diff options
Diffstat (limited to 'base')
9 files changed, 785 insertions, 113 deletions
diff --git a/base/common/src/com/netscape/certsrv/profile/PolicyConstraint.java b/base/common/src/com/netscape/certsrv/profile/PolicyConstraint.java index a0f4e9def..ab46ecd14 100644 --- a/base/common/src/com/netscape/certsrv/profile/PolicyConstraint.java +++ b/base/common/src/com/netscape/certsrv/profile/PolicyConstraint.java @@ -81,4 +81,46 @@ public class PolicyConstraint { this.constraints = constraints; } + @Override + public int hashCode() { + final int prime = 31; + int result = 1; + result = prime * result + ((classId == null) ? 0 : classId.hashCode()); + result = prime * result + ((constraints == null) ? 0 : constraints.hashCode()); + result = prime * result + ((name == null) ? 0 : name.hashCode()); + result = prime * result + ((text == null) ? 0 : text.hashCode()); + return result; + } + + @Override + public boolean equals(Object obj) { + if (this == obj) + return true; + if (obj == null) + return false; + if (getClass() != obj.getClass()) + return false; + PolicyConstraint other = (PolicyConstraint) obj; + if (classId == null) { + if (other.classId != null) + return false; + } else if (!classId.equals(other.classId)) + return false; + if (constraints == null) { + if (other.constraints != null) + return false; + } else if (!constraints.equals(other.constraints)) + return false; + if (name == null) { + if (other.name != null) + return false; + } else if (!name.equals(other.name)) + return false; + if (text == null) { + if (other.text != null) + return false; + } else if (!text.equals(other.text)) + return false; + return true; + } } diff --git a/base/common/src/com/netscape/certsrv/profile/PolicyConstraintValue.java b/base/common/src/com/netscape/certsrv/profile/PolicyConstraintValue.java index a16b4c59d..162b706bb 100644 --- a/base/common/src/com/netscape/certsrv/profile/PolicyConstraintValue.java +++ b/base/common/src/com/netscape/certsrv/profile/PolicyConstraintValue.java @@ -70,4 +70,41 @@ public class PolicyConstraintValue { public void setValue(String value) { this.value = value; } + + @Override + public int hashCode() { + final int prime = 31; + int result = 1; + result = prime * result + ((descriptor == null) ? 0 : descriptor.hashCode()); + result = prime * result + ((name == null) ? 0 : name.hashCode()); + result = prime * result + ((value == null) ? 0 : value.hashCode()); + return result; + } + + @Override + public boolean equals(Object obj) { + if (this == obj) + return true; + if (obj == null) + return false; + if (getClass() != obj.getClass()) + return false; + PolicyConstraintValue other = (PolicyConstraintValue) obj; + if (descriptor == null) { + if (other.descriptor != null) + return false; + } else if (!descriptor.equals(other.descriptor)) + return false; + if (name == null) { + if (other.name != null) + return false; + } else if (!name.equals(other.name)) + return false; + if (value == null) { + if (other.value != null) + return false; + } else if (!value.equals(other.value)) + return false; + return true; + } } diff --git a/base/common/src/com/netscape/certsrv/profile/PolicyDefault.java b/base/common/src/com/netscape/certsrv/profile/PolicyDefault.java index f92242cc1..5b1943147 100644 --- a/base/common/src/com/netscape/certsrv/profile/PolicyDefault.java +++ b/base/common/src/com/netscape/certsrv/profile/PolicyDefault.java @@ -92,4 +92,52 @@ public class PolicyDefault { this.params = params; } + @Override + public int hashCode() { + final int prime = 31; + int result = 1; + result = prime * result + ((attributes == null) ? 0 : attributes.hashCode()); + result = prime * result + ((classId == null) ? 0 : classId.hashCode()); + result = prime * result + ((name == null) ? 0 : name.hashCode()); + result = prime * result + ((params == null) ? 0 : params.hashCode()); + result = prime * result + ((text == null) ? 0 : text.hashCode()); + return result; + } + + @Override + public boolean equals(Object obj) { + if (this == obj) + return true; + if (obj == null) + return false; + if (getClass() != obj.getClass()) + return false; + PolicyDefault other = (PolicyDefault) obj; + if (attributes == null) { + if (other.attributes != null) + return false; + } else if (!attributes.equals(other.attributes)) + return false; + if (classId == null) { + if (other.classId != null) + return false; + } else if (!classId.equals(other.classId)) + return false; + if (name == null) { + if (other.name != null) + return false; + } else if (!name.equals(other.name)) + return false; + if (params == null) { + if (other.params != null) + return false; + } else if (!params.equals(other.params)) + return false; + if (text == null) { + if (other.text != null) + return false; + } else if (!text.equals(other.text)) + return false; + return true; + } } diff --git a/base/common/src/com/netscape/certsrv/profile/ProfileAttribute.java b/base/common/src/com/netscape/certsrv/profile/ProfileAttribute.java index 9c889bb8a..c3549424c 100644 --- a/base/common/src/com/netscape/certsrv/profile/ProfileAttribute.java +++ b/base/common/src/com/netscape/certsrv/profile/ProfileAttribute.java @@ -77,4 +77,41 @@ public class ProfileAttribute { return "PolicyAttribute [name=" + name + ", value=" + value + ", descriptor=" + descriptor + "]"; } + @Override + public int hashCode() { + final int prime = 31; + int result = 1; + result = prime * result + ((descriptor == null) ? 