendb.templateDir=[PKI_INSTANCE_PATH]/docroot/tus -tokendb.userBaseDN=[TOKENDB_ROOT] -tokendb.userDeleteTemplate=userDelete.template +tokendb.selfTestResultsTemplate=selfTestResults.template +tokendb.auditAdminTemplate=auditAdmin.template +tokendb.selectConfigTemplate=selectConfig.template +tokendb.agentSelectConfigTemplate=agentSelectConfig.template +tokendb.editConfigTemplate=editConfig.template +tokendb.agentViewConfigTemplate=agentViewConfig.template +tokendb.addConfigTemplate=addConfig.template +tokendb.confirmConfigChangesTemplate=confirmConfigChanges.template +tokendb.confirmDeleteConfigTemplate=confirmDeleteConfig.template +log.instance.SignedAudit.selected.events=ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,CONFIG,CONFIG_ROLE,CONFIG_TOKEN,CONFIG_PROFILE,CONFIG_AUDIT,APPLET_UPGRADE,KEY_CHANGEOVER,RENEWAL +log.instance.SignedAudit.selectable.events=ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE,PRIVATE_KEY_ARCHIVE_PROCESSED,KEY_RECOVERY_REQUEST,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_PROCESSED,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,CONFIG,CONFIG_ROLE,CONFIG_TOKEN,CONFIG_PROFILE,CONFIG_AUDIT,APPLET_UPGRADE,KEY_CHANGEOVER,RENEWAL +log.instance.SignedAudit.nonselectable.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_PROCESSED,SERVER_SIDE_KEYGEN_REQUEST +tokendb.allowedTransitions=0:1,0:2,0:3,0:4,0:5,0:6,3:4,3:5,3:6,4:1,4:2,4:3,4:6 +target._000=######################################### +target._001=# entries to enable configuration of parameter sets through the TPS UI agent and admin tabs +target._002=# +target._003=# target.configure.list = comma separated lists of all parameter sets that can be configured by the admin. +target._004=# Each entry will show up (with underscore replaced by space) under Advanced Configuration on the admin tab. +target._005=# +target._006=# target.agent_approve.list = comma separated subset of above list. Parameter sets in this list +target._007=# will show up in the agent tab (under advanced configuration) and will require agent involvement +target._008=# (enable/ disable) to be edited. +target._009=# +target._010=# For the wording to display correctly, the values in the above list should be plurals. +target._011=# +target._012=# Each parameter set in the lists above requires three parameters: +target._013=# target.<type name>.list : list of choices of this parameter set type (will display in the drop down box) +target._014=# target.<type name>.pattern : the regular expression to select parameters in CS.cfg for this parameter set. +target._015=# target.<type_name>.displayname: used in the UI display text. This should be the singular form of <type_name>. +target._016=# +target._017=# The exception is the parameter set Generals, which has only a pattern and displayname defined. +target._018=# +target._019=######################################## +target.configure.list=Profiles,Subsystem_Connections,Profile_Mappings,Authentication_Sources +target.agent_approve.list=Profiles +target.Profiles.list=userKey,soKey,soCleanUserToken,soUserKey,cleanToken,soCleanSoToken,tokenKey +target.Profiles.pattern=op\..*\.$name\..* +target.Profiles.displayname=Profile +target.Subsystem_Connections.list=ca1,drm1,tks1 +target.Subsystem_Connections.pattern=conn\.$name\..* +target.Subsystem_Connections.displayname=Subsystem Connection +target.Profile_Mappings.list=enroll,format,pinReset +target.Profile_Mappings.pattern=op\.$name\.mapping\..* +target.Profile_Mappings.displayname=Profile Mapping +target.Authentication_Sources.list=0,1 +target.Authentication_Sources.pattern=auth\.instance\.$name\..* +target.Authentication_Sources.displayname=Authentication Source +target.Generals.displayname=General +target.Generals.pattern=^applet\..*\|^general\..*\|^failover.pod.enable\|^channel\..* +config.Generals.General.state=Enabled +config.Generals.General.timestamp=1280283607424406 tps._000=######################################## tps._001=# For verifying system certificates tps._002=# tps.cert.list=sslserver,subsystem,audit_signing @@ -1591,13 +1601,8 @@ tps._015=# TOKEN_TEMP_LOST_PERM_LOST =5, tps._016=# TOKEN_TERMINATED = 6 tps._017=# Sample: tps.operations.allowedTransitions=0:0,0:4,4:6,6:0 tps._018=######################################## -tps.cert.audit_signing.certusage=ObjectSigner -tps.cert.audit_signing.nickname=[HSM_LABEL][NICKNAME] -tps.cert.list=sslserver,subsystem,audit_signing -tps.cert.sslserver.certusage=SSLServer -tps.cert.subsystem.certusage=SSLClient tps.operations.allowedTransitions=0:0,0:4,4:0 -usrgrp._000=## -usrgrp._001=## User/Group -usrgrp._002=## -usrgrp.ldap=internaldb +tps.cert.list=sslserver,subsystem,audit_signing +tps.cert.sslserver.nickname=[HSM_LABEL][NICKNAME] +tps.cert.subsystem.nickname=[HSM_LABEL][NICKNAME] +tps.cert.audit_signing.nickname=[HSM_LABEL][NICKNAME] diff --git a/base/tps/java/CMakeLists.txt b/base/tps/java/CMakeLists.txt deleted file mode 100644 index c8f90e44e..000000000 --- a/base/tps/java/CMakeLists.txt +++ /dev/null @@ -1,136 +0,0 @@ -project(pki-tps_java NONE) - -find_file(LDAPJDK_JAR - NAMES - ldapjdk.jar - PATHS - /usr/share/java -) - -find_file(JAXRS_API_JAR - NAMES - jaxrs-api.jar - PATHS - ${RESTEASY_LIB} -) - -find_file(JSS_JAR - NAMES - jss4.jar - PATHS - ${JAVA_LIB_INSTALL_DIR} -) - -find_file(COMMONS_CODEC_JAR - NAMES - commons-codec.jar - PATHS - /usr/share/java -) - -find_file(JAXRS_API_JAR - NAMES - jaxrs-api.jar - PATHS - ${RESTEASY_LIB} -) - -find_file(PKI_CERTSRV_JAR - NAMES - pki-certsrv.jar - PATHS - /usr/share/java/pki -) - -find_file(PKI_CMS_JAR - NAMES - pki-cms.jar - PATHS - /usr/share/java/pki -) - -find_file(PKI_CMSCORE_JAR - NAMES - pki-cmscore.jar - PATHS - /usr/share/java/pki -) - -find_file(PKI_CMSUTIL_JAR - NAMES - pki-cmsutil.jar - PATHS - /usr/share/java/pki -) - -find_file(PKI_NSUTIL_JAR - NAMES - pki-nsutil.jar - PATHS - /usr/share/java/pki -) - -find_file(RESTEASY_ATOM_PROVIDER_JAR - NAMES - resteasy-atom-provider.jar - PATHS - ${RESTEASY_LIB} -) - -find_file(SERVLET_JAR - NAMES - servlet.jar - PATHS - ${JAVA_LIB_INSTALL_DIR} - /usr/share/java -) - -find_file(SYMKEY_JAR - NAMES - symkey.jar - PATHS - ${JAVA_LIB_INSTALL_DIR} - /usr/share/java -) - -# build pki-tps -javac(pki-tps-classes - SOURCES - org/dogtagpki/tps/*.java - CLASSPATH - ${PKI_CERTSRV_JAR} ${PKI_CMS_JAR} ${PKI_CMSCORE_JAR} - ${PKI_CMSUTIL_JAR} ${PKI_NSUTIL_JAR} - ${LDAPJDK_JAR} ${JAXRS_API_JAR} ${RESTEASY_ATOM_PROVIDER_JAR} - ${JSS_JAR} ${COMMONS_CODEC_JAR} ${SYMKEY_JAR} ${SERVLET_JAR} - OUTPUT_DIR - ${CMAKE_BINARY_DIR}/classes -) - -configure_file( - ${CMAKE_CURRENT_SOURCE_DIR}/pki-tps.mf - ${CMAKE_CURRENT_BINARY_DIR}/pki-tps.mf -) - -jar(pki-tps-jar - CREATE - ${CMAKE_BINARY_DIR}/dist/pki-tps.jar - OPTIONS - m - PARAMS - ${CMAKE_CURRENT_BINARY_DIR}/pki-tps.mf - INPUT_DIR - ${CMAKE_BINARY_DIR}/classes - FILES - org/dogtagpki/tps/*.class - DEPENDS - pki-tps-classes -) - -install( - FILES - ${CMAKE_BINARY_DIR}/dist/pki-tps.jar - DESTINATION - ${JAVA_JAR_INSTALL_DIR}/pki -) - -set(PKI_TPS_JAR ${CMAKE_BINARY_DIR}/dist/pki-tps.jar CACHE INTERNAL "pki-tps jar file") diff --git a/base/tps/java/org/dogtagpki/tps/TPSConnection.java b/base/tps/java/org/dogtagpki/tps/TPSConnection.java deleted file mode 100644 index cd62ff530..000000000 --- a/base/tps/java/org/dogtagpki/tps/TPSConnection.java +++ /dev/null @@ -1,98 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- -package org.dogtagpki.tps; - -import java.io.IOException; -import java.io.InputStream; -import java.io.OutputStream; -import java.io.PrintStream; - -/** - * @author Endi S. Dewata <edewata@redhat.com> - */ -public class TPSConnection { - - public InputStream in; - public PrintStream out; - public boolean chunked; - - public TPSConnection(InputStream in, OutputStream out) { - this(in, out, false); - } - - public TPSConnection(InputStream in, OutputStream out, boolean chunked) { - this.in = in; - this.out = new PrintStream(out); - this.chunked = chunked; - } - - public TPSMessage read() throws IOException { - - StringBuilder sb = new StringBuilder(); - int b; - - // read the first parameter - while ((b = in.read()) >= 0) { - char c = (char)b; - if (c == '&') break; - sb.append(c); - } - - if (b < 0) throw new IOException("Unexpected end of stream"); - - // parse message size - String nvp = sb.toString(); - String[] s = nvp.split("="); - int size = Integer.parseInt(s[1]); - - sb.append('&'); - - // read the rest of message - for (int i=0; i<size; i++) { - - b = in.read(); - if (b < 0) throw new IOException("Unexpected end of stream"); - - char c = (char)b; - sb.append(c); - } - - // parse the entire message - return new TPSMessage(sb.toString()); - } - - public void write(TPSMessage message) throws IOException { - String s = message.encode(); - - if (chunked) { - // send message length + EOL - out.print(Integer.toHexString(s.length())); - out.print("\r\n"); - } - - // send message - out.print(s); - - if (chunked) { - // send EOL - out.print("\r\n"); - } - - out.flush(); - } -} diff --git a/base/tps/java/org/dogtagpki/tps/TPSMessage.java b/base/tps/java/org/dogtagpki/tps/TPSMessage.java deleted file mode 100644 index 522a0f408..000000000 --- a/base/tps/java/org/dogtagpki/tps/TPSMessage.java +++ /dev/null @@ -1,101 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- -package org.dogtagpki.tps; - -import java.util.LinkedHashMap; -import java.util.Map; - -/** - * @author Endi S. Dewata <edewata@redhat.com> - */ -public class TPSMessage { - - Map<String, String> map = new LinkedHashMap<String, String>(); - - public TPSMessage() { - } - - public TPSMessage(String message) { - decode(message); - } - - public TPSMessage(Map<String, String> map) { - this.map.putAll(map); - } - - public void put(String key, String value) { - map.put(key, value); - } - - public void put(String key, Integer value) { - map.put(key, value.toString()); - } - - public void put(String key, byte[] bytes) { - StringBuilder sb = new StringBuilder(); - - for (byte b : bytes) { - sb.append("%"); - sb.append(String.format("%02X", b)); - } - - map.put(key, sb.toString()); - } - - public void decode(String message) { - - for (String nvp : message.split("&")) { - String[] s = nvp.split("="); - - String key = s[0]; - String value = s[1]; - - // skip message size - if (key.equals("s")) continue; - - map.put(key, value); - } - } - - public String encode() { - - StringBuilder sb = new StringBuilder(); - - // encode message type - String type = map.get("msg_type"); - sb.append("msg_type=" + type); - - // encode other parameters - for (String key : map.keySet()) { - - if (key.equals("msg_type")) continue; - - String value = map.get(key); - sb.append("&" + key + "=" + value); - } - - String message = sb.toString(); - - // encode message_size - return "s=" + message.length() + "&" + message; - } - - public String toString() { - return map.toString(); - } -} diff --git a/base/tps/java/org/dogtagpki/tps/server/TPSApplication.java b/base/tps/java/org/dogtagpki/tps/server/TPSApplication.java deleted file mode 100644 index 2f2b2a63a..000000000 --- a/base/tps/java/org/dogtagpki/tps/server/TPSApplication.java +++ /dev/null @@ -1,84 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- -package org.dogtagpki.tps.server; - -import java.util.HashSet; -import java.util.Set; - -import javax.ws.rs.core.Application; - -import org.dogtagpki.tps.token.TokenService; - -import com.netscape.certsrv.acls.ACLInterceptor; -import com.netscape.certsrv.authentication.AuthMethodInterceptor; -import com.netscape.certsrv.base.PKIException; -import com.netscape.cms.servlet.account.AccountService; -import com.netscape.cms.servlet.admin.GroupMemberService; -import com.netscape.cms.servlet.admin.GroupService; -import com.netscape.cms.servlet.admin.SystemCertService; -import com.netscape.cms.servlet.admin.UserCertService; -import com.netscape.cms.servlet.admin.UserMembershipService; -import com.netscape.cms.servlet.admin.UserService; -import com.netscape.cms.servlet.csadmin.SystemConfigService; - -/** - * @author Endi S. Dewata <edewata@redhat.com> - */ -public class TPSApplication extends Application { - - private Set<Object> singletons = new HashSet<Object>(); - private Set<Class<?>> classes = new HashSet<Class<?>>(); - - public TPSApplication() { - - // account - classes.add(AccountService.class); - - // installer - classes.add(SystemConfigService.class); - - // user and group management - classes.add(GroupMemberService.class); - classes.add(GroupService.class); - classes.add(UserCertService.class); - classes.add(UserMembershipService.class); - classes.add(UserService.class); - - // system certs - classes.add(SystemCertService.class); - - // tokens - classes.add(TokenService.class); - - // exception mapper - classes.add(PKIException.Mapper.class); - - // interceptors - singletons.add(new AuthMethodInterceptor()); - singletons.add(new ACLInterceptor()); - } - - public Set<Class<?>> getClasses() { - return classes; - } - - public Set<Object> getSingletons() { - return singletons; - } - -} diff --git a/base/tps/java/org/dogtagpki/tps/server/TPSServlet.java b/base/tps/java/org/dogtagpki/tps/server/TPSServlet.java deleted file mode 100644 index 78e6df4f8..000000000 --- a/base/tps/java/org/dogtagpki/tps/server/TPSServlet.java +++ /dev/null @@ -1,61 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- -package org.dogtagpki.tps.server; - -import java.io.IOException; - -import javax.servlet.http.HttpServlet; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; - -import org.dogtagpki.tps.TPSConnection; -import org.dogtagpki.tps.TPSMessage; - -/** - * @author Endi S. Dewata <edewata@redhat.com> - */ -public class TPSServlet extends HttpServlet { - - private static final long serialVersionUID = -1092227495262381074L; - - public void service(HttpServletRequest request, HttpServletResponse response) throws IOException { - - response.setHeader("Transfer-Encoding", "chunked"); - - TPSConnection con = new TPSConnection( - request.getInputStream(), response.getOutputStream(), true); - - TPSMessage message = con.read(); - System.out.println("Receive: " + message); - - message = new TPSMessage(); - message.put("msg_type", 9); - message.put("pdu_size", 12); - message.put("pdu_data", new byte[] { - (byte)0x00, (byte)0xA4, (byte)0x04, (byte)0x00, - (byte)0x07, (byte)0xA0, (byte)0x00, (byte)0x00, - (byte)0x00, (byte)0x03, (byte)0x00, (byte)0x00 - }); - - System.out.println("Send: " + message); - con.write(message); - - message = con.read(); - System.out.println("Receive: " + message); - } -} diff --git a/base/tps/java/org/dogtagpki/tps/server/TPSSubsystem.java b/base/tps/java/org/dogtagpki/tps/server/TPSSubsystem.java deleted file mode 100644 index 92017812c..000000000 --- a/base/tps/java/org/dogtagpki/tps/server/TPSSubsystem.java +++ /dev/null @@ -1,115 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- -package org.dogtagpki.tps.server; - -import org.dogtagpki.tps.token.TokenDatabase; - -import com.netscape.certsrv.apps.CMS; -import com.netscape.certsrv.authority.IAuthority; -import com.netscape.certsrv.base.EBaseException; -import com.netscape.certsrv.base.IConfigStore; -import com.netscape.certsrv.base.ISubsystem; -import com.netscape.certsrv.logging.ILogger; -import com.netscape.certsrv.request.IRequestListener; -import com.netscape.certsrv.request.IRequestQueue; - -/** - * @author Endi S. Dewata <edewata@redhat.com> - */ -public class TPSSubsystem implements IAuthority, ISubsystem { - - public final static TPSSubsystem INSTANCE = new TPSSubsystem(); - - public ILogger logger = CMS.getLogger(); - - public String id; - public String nickname; - public ISubsystem owner; - public IConfigStore config; - - public TokenDatabase tokenDatabase = new TokenDatabase(); - - public static TPSSubsystem getInstance() { - return INSTANCE; - } - - @Override - public String getId() { - return id; - } - - @Override - public void setId(String id) throws EBaseException { - this.id = id; - } - - @Override - public void init(ISubsystem owner, IConfigStore config) throws EBaseException { - this.owner = owner; - this.config = config; - } - - @Override - public void startup() throws EBaseException { - } - - @Override - public void shutdown() { - } - - @Override - public IConfigStore getConfigStore() { - return config; - } - - @Override - public IRequestQueue getRequestQueue() { - return null; - } - - @Override - public void registerRequestListener(IRequestListener listener) { - } - - @Override - public void registerPendingListener(IRequestListener listener) { - } - - @Override - public void log(int level, String msg) { - logger.log(ILogger.EV_SYSTEM, ILogger.S_TPS, level, msg); - } - - @Override - public String getNickname() { - return nickname; - } - - public void setNickname(String nickname) { - this.nickname = nickname; - } - - @Override - public String getOfficialName() { - return "tps"; - } - - public TokenDatabase getTokenDatabase() { - return tokenDatabase; - } -} diff --git a/base/tps/java/org/dogtagpki/tps/token/TokenDatabase.java b/base/tps/java/org/dogtagpki/tps/token/TokenDatabase.java deleted file mode 100644 index 3db76649f..000000000 --- a/base/tps/java/org/dogtagpki/tps/token/TokenDatabase.java +++ /dev/null @@ -1,76 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- - -package org.dogtagpki.tps.token; - -import java.util.Collection; -import java.util.Date; -import java.util.LinkedHashMap; -import java.util.Map; - -/** - * This class implements in-memory token database. In the future this - * will be replaced with LDAP database. - * - * @author Endi S. Dewata - */ -public class TokenDatabase { - - public final static int DEFAULT_SIZE = 20; - - Map<String, TokenRecord> tokens = new LinkedHashMap<String, TokenRecord>(); - - public Collection<TokenRecord> getTokens() throws Exception { - return tokens.values(); - } - - public TokenRecord getToken(String tokenID) throws Exception { - if (!tokens.containsKey(tokenID)) { - throw new Exception("Token "+ tokenID + " does not exist."); - } - return tokens.get(tokenID); - } - - public void addToken(TokenRecord tokenRecord) throws Exception { - if (tokens.containsKey(tokenRecord.getID())) { - throw new Exception("Token "+ tokenRecord.getID() + " already exists."); - } - - tokenRecord.setStatus("ENABLED"); - tokenRecord.setCreateTimestamp(new Date()); - - tokens.put(tokenRecord.getID(), tokenRecord); - } - - public void updateToken(String tokenID, TokenRecord tokenRecord) throws Exception { - if (!tokens.containsKey(tokenRecord.getID())) { - throw new Exception("Token "+ tokenRecord.getID() + " does not exist."); - } - - tokenRecord.setModifyTimestamp(new Date()); - - tokens.put(tokenRecord.getID(), tokenRecord); - } - - public void removeToken(String tokenID) throws Exception { - if (!tokens.containsKey(tokenID)) { - throw new Exception("Token "+ tokenID + " does not exist."); - } - tokens.remove(tokenID); - } -} diff --git a/base/tps/java/org/dogtagpki/tps/token/TokenRecord.java b/base/tps/java/org/dogtagpki/tps/token/TokenRecord.java deleted file mode 100644 index 1f9d9caf5..000000000 --- a/base/tps/java/org/dogtagpki/tps/token/TokenRecord.java +++ /dev/null @@ -1,188 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- - -package org.dogtagpki.tps.token; - -import java.util.Date; - -import com.netscape.certsrv.token.TokenData; - -/** - * @author Endi S. Dewata - */ -public class TokenRecord { - - String id; - String userID; - String status; - String reason; - String appletID; - String keyInfo; - Date createTimestamp; - Date modifyTimestamp; - - public String getID() { - return id; - } - - public void setID(String id) { - this.id = id; - } - - public String getUserID() { - return userID; - } - - public void setUserID(String userID) { - this.userID = userID; - } - - public String getStatus() { - return status; - } - - public void setStatus(String status) { - this.status = status; - } - - public String getReason() { - return reason; - } - - public void setReason(String reason) { - this.reason = reason; - } - - public String getAppletID() { - return appletID; - } - - public void setAppletID(String appletID) { - this.appletID = appletID; - } - - public String getKeyInfo() { - return keyInfo; - } - - public void setKeyInfo(String keyInfo) { - this.keyInfo = keyInfo; - } - - public Date getCreateTimestamp() { - return createTimestamp; - } - - public void setCreateTimestamp(Date createTimestamp) { - this.createTimestamp = createTimestamp; - } - - public Date getModifyTimestamp() { - return modifyTimestamp; - } - - public void setModifyTimestamp(Date modifyTimestamp) { - this.modifyTimestamp = modifyTimestamp; - } - - @Override - public int hashCode() { - final int prime = 31; - int result = 1; - result = prime * result + ((appletID == null) ? 0 : appletID.hashCode()); - result = prime * result + ((createTimestamp == null) ? 0 : createTimestamp.hashCode()); - result = prime * result + ((id == null) ? 0 : id.hashCode()); - result = prime * result + ((keyInfo == null) ? 0 : keyInfo.hashCode()); - result = prime * result + ((modifyTimestamp == null) ? 0 : modifyTimestamp.hashCode()); - result = prime * result + ((reason == null) ? 0 : reason.hashCode()); - result = prime * result + ((status == null) ? 0 : status.hashCode()); - result = prime * result + ((userID == null) ? 0 : userID.hashCode()); - return result; - } - - @Override - public boolean equals(Object obj) { - if (this == obj) - return true; - if (obj == null) - return false; - if (getClass() != obj.getClass()) - return false; - TokenRecord other = (TokenRecord) obj; - if (appletID == null) { - if (other.appletID != null) - return false; - } else if (!appletID.equals(other.appletID)) - return false; - if (createTimestamp == null) { - if (other.createTimestamp != null) - return false; - } else if (!createTimestamp.equals(other.createTimestamp)) - return false; - if (id == null) { - if (other.id != null) - return false; - } else if (!id.equals(other.id)) - return false; - if (keyInfo == null) { - if (other.keyInfo != null) - return false; - } else if (!keyInfo.equals(other.keyInfo)) - return false; - if (modifyTimestamp == null) { - if (other.modifyTimestamp != null) - return false; - } else if (!modifyTimestamp.equals(other.modifyTimestamp)) - return false; - if (reason == null) { - if (other.reason != null) - return false; - } else if (!reason.equals(other.reason)) - return false; - if (status == null) { - if (other.status != null) - return false; - } else if (!status.equals(other.status)) - return false; - if (userID == null) { - if (other.userID != null) - return false; - } else if (!userID.equals(other.userID)) - return false; - return true; - } - - public static void main(String args[]) throws Exception { - - TokenData before = new TokenData(); - before.setID("token1"); - before.setUserID("user1"); - before.setStatus("revoked"); - before.setReason("lost"); - before.setAppletID("APPLET1234"); - before.setKeyInfo("key info"); - before.setCreateTimestamp(new Date()); - before.setModifyTimestamp(new Date()); - - String string = before.toString(); - System.out.println(string); - - TokenData after = TokenData.valueOf(string); - System.out.println(before.equals(after)); - } -} diff --git a/base/tps/java/org/dogtagpki/tps/token/TokenService.java b/base/tps/java/org/dogtagpki/tps/token/TokenService.java deleted file mode 100644 index bc8b35d59..000000000 --- a/base/tps/java/org/dogtagpki/tps/token/TokenService.java +++ /dev/null @@ -1,245 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- - -package org.dogtagpki.tps.token; - -import java.io.UnsupportedEncodingException; -import java.net.URI; -import java.net.URLEncoder; -import java.util.Iterator; - -import javax.ws.rs.core.MediaType; -import javax.ws.rs.core.Response; - -import org.dogtagpki.tps.server.TPSSubsystem; -import org.jboss.resteasy.plugins.providers.atom.Link; - -import com.netscape.certsrv.base.PKIException; -import com.netscape.certsrv.token.TokenCollection; -import com.netscape.certsrv.token.TokenData; -import com.netscape.certsrv.token.TokenModifyRequest; -import com.netscape.certsrv.token.TokenResource; -import com.netscape.cms.servlet.base.PKIService; - -/** - * @author Endi S. Dewata - */ -public class TokenService extends PKIService implements TokenResource { - - public final static int DEFAULT_SIZE = 20; - - public TokenService() { - System.out.println("TokenService.<init>()"); - } - - public TokenData createTokenData(TokenRecord tokenRecord) { - - TokenData tokenData = new TokenData(); - tokenData.setID(tokenRecord.getID()); - tokenData.setUserID(tokenRecord.getUserID()); - tokenData.setStatus(tokenRecord.getStatus()); - tokenData.setReason(tokenRecord.getReason()); - tokenData.setAppletID(tokenRecord.getAppletID()); - tokenData.setKeyInfo(tokenRecord.getKeyInfo()); - tokenData.setCreateTimestamp(tokenRecord.getCreateTimestamp()); - tokenData.setModifyTimestamp(tokenRecord.getModifyTimestamp()); - - String tokenID = tokenRecord.getID(); - try { - tokenID = URLEncoder.encode(tokenID, "UTF-8"); - } catch (UnsupportedEncodingException e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - - URI uri = uriInfo.getBaseUriBuilder().path(TokenResource.class).path("{tokenID}").build(tokenID); - tokenData.setLink(new Link("self", uri)); - - return tokenData; - } - - public TokenRecord createTokenRecord(TokenData tokenData) { - - TokenRecord tokenRecord = new TokenRecord(); - tokenRecord.setID(tokenData.getID()); - tokenRecord.setUserID(tokenData.getUserID()); - tokenRecord.setStatus(tokenData.getStatus()); - tokenRecord.setReason(tokenData.getReason()); - tokenRecord.setAppletID(tokenData.getAppletID()); - tokenRecord.setKeyInfo(tokenData.getKeyInfo()); - tokenRecord.setCreateTimestamp(tokenData.getCreateTimestamp()); - tokenRecord.setModifyTimestamp(tokenData.getModifyTimestamp()); - - return tokenRecord; - } - - @Override - public TokenCollection findTokens(Integer start, Integer size) { - - System.out.println("TokenService.findTokens()"); - - try { - start = start == null ? 0 : start; - size = size == null ? DEFAULT_SIZE : size; - - TPSSubsystem subsystem = TPSSubsystem.getInstance(); - TokenDatabase database = subsystem.getTokenDatabase(); - - Iterator<TokenRecord> tokens = database.getTokens().iterator(); - - TokenCollection response = new TokenCollection(); - - int i = 0; - - // skip to the start of the page - for ( ; i<start && tokens.hasNext(); i++) tokens.next(); - - // return entries up to the page size - for ( ; i<start+size && tokens.hasNext(); i++) { - response.addToken(createTokenData(tokens.next())); - } - - // count the total entries - for ( ; tokens.hasNext(); i++) tokens.next(); - - if (start > 0) { - URI uri = uriInfo.getRequestUriBuilder().replaceQueryParam("start", Math.max(start-size, 0)).build(); - response.addLink(new Link("prev", uri)); - } - - if (start+size < i) { - URI uri = uriInfo.getRequestUriBuilder().replaceQueryParam("start", start+size).build(); - response.addLink(new Link("next", uri)); - } - - return response; - - } catch (Exception e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - } - - @Override - public TokenData getToken(String tokenID) { - - System.out.println("TokenService.getToken(\"" + tokenID + "\")"); - - try { - TPSSubsystem subsystem = TPSSubsystem.getInstance(); - TokenDatabase database = subsystem.getTokenDatabase(); - - return createTokenData(database.getToken(tokenID)); - - } catch (Exception e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - } - - @Override - public Response addToken(TokenData tokenData) { - - System.out.println("TokenService.addToken(\"" + tokenData.getID() + "\")"); - - try { - TPSSubsystem subsystem = TPSSubsystem.getInstance(); - TokenDatabase database = subsystem.getTokenDatabase(); - - database.addToken(createTokenRecord(tokenData)); - tokenData = createTokenData(database.getToken(tokenData.getID())); - - return Response - .created(tokenData.getLink().getHref()) - .entity(tokenData) - .type(MediaType.APPLICATION_XML) - .build(); - - } catch (Exception e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - } - - @Override - public Response updateToken(String tokenID, TokenData tokenData) { - - System.out.println("TokenService.updateToken(\"" + tokenID + "\")"); - - try { - TPSSubsystem subsystem = TPSSubsystem.getInstance(); - TokenDatabase database = subsystem.getTokenDatabase(); - - TokenRecord tokenRecord = database.getToken(tokenID); - tokenRecord.setUserID(tokenData.getUserID()); - database.updateToken(tokenData.getID(), tokenRecord); - - tokenData = createTokenData(database.getToken(tokenID)); - - return Response - .ok(tokenData) - .type(MediaType.APPLICATION_XML) - .build(); - - } catch (Exception e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - } - - @Override - public Response modifyToken(String tokenID, TokenModifyRequest request) { - - System.out.println("TokenService.modifyToken(\"" + tokenID + "\", request"); - - try { - TPSSubsystem subsystem = TPSSubsystem.getInstance(); - TokenDatabase database = subsystem.getTokenDatabase(); - - TokenRecord tokenRecord = database.getToken(tokenID); - // TODO: perform modification - - TokenData tokenData = createTokenData(tokenRecord); - - return Response - .ok(tokenData) - .type(MediaType.APPLICATION_XML) - .build(); - - } catch (Exception e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - } - - @Override - public void removeToken(String tokenID) { - - System.out.println("TokenService.removeToken(\"" + tokenID + "\")"); - - try { - TPSSubsystem subsystem = TPSSubsystem.getInstance(); - TokenDatabase database = subsystem.getTokenDatabase(); - database.removeToken(tokenID); - - } catch (Exception e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - } -} diff --git a/base/tps/java/pki-tps.mf b/base/tps/java/pki-tps.mf deleted file mode 100644 index d77fe8fa9..000000000 --- a/base/tps/java/pki-tps.mf +++ /dev/null @@ -1,3 +0,0 @@ -Name: pki-tps -Specification-Version: ${APPLICATION_VERSION} -Implementation-Version: ${VERSION} diff --git a/base/tps/shared/conf/acl.ldif b/base/tps/shared/conf/acl.ldif deleted file mode 100644 index fb63122d1..000000000 --- a/base/tps/shared/conf/acl.ldif +++ /dev/null @@ -1,22 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: cn=aclResources,{rootSuffix} -objectClass: top -objectClass: CertACLS -cn: aclResources -resourceACLS: certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete -resourceACLS: certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify -resourceACLS: certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify -resourceACLS: certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter -#resourceACLS: certServer.log.configuration.signedAudit.expirationTime:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";deny (modify) user=anybody:Nobody is allowed to modify an expirationTime parameter -resourceACLS: certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log -resourceACLS: certServer.log.content.system:read:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents":Administrators, auditors, and agents are allowed to read the log content -resourceACLS: certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents":Administrators, auditors, and agents are allowed to read the log content -resourceACLS: certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify -resourceACLS: certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify) group="Administrators":this acl is shared by all admin servlets -resourceACLS: certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate -resourceACLS: certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody":Anybody may submit an enrollment request -resourceACLS: certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to clone the configuration. diff --git a/base/tps/shared/conf/catalina.policy b/base/tps/shared/conf/catalina.policy deleted file mode 100644 index 5ccc7959e..000000000 --- a/base/tps/shared/conf/catalina.policy +++ /dev/null @@ -1,182 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// Copyright (C) 2006-2010 Red Hat, Inc. -// All rights reserved. -// Modifications: configuration parameters -// --- END COPYRIGHT BLOCK --- - -// Licensed to the Apache Software Foundation (ASF) under one or more -// contributor license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright ownership. -// The ASF licenses this file to You under the Apache License, Version 2.0 -// (the "License"); you may not use this file except in compliance with -// the License. You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -// ============================================================================ -// catalina.corepolicy - Security Policy Permissions for Tomcat 6 -// -// This file contains a default set of security policies to be enforced (by the -// JVM) when Catalina is executed with the "-security" option. In addition -// to the permissions granted here, the following additional permissions are -// granted to the codebase specific to each web application: -// -// * Read access to the document root directory -// -// $Id$ -// ============================================================================ - - -// ========== SYSTEM CODE PERMISSIONS ========================================= - - -// These permissions apply to javac -grant codeBase "file:${java.home}/lib/-" { - permission java.security.AllPermission; -}; - -// These permissions apply to all shared system extensions -grant codeBase "file:${java.home}/jre/lib/ext/-" { - permission java.security.AllPermission; -}; - -// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre -grant codeBase "file:${java.home}/../lib/-" { - permission java.security.AllPermission; -}; - -// These permissions apply to all shared system extensions when -// ${java.home} points at $JAVA_HOME/jre -grant codeBase "file:${java.home}/lib/ext/-" { - permission java.security.AllPermission; -}; - - -// ========== CATALINA CODE PERMISSIONS ======================================= - - -// These permissions apply to the daemon code -grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" { - permission java.security.AllPermission; -}; - -// These permissions apply to the logging API -grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" { - permission java.util.PropertyPermission "java.util.logging.config.class", "read"; - permission java.util.PropertyPermission "java.util.logging.config.file", "read"; - permission java.io.FilePermission "${java.home}${file.separator}lib${file.separator}logging.properties", "read"; - permission java.lang.RuntimePermission "shutdownHooks"; - permission java.io.FilePermission "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read"; - permission java.util.PropertyPermission "catalina.base", "read"; - permission java.util.logging.LoggingPermission "control"; - permission java.io.FilePermission "${catalina.base}${file.separator}logs", "read, write"; - permission java.io.FilePermission "${catalina.base}${file.separator}logs${file.separator}*", "read, write"; - permission java.lang.RuntimePermission "getClassLoader"; - // To enable per context logging configuration, permit read access to the appropriate file. - // Be sure that the logging configuration is secure before enabling such access - // eg for the examples web application: - // permission java.io.FilePermission "${catalina.base}${file.separator}webapps${file.separator}examples${file.separator}WEB-INF${file.separator}classes${file.separator}logging.properties", "read"; -}; - -// These permissions apply to the server startup code -grant codeBase "file:${catalina.home}/bin/bootstrap.jar" { - permission java.security.AllPermission; -}; - -// These permissions apply to the servlet API classes -// and those that are shared across all class loaders -// located in the "lib" directory -grant codeBase "file:${catalina.home}/lib/-" { - permission java.security.AllPermission; -}; - - -// ========== WEB APPLICATION PERMISSIONS ===================================== - - -// These permissions are granted by default to all web applications -// In addition, a web application will be given a read FilePermission -// and JndiPermission for all files and directories in its document root. -grant { - // Required for JNDI lookup of named JDBC DataSource's and - // javamail named MimePart DataSource used to send mail - permission java.util.PropertyPermission "java.home", "read"; - permission java.util.PropertyPermission "java.naming.*", "read"; - permission java.util.PropertyPermission "javax.sql.*", "read"; - - // OS Specific properties to allow read access - permission java.util.PropertyPermission "os.name", "read"; - permission java.util.PropertyPermission "os.version", "read"; - permission java.util.PropertyPermission "os.arch", "read"; - permission java.util.PropertyPermission "file.separator", "read"; - permission java.util.PropertyPermission "path.separator", "read"; - permission java.util.PropertyPermission "line.separator", "read"; - - // JVM properties to allow read access - permission java.util.PropertyPermission "java.version", "read"; - permission java.util.PropertyPermission "java.vendor", "read"; - permission java.util.PropertyPermission "java.vendor.url", "read"; - permission java.util.PropertyPermission "java.class.version", "read"; - permission java.util.PropertyPermission "java.specification.version", "read"; - permission java.util.PropertyPermission "java.specification.vendor", "read"; - permission java.util.PropertyPermission "java.specification.name", "read"; - - permission java.util.PropertyPermission "java.vm.specification.version", "read"; - permission java.util.PropertyPermission "java.vm.specification.vendor", "read"; - permission java.util.PropertyPermission "java.vm.specification.name", "read"; - permission java.util.PropertyPermission "java.vm.version", "read"; - permission java.util.PropertyPermission "java.vm.vendor", "read"; - permission java.util.PropertyPermission "java.vm.name", "read"; - - // Required for OpenJMX - permission java.lang.RuntimePermission "getAttribute"; - - // Allow read of JAXP compliant XML parser debug - permission java.util.PropertyPermission "jaxp.debug", "read"; - - // Precompiled JSPs need access to this package. - permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime"; - permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*"; - - // Precompiled JSPs need access to this system property. - permission java.util.PropertyPermission "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read"; -}; - - -// You can assign additional permissions to particular web applications by -// adding additional "grant" entries here, based on the code base for that -// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files. -// -// Different permissions can be granted to JSP pages, classes loaded from -// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/ -// directory, or even to individual jar files in the /WEB-INF/lib/ directory. -// -// For instance, assume that the standard "examples" application -// included a JDBC driver that needed to establish a network connection to the -// corresponding database and used the scrape taglib to get the weather from -// the NOAA web server. You might create a "grant" entries like this: -// -// The permissions granted to the context root directory apply to JSP pages. -// grant codeBase "file:${catalina.home}/webapps/examples/-" { -// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; -// permission java.net.SocketPermission "*.noaa.gov:80", "connect"; -// }; -// -// The permissions granted to the context WEB-INF/classes directory -// grant codeBase "file:${catalina.home}/webapps/examples/WEB-INF/classes/-" { -// }; -// -// The permission granted to your JDBC driver -// grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/driver.jar!/-" { -// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; -// }; -// The permission granted to the scrape taglib -// grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/scrape.jar!/-" { -// permission java.net.SocketPermission "*.noaa.gov:80", "connect"; -// }; diff --git a/base/tps/shared/conf/catalina.properties b/base/tps/shared/conf/catalina.properties deleted file mode 100644 index f6d1d1415..000000000 --- a/base/tps/shared/conf/catalina.properties +++ /dev/null @@ -1,87 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006-2010 Red Hat, Inc. -# All rights reserved. -# Modifications: configuration parameters -# --- END COPYRIGHT BLOCK --- - -# Licensed to the Apache Software Foundation (ASF) under one or more -# contributor license agreements. See the NOTICE file distributed with -# this work for additional information regarding copyright ownership. -# The ASF licenses this file to You under the Apache License, Version 2.0 -# (the "License"); you may not use this file except in compliance with -# the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# -# List of comma-separated packages that start with or equal this string -# will cause a security exception to be thrown when -# passed to checkPackageAccess unless the -# corresponding RuntimePermission ("accessClassInPackage."+package) has -# been granted. -package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,org.apache.jasper.,sun.beans. -# -# List of comma-separated packages that start with or equal this string -# will cause a security exception to be thrown when -# passed to checkPackageDefinition unless the -# corresponding RuntimePermission ("defineClassInPackage."+package) has -# been granted. -# -# by default, no packages are restricted for definition, and none of -# the class loaders supplied with the JDK call checkPackageDefinition. -# -package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,org.apache.jasper. - -# -# -# List of comma-separated paths defining the contents of the "common" -# classloader. Prefixes should be used to define what is the repository type. -# Path may be relative to the CATALINA_HOME or CATALINA_BASE path or absolute. -# If left as blank,the JVM system loader will be used as Catalina's "common" -# loader. -# Examples: -# "foo": Add this folder as a class repository -# "foo/*.jar": Add all the JARs of the specified folder as class -# repositories -# "foo/bar.jar": Add bar.jar as a class repository -common.loader=${catalina.home}/lib,${catalina.home}/lib/*.jar,[TOMCAT_INSTANCE_COMMON_LIB] - -# -# List of comma-separated paths defining the contents of the "server" -# classloader. Prefixes should be used to define what is the repository type. -# Path may be relative to the CATALINA_HOME or CATALINA_BASE path or absolute. -# If left as blank, the "common" loader will be used as Catalina's "server" -# loader. -# Examples: -# "foo": Add this folder as a class repository -# "foo/*.jar": Add all the JARs of the specified folder as class -# repositories -# "foo/bar.jar": Add bar.jar as a class repository -server.loader= - -# -# List of comma-separated paths defining the contents of the "shared" -# classloader. Prefixes should be used to define what is the repository type. -# Path may be relative to the CATALINA_BASE path or absolute. If left as blank, -# the "common" loader will be used as Catalina's "shared" loader. -# Examples: -# "foo": Add this folder as a class repository -# "foo/*.jar": Add all the JARs of the specified folder as class -# repositories -# "foo/bar.jar": Add bar.jar as a class repository -# Please note that for single jars, e.g. bar.jar, you need the URL form -# starting with file:. -shared.loader= - -# -# String cache configuration. -tomcat.util.buf.StringCache.byte.enabled=true -#tomcat.util.buf.StringCache.char.enabled=true -#tomcat.util.buf.StringCache.trainThreshold=500000 -#tomcat.util.buf.StringCache.cacheSize=5000 diff --git a/base/tps/shared/conf/context.xml b/base/tps/shared/conf/context.xml deleted file mode 100644 index ba139add2..000000000 --- a/base/tps/shared/conf/context.xml +++ /dev/null @@ -1,40 +0,0 @@ -<?xml version='1.0' encoding='utf-8'?> -<!-- BEGIN COPYRIGHT BLOCK - Copyright (C) 2006-2010 Red Hat, Inc. - All rights reserved. - Modifications: configuration parameters - END COPYRIGHT BLOCK --> -<!-- - Licensed to the Apache Software Foundation (ASF) under one or more - contributor license agreements. See the NOTICE file distributed with - this work for additional information regarding copyright ownership. - The ASF licenses this file to You under the Apache License, Version 2.0 - (the "License"); you may not use this file except in compliance with - the License. You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. ---> -<!-- The contents of this file will be loaded for each web application --> -<Context crossContext="true" allowLinking="true"> - - <!-- Default set of monitored resources --> - <WatchedResource>WEB-INF/web.xml</WatchedResource> - - <!-- Uncomment this to disable session persistence across Tomcat restarts --> - <!-- - <Manager pathname="" /> - --> - - <!-- Uncomment this to enable Comet connection tacking (provides events - on session expiration as well as webapp lifecycle) --> - <!-- - <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" /> - --> - -</Context> diff --git a/base/tps/shared/conf/database.ldif b/base/tps/shared/conf/database.ldif deleted file mode 100644 index d3c5f9e68..000000000 --- a/base/tps/shared/conf/database.ldif +++ /dev/null @@ -1,9 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: cn=config -changetype: modify -replace: nsslapd-maxbersize -nsslapd-maxbersize: 209715200 diff --git a/base/tps/shared/conf/db.ldif b/base/tps/shared/conf/db.ldif deleted file mode 100644 index 1dada984a..000000000 --- a/base/tps/shared/conf/db.ldif +++ /dev/null @@ -1,54 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: ou=Tokens,{rootSuffix} -objectclass: top -objectclass: organizationalunit -ou: Tokens - -dn: ou=Activities,{rootSuffix} -objectclass: top -objectclass: organizationalunit -ou: Activities - -dn: ou=Certificates,{rootSuffix} -objectclass: top -objectclass: organizationalunit -ou: Certificates - -dn: ou=People,{rootSuffix} -objectclass: top -objectclass: organizationalunit -ou: People -aci: (targetattr!="userPassword")(version 3.0; acl "Enable anonymous access"; allow (read, search, compare)userdn="ldap:///anyone";) - -dn: ou=Groups,{rootSuffix} -objectclass: top -objectclass: organizationalunit -ou: Groups - -dn: cn=TUS Agents,ou=Groups,{rootSuffix} -objectClass: top -objectClass: groupOfUniqueNames -cn: TUS Agents -description: Agents for TUS - -dn: cn=TUS Officers,ou=Groups,{rootSuffix} -objectClass: top -objectClass: groupOfUniqueNames -cn: TUS Officers -description: Security Officers for TUS - -dn: cn=TUS Administrators,ou=Groups,{rootSuffix} -objectClass: top -objectClass: groupOfUniqueNames -cn: TUS Administrators -description: Administrators for TUS - -dn: cn=TUS Operators,ou=Groups,{rootSuffix} -objectClass: top -objectClass: groupOfUniqueNames -cn: TUS Operators -description: Operators for TUS diff --git a/base/tps/shared/conf/etc/init.d/pki-tpsd b/base/tps/shared/conf/etc/init.d/pki-tpsd deleted file mode 100755 index 7b991f39c..000000000 --- a/base/tps/shared/conf/etc/init.d/pki-tpsd +++ /dev/null @@ -1,86 +0,0 @@ -#!/bin/bash -# -# --- BEGIN COPYRIGHT BLOCK --- -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; version 2 of the License. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License along -# with this program; if not, write to the Free Software Foundation, Inc., -# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -# -# Copyright (C) 2007-2010 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -# pki-tpsd Startup script for pki-tps with tomcat7 -# -# chkconfig: - 84 16 -# description: Token Processing Service (Tomcat 7.0) -# processname: pki-tpsd -# piddir: /var/run/pki/tps -# - -PROG_NAME=`basename $0` -SERVICE_NAME="pki-tpsd" -SERVICE_PROG="/sbin/service" -PKI_PATH="/usr/share/pki/tps" -PKI_REGISTRY="/etc/sysconfig/pki/tps" -PKI_TYPE="pki-tps" -PKI_TOTAL_PORTS=6 - -# Avoid using 'systemctl' for now -SYSTEMCTL_SKIP_REDIRECT=1 -export SYSTEMCTL_SKIP_REDIRECT - -# Disallow 'others' the ability to 'write' to new files -umask 00002 - -command="$1" -pki_instance="$2" - -# Source function library. -. /etc/init.d/functions - -# Source the PKI function library -. /usr/share/pki/scripts/functions - -# See how we were called. -case $command in - status) - registry_status - exit $? - ;; - start) - start - exit $? - ;; - restart) - restart - exit $? - ;; - stop) - stop - exit $? - ;; - condrestart|force-restart|try-restart) - [ ! -f ${lockfile} ] || restart - exit $? - ;; - reload) - echo "The 'reload' action is an unimplemented feature." - exit ${default_error} - ;; - *) - echo "unknown action ($command)" - usage - echo "where valid instance names include:" - list_instances - exit ${default_error} - ;; -esac diff --git a/base/tps/shared/conf/index.ldif b/base/tps/shared/conf/index.ldif deleted file mode 100644 index d896de394..000000000 --- a/base/tps/shared/conf/index.ldif +++ /dev/null @@ -1,76 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; -# version 2.1 of the License. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301 USA -# -# Copyright (C) 2007 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: cn=tokenUserID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: tokenUserID -nsindextype: eq -nsindextype: pres -nsindextype: sub -nssystemindex: false - -dn: cn=tokenID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: tokenID -nsindextype: eq -nsindextype: pres -nsindextype: sub -nssystemindex: false - -dn: cn=dateOfCreate,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: dateOfCreate -nsindextype: eq -nsindextype: pres -nsindextype: sub -nssystemindex: false - -dn: cn=dateOfModify,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: dateOfModify -nsindextype: eq -nsindextype: pres -nsindextype: sub -nssystemindex: false - -dn: cn=userCertificate,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: userCertificate -nsindextype: eq -nssystemindex: false - -dn: cn=tokenSerial,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: tokenSerial -nsindextype: eq -nssystemindex: false - -dn: cn=tokenKeyType,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: tokenKeyType -nsindextype: eq -nssystemindex: false diff --git a/base/tps/shared/conf/jk2.manifest b/base/tps/shared/conf/jk2.manifest deleted file mode 100644 index 986d7b874..000000000 --- a/base/tps/shared/conf/jk2.manifest +++ /dev/null @@ -1,2 +0,0 @@ -Main-Class: org.apache.jk.apr.TomcatStarter -Class-Path: ../lib/tomcat.jar log4j.jar log4j-core.jar ../lib/common/log4j.jar ../lib/common/log4j-core.jar ../lib/common/classes ../lib/common/commons-logging.jar bootstrap.jar ../server/lib/commons-logging.jar ../server/lib/jmx.jar jmx.jar commons-logging-api.jar diff --git a/base/tps/shared/conf/jk2.properties b/base/tps/shared/conf/jk2.properties deleted file mode 100644 index 934d6ed54..000000000 --- a/base/tps/shared/conf/jk2.properties +++ /dev/null @@ -1,31 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -## THIS FILE MAY BE OVERRIDEN AT RUNTIME. MAKE SURE TOMCAT IS STOPED -## WHEN YOU EDIT THE FILE. - -## COMMENTS WILL BE _LOST_ - -## DOCUMENTATION OF THE FORMAT IN JkMain javadoc. - -# Set the desired handler list -# handler.list=apr,request,channelJni -# -# Override the default port for the socketChannel -# channelSocket.port=8019 -# Default: -# channelUnix.file=${jkHome}/work/jk2.socket -# Just to check if the the config is working -# shm.file=${jkHome}/work/jk2.shm - -# In order to enable jni use any channelJni directive -# channelJni.disabled = 0 -# And one of the following directives: - -# apr.jniModeSo=/opt/apache2/modules/mod_jk2.so - -# If set to inprocess the mod_jk2 will Register natives itself -# This will enable the starting of the Tomcat from mod_jk2 -# apr.jniModeSo=inprocess diff --git a/base/tps/shared/conf/jkconf.ant.xml b/base/tps/shared/conf/jkconf.ant.xml deleted file mode 100644 index 48396f1b7..000000000 --- a/base/tps/shared/conf/jkconf.ant.xml +++ /dev/null @@ -1,55 +0,0 @@ -<!-- BEGIN COPYRIGHT BLOCK - Copyright (C) 2006 Red Hat, Inc. - All rights reserved. - END COPYRIGHT BLOCK --> -<project name="jkconf" default="main" basedir="."> - - <target name="init-3x" if="33.detect"> - <taskdef name="jkconf" - classname="org.apache.jk.config.WebXml2Jk" > - <classpath> - <!-- 3.3 support --> - <pathelement location="/ws/jtc/jk/build/classes" /> - <pathelement location="${tomcat.home}/lib/container/tomcat-jk2.jar" /> - <pathelement location="${tomcat.home}/lib/container/crimson.jar"/> - <pathelement location="${tomcat.home}/lib/common/commons-logging.jar"/> - </classpath> - </taskdef> - </target> - - <target name="init-4x" if="4x.detect" > - <path id="main.classpath"> - <!-- 3.3 support --> - <fileset dir="${tomcat.home}/lib" includes="*.jar" /> - <fileset dir="${tomcat.home}/server/lib" includes="*.jar" /> - <fileset dir="${tomcat.home}/common/lib" includes="*.jar" /> - </path> - - <taskdef name="jkconf" classpathref="main.classpath" - classname="org.apache.jk.config.WebXml2Jk" /> - </target> - - <target name="detect" > - <property file="build.properties"/> - <property file="${user.home}/build.properties"/> - <property file="${user.home}/.build.properties"/> - - <!-- default locations, overrident by properties. - This file must be installed in conf/ --> - <property name="tomcat.home" location=".." /> - - <available property="33.detect" file="${tomcat.home}/lib/container" /> - <available property="4x.detect" file="${tomcat.home}/server/lib" /> - </target> - - <target name="init" depends="detect,init-3x,init-4x" /> - - <!-- ==================== Detection and reports ==================== --> - - - <target name="main" depends="init"> - <jkconf docBase="${tomcat.home}/webapps/examples" - context="/examples" /> - </target> - -</project> diff --git a/base/tps/shared/conf/jkconfig.manifest b/base/tps/shared/conf/jkconfig.manifest deleted file mode 100644 index 3ba1f2e3e..000000000 --- a/base/tps/shared/conf/jkconfig.manifest +++ /dev/null @@ -1,2 +0,0 @@ -Main-Class: org.apache.jk.config.WebXml2Jk -Class-Path: tomcat-jk2.jar commons-logging.jar crimson.jar xercesImpl.jar xmlApis.jar tomcat-util.jar log4j.jar log4j-core.jar diff --git a/base/tps/shared/conf/logging.properties b/base/tps/shared/conf/logging.properties deleted file mode 100644 index 796cfc071..000000000 --- a/base/tps/shared/conf/logging.properties +++ /dev/null @@ -1,70 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006-2010 Red Hat, Inc. -# All rights reserved. -# Modifications: configuration parameters -# --- END COPYRIGHT BLOCK --- - -# Licensed to the Apache Software Foundation (ASF) under one or more -# contributor license agreements. See the NOTICE file distributed with -# this work for additional information regarding copyright ownership. -# The ASF licenses this file to You under the Apache License, Version 2.0 -# (the "License"); you may not use this file except in compliance with -# the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler - -.handlers = 1catalina.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler - -############################################################ -# Handler specific properties. -# Describes specific configuration info for Handlers. -############################################################ - -1catalina.org.apache.juli.FileHandler.level = FINE -1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs -1catalina.org.apache.juli.FileHandler.prefix = catalina. - -2localhost.org.apache.juli.FileHandler.level = FINE -2localhost.org.apache.juli.FileHandler.directory = ${catalina.base}/logs -2localhost.org.apache.juli.FileHandler.prefix = localhost. - -3manager.org.apache.juli.FileHandler.level = FINE -3manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs -3manager.org.apache.juli.FileHandler.prefix = manager. - -4host-manager.org.apache.juli.FileHandler.level = FINE -4host-manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs -4host-manager.org.apache.juli.FileHandler.prefix = host-manager. - -java.util.logging.ConsoleHandler.level = FINE -java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter - - -############################################################ -# Facility specific properties. -# Provides extra control for each logger. -############################################################ - -org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = INFO -org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = 2localhost.org.apache.juli.FileHandler - -org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = INFO -org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = 3manager.org.apache.juli.FileHandler - -org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].level = INFO -org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = 4host-manager.org.apache.juli.FileHandler - -# For example, set the com.xyz.foo logger to only log SEVERE -# messages: -#org.apache.catalina.startup.ContextConfig.level = FINE -#org.apache.catalina.startup.HostConfig.level = FINE -#org.apache.catalina.session.ManagerBase.level = FINE -#org.apache.catalina.core.AprLifecycleListener.level=FINE diff --git a/base/tps/shared/conf/manager.ldif b/base/tps/shared/conf/manager.ldif deleted file mode 100644 index 18700dd4b..000000000 --- a/base/tps/shared/conf/manager.ldif +++ /dev/null @@ -1,46 +0,0 @@ -# acis for cert manager - -dn: ou=csusers,cn=config -objectClass: top -objectClass: organizationalUnit -ou: csusers - -dn: {rootSuffix} -changetype: modify -add: aci -aci: (targetattr=*)(version 3.0; acl "cert manager access v2"; allow (all) userdn = "ldap:///{dbuser}";) - -dn: cn=ldbm database,cn=plugins,cn=config -changetype: modify -add: aci -aci: (targetattr=*)(version 3.0; acl "Cert Manager access for VLV searches"; allow (read) userdn="ldap:///{dbuser}";) - -dn: cn=config -changetype: modify -add: aci -aci: (targetattr != aci)(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///{dbuser}";) - -dn: ou=csusers,cn=config -changetype: modify -add: aci -aci: (targetattr != aci)(version 3.0; aci "cert manager manage replication users"; allow (all) userdn = "ldap:///{dbuser}";) - -dn: cn="{rootSuffix}",cn=mapping tree,cn=config -changetype: modify -add: aci -aci: (targetattr=*)(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///{dbuser}";) - -dn: cn="{rootSuffix}",cn=mapping tree,cn=config -changetype: modify -add: aci -aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///{dbuser}";) - -dn: cn="{rootSuffix}",cn=mapping tree,cn=config -changetype: modify -add: aci -aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///{dbuser}";) - -dn: cn=tasks,cn=config -changetype: modify -add: aci -aci: (targetattr=*)(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///{dbuser}";) diff --git a/base/tps/shared/conf/schema.ldif b/base/tps/shared/conf/schema.ldif deleted file mode 100644 index bde045630..000000000 --- a/base/tps/shared/conf/schema.ldif +++ /dev/null @@ -1,58 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; -# version 2.1 of the License. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301 USA -# -# Copyright (C) 2007 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: cn=schema -changetype: modify -add: attributeTypes -attributeTypes: ( dateOfCreate-oid NAME 'dateOfCreate' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( dateOfModify-oid NAME 'dateOfModify' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( modified-oid NAME 'modified' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenUserID-oid NAME 'tokenUserID' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenStatus-oid NAME 'tokenStatus' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenAppletID-oid NAME 'tokenAppletID' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( keyInfo-oid NAME 'keyInfo' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( numberOfResets-oid NAME 'numberOfResets' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) -attributeTypes: ( numberOfEnrollments-oid NAME 'numberOfEnrollments' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) -attributeTypes: ( numberOfRenewals-oid NAME 'numberOfRenewals' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) -attributeTypes: ( numberOfRecoveries-oid NAME 'numberOfRecoveries' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) -attributeTypes: ( allowPinReset-oid NAME 'allowPinReset' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( extensions-oid NAME 'extensions' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenOp-oid NAME 'tokenOp' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenID-oid NAME 'tokenID' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenMsg-oid NAME 'tokenMsg' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenResult-oid NAME 'tokenResult' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenIP-oid NAME 'tokenIP' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenPolicy-oid NAME 'tokenPolicy' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenIssuer-oid NAME 'tokenIssuer' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenSubject-oid NAME 'tokenSubject' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenSerial-oid NAME 'tokenSerial' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenOrigin-oid NAME 'tokenOrigin' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenType-oid NAME 'tokenType' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenKeyType-oid NAME 'tokenKeyType' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenReason-oid NAME 'tokenReason' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenNotBefore-oid NAME 'tokenNotBefore' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenNotAfter-oid NAME 'tokenNotAfter' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( profileID-oid NAME 'profileID' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -- -add: objectClasses -objectClasses: ( tokenRecord-oid NAME 'tokenRecord' DESC 'CMS defined class' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ modified $ tokenReason $ tokenUserID $ tokenStatus $ tokenAppletID $ keyInfo $ tokenPolicy $ extensions $ numberOfResets $ numberOfEnrollments $ numberOfRenewals $ numberOfRecoveries $ userCertificate $ tokenType ) X-ORIGIN 'user defined' ) -objectClasses: ( tokenActivity-oid NAME 'tokenActivity' DESC 'CMS defined class' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ tokenOp $ tokenIP $ tokenResult $ tokenID $ tokenUserID $ tokenMsg $ extensions $ tokenType ) X-ORIGIN 'user defined' ) -objectClasses: ( tokenCert-oid NAME 'tokenCert' DESC 'CMS defined class' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ userCertificate $ tokenUserID $ tokenID $ tokenIssuer $ tokenOrigin $ tokenSubject $ tokenSerial $ tokenStatus $ tokenType $ tokenKeyType $ tokenNotBefore $ tokenNotAfter $ extensions ) X-ORIGIN 'user defined' ) -objectClasses: ( tpsProfileID-oid NAME 'tpsProfileID' DESC 'CMS defined class' SUP top AUXILIARY MAY ( profileID ) X-ORIGIN 'user-defined' ) diff --git a/base/tps/shared/conf/server-minimal.xml b/base/tps/shared/conf/server-minimal.xml deleted file mode 100644 index fc855c6e3..000000000 --- a/base/tps/shared/conf/server-minimal.xml +++ /dev/null @@ -1,29 +0,0 @@ -<!-- BEGIN COPYRIGHT BLOCK - Copyright (C) 2006 Red Hat, Inc. - All rights reserved. - END COPYRIGHT BLOCK --> -<Server port="8005" shutdown="SHUTDOWN"> - - <GlobalNamingResources> - <!-- Used by Manager webapp --> - <Resource name="UserDatabase" auth="Container" - type="org.apache.catalina.UserDatabase" - description="User database that can be updated and saved" - factory="org.apache.catalina.users.MemoryUserDatabaseFactory" - pathname="conf/tomcat-users.xml" /> - </GlobalNamingResources> - - <Service name="Catalina"> - <Connector port="8080" /> - - <!-- This is here for compatibility only, not required --> - <Connector port="8009" protocol="AJP/1.3" /> - - <Engine name="Catalina" defaultHost="localhost"> - <Realm className="org.apache.catalina.realm.UserDatabaseRealm" - resourceName="UserDatabase" /> - <Host name="localhost" appBase="webapps" /> - </Engine> - - </Service> -</Server> diff --git a/base/tps/shared/conf/server.xml b/base/tps/shared/conf/server.xml deleted file mode 100644 index b66cb51ae..000000000 --- a/base/tps/shared/conf/server.xml +++ /dev/null @@ -1,258 +0,0 @@ -<?xml version='1.0' encoding='utf-8'?> -<!-- BEGIN COPYRIGHT BLOCK - Copyright (C) 2006-2010 Red Hat, Inc. - All rights reserved. - Modifications: configuration parameters - END COPYRIGHT BLOCK --> -<!-- - Licensed to the Apache Software Foundation (ASF) under one or more - contributor license agreements. See the NOTICE file distributed with - this work for additional information regarding copyright ownership. - The ASF licenses this file to You under the Apache License, Version 2.0 - (the "License"); you may not use this file except in compliance with - the License. You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. ---> -<!-- Note: A "Server" is not itself a "Container", so you may not - define subcomponents such as "Valves" at this level. - Documentation at /docs/config/server.html - --> - -<!-- DO NOT REMOVE - Begin PKI Status Definitions --> -<!-- -Unsecure Port = http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE] -Secure Agent Port = https://[PKI_HOSTNAME]:[PKI_AGENT_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/agent/[PKI_SUBSYSTEM_TYPE] -Secure EE Port = https://[PKI_HOSTNAME]:[PKI_EE_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/ee/[PKI_SUBSYSTEM_TYPE] -Secure Admin Port = https://[PKI_HOSTNAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE]/services -PKI Console Port = pkiconsole https://[PKI_HOSTNAME]:[PKI_ADMIN_SECURE_PORT]/[PKI_SUBSYSTEM_TYPE] -Tomcat Port = [TOMCAT_SERVER_PORT] (for shutdown) ---> -<!-- DO NOT REMOVE - End PKI Status Definitions --> - -<Server port="[TOMCAT_SERVER_PORT]" shutdown="SHUTDOWN"> - - <!--APR library loader. Documentation at /docs/apr.html --> - <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" /> - <!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html --> - <Listener className="org.apache.catalina.core.JasperListener" /> - <!-- JMX Support for the Tomcat server. Documentation at /docs/non-existent.html --> - <Listener className="org.apache.catalina.mbeans.ServerLifecycleListener" /> - <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" /> - - <!-- Global JNDI resources - Documentation at /docs/jndi-resources-howto.html - --> - <GlobalNamingResources> - <!-- Editable user database that can also be used by - UserDatabaseRealm to authenticate users - --> - <Resource name="UserDatabase" auth="Container" - type="org.apache.catalina.UserDatabase" - description="User database that can be updated and saved" - factory="org.apache.catalina.users.MemoryUserDatabaseFactory" - pathname="conf/tomcat-users.xml" /> - </GlobalNamingResources> - - <!-- A "Service" is a collection of one or more "Connectors" that share - a single "Container" Note: A "Service" is not itself a "Container", - so you may not define subcomponents such as "Valves" at this level. - Documentation at /docs/config/service.html - --> - <Service name="Catalina"> - - <!--The connectors can use a shared executor, you can define one or more named thread pools--> - <!-- - <Executor name="tomcatThreadPool" namePrefix="catalina-exec-" - maxThreads="150" minSpareThreads="4"/> - --> - - - <!-- A "Connector" represents an endpoint by which requests are received - and responses are returned. Documentation at : - Java HTTP Connector: /docs/config/http.html (blocking & non-blocking) - Java AJP Connector: /docs/config/ajp.html - APR (HTTP/AJP) Connector: /docs/apr.html - Define a non-SSL HTTP/1.1 Connector on port 8080 - --> - - [PKI_UNSECURE_PORT_SERVER_COMMENT] - <Connector name="[PKI_UNSECURE_PORT_CONNECTOR_NAME]" port="[PKI_UNSECURE_PORT]" protocol="HTTP/1.1" redirectPort="8443" - maxHttpHeaderSize="8192" - acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" - enableLookups="false" connectionTimeout="20000" disableUploadTimeout="true" - /> - - <!-- Define a SSL HTTP/1.1 Connector on port 8443 --> - [PKI_SECURE_PORT_SERVER_COMMENT] - <!-- DO NOT REMOVE - Begin define PKI secure port - NOTE: The OCSP settings take effect globally, so it should only be set once. - - In setup where SSL clientAuth="true", OCSP can be turned on by - setting enableOCSP to true like the following: - enableOCSP="true" - along with changes to related settings, especially: - ocspResponderURL=<see example in connector definition below> - ocspResponderCertNickname=<see example in connector definition below> - Here are the definition to all the OCSP-related settings: - enableOCSP - turns on/off the ocsp check - ocspResponderURL - sets the url where the ocsp requests are sent - ocspResponderCertNickname - sets the nickname of the cert that is - either CA's signing certificate or the OCSP server's signing - certificate. - The CA's signing certificate should already be in the db, in - case of the same security domain. - In case of an ocsp signing certificate, one must import the cert - into the subsystem's nss db and set trust. e.g.: - certutil -d . -A -n "ocspSigningCert cert-pki-ca" -t "C,," -a -i ocspCert.b64 - ocspCacheSize - sets max cache entries - ocspMinCacheEntryDuration - sets minimum seconds to next fetch attempt - ocspMaxCacheEntryDuration - sets maximum seconds to next fetch attempt - ocspTimeout -sets OCSP timeout in seconds - --> - <Connector name="[PKI_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_SECURE_PORT]" protocol="HTTP/1.1" SSLEnabled="true" sslProtocol="SSL" scheme="https" secure="true" - maxHttpHeaderSize="8192" - acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" - enableLookups="false" disableUploadTimeout="true" - SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation" - enableOCSP="false" - ocspResponderURL="http://[PKI_HOSTNAME]:9080/ca/ocsp" - ocspResponderCertNickname="ocspSigningCert cert-pki-ca" - ocspCacheSize="1000" - ocspMinCacheEntryDuration="60" - ocspMaxCacheEntryDuration="120" - ocspTimeout="10" - strictCiphers="false" - clientAuth="[PKI_AGENT_CLIENTAUTH]" - sslOptions="[TOMCAT_SSL_OPTIONS]" - ssl2Ciphers="[TOMCAT_SSL2_CIPHERS]" - ssl3Ciphers="[TOMCAT_SSL3_CIPHERS]" - tlsCiphers="[TOMCAT_TLS_CIPHERS]" - serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf" - passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf" - passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile" - certdbDir="[PKI_INSTANCE_PATH]/alias" - /> - <!-- DO NOT REMOVE - End define PKI secure port --> - - [PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_ADMIN_SECURE_PORT_SERVER_COMMENT] - <Connector name="[PKI_ADMIN_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_ADMIN_SECURE_PORT]" SSLEnabled="true" sslProtocol="SSL" scheme="https" secure="true" - maxHttpHeaderSize="8192" - acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" - enableLookups="false" disableUploadTimeout="true" - SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation" - strictCiphers="false" - clientAuth="false" - sslOptions="[TOMCAT_SSL_OPTIONS]" - ssl2Ciphers="[TOMCAT_SSL2_CIPHERS]" - ssl3Ciphers="[TOMCAT_SSL3_CIPHERS]" - tlsCiphers="[TOMCAT_TLS_CIPHERS]" - serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf" - passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf" - passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile" - certdbDir="[PKI_INSTANCE_PATH]/alias"/> - [PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT] - - [PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_EE_SECURE_PORT_SERVER_COMMENT] - <Connector name="[PKI_EE_SECURE_PORT_CONNECTOR_NAME]" port="[PKI_EE_SECURE_PORT]" SSLEnabled="true" sslProtocol="SSL" scheme="https" secure="true" - maxHttpHeaderSize="8192" - acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" - enableLookups="false" disableUploadTimeout="true" - SSLImplementation="org.apache.tomcat.util.net.jss.JSSImplementation" - strictCiphers="false" - clientAuth="false" - sslOptions="[TOMCAT_SSL_OPTIONS]" - ssl2Ciphers="[TOMCAT_SSL2_CIPHERS]" - ssl3Ciphers="[TOMCAT_SSL3_CIPHERS]" - tlsCiphers="[TOMCAT_TLS_CIPHERS]" - serverCertNickFile="[PKI_INSTANCE_PATH]/conf/serverCertNick.conf" - passwordFile="[PKI_INSTANCE_PATH]/conf/password.conf" - passwordClass="org.apache.tomcat.util.net.jss.PlainPasswordFile" - certdbDir="[PKI_INSTANCE_PATH]/alias"/> - [PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT] - - <!-- A "Connector" using the shared thread pool--> - <!-- - <Connector executor="tomcatThreadPool" - port="8080" protocol="HTTP/1.1" - connectionTimeout="20000" - redirectPort="8443" /> - --> - <!-- Define a SSL HTTP/1.1 Connector on port 8443 - This connector uses the JSSE configuration, when using APR, the - connector should be using the OpenSSL style configuration - described in the APR documentation --> - <!-- - <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" - maxThreads="150" scheme="https" secure="true" - clientAuth="false" sslProtocol="TLS" /> - --> - - <!-- Define an AJP 1.3 Connector on port [PKI_AJP_PORT] --> -[PKI_OPEN_AJP_PORT_COMMENT] - <Connector port="[PKI_AJP_PORT]" protocol="AJP/1.3" redirectPort="[PKI_AJP_REDIRECT_PORT]" address="127.0.0.1" /> -[PKI_CLOSE_AJP_PORT_COMMENT] - - - <!-- An Engine represents the entry point (within Catalina) that processes - every request. The Engine implementation for Tomcat stand alone - analyzes the HTTP headers included with the request, and passes them - on to the appropriate Host (virtual host). - Documentation at /docs/config/engine.html --> - - <!-- You should set jvmRoute to support load-balancing via AJP ie : - <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1"> - --> - <Engine name="Catalina" defaultHost="localhost"> - - <!--For clustering, please take a look at documentation at: - /docs/cluster-howto.html (simple how to) - /docs/config/cluster.html (reference documentation) --> - <!-- - <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/> - --> - - <!-- The request dumper valve dumps useful debugging information about - the request and response data received and sent by Tomcat. - Documentation at: /docs/config/valve.html --> - <!-- - <Valve className="org.apache.catalina.valves.RequestDumperValve"/> - --> - - <!-- This Realm uses the UserDatabase configured in the global JNDI - resources under the key "UserDatabase". Any edits - that are performed against this UserDatabase are immediately - available for use by the Realm. --> - <Realm className="org.apache.catalina.realm.UserDatabaseRealm" - resourceName="UserDatabase"/> - - <!-- Define the default virtual host - Note: XML Schema validation will not work with Xerces 2.2. - --> - <Host name="localhost" appBase="webapps" - unpackWARs="true" autoDeploy="false" - xmlValidation="false" xmlNamespaceAware="false"> - - <!-- SingleSignOn valve, share authentication between web applications - Documentation at: /docs/config/valve.html --> - <!-- - <Valve className="org.apache.catalina.authenticator.SingleSignOn" /> - --> - - <!-- Access log processes all example. - Documentation at: /docs/config/valve.html --> - <!-- - <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" - prefix="localhost_access_log." suffix=".txt" pattern="common" resolveHosts="false"/> - --> - - </Host> - </Engine> - </Service> -</Server> diff --git a/base/tps/shared/conf/shm.manifest b/base/tps/shared/conf/shm.manifest deleted file mode 100644 index 0505c085b..000000000 --- a/base/tps/shared/conf/shm.manifest +++ /dev/null @@ -1,2 +0,0 @@ -Main-Class: org.apache.jk.common.Shm -Class-Path: tomcat-jk2.jar commons-logging.jar tomcat-util.jar log4j.jar log4j-core.jar diff --git a/base/tps/shared/conf/tomcat-jk2.manifest b/base/tps/shared/conf/tomcat-jk2.manifest deleted file mode 100644 index acfef4a90..000000000 --- a/base/tps/shared/conf/tomcat-jk2.manifest +++ /dev/null @@ -1,7 +0,0 @@ -Manifest-version: 1.0 -Extension-Name: org.apache.jk -Specification-Vendor: Apache Software Foundation -Specification-Version: 2.0 -Implementation-Vendor-Id: org.apache -Implementation-Vendor: Apache Software Foundation -Implementation-Version: 2.1 diff --git a/base/tps/shared/conf/tomcat-users.xml b/base/tps/shared/conf/tomcat-users.xml deleted file mode 100644 index daa9260cc..000000000 --- a/base/tps/shared/conf/tomcat-users.xml +++ /dev/null @@ -1,45 +0,0 @@ -<?xml version='1.0' encoding='utf-8'?> -<!-- BEGIN COPYRIGHT BLOCK - Copyright (C) 2006-2010 Red Hat, Inc. - All rights reserved. - Modifications: configuration parameters - END COPYRIGHT BLOCK --> -<!-- - Licensed to the Apache Software Foundation (ASF) under one or more - contributor license agreements. See the NOTICE file distributed with - this work for additional information regarding copyright ownership. - The ASF licenses this file to You under the Apache License, Version 2.0 - (the "License"); you may not use this file except in compliance with - the License. You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. ---> - -<!-- - <role rolename="tomcat"/> - <role rolename="role1"/> - <user username="tomcat" password="tomcat" roles="tomcat"/> - <user username="both" password="tomcat" roles="tomcat,role1"/> - <user username="role1" password="tomcat" roles="role1"/> ---> - -<!-- The host manager webapp is restricted to users with role "admin" --> -<!--<user name="tomcat" password="password" roles="admin" />--> -<!-- The manager webapp is restricted to users with role "manager" --> -<!--<user name="tomcat" password="password" roles="manager" />--> -<tomcat-users> - <role rolename="pkiuser"/> - <role rolename="tomcat"/> - <role rolename="manager"/> - <role rolename="admin"/> - - <user username="pkiuser" password="pkiuser" roles="pkiuser"/> - <user username="tomcat" password="tomcat" roles="tomcat"/> - <user username="admin" password="netscape" roles="admin,manager"/> -</tomcat-users> diff --git a/base/tps/shared/conf/tomcat6.conf b/base/tps/shared/conf/tomcat6.conf deleted file mode 100644 index 2d7def5ec..000000000 --- a/base/tps/shared/conf/tomcat6.conf +++ /dev/null @@ -1,58 +0,0 @@ -# Service-specific configuration file for tomcat6. This will be sourced by -# the SysV init script after the global configuration file -# /etc/tomcat6/tomcat6.conf, thus allowing values to be overridden in -# a per-service manner. -# -# NEVER change the init script itself. To change values for all services make -# your changes in /etc/tomcat6/tomcat6.conf -# -# To change values for a specific service make your edits here. -# To create a new service create a link from /etc/init.d/<your new service> to -# /etc/init.d/tomcat6 (do not copy the init script) and make a copy of the -# /etc/sysconfig/tomcat6 file to /etc/sysconfig/<your new service> and change -# the property values so the two services won't conflict. Register the new -# service in the system as usual (see chkconfig and similars). -# - -# Where your java installation lives -#JAVA_HOME="/usr/lib/jvm/java" - -# Where your tomcat installation lives -CATALINA_BASE="[PKI_INSTANCE_PATH]" -#CATALINA_HOME="/usr/share/tomcat6" -#JASPER_HOME="/usr/share/tomcat6" -#CATALINA_TMPDIR="/var/cache/tomcat6/temp" - -# You can pass some parameters to java here if you wish to -#JAVA_OPTS="-Xminf0.1 -Xmaxf0.3" - -# Use JAVA_OPTS to set java.library.path for libtcnative.so -#JAVA_OPTS="-Djava.library.path=/usr/lib64" - -# What user should run tomcat -TOMCAT_USER="[PKI_USER]" - -# You can change your tomcat locale here -#LANG="en_US" - -# Run tomcat under the Java Security Manager -#SECURITY_MANAGER="false" - -# Time to wait in seconds, before killing process -#SHUTDOWN_WAIT="30" - -# Whether to annoy the user with "attempting to shut down" messages or not -#SHUTDOWN_VERBOSE="false" - -# Set the TOMCAT_PID location -CATALINA_PID="[TOMCAT_PIDFILE]" - -# Set the tomcat log file -TOMCAT_LOG="[TOMCAT_LOG_DIR]/tomcat-initd.log" - -# Connector port is 8080 for this tomcat6 instance -#CONNECTOR_PORT="8080" - -# If you wish to further customize your tomcat environment, -# put your own definitions here -# (i.e. LD_LIBRARY_PATH for some jdbc drivers) diff --git a/base/tps/shared/conf/uriworkermap.properties b/base/tps/shared/conf/uriworkermap.properties deleted file mode 100644 index c89dd82a6..000000000 --- a/base/tps/shared/conf/uriworkermap.properties +++ /dev/null @@ -1,18 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -# uriworkermap.properties - IIS -# -# This file provides sample mappings for example ajp13w -# worker defined in workermap.properties.minimal -# The general sytax for this file is: -# [URL]=[Worker name] - -/servlet-examples/*=ajp13w - -# Optionally filter out all .jpeg files inside that context -# For no mapping the url has to start with exclamation (!) - -!/servlet-examples/*.jpeg=ajp13w diff --git a/base/tps/shared/conf/vlv.ldif b/base/tps/shared/conf/vlv.ldif deleted file mode 100644 index db7988e36..000000000 --- a/base/tps/shared/conf/vlv.ldif +++ /dev/null @@ -1,51 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; -# version 2.1 of the License. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301 USA -# -# Copyright (C) 2007 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: cn=tus-listTokens-vlv,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -cn: tus-listtokens-vlv -objectClass: top -objectClass: vlvsearch -vlvBase: ou=Tokens,{rootSuffix} -vlvFilter: (&(cn=*)(tokenUserID=*)) -vlvScope: 2 - -dn: cn=tus-listActivities-vlv,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -cn: tus-listActivities-vlv -objectClass: top -objectClass: vlvsearch -vlvBase: ou=Activities,{rootSuffix} -vlvFilter: (&(tokenID=*)(tokenUserID=*)) -vlvScope: 2 - -dn: cn=listTokensIndex,cn=tus-listTokens-vlv,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -cn: listTokensIndex -objectClass: top -objectClass: vlvindex -vlvSort: -dateOfModify -vlvEnabled: 1 -vlvUses: 0 - -dn: cn=listActivitiesIndex,cn=tus-listActivities-vlv,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -cn: listActivitiesIndex -objectClass: top -objectClass: vlvindex -vlvSort: -dateOfCreate -vlvEnabled: 1 -vlvUses: 0 diff --git a/base/tps/shared/conf/vlvtasks.ldif b/base/tps/shared/conf/vlvtasks.ldif deleted file mode 100644 index b6b4bb762..000000000 --- a/base/tps/shared/conf/vlvtasks.ldif +++ /dev/null @@ -1,28 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; -# version 2.1 of the License. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301 USA -# -# Copyright (C) 2007 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: cn=index1160528734, cn=index, cn=tasks, cn=config -objectclass: top -objectclass: extensibleObject -cn: index1160528734 -ttl: 4 -nsInstance: userRoot -nsIndexVLVAttribute: listTokensIndex -nsIndexVLVAttribute: listActivitiesIndex diff --git a/base/tps/shared/conf/web.xml b/base/tps/shared/conf/web.xml deleted file mode 100644 index 8330ecca8..000000000 --- a/base/tps/shared/conf/web.xml +++ /dev/null @@ -1,993 +0,0 @@ -<?xml version="1.0" encoding="ISO-8859-1"?> -<!-- BEGIN COPYRIGHT BLOCK - Copyright (C) 2006 Red Hat, Inc. - All rights reserved. - END COPYRIGHT BLOCK --> -<web-app xmlns="http://java.sun.com/xml/ns/j2ee" - xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" - version="2.4"> - - <!-- ======================== Introduction ============================== --> - <!-- This document defines default values for *all* web applications --> - <!-- loaded into this instance of Tomcat. As each application is --> - <!-- deployed, this file is processed, followed by the --> - <!-- "/WEB-INF/web.xml" deployment descriptor from your own --> - <!-- applications. --> - <!-- --> - <!-- WARNING: Do not configure application-specific resources here! --> - <!-- They should go in the "/WEB-INF/web.xml" file in your application. --> - - - <!-- ================== Built In Servlet Definitions ==================== --> - - - <!-- The default servlet for all web applications, that serves static --> - <!-- resources. It processes all requests that are not mapped to other --> - <!-- servlets with servlet mappings (defined either here or in your own --> - <!-- web.xml file. This servlet supports the following initialization --> - <!-- parameters (default values are in square brackets): --> - <!-- --> - <!-- debug Debugging detail level for messages logged --> - <!-- by this servlet. [0] --> - <!-- --> - <!-- fileEncoding Encoding to be used to read static resources --> - <!-- [platform default] --> - <!-- --> - <!-- input Input buffer size (in bytes) when reading --> - <!-- resources to be served. [2048] --> - <!-- --> - <!-- listings Should directory listings be produced if there --> - <!-- is no welcome file in this directory? [true] --> - <!-- --> - <!-- output Output buffer size (in bytes) when writing --> - <!-- resources to be served. [2048] --> - <!-- --> - <!-- readonly Is this context "read only", so HTTP --> - <!-- commands like PUT and DELETE are --> - <!-- rejected? [true] --> - <!-- --> - <!-- readmeFile File name to display with the directory --> - <!-- contents. [null] --> - <!-- --> - <!-- For directory listing customization. Checks localXsltFile, then --> - <!-- globalXsltFile, then defaults to original behavior. --> - <!-- --> - <!-- localXsltFile Make directory listings an XML doc and --> - <!-- pass the result to this style sheet residing --> - <!-- in that directory. This overrides --> - <!-- globalXsltFile[null] --> - <!-- --> - <!-- globalXsltFile Site wide configuration version of --> - <!-- localXsltFile This argument is expected --> - <!-- to be a physical file. [null] --> - <!-- --> - <!-- --> - - <servlet> - <servlet-name>default</servlet-name> - <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class> - <init-param> - <param-name>debug</param-name> - <param-value>0</param-value> - </init-param> - <init-param> - <param-name>listings</param-name> - <param-value>false</param-value> - </init-param> - <load-on-startup>1</load-on-startup> - </servlet> - - - <!-- The "invoker" servlet, which executes anonymous servlet classes --> - <!-- that have not been defined in a web.xml file. Traditionally, this --> - <!-- servlet is mapped to the URL pattern "/servlet/*", but you can map --> - <!-- it to other patterns as well. The extra path info portion of such a --> - <!-- request must be the fully qualified class name of a Java class that --> - <!-- implements Servlet (or extends HttpServlet), or the servlet name --> - <!-- of an existing servlet definition. This servlet supports the --> - <!-- following initialization parameters (default values are in square --> - <!-- brackets): --> - <!-- --> - <!-- debug Debugging detail level for messages logged --> - <!-- by this servlet. [0] --> - -<!-- - <servlet> - <servlet-name>invoker</servlet-name> - <servlet-class> - org.apache.catalina.servlets.InvokerServlet - </servlet-class> - <init-param> - <param-name>debug</param-name> - <param-value>0</param-value> - </init-param> - <load-on-startup>2</load-on-startup> - </servlet> ---> - - - <!-- The JSP page compiler and execution servlet, which is the mechanism --> - <!-- used by Tomcat to support JSP pages. Traditionally, this servlet --> - <!-- is mapped to the URL pattern "*.jsp". This servlet supports the --> - <!-- following initialization parameters (default values are in square --> - <!-- brackets): --> - <!-- --> - <!-- checkInterval If development is false and checkInterval is --> - <!-- greater than zero, background compilations are --> - <!-- enabled. checkInterval is the time in seconds --> - <!-- between checks to see if a JSP page needs to --> - <!-- be recompiled. [0] --> - <!-- --> - <!-- modificationTestInterval --> - <!-- Causes a JSP (and its dependent files) to not --> - <!-- be checked for modification during the --> - <!-- specified time interval (in seconds) from the --> - <!-- last time the JSP was checked for --> - <!-- modification. A value of 0 will cause the JSP --> - <!-- to be checked on every access. --> - <!-- Used in development mode only. [4] --> - <!-- --> - <!-- compiler Which compiler Ant should use to compile JSP --> - <!-- pages. See the Ant documentation for more --> - <!-- information. [javac] --> - <!-- --> - <!-- classdebuginfo Should the class file be compiled with --> - <!-- debugging information? [true] --> - <!-- --> - <!-- classpath What class path should I use while compiling --> - <!-- generated servlets? [Created dynamically --> - <!-- based on the current web application] --> - <!-- --> - <!-- development Is Jasper used in development mode? If true, --> - <!-- the frequency at which JSPs are checked for --> - <!-- modification may be specified via the --> - <!-- modificationTestInterval parameter. [true] --> - <!-- --> - <!-- enablePooling Determines whether tag handler pooling is --> - <!-- enabled [true] --> - <!-- --> - <!-- fork Tell Ant to fork compiles of JSP pages so that --> - <!-- a separate JVM is used for JSP page compiles --> - <!-- from the one Tomcat is running in. [true] --> - <!-- --> - <!-- ieClassId The class-id value to be sent to Internet --> - <!-- Explorer when using <jsp:plugin> tags. --> - <!-- [clsid:8AD9C840-044E-11D1-B3E9-00805F499D93] --> - <!-- --> - <!-- javaEncoding Java file encoding to use for generating java --> - <!-- source files. [UTF8] --> - <!-- --> - <!-- keepgenerated Should we keep the generated Java source code --> - <!-- for each page instead of deleting it? [true] --> - <!-- --> - <!-- mappedfile Should we generate static content with one --> - <!-- print statement per input line, to ease --> - <!-- debugging? [true] --> - <!-- --> - <!-- trimSpaces Should white spaces in template text between --> - <!-- actions or directives be trimmed? [false] --> - <!-- --> - <!-- suppressSmap Should the generation of SMAP info for JSR45 --> - <!-- debugging be suppressed? [false] --> - <!-- --> - <!-- dumpSmap Should the SMAP info for JSR45 debugging be --> - <!-- dumped to a file? [false] --> - <!-- False if suppressSmap is true --> - <!-- --> - <!-- genStrAsCharArray Should text strings be generated as char --> - <!-- arrays, to improve performance in some cases? --> - <!-- [false] --> - <!-- --> - <!-- errorOnUseBeanInvalidClassAttribute --> - <!-- Should Jasper issue an error when the value of --> - <!-- the class attribute in an useBean action is --> - <!-- not a valid bean class? [true] --> - <!-- --> - <!-- scratchdir What scratch directory should we use when --> - <!-- compiling JSP pages? [default work directory --> - <!-- for the current web application] --> - <!-- --> - <!-- xpoweredBy Determines whether X-Powered-By response --> - <!-- header is added by generated servlet [false] --> - <!-- --> - <!-- If you wish to use Jikes to compile JSP pages: --> - <!-- Please see the "Using Jikes" section of the Jasper-HowTo --> - <!-- page in the Tomcat documentation. --> - - <servlet> - <servlet-name>jsp</servlet-name> - <servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class> - <init-param> - <param-name>fork</param-name> - <param-value>false</param-value> - </init-param> - <init-param> - <param-name>xpoweredBy</param-name> - <param-value>false</param-value> - </init-param> - <load-on-startup>3</load-on-startup> - </servlet> - - - <!-- Server Side Includes processing servlet, which processes SSI --> - <!-- directives in HTML pages consistent with similar support in web --> - <!-- servers like Apache. Traditionally, this servlet is mapped to the --> - <!-- URL pattern "*.shtml". This servlet supports the following --> - <!-- initialization parameters (default values are in square brackets): --> - <!-- --> - <!-- buffered Should output from this servlet be buffered? --> - <!-- (0=false, 1=true) [0] --> - <!-- --> - <!-- debug Debugging detail level for messages logged --> - <!-- by this servlet. [0] --> - <!-- --> - <!-- expires The number of seconds before a page with SSI --> - <!-- directives will expire. [No default] --> - <!-- --> - <!-- isVirtualWebappRelative --> - <!-- Should "virtual" paths be interpreted as --> - <!-- relative to the context root, instead of --> - <!-- the server root? (0=false, 1=true) [0] --> - <!-- --> - <!-- --> - <!-- IMPORTANT: To use the SSI servlet, you also need to rename the --> - <!-- $CATALINA_HOME/server/lib/servlets-ssi.renametojar file --> - <!-- to $CATALINA_HOME/server/lib/servlets-ssi.jar --> - -<!-- - <servlet> - <servlet-name>ssi</servlet-name> - <servlet-class> - org.apache.catalina.ssi.SSIServlet - </servlet-class> - <init-param> - <param-name>buffered</param-name> - <param-value>1</param-value> - </init-param> - <init-param> - <param-name>debug</param-name> - <param-value>0</param-value> - </init-param> - <init-param> - <param-name>expires</param-name> - <param-value>666</param-value> - </init-param> - <init-param> - <param-name>isVirtualWebappRelative</param-name> - <param-value>0</param-value> - </init-param> - <load-on-startup>4</load-on-startup> - </servlet> ---> - - - <!-- Common Gateway Includes (CGI) processing servlet, which supports --> - <!-- execution of external applications that conform to the CGI spec --> - <!-- requirements. Typically, this servlet is mapped to the URL pattern --> - <!-- "/cgi-bin/*", which means that any CGI applications that are --> - <!-- executed must be present within the web application. This servlet --> - <!-- supports the following initialization parameters (default values --> - <!-- are in square brackets): --> - <!-- --> - <!-- cgiPathPrefix The CGI search path will start at --> - <!-- webAppRootDir + File.separator + this prefix. --> - <!-- [WEB-INF/cgi] --> - <!-- --> - <!-- debug Debugging detail level for messages logged --> - <!-- by this servlet. [0] --> - <!-- --> - <!-- executable Name of the exectuable used to run the --> - <!-- script. [perl] --> - <!-- --> - <!-- parameterEncoding Name of parameter encoding to be used with --> - <!-- CGI servlet. --> - <!-- [System.getProperty("file.encoding","UTF-8")] --> - <!-- --> - <!-- passShellEnvironment Should the shell environment variables (if --> - <!-- any) be passed to the CGI script? [false] --> - <!-- --> - <!-- IMPORTANT: To use the CGI servlet, you also need to rename the --> - <!-- $CATALINA_HOME/server/lib/servlets-cgi.renametojar file --> - <!-- to $CATALINA_HOME/server/lib/servlets-cgi.jar --> - -<!-- - <servlet> - <servlet-name>cgi</servlet-name> - <servlet-class>org.apache.catalina.servlets.CGIServlet</servlet-class> - <init-param> - <param-name>debug</param-name> - <param-value>6</param-value> - </init-param> - <init-param> - <param-name>cgiPathPrefix</param-name> - <param-value>WEB-INF/cgi</param-value> - </init-param> - <load-on-startup>5</load-on-startup> - </servlet> ---> - - - <!-- ================ Built In Servlet Mappings ========================= --> - - - <!-- The servlet mappings for the built in servlets defined above. Note --> - <!-- that, by default, the CGI and SSI servlets are *not* mapped. You --> - <!-- must uncomment these mappings (or add them to your application's own --> - <!-- web.xml deployment descriptor) to enable these services --> - - <!-- The mapping for the default servlet --> - <servlet-mapping> - <servlet-name>default</servlet-name> - <url-pattern>/</url-pattern> - </servlet-mapping> - - <!-- The mapping for the invoker servlet --> -<!-- - <servlet-mapping> - <servlet-name>invoker</servlet-name> - <url-pattern>/servlet/*</url-pattern> - </servlet-mapping> ---> - - <!-- The mapping for the JSP servlet --> - <servlet-mapping> - <servlet-name>jsp</servlet-name> - <url-pattern>*.jsp</url-pattern> - </servlet-mapping> - - <servlet-mapping> - <servlet-name>jsp</servlet-name> - <url-pattern>*.jspx</url-pattern> - </servlet-mapping> - - <!-- The mapping for the SSI servlet --> -<!-- - <servlet-mapping> - <servlet-name>ssi</servlet-name> - <url-pattern>*.shtml</url-pattern> - </servlet-mapping> ---> - - <!-- The mapping for the CGI Gateway servlet --> - -<!-- - <servlet-mapping> - <servlet-name>cgi</servlet-name> - <url-pattern>/cgi-bin/*</url-pattern> - </servlet-mapping> ---> - - - <!-- ==================== Default Session Configuration ================= --> - <!-- You can set the default session timeout (in minutes) for all newly --> - <!-- created sessions by modifying the value below. --> - - <session-config> - <session-timeout>30</session-timeout> - </session-config> - - - <!-- ===================== Default MIME Type Mappings =================== --> - <!-- When serving static resources, Tomcat will automatically generate --> - <!-- a "Content-Type" header based on the resource's filename extension, --> - <!-- based on these mappings. Additional mappings can be added here (to --> - <!-- apply to all web applications), or in your own application's web.xml --> - <!-- deployment descriptor. --> - - <mime-mapping> - <extension>abs</extension> - <mime-type>audio/x-mpeg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>ai</extension> - <mime-type>application/postscript</mime-type> - </mime-mapping> - <mime-mapping> - <extension>aif</extension> - <mime-type>audio/x-aiff</mime-type> - </mime-mapping> - <mime-mapping> - <extension>aifc</extension> - <mime-type>audio/x-aiff</mime-type> - </mime-mapping> - <mime-mapping> - <extension>aiff</extension> - <mime-type>audio/x-aiff</mime-type> - </mime-mapping> - <mime-mapping> - <extension>aim</extension> - <mime-type>application/x-aim</mime-type> - </mime-mapping> - <mime-mapping> - <extension>art</extension> - <mime-type>image/x-jg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>asf</extension> - <mime-type>video/x-ms-asf</mime-type> - </mime-mapping> - <mime-mapping> - <extension>asx</extension> - <mime-type>video/x-ms-asf</mime-type> - </mime-mapping> - <mime-mapping> - <extension>au</extension> - <mime-type>audio/basic</mime-type> - </mime-mapping> - <mime-mapping> - <extension>avi</extension> - <mime-type>video/x-msvideo</mime-type> - </mime-mapping> - <mime-mapping> - <extension>avx</extension> - <mime-type>video/x-rad-screenplay</mime-type> - </mime-mapping> - <mime-mapping> - <extension>bcpio</extension> - <mime-type>application/x-bcpio</mime-type> - </mime-mapping> - <mime-mapping> - <extension>bin</extension> - <mime-type>application/octet-stream</mime-type> - </mime-mapping> - <mime-mapping> - <extension>bmp</extension> - <mime-type>image/bmp</mime-type> - </mime-mapping> - <mime-mapping> - <extension>body</extension> - <mime-type>text/html</mime-type> - </mime-mapping> - <mime-mapping> - <extension>cdf</extension> - <mime-type>application/x-cdf</mime-type> - </mime-mapping> - <mime-mapping> - <extension>cer</extension> - <mime-type>application/x-x509-ca-cert</mime-type> - </mime-mapping> - <mime-mapping> - <extension>class</extension> - <mime-type>application/java</mime-type> - </mime-mapping> - <mime-mapping> - <extension>cpio</extension> - <mime-type>application/x-cpio</mime-type> - </mime-mapping> - <mime-mapping> - <extension>csh</extension> - <mime-type>application/x-csh</mime-type> - </mime-mapping> - <mime-mapping> - <extension>css</extension> - <mime-type>text/css</mime-type> - </mime-mapping> - <mime-mapping> - <extension>dib</extension> - <mime-type>image/bmp</mime-type> - </mime-mapping> - <mime-mapping> - <extension>doc</extension> - <mime-type>application/msword</mime-type> - </mime-mapping> - <mime-mapping> - <extension>dtd</extension> - <mime-type>application/xml-dtd</mime-type> - </mime-mapping> - <mime-mapping> - <extension>dv</extension> - <mime-type>video/x-dv</mime-type> - </mime-mapping> - <mime-mapping> - <extension>dvi</extension> - <mime-type>application/x-dvi</mime-type> - </mime-mapping> - <mime-mapping> - <extension>eps</extension> - <mime-type>application/postscript</mime-type> - </mime-mapping> - <mime-mapping> - <extension>etx</extension> - <mime-type>text/x-setext</mime-type> - </mime-mapping> - <mime-mapping> - <extension>exe</extension> - <mime-type>application/octet-stream</mime-type> - </mime-mapping> - <mime-mapping> - <extension>gif</extension> - <mime-type>image/gif</mime-type> - </mime-mapping> - <mime-mapping> - <extension>gtar</extension> - <mime-type>application/x-gtar</mime-type> - </mime-mapping> - <mime-mapping> - <extension>gz</extension> - <mime-type>application/x-gzip</mime-type> - </mime-mapping> - <mime-mapping> - <extension>hdf</extension> - <mime-type>application/x-hdf</mime-type> - </mime-mapping> - <mime-mapping> - <extension>hqx</extension> - <mime-type>application/mac-binhex40</mime-type> - </mime-mapping> - <mime-mapping> - <extension>htc</extension> - <mime-type>text/x-component</mime-type> - </mime-mapping> - <mime-mapping> - <extension>htm</extension> - <mime-type>text/html</mime-type> - </mime-mapping> - <mime-mapping> - <extension>html</extension> - <mime-type>text/html</mime-type> - </mime-mapping> - <mime-mapping> - <extension>hqx</extension> - <mime-type>application/mac-binhex40</mime-type> - </mime-mapping> - <mime-mapping> - <extension>ief</extension> - <mime-type>image/ief</mime-type> - </mime-mapping> - <mime-mapping> - <extension>jad</extension> - <mime-type>text/vnd.sun.j2me.app-descriptor</mime-type> - </mime-mapping> - <mime-mapping> - <extension>jar</extension> - <mime-type>application/java-archive</mime-type> - </mime-mapping> - <mime-mapping> - <extension>java</extension> - <mime-type>text/plain</mime-type> - </mime-mapping> - <mime-mapping> - <extension>jnlp</extension> - <mime-type>application/x-java-jnlp-file</mime-type> - </mime-mapping> - <mime-mapping> - <extension>jpe</extension> - <mime-type>image/jpeg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>jpeg</extension> - <mime-type>image/jpeg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>jpg</extension> - <mime-type>image/jpeg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>js</extension> - <mime-type>text/javascript</mime-type> - </mime-mapping> - <mime-mapping> - <extension>jsf</extension> - <mime-type>text/plain</mime-type> - </mime-mapping> - <mime-mapping> - <extension>jspf</extension> - <mime-type>text/plain</mime-type> - </mime-mapping> - <mime-mapping> - <extension>kar</extension> - <mime-type>audio/x-midi</mime-type> - </mime-mapping> - <mime-mapping> - <extension>latex</extension> - <mime-type>application/x-latex</mime-type> - </mime-mapping> - <mime-mapping> - <extension>m3u</extension> - <mime-type>audio/x-mpegurl</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mac</extension> - <mime-type>image/x-macpaint</mime-type> - </mime-mapping> - <mime-mapping> - <extension>man</extension> - <mime-type>application/x-troff-man</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mathml</extension> - <mime-type>application/mathml+xml</mime-type> - </mime-mapping> - <mime-mapping> - <extension>me</extension> - <mime-type>application/x-troff-me</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mid</extension> - <mime-type>audio/x-midi</mime-type> - </mime-mapping> - <mime-mapping> - <extension>midi</extension> - <mime-type>audio/x-midi</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mif</extension> - <mime-type>application/x-mif</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mov</extension> - <mime-type>video/quicktime</mime-type> - </mime-mapping> - <mime-mapping> - <extension>movie</extension> - <mime-type>video/x-sgi-movie</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mp1</extension> - <mime-type>audio/x-mpeg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mp2</extension> - <mime-type>audio/x-mpeg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mp3</extension> - <mime-type>audio/x-mpeg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mpa</extension> - <mime-type>audio/x-mpeg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mpe</extension> - <mime-type>video/mpeg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mpeg</extension> - <mime-type>video/mpeg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mpega</extension> - <mime-type>audio/x-mpeg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mpg</extension> - <mime-type>video/mpeg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>mpv2</extension> - <mime-type>video/mpeg2</mime-type> - </mime-mapping> - <mime-mapping> - <extension>ms</extension> - <mime-type>application/x-wais-source</mime-type> - </mime-mapping> - <mime-mapping> - <extension>nc</extension> - <mime-type>application/x-netcdf</mime-type> - </mime-mapping> - <mime-mapping> - <extension>oda</extension> - <mime-type>application/oda</mime-type> - </mime-mapping> - <mime-mapping> - <extension>ogg</extension> - <mime-type>application/ogg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>pbm</extension> - <mime-type>image/x-portable-bitmap</mime-type> - </mime-mapping> - <mime-mapping> - <extension>pct</extension> - <mime-type>image/pict</mime-type> - </mime-mapping> - <mime-mapping> - <extension>pdf</extension> - <mime-type>application/pdf</mime-type> - </mime-mapping> - <mime-mapping> - <extension>pgm</extension> - <mime-type>image/x-portable-graymap</mime-type> - </mime-mapping> - <mime-mapping> - <extension>pic</extension> - <mime-type>image/pict</mime-type> - </mime-mapping> - <mime-mapping> - <extension>pict</extension> - <mime-type>image/pict</mime-type> - </mime-mapping> - <mime-mapping> - <extension>pls</extension> - <mime-type>audio/x-scpls</mime-type> - </mime-mapping> - <mime-mapping> - <extension>png</extension> - <mime-type>image/png</mime-type> - </mime-mapping> - <mime-mapping> - <extension>pnm</extension> - <mime-type>image/x-portable-anymap</mime-type> - </mime-mapping> - <mime-mapping> - <extension>pnt</extension> - <mime-type>image/x-macpaint</mime-type> - </mime-mapping> - <mime-mapping> - <extension>ppm</extension> - <mime-type>image/x-portable-pixmap</mime-type> - </mime-mapping> - <mime-mapping> - <extension>ppt</extension> - <mime-type>application/powerpoint</mime-type> - </mime-mapping> - <mime-mapping> - <extension>ps</extension> - <mime-type>application/postscript</mime-type> - </mime-mapping> - <mime-mapping> - <extension>psd</extension> - <mime-type>image/x-photoshop</mime-type> - </mime-mapping> - <mime-mapping> - <extension>qt</extension> - <mime-type>video/quicktime</mime-type> - </mime-mapping> - <mime-mapping> - <extension>qti</extension> - <mime-type>image/x-quicktime</mime-type> - </mime-mapping> - <mime-mapping> - <extension>qtif</extension> - <mime-type>image/x-quicktime</mime-type> - </mime-mapping> - <mime-mapping> - <extension>ras</extension> - <mime-type>image/x-cmu-raster</mime-type> - </mime-mapping> - <mime-mapping> - <extension>rdf</extension> - <mime-type>application/rdf+xml</mime-type> - </mime-mapping> - <mime-mapping> - <extension>rgb</extension> - <mime-type>image/x-rgb</mime-type> - </mime-mapping> - <mime-mapping> - <extension>rm</extension> - <mime-type>application/vnd.rn-realmedia</mime-type> - </mime-mapping> - <mime-mapping> - <extension>roff</extension> - <mime-type>application/x-troff</mime-type> - </mime-mapping> - <mime-mapping> - <extension>rtf</extension> - <mime-type>application/rtf</mime-type> - </mime-mapping> - <mime-mapping> - <extension>rtx</extension> - <mime-type>text/richtext</mime-type> - </mime-mapping> - <mime-mapping> - <extension>sh</extension> - <mime-type>application/x-sh</mime-type> - </mime-mapping> - <mime-mapping> - <extension>shar</extension> - <mime-type>application/x-shar</mime-type> - </mime-mapping> - <mime-mapping> - <extension>smf</extension> - <mime-type>audio/x-midi</mime-type> - </mime-mapping> - <mime-mapping> - <extension>sit</extension> - <mime-type>application/x-stuffit</mime-type> - </mime-mapping> - <mime-mapping> - <extension>snd</extension> - <mime-type>audio/basic</mime-type> - </mime-mapping> - <mime-mapping> - <extension>src</extension> - <mime-type>application/x-wais-source</mime-type> - </mime-mapping> - <mime-mapping> - <extension>sv4cpio</extension> - <mime-type>application/x-sv4cpio</mime-type> - </mime-mapping> - <mime-mapping> - <extension>sv4crc</extension> - <mime-type>application/x-sv4crc</mime-type> - </mime-mapping> - <mime-mapping> - <extension>svg</extension> - <mime-type>image/svg+xml</mime-type> - </mime-mapping> - <mime-mapping> - <extension>swf</extension> - <mime-type>application/x-shockwave-flash</mime-type> - </mime-mapping> - <mime-mapping> - <extension>t</extension> - <mime-type>application/x-troff</mime-type> - </mime-mapping> - <mime-mapping> - <extension>tar</extension> - <mime-type>application/x-tar</mime-type> - </mime-mapping> - <mime-mapping> - <extension>tcl</extension> - <mime-type>application/x-tcl</mime-type> - </mime-mapping> - <mime-mapping> - <extension>tex</extension> - <mime-type>application/x-tex</mime-type> - </mime-mapping> - <mime-mapping> - <extension>texi</extension> - <mime-type>application/x-texinfo</mime-type> - </mime-mapping> - <mime-mapping> - <extension>texinfo</extension> - <mime-type>application/x-texinfo</mime-type> - </mime-mapping> - <mime-mapping> - <extension>tif</extension> - <mime-type>image/tiff</mime-type> - </mime-mapping> - <mime-mapping> - <extension>tiff</extension> - <mime-type>image/tiff</mime-type> - </mime-mapping> - <mime-mapping> - <extension>tr</extension> - <mime-type>application/x-troff</mime-type> - </mime-mapping> - <mime-mapping> - <extension>tsv</extension> - <mime-type>text/tab-separated-values</mime-type> - </mime-mapping> - <mime-mapping> - <extension>txt</extension> - <mime-type>text/plain</mime-type> - </mime-mapping> - <mime-mapping> - <extension>ulw</extension> - <mime-type>audio/basic</mime-type> - </mime-mapping> - <mime-mapping> - <extension>ustar</extension> - <mime-type>application/x-ustar</mime-type> - </mime-mapping> - <mime-mapping> - <extension>vxml</extension> - <mime-type>application/voicexml+xml</mime-type> - </mime-mapping> - <mime-mapping> - <extension>xbm</extension> - <mime-type>image/x-xbitmap</mime-type> - </mime-mapping> - <mime-mapping> - <extension>xht</extension> - <mime-type>application/xhtml+xml</mime-type> - </mime-mapping> - <mime-mapping> - <extension>xhtml</extension> - <mime-type>application/xhtml+xml</mime-type> - </mime-mapping> - <mime-mapping> - <extension>xml</extension> - <mime-type>application/xml</mime-type> - </mime-mapping> - <mime-mapping> - <extension>xpm</extension> - <mime-type>image/x-xpixmap</mime-type> - </mime-mapping> - <mime-mapping> - <extension>xsl</extension> - <mime-type>application/xml</mime-type> - </mime-mapping> - <mime-mapping> - <extension>xslt</extension> - <mime-type>application/xslt+xml</mime-type> - </mime-mapping> - <mime-mapping> - <extension>xul</extension> - <mime-type>application/vnd.mozilla.xul+xml</mime-type> - </mime-mapping> - <mime-mapping> - <extension>xwd</extension> - <mime-type>image/x-xwindowdump</mime-type> - </mime-mapping> - <mime-mapping> - <extension>wav</extension> - <mime-type>audio/x-wav</mime-type> - </mime-mapping> - <mime-mapping> - <extension>svg</extension> - <mime-type>image/svg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>svgz</extension> - <mime-type>image/svg</mime-type> - </mime-mapping> - <mime-mapping> - <extension>vsd</extension> - <mime-type>application/x-visio</mime-type> - </mime-mapping> - <mime-mapping> - <!-- Wireless Bitmap --> - <extension>wbmp</extension> - <mime-type>image/vnd.wap.wbmp</mime-type> - </mime-mapping> - <mime-mapping> - <!-- WML Source --> - <extension>wml</extension> - <mime-type>text/vnd.wap.wml</mime-type> - </mime-mapping> - <mime-mapping> - <!-- Compiled WML --> - <extension>wmlc</extension> - <mime-type>application/vnd.wap.wmlc</mime-type> - </mime-mapping> - <mime-mapping> - <!-- WML Script Source --> - <extension>wmls</extension> - <mime-type>text/vnd.wap.wmlscript</mime-type> - </mime-mapping> - <mime-mapping> - <!-- Compiled WML Script --> - <extension>wmlscriptc</extension> - <mime-type>application/vnd.wap.wmlscriptc</mime-type> - </mime-mapping> - <mime-mapping> - <extension>wrl</extension> - <mime-type>x-world/x-vrml</mime-type> - </mime-mapping> - <mime-mapping> - <extension>Z</extension> - <mime-type>application/x-compress</mime-type> - </mime-mapping> - <mime-mapping> - <extension>z</extension> - <mime-type>application/x-compress</mime-type> - </mime-mapping> - <mime-mapping> - <extension>zip</extension> - <mime-type>application/zip</mime-type> - </mime-mapping> - - - <!-- ==================== Default Welcome File List ===================== --> - <!-- When a request URI refers to a directory, the default servlet looks --> - <!-- for a "welcome file" within that directory and, if present, --> - <!-- to the corresponding resource URI for display. If no welcome file --> - <!-- is present, the default servlet either serves a directory listing, --> - <!-- or returns a 404 status, depending on how it is configured. --> - <!-- --> - <!-- If you define welcome files in your own application's web.xml --> - <!-- deployment descriptor, that list *replaces* the list configured --> - <!-- here, so be sure that you include any of the default values that --> - <!-- you wish to include. --> - - <welcome-file-list> - <welcome-file>index.html</welcome-file> - <welcome-file>index.htm</welcome-file> - <welcome-file>index.jsp</welcome-file> - </welcome-file-list> - - <error-page> - <error-code>404</error-code> - <location>/404.html</location> - </error-page> - - <error-page> - <error-code>500</error-code> - <location>/500.html</location> - </error-page> - -</web-app> diff --git a/base/tps/shared/conf/workers.properties b/base/tps/shared/conf/workers.properties deleted file mode 100644 index ae26a983c..000000000 --- a/base/tps/shared/conf/workers.properties +++ /dev/null @@ -1,209 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -# workers.properties - -# -# This file provides jk derived plugins with the needed information to -# connect to the different tomcat workers. Note that the distributed -# version of this file requires modification before it is usable by a -# plugin. -# -# As a general note, the characters $( and ) are used internally to define -# macros. Do not use them in your own configuration!!! -# -# Whenever you see a set of lines such as: -# x=value -# y=$(x)\something -# -# the final value for y will be value\something -# -# Normaly all you will need to do is un-comment and modify the first three -# properties, i.e. workers.tomcat_home, workers.java_home and ps. -# Most of the configuration is derived from these. -# -# When you are done updating workers.tomcat_home, workers.java_home and ps -# you should have 3 workers configured: -# -# - An ajp12 worker that connects to localhost:8007 -# - An ajp13 worker that connects to localhost:8009 -# - A jni inprocess worker. -# - A load balancer worker -# -# However by default the plugins will only use the ajp12 worker. To have -# the plugins use other workers you should modify the worker.list property. -# -# - -# OPTIONS ( very important for jni mode ) - -# -# workers.tomcat_home should point to the location where you -# installed tomcat. This is where you have your conf, webapps and lib -# directories. -# -workers.tomcat_home=/var/tomcat3 - -# -# workers.java_home should point to your Java installation. Normally -# you should have a bin and lib directories beneath it. -# -workers.java_home=/opt/IBMJava2-13 - -# -# You should configure your environment slash... ps=\ on NT and / on UNIX -# and maybe something different elsewhere. -# -ps=/ - -# -#------ ADVANCED MODE ------------------------------------------------ -#--------------------------------------------------------------------- -# - -# -#------ DEFAULT worket list ------------------------------------------ -#--------------------------------------------------------------------- -# -# -# The workers that your plugins should create and work with -# -# Add 'inprocess' if you want JNI connector -worker.list=ajp12, ajp13 -# , inprocess - - -# -#------ DEFAULT ajp12 WORKER DEFINITION ------------------------------ -#--------------------------------------------------------------------- -# - -# -# Defining a worker named ajp12 and of type ajp12 -# Note that the name and the type do not have to match. -# -worker.ajp12.port=8007 -worker.ajp12.host=localhost -worker.ajp12.type=ajp12 -# -# Specifies the load balance factor when used with -# a load balancing worker. -# Note: -# ----> lbfactor must be > 0 -# ----> Low lbfactor means less work done by the worker. -worker.ajp12.lbfactor=1 - -# -#------ DEFAULT ajp13 WORKER DEFINITION ------------------------------ -#--------------------------------------------------------------------- -# - -# -# Defining a worker named ajp13 and of type ajp13 -# Note that the name and the type do not have to match. -# -worker.ajp13.port=8009 -worker.ajp13.host=localhost -worker.ajp13.type=ajp13 -# -# Specifies the load balance factor when used with -# a load balancing worker. -# Note: -# ----> lbfactor must be > 0 -# ----> Low lbfactor means less work done by the worker. -worker.ajp13.lbfactor=1 - -# -# Specify the size of the open connection cache. -#worker.ajp13.cachesize - -# -#------ DEFAULT LOAD BALANCER WORKER DEFINITION ---------------------- -#--------------------------------------------------------------------- -# - -# -# The loadbalancer (type lb) workers perform wighted round-robin -# load balancing with sticky sessions. -# Note: -# ----> If a worker dies, the load balancer will check its state -# once in a while. Until then all work is redirected to peer -# workers. -worker.loadbalancer.type=lb -worker.loadbalancer.balanced_workers=ajp12, ajp13 - - -# -#------ DEFAULT JNI WORKER DEFINITION--------------------------------- -#--------------------------------------------------------------------- -# - -# -# Defining a worker named inprocess and of type jni -# Note that the name and the type do not have to match. -# -worker.inprocess.type=jni - -# -#------ CLASSPATH DEFINITION ----------------------------------------- -#--------------------------------------------------------------------- -# - -# -# Additional class path components. -# -worker.inprocess.class_path=$(workers.tomcat_home)$(ps)lib$(ps)tomcat.jar - -# -# Setting the command line for tomcat. -# Note: The cmd_line string may not contain spaces. -# -worker.inprocess.cmd_line=start - -# Not needed, but can be customized. -#worker.inprocess.cmd_line=-config -#worker.inprocess.cmd_line=$(workers.tomcat_home)$(ps)conf$(ps)server.xml -#worker.inprocess.cmd_line=-home -#worker.inprocess.cmd_line=$(workers.tomcat_home) - -# -# The JVM that we are about to use -# -# This is for Java2 -# -# Windows -worker.inprocess.jvm_lib=$(workers.java_home)$(ps)jre$(ps)bin$(ps)classic$(ps)jvm.dll -# IBM JDK1.3 -#worker.inprocess.jvm_lib=$(workers.java_home)$(ps)jre$(ps)bin$(ps)classic$(ps)libjvm.so -# Unix - Sun VM or blackdown -#worker.inprocess.jvm_lib=$(workers.java_home)$(ps)jre$(ps)lib$(ps)i386$(ps)classic$(ps)libjvm.so - -# -# And this is for jdk1.1.X -# -#worker.inprocess.jvm_lib=$(workers.java_home)$(ps)bin$(ps)javai.dll - - -# -# Setting the place for the stdout and stderr of tomcat -# -worker.inprocess.stdout=$(workers.tomcat_home)$(ps)logs$(ps)inprocess.stdout -worker.inprocess.stderr=$(workers.tomcat_home)$(ps)logs$(ps)inprocess.stderr - -# -# Setting the tomcat.home Java property -# -#worker.inprocess.sysprops=tomcat.home=$(workers.tomcat_home) - -# -# Java system properties -# -# worker.inprocess.sysprops=java.compiler=NONE -# worker.inprocess.sysprops=myprop=mypropvalue - -# -# Additional path components. -# -# worker.inprocess.ld_path=d:$(ps)SQLLIB$(ps)bin -# diff --git a/base/tps/shared/conf/workers.properties.minimal b/base/tps/shared/conf/workers.properties.minimal deleted file mode 100644 index 51980ac49..000000000 --- a/base/tps/shared/conf/workers.properties.minimal +++ /dev/null @@ -1,22 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -# workers.properties.minimal - -# -# This file provides minimal jk configuration properties needed to -# connect to Tomcat. -# -# The workers that jk should create and work with -# -worker.list=ajp13w - - -# -# Defining a worker named ajp13w and of type ajp13 -# Note that the name and the type do not have to match. -# -worker.ajp13w.type=ajp13 -worker.ajp13w.host=localhost -worker.ajp13w.port=8009 diff --git a/base/tps/shared/conf/workers2.properties b/base/tps/shared/conf/workers2.properties deleted file mode 100644 index 3c8e0f4a5..000000000 --- a/base/tps/shared/conf/workers2.properties +++ /dev/null @@ -1,136 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -[logger] -level=DEBUG - -[config:] -file=${serverRoot}/conf/workers2.properties -debug=0 -debugEnv=0 - -[uriMap:] -info=Maps the requests. Options: debug -debug=0 - -# Alternate file logger -#[logger.file:0] -#level=DEBUG -#file=${serverRoot}/logs/jk2.log - -[shm:] -info=Scoreboard. Required for reconfiguration and status with multiprocess servers -file=${serverRoot}/logs/jk2.shm -size=1000000 -debug=0 -disabled=0 - -[workerEnv:] -info=Global server options -timing=1 -debug=0 -# Default Native Logger (apache2 or win32 ) -# can be overriden to a file logger, useful -# when tracing win32 related issues -#logger=logger.file:0 - -[lb:lb] -info=Default load balancer. -debug=0 - -[lb:lb_1] -info=A second load balancer. -debug=0 - -[channel.socket:localhost:8009] -info=Ajp13 forwarding over socket -debug=0 -tomcatId=localhost:8009 - -[channel.socket:localhost:8019] -info=A second tomcat instance. -debug=0 -tomcatId=localhost:8019 -lb_factor=1 -#group=lb -group:lb:lb -#group=lb_1 -group:lb:lb_1 -disabled=0 - -[channel.un:/opt/33/work/jk2.socket] -info=A second channel connecting to localhost:8019 via unix socket -tomcatId=localhost:8019 -lb_factor=1 -debug=0 - -[channel.jni:jni] -info=The jni channel, used if tomcat is started inprocess - -[status:] -info=Status worker, displays runtime informations - -[vm:] -info=Parameters used to load a JVM in the server process -#JVM=C:\jdk\jre\bin\hotspot\jvm.dll -classpath=${TOMCAT_HOME}/bin/tomcat-jni.jar -classpath=${TOMCAT_HOME}/server/lib/commons-logging.jar -OPT=-Dtomcat.home=${TOMCAT_HOME} -OPT=-Dcatalina.home=${TOMCAT_HOME} -OPT=-Xmx128M -#OPT=-Djava.compiler=NONE -disabled=1 - -[worker.jni:onStartup] -info=Command to be executed by the VM on startup. This one will start tomcat. -class=org/apache/jk/apr/TomcatStarter -ARG=start -# For Tomcat 5 use the 'stard' for startup argument -# ARG=stard -disabled=1 -stdout=${serverRoot}/logs/stdout.log -stderr=${serverRoot}/logs/stderr.log - -[worker.jni:onShutdown] -info=Command to be executed by the VM on shutdown. This one will stop tomcat. -class=org/apache/jk/apr/TomcatStarter -ARG=stop -disabled=1 - -[uri:/jkstatus/*] -info=Display status information and checks the config file for changes. -group=status: - -[uri:127.0.0.1:8003] -info=Example virtual host. Make sure myVirtualHost is in /etc/hosts to test it -alias=myVirtualHost:8003 - -[uri:127.0.0.1:8003/ex] -info=Example webapp in the virtual host. It'll go to lb_1 ( i.e. localhost:8019 ) -context=/ex -group=lb_1 - -[uri:/examples] -info=Example webapp in the default context. -context=/examples -debug=0 - -[uri:/examples1/*] -info=A second webapp, this time going to the second tomcat only. -group=lb_1 -debug=0 - -[uri:/examples/servlet/*] -info=Prefix mapping - -[uri:/examples/*.jsp] -info=Extension mapping - -[uri:/examples/*] -info=Map the whole webapp - -[uri:/examples/servlet/HelloW] -info=Example with debug enabled. -debug=10 diff --git a/base/tps/shared/conf/workers2.properties.minimal b/base/tps/shared/conf/workers2.properties.minimal deleted file mode 100644 index 0e88d14c7..000000000 --- a/base/tps/shared/conf/workers2.properties.minimal +++ /dev/null @@ -1,60 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -# -# This is the minimal JK2 connector configuration file. -# - -[logger] -info=Native logger -level=ERROR - -[config:] -file=${serverRoot}/conf/workers2.properties -debug=0 -debugEnv=0 - -[uriMap:] -info=Maps the requests. -debug=0 - -[shm:] -info=Scoreboard. Required for reconfiguration and status with multiprocess servers -file=anonymous -debug=0 - -[workerEnv:] -info=Global server options -timing=0 -debug=0 - -[lb:lb] -info=Default load balancer. -debug=0 - -[channel.socket:localhost:8009] -info=Ajp13 forwarding over socket -debug=0 -tomcatId=localhost:8009 - -[uri:/admin] -info=Tomcat HTML based administration web application. -debug=0 - -[uri:/manager] -info=A scriptable management web application for the Tomcat Web Server. -debug=0 - -[uri:/jsp-examples] -info=JSP 2.0 Examples. -debug=0 - -[uri:/servlets-examples] -info=Servlet 2.4 Examples. -debug=0 - -[uri:/*.jsp] -info=JSP Extension mapping. -debug=0 diff --git a/base/tps/shared/etc/init.d/pki-tpsd b/base/tps/shared/etc/init.d/pki-tpsd deleted file mode 100755 index 7b991f39c..000000000 --- a/base/tps/shared/etc/init.d/pki-tpsd +++ /dev/null @@ -1,86 +0,0 @@ -#!/bin/bash -# -# --- BEGIN COPYRIGHT BLOCK --- -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; version 2 of the License. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License along -# with this program; if not, write to the Free Software Foundation, Inc., -# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -# -# Copyright (C) 2007-2010 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -# pki-tpsd Startup script for pki-tps with tomcat7 -# -# chkconfig: - 84 16 -# description: Token Processing Service (Tomcat 7.0) -# processname: pki-tpsd -# piddir: /var/run/pki/tps -# - -PROG_NAME=`basename $0` -SERVICE_NAME="pki-tpsd" -SERVICE_PROG="/sbin/service" -PKI_PATH="/usr/share/pki/tps" -PKI_REGISTRY="/etc/sysconfig/pki/tps" -PKI_TYPE="pki-tps" -PKI_TOTAL_PORTS=6 - -# Avoid using 'systemctl' for now -SYSTEMCTL_SKIP_REDIRECT=1 -export SYSTEMCTL_SKIP_REDIRECT - -# Disallow 'others' the ability to 'write' to new files -umask 00002 - -command="$1" -pki_instance="$2" - -# Source function library. -. /etc/init.d/functions - -# Source the PKI function library -. /usr/share/pki/scripts/functions - -# See how we were called. -case $command in - status) - registry_status - exit $? - ;; - start) - start - exit $? - ;; - restart) - restart - exit $? - ;; - stop) - stop - exit $? - ;; - condrestart|force-restart|try-restart) - [ ! -f ${lockfile} ] || restart - exit $? - ;; - reload) - echo "The 'reload' action is an unimplemented feature." - exit ${default_error} - ;; - *) - echo "unknown action ($command)" - usage - echo "where valid instance names include:" - list_instances - exit ${default_error} - ;; -esac diff --git a/base/tps/shared/lib/systemd/system/pki-tpsd.target b/base/tps/shared/lib/systemd/system/pki-tpsd.target deleted file mode 100644 index 443c2adad..000000000 --- a/base/tps/shared/lib/systemd/system/pki-tpsd.target +++ /dev/null @@ -1,6 +0,0 @@ -[Unit] -Description=PKI Token Processing Service -After=syslog.target network.target - -[Install] -WantedBy=multi-user.target diff --git a/base/tps/shared/lib/systemd/system/pki-tpsd@.service b/base/tps/shared/lib/systemd/system/pki-tpsd@.service deleted file mode 100644 index 4703b3fe8..000000000 --- a/base/tps/shared/lib/systemd/system/pki-tpsd@.service +++ /dev/null @@ -1,12 +0,0 @@ -[Unit] -Description=PKI Token Processing Service %i -After=pki-tpsd.target -BindTo=pki-tpsd.target - -[Service] -Type=forking -ExecStart=/usr/bin/pkicontrol start tps %i -ExecStop=/usr/bin/pkicontrol stop tps %i - -[Install] -WantedBy=multi-user.target diff --git a/base/tps/shared/webapps/tps/404.html b/base/tps/shared/webapps/tps/404.html deleted file mode 100755 index 0bf93578c..000000000 --- a/base/tps/shared/webapps/tps/404.html +++ /dev/null @@ -1,145 +0,0 @@ -<!-- --- BEGIN COPYRIGHT BLOCK --- - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 of the License. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License along - with this program; if not, write to the Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. - - Copyright (C) 2009 Red Hat, Inc. - All rights reserved. - --- END COPYRIGHT BLOCK --- --> -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> -<html> -<script language=javascript> -var url = document.URL; -var protocol = location.protocol; -var hostname = location.hostname; -var port = location.port; -</script> - -<head> -<title>TPS 404 Error!</title> -<!-- always expand ALL relative paths --> -<script language=javascript> -document.write('<link rel="shortcut icon" href="'); -document.write(protocol); -document.write('//'); -document.write(hostname); -document.write(':'); -document.write(port); -document.write('/pki/images/favicon.ico'); -document.write('" />'); -document.write('<link rel="stylesheet" href="'); -document.write(protocol); -document.write('//'); -document.write(hostname); -document.write(':'); -document.write(port); -document.write('/pki/css/pki-base.css'); -document.write('" type="text/css" />'); -document.write('<META http-equiv=Content-Type content="text/html; charset=UTF-8">'); -</script> -</head> -<body bgcolor="#FFFFFF" link="#666699" vlink="#666699" alink="#333366"> -<div id="header"> -<!-- always expand ALL relative paths --> -<script language=javascript> -document.write('<a href="http://pki.fedoraproject.org/" title="Visit pki.fedoraproject.org for more information about Dogtag products and services"><img src="'); -document.write(protocol); -document.write('//'); -document.write(hostname); -document.write(':'); -document.write(port); -document.write('/pki/images/logo_header.gif'); -document.write('" alt="Dogtag" id="myLogo" /></a>'); -</script> - <div id="headertitle"> - <a href="/" title="Dogtag Network homepage">Dogtag<sup><font size="-2">®</font></sup> Certificate System</a> - </div> - <div id="account"> - <dl><dt><span></span></dt><dd></dd></dl> - </div> -</div> - -<div id="mainNavOuter"> -<div id="mainNav"> -<div id="mainNavInner"> - -</div><!-- end mainNavInner --> -</div><!-- end mainNav --> -</div><!-- end mainNavOuter --> - - -<div id="bar"> - -<div id="systembar"> -<div id="systembarinner"> - -<div> - - -</div> - - -</div> -</div> - -</div> -<font size="+1" face="PrimaSans BT, Verdana, Arial, Helvetica, sans-serif"> -Certificate System TPS Error Page -</font><br> -<p> -</font> -<p> -<script language=javascript> -document.write('<center>'); -document.write('<table border="1" cellspacing="0" cellpadding="0">'); -document.write('<tr valign="TOP">'); -document.write('<td bgcolor="grey" align="center"><b><font color="BLACK">HTTP STATUS</font></b></td>'); -document.write('<td bgcolor="grey" align="center"><b><font color="BLACK">DESCRIPTION</font></b></td>'); -document.write('</tr>'); -document.write('<tr valign="TOP">'); -document.write('<td align="center"><b><font size="+3" color="red">'); -document.write('404'); -document.write('</font></b></td>'); -document.write('<td><b><font size="+1" color="RED">'); -document.write('The requested resource could not be found but may be available again in the future.'); -document.write('</font></b><br><b><font size="+1" color="RED">'); -document.write('Please check the validity of the URL listed below:'); -document.write('</font></b><br><br>'); -document.write('<center><b><font size="+1"><a href="'); -document.write(url); -document.write('">'); -document.write(url); -document.write('</a>'); -document.write('</font></b></center><br></td>'); -document.write('</tr>'); -document.write('</table>'); -document.write('</center>'); -</script> -<div id="footer"> -</div> -<!-- -To prevent Internet Explorer from overriding the display of this custom error -page by displaying it's own "Friendly HTTP Error Message", always include the -following 'padding' to ensure that the text size exceeds 512 bytes: - -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] ---> -</body> -</html> diff --git a/base/tps/shared/webapps/tps/500.html b/base/tps/shared/webapps/tps/500.html deleted file mode 100755 index 3e1e8bb66..000000000 --- a/base/tps/shared/webapps/tps/500.html +++ /dev/null @@ -1,138 +0,0 @@ -<!-- --- BEGIN COPYRIGHT BLOCK --- - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 of the License. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License along - with this program; if not, write to the Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. - - Copyright (C) 2009 Red Hat, Inc. - All rights reserved. - --- END COPYRIGHT BLOCK --- --> -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> -<html> -<script language=javascript> -var url = document.URL; -var protocol = location.protocol; -var hostname = location.hostname; -var port = location.port; -</script> - -<head> -<title>TPS 500 Error!</title> -<!-- always expand ALL relative paths --> -<script language=javascript> -document.write('<link rel="shortcut icon" href="'); -document.write(protocol); -document.write('//'); -document.write(hostname); -document.write(':'); -document.write(port); -document.write('/pki/images/favicon.ico'); -document.write('" />'); -document.write('<link rel="stylesheet" href="'); -document.write(protocol); -document.write('//'); -document.write(hostname); -document.write(':'); -document.write(port); -document.write('/pki/css/pki-base.css'); -document.write('" type="text/css" />'); -document.write('<META http-equiv=Content-Type content="text/html; charset=UTF-8">'); -</script> -</head> -<body bgcolor="#FFFFFF" link="#666699" vlink="#666699" alink="#333366"> -<div id="header"> -<!-- always expand ALL relative paths --> -<script language=javascript> -document.write('<a href="http://pki.fedoraproject.org/" title="Visit pki.fedoraproject.org for more information about Dogtag products and services"><img src="'); -document.write(protocol); -document.write('//'); -document.write(hostname); -document.write(':'); -document.write(port); -document.write('/pki/images/logo_header.gif'); -document.write('" alt="Dogtag" id="myLogo" /></a>'); -</script> - <div id="headertitle"> - <a href="/" title="Dogtag Network homepage">Dogtag<sup><font size="-2">®</font></sup> Certificate System</a> - </div> - <div id="account"> - <dl><dt><span></span></dt><dd></dd></dl> - </div> -</div> - -<div id="mainNavOuter"> -<div id="mainNav"> -<div id="mainNavInner"> - -</div><!-- end mainNavInner --> -</div><!-- end mainNav --> -</div><!-- end mainNavOuter --> - - -<div id="bar"> - -<div id="systembar"> -<div id="systembarinner"> - -<div> - - -</div> - - -</div> -</div> - -</div> -<font size="+1" face="PrimaSans BT, Verdana, Arial, Helvetica, sans-serif"> -Certificate System TPS Error Page -</font><br> -<p> -</font> -<p> -<script language=javascript> -document.write('<center>'); -document.write('<table border="1" cellspacing="0" cellpadding="0">'); -document.write('<tr valign="TOP">'); -document.write('<td bgcolor="grey" align="center"><b><font color="BLACK">HTTP STATUS</font></b></td>'); -document.write('<td bgcolor="grey" align="center"><b><font color="BLACK">DESCRIPTION</font></b></td>'); -document.write('</tr>'); -document.write('<tr valign="TOP">'); -document.write('<td align="center"><b><font size="+3" color="red">'); -document.write('500'); -document.write('</font></b></td>'); -document.write('<td><b><font size="+1" color="RED">'); -document.write('The server encountered an unexpected condition which prevented it from fulfilling the request.<br>'); -document.write('Please consult your local administrator for further assistance. The Certificate System logs may provide further information.'); -document.write('</font></b><br></td>'); -document.write('</tr>'); -document.write('</table>'); -document.write('</center>'); -</script> -<div id="footer"> -</div> -<!-- -To prevent Internet Explorer from overriding the display of this custom error -page by displaying it's own "Friendly HTTP Error Message", always include the -following 'padding' to ensure that the text size exceeds 512 bytes: - -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] -[IE padding][IE padding][IE padding][IE padding][IE padding][IE padding] ---> -</body> -</html> diff --git a/base/tps/shared/webapps/tps/GenUnexpectedError.template b/base/tps/shared/webapps/tps/GenUnexpectedError.template deleted file mode 100644 index ea545c145..000000000 --- a/base/tps/shared/webapps/tps/GenUnexpectedError.template +++ /dev/null @@ -1,67 +0,0 @@ -<!-- --- BEGIN COPYRIGHT BLOCK --- - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 of the License. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License along - with this program; if not, write to the Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. - - Copyright (C) 2007 Red Hat, Inc. - All rights reserved. - --- END COPYRIGHT BLOCK --- --> -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> -<HTML> -<CMS_TEMPLATE> - -<TITLE>TPS Processing Error!</TITLE> - -<BODY BGCOLOR="white"> - -<font size="+1" face="PrimaSans BT, Verdana, Arial, Helvetica, sans-serif"> -Problem Processing Your Request -</font> - -<table BORDER=0 CELLSPACING=0 CELLPADDING=0 WIDTH="100%" BACKGROUND="/pki/images/hr.gif" > - <tr> - <td> </td> - </tr> -</table> - -<font size="-1" face="PrimaSans BT, Verdana, Arial, Helvetica, sans-serif"> - -<SCRIPT LANGUAGE="JavaScript"> -var authority = 'Certificate System'; -if (result.fixed.authorityName != null) { - authority = result.fixed.authorityName; -} - -document.writeln('<P>'); -document.write('The '+authority+' encountered an unexpected error '); -document.writeln(' while processing your request.'); -document.writeln( - 'The following is a detailed message of the error that occurred.'); - -document.writeln('<P>'); -document.writeln('<BLOCKQUOTE><B><PRE>'); -if (result.fixed.unexpectedError != null) { - document.write(result.fixed.unexpectedError); -} else { - document.write('No further details provided.'); -} -document.writeln('</PRE></B></BLOCKQUOTE>'); - -document.writeln('<P>'); -document.writeln( - 'Please consult your local administrator for further assistance.'); -document.writeln('The Certificate System logs may provide further information.'); -</SCRIPT> - -</font> -</BODY> -</HTML> diff --git a/base/tps/shared/webapps/tps/META-INF/context.xml b/base/tps/shared/webapps/tps/META-INF/context.xml deleted file mode 100644 index e838503a6..000000000 --- a/base/tps/shared/webapps/tps/META-INF/context.xml +++ /dev/null @@ -1,37 +0,0 @@ -<?xml version='1.0' encoding='utf-8'?> -<!-- BEGIN COPYRIGHT BLOCK - Copyright (C) 2012 Red Hat, Inc. - All rights reserved. - Modifications: configuration parameters - END COPYRIGHT BLOCK ---> - -<!-- - Licensed to the Apache Software Foundation (ASF) under one or more - contributor license agreements. See the NOTICE file distributed with - this work for additional information regarding copyright ownership. - The ASF licenses this file to You under the Apache License, Version 2.0 - (the "License"); you may not use this file except in compliance with - the License. You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. ---> -<Context crossContext="true" allowLinking="true"> - - <Manager - secureRandomProvider="Mozilla-JSS" secureRandomAlgorithm="pkcs11prng"/> - - <Valve className="com.netscape.cms.tomcat.SSLAuthenticatorWithFallback" - alwaysUseSession="true" - secureRandomProvider="Mozilla-JSS" - secureRandomAlgorithm="pkcs11prng"/> - - <Realm className="com.netscape.cms.tomcat.ProxyRealm" /> - -</Context> diff --git a/base/tps/shared/webapps/tps/WEB-INF/auth.properties b/base/tps/shared/webapps/tps/WEB-INF/auth.properties deleted file mode 100644 index 8ed17dbe0..000000000 --- a/base/tps/shared/webapps/tps/WEB-INF/auth.properties +++ /dev/null @@ -1,10 +0,0 @@ -# Restful API authorization mapping info -# -# Format: -# <mapping name> = <resource ID>,<operation> -# ex: admin.users = certServer.ca.users,read - -account.login = certServer.tps.account,login -account.logout = certServer.tps.account,logout -admin.users = certServer.tps.users,execute -admin.groups = certServer.tps.groups,execute diff --git a/base/tps/shared/webapps/tps/WEB-INF/velocity.properties b/base/tps/shared/webapps/tps/WEB-INF/velocity.properties deleted file mode 100644 index 5cd0454cc..000000000 --- a/base/tps/shared/webapps/tps/WEB-INF/velocity.properties +++ /dev/null @@ -1,13 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -resource.loader = file -file.resource.loader.class = org.apache.velocity.runtime.resource.loader.FileResourceLoader -file.resource.loader.path = [PKI_INSTANCE_PATH]/[PKI_WEBAPPS_NAME]/[PKI_SUBSYSTEM_TYPE] -file.resource.loader.cache = true -file.resource.loader.modificationCheckInterval = 2 -input.encoding=UTF-8 -output.encoding=UTF-8 -runtime.log.logsystem.class=org.apache.velocity.runtime.log.NullLogSystem diff --git a/base/tps/shared/webapps/tps/WEB-INF/web.xml b/base/tps/shared/webapps/tps/WEB-INF/web.xml deleted file mode 100644 index 9a6c87462..000000000 --- a/base/tps/shared/webapps/tps/WEB-INF/web.xml +++ /dev/null @@ -1,188 +0,0 @@ -<?xml version="1.0" encoding="ISO-8859-1"?> -<!-- BEGIN COPYRIGHT BLOCK - Copyright (C) 2006 Red Hat, Inc. - All rights reserved. - END COPYRIGHT BLOCK --> -<!DOCTYPE web-app - PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "file:///usr/share/pki/setup/web-app_2_3.dtd"> -<web-app> - - <display-name>Token Processing Service</display-name> - - <servlet> - <servlet-name>csadmin-login</servlet-name> - <servlet-class>com.netscape.cms.servlet.csadmin.LoginServlet</servlet-class> - <init-param> - <param-name>properties</param-name> - <param-value>/WEB-INF/velocity.properties</param-value> - </init-param> - </servlet> - - <servlet> - <servlet-name>tpsstart</servlet-name> - <servlet-class>com.netscape.cms.servlet.base.CMSStartServlet</servlet-class> - <init-param> - <param-name>AuthzMgr</param-name> - <param-value>BasicAclAuthz</param-value> - </init-param> - <init-param> - <param-name>cfgPath</param-name> - <param-value>[PKI_INSTANCE_PATH]/conf/[PKI_SUBSYSTEM_TYPE]/CS.cfg</param-value> - </init-param> - <init-param> - <param-name>ID</param-name> - <param-value>tpsstart</param-value> - </init-param> - <load-on-startup>1</load-on-startup> - </servlet> - - <servlet> - <servlet-name>tpsug</servlet-name> - <servlet-class>com.netscape.cms.servlet.admin.UsrGrpAdminServlet</servlet-class> - <init-param> - <param-name>ID</param-name> - <param-value>tpsug</param-value> - </init-param> - <init-param> - <param-name>AuthzMgr</param-name> - <param-value>BasicAclAuthz</param-value> - </init-param> - </servlet> - - <servlet> - <servlet-name>tpslog</servlet-name> - <servlet-class>com.netscape.cms.servlet.admin.LogAdminServlet</servlet-class> - <init-param> - <param-name>ID</param-name> - <param-value>tpslog</param-value> </init-param> - <init-param> - <param-name>AuthzMgr</param-name> - <param-value>BasicAclAuthz</param-value> - </init-param> - </servlet> - - <servlet> - <servlet-name>tpsGetStatus </servlet-name> - <servlet-class> com.netscape.cms.servlet.csadmin.GetStatus</servlet-class> - <init-param> - <param-name>GetClientCert</param-name> - <param-value>false</param-value> - </init-param> - <init-param> - <param-name>authority</param-name> - <param-value>tps</param-value> - </init-param> - <init-param> - <param-name>ID</param-name> - <param-value>tpsGetStatus</param-value> - </init-param> - </servlet> - - <servlet> - <servlet-name>tps</servlet-name> - <servlet-class>org.dogtagpki.tps.server.TPSServlet</servlet-class> - </servlet> - - <listener> - <listener-class>org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap</listener-class> - </listener> - - <context-param> - <param-name>resteasy.servlet.mapping.prefix</param-name> - <param-value>/rest</param-value> - </context-param> - - <context-param> - <param-name>resteasy.resource.method-interceptors</param-name> - <param-value>org.jboss.resteasy.core.ResourceMethodSecurityInterceptor</param-value> - </context-param> - - <servlet> - <servlet-name>Resteasy</servlet-name> - <servlet-class>org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher</servlet-class> - <init-param> - <param-name>javax.ws.rs.Application</param-name> - <param-value>org.dogtagpki.tps.server.TPSApplication</param-value> - </init-param> - </servlet> - - <servlet-mapping> - <servlet-name>Resteasy</servlet-name> - <url-pattern>/rest/*</url-pattern> - </servlet-mapping> - - <servlet-mapping> - <servlet-name>tpsstart</servlet-name> - <url-pattern>/start</url-pattern> - </servlet-mapping> - - <servlet-mapping> - <servlet-name>tpsug</servlet-name> - <url-pattern>/ug</url-pattern> - </servlet-mapping> - - <servlet-mapping> - <servlet-name>tpslog</servlet-name> - <url-pattern>/log</url-pattern> - </servlet-mapping> - - <servlet-mapping> - <servlet-name>csadmin-login</servlet-name> - <url-pattern>/admin/console/config/login</url-pattern> - </servlet-mapping> - - <servlet-mapping> - <servlet-name>tpsGetStatus</servlet-name> - <url-pattern>/admin/tps/getStatus</url-pattern> - </servlet-mapping> - - <servlet-mapping> - <servlet-name>tps</servlet-name> - <url-pattern>/tps</url-pattern> - </servlet-mapping> - - <!-- ==================== Default Session Configuration =============== --> - <!-- You can set the default session timeout (in minutes) for all newly --> - <!-- created sessions by modifying the value below. --> - <!-- --> - <!-- To disable session timeouts for this instance, set a value of -1. --> - - <session-config> - <session-timeout>30</session-timeout> - </session-config> - - <security-constraint> - <web-resource-collection> - <web-resource-name>Account Services</web-resource-name> - <url-pattern>/rest/account/*</url-pattern> - </web-resource-collection> - <auth-constraint> - <role-name>*</role-name> - </auth-constraint> - <user-data-constraint> - <transport-guarantee>CONFIDENTIAL</transport-guarantee> - </user-data-constraint> - </security-constraint> - - <security-constraint> - <web-resource-collection> - <web-resource-name>Admin Services</web-resource-name> - <url-pattern>/rest/admin/*</url-pattern> - </web-resource-collection> - <auth-constraint> - <role-name>*</role-name> - </auth-constraint> - <user-data-constraint> - <transport-guarantee>CONFIDENTIAL</transport-guarantee> - </user-data-constraint> - </security-constraint> - - <login-config> - <realm-name>Token Processing Service</realm-name> - </login-config> - - <security-role> - <role-name>*</role-name> - </security-role> - -</web-app> diff --git a/base/tps/shared/webapps/tps/index.html b/base/tps/shared/webapps/tps/index.html deleted file mode 100644 index 30662d47a..000000000 --- a/base/tps/shared/webapps/tps/index.html +++ /dev/null @@ -1,23 +0,0 @@ -<!-- --- BEGIN COPYRIGHT BLOCK --- - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 of the License. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License along - with this program; if not, write to the Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. - - Copyright (C) 2007 Red Hat, Inc. - All rights reserved. - --- END COPYRIGHT BLOCK --- --> -<html> -<script lang="javascript"> - // redirect to 'ROOT' - window.location = "/"; -</script> -</html> diff --git a/base/tps/shared/webapps/tps/services.template b/base/tps/shared/webapps/tps/services.template deleted file mode 100644 index c6792fea1..000000000 --- a/base/tps/shared/webapps/tps/services.template +++ /dev/null @@ -1,106 +0,0 @@ -<!-- --- BEGIN COPYRIGHT BLOCK --- - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 of the License. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License along - with this program; if not, write to the Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. - - Copyright (C) 2007 Red Hat, Inc. - All rights reserved. - --- END COPYRIGHT BLOCK --- --> -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> -<html> -<CMS_TEMPLATE> -<title>TKS Services</title> - <link rel="shortcut icon" href="/pki/images/favicon.ico" /> - <link rel="stylesheet" href="/pki/css/pki-base.css" type="text/css" /> - <META http-equiv=Content-Type content="text/html; charset=UTF-8"> - -</head> -<body bgcolor="#FFFFFF" link="#666699" vlink="#666699" alink="#333366"> - -<div id="header"> - <a href="http://pki.fedoraproject.org/" title="Visit pki.fedoraproject.org for more information about Dogtag products and services"><img src="/pki/images/logo_header.gif" alt="Dogtag" id="myLogo" /></a> - <div id="headertitle"> - <a href="/" title="Dogtag Network homepage">Dogtag<sup><font size="-2">®</font></sup> Certificate System</a> - </div> - <div id="account"> - <dl><dt><span></span></dt><dd></dd></dl> - </div> -</div> - -<div id="mainNavOuter"> -<div id="mainNav"> -<div id="mainNavInner"> - -</div><!-- end mainNavInner --> -</div><!-- end mainNav --> -</div><!-- end mainNavOuter --> - - -<div id="bar"> - -<div id="systembar"> -<div id="systembarinner"> - -<div> - - -</div> - - -</div> -</div> - -</div> - - -<font size="+1" face="PrimaSans BT, Verdana, Arial, Helvetica, sans-serif"> -Certificate System TKS Services Page -</font><br> -<p> -</font> -<p> -<center> -<table border="0" cellspacing="0" cellpadding="0"> -<tr valign="TOP"> -<td> </td> -<td> </td> -</tr> -<script language=javascript> -for (var i=0; i<result.recordSet.length; ++i) { - document.write('<tr valign="TOP">'); - document.write('<td>'); - document.write('<td>'); - document.write('<font size=4 face="PrimaSans BT, Verdana, sans-serif">'); - document.write('<li><a href="'); - document.write(result.recordSet[i].prefix + "://" + - result.recordSet[i].host + ":" + result.recordSet[i].port + "/"+ - result.recordSet[i].uri); - if (result.recordSet[i].type == "admin") { - document.write('">Admin Services</a></font>'); - } else if (result.recordSet[i].type == "agent") { - document.write('">Agent Services</a></font>'); - } else if (result.recordSet[i].type == "ee") { - document.write('">SSL End Users Services</a></font>'); - } - - document.write('</font></td></tr>'); -} -</script> -<tr valign="TOP"> -<td> </td> -<td> </td> -</tr> -</table> -</center> -<div id="footer"> -</div> -</body> -</html> |