0 : descriptor.hashCode()); + result = prime * result + ((name == null) ? 0 : name.hashCode()); + result = prime * result + ((value == null) ? 0 : value.hashCode()); + return result; + } + + @Override + public boolean equals(Object obj) { + if (this == obj) + return true; + if (obj == null) + return false; + if (getClass() != obj.getClass()) + return false; + ProfileAttribute other = (ProfileAttribute) obj; + if (descriptor == null) { + if (other.descriptor != null) + return false; + } else if (!descriptor.equals(other.descriptor)) + return false; + if (name == null) { + if (other.name != null) + return false; + } else if (!name.equals(other.name)) + return false; + if (value == null) { + if (other.value != null) + return false; + } else if (!value.equals(other.value)) + return false; + return true; + } + } diff --git a/base/common/src/com/netscape/certsrv/profile/ProfileInput.java b/base/common/src/com/netscape/certsrv/profile/ProfileInput.java index a9b9507cb..2826f50d8 100644 --- a/base/common/src/com/netscape/certsrv/profile/ProfileInput.java +++ b/base/common/src/com/netscape/certsrv/profile/ProfileInput.java @@ -129,4 +129,59 @@ public class ProfileInput { configAttrs.clear(); } + @Override + public int hashCode() { + final int prime = 31; + int result = 1; + result = prime * result + ((attrs == null) ? 0 : attrs.hashCode()); + result = prime * result + ((classId == null) ? 0 : classId.hashCode()); + result = prime * result + ((configAttrs == null) ? 0 : configAttrs.hashCode()); + result = prime * result + ((id == null) ? 0 : id.hashCode()); + result = prime * result + ((name == null) ? 0 : name.hashCode()); + result = prime * result + ((text == null) ? 0 : text.hashCode()); + return result; + } + + @Override + public boolean equals(Object obj) { + if (this == obj) + return true; + if (obj == null) + return false; + if (getClass() != obj.getClass()) + return false; + ProfileInput other = (ProfileInput) obj; + if (attrs == null) { + if (other.attrs != null) + return false; + } else if (!attrs.equals(other.attrs)) + return false; + if (classId == null) { + if (other.classId != null) + return false; + } else if (!classId.equals(other.classId)) + return false; + if (configAttrs == null) { + if (other.configAttrs != null) + return false; + } else if (!configAttrs.equals(other.configAttrs)) + return false; + if (id == null) { + if (other.id != null) + return false; + } else if (!id.equals(other.id)) + return false; + if (name == null) { + if (other.name != null) + return false; + } else if (!name.equals(other.name)) + return false; + if (text == null) { + if (other.text != null) + return false; + } else if (!text.equals(other.text)) + return false; + return true; + } + } diff --git a/base/common/src/com/netscape/certsrv/profile/ProfileOutput.java b/base/common/src/com/netscape/certsrv/profile/ProfileOutput.java index 759b65ce7..f12b64787 100644 --- a/base/common/src/com/netscape/certsrv/profile/ProfileOutput.java +++ b/base/common/src/com/netscape/certsrv/profile/ProfileOutput.java @@ -118,4 +118,53 @@ public class ProfileOutput { attrs.clear(); } + @Override + public int hashCode() { + final int prime = 31; + int result = 1; + result = prime * result + ((attrs == null) ? 0 : attrs.hashCode()); + result = prime * result + ((classId == null) ? 0 : classId.hashCode()); + result = prime * result + ((id == null) ? 0 : id.hashCode()); + result = prime * result + ((name == null) ? 0 : name.hashCode()); + result = prime * result + ((text == null) ? 0 : text.hashCode()); + return result; + } + + @Override + public boolean equals(Object obj) { + if (this == obj) + return true; + if (obj == null) + return false; + if (getClass() != obj.getClass()) + return false; + ProfileOutput other = (ProfileOutput) obj; + if (attrs == null) { + if (other.attrs != null) + return false; + } else if (!attrs.equals(other.attrs)) + return false; + if (classId == null) { + if (other.classId != null) + return false; + } else if (!classId.equals(other.classId)) + return false; + if (id == null) { + if (other.id != null) + return false; + } else if (!id.equals(other.id)) + return false; + if (name == null) { + if (other.name != null) + return false; + } else if (!name.equals(other.name)) + return false; + if (text == null) { + if (other.text != null) + return false; + } else if (!text.equals(other.text)) + return false; + return true; + } + } diff --git a/base/common/src/com/netscape/certsrv/profile/ProfilePolicy.java b/base/common/src/com/netscape/certsrv/profile/ProfilePolicy.java index d5f84f188..4ea0f1abb 100644 --- a/base/common/src/com/netscape/certsrv/profile/ProfilePolicy.java +++ b/base/common/src/com/netscape/certsrv/profile/ProfilePolicy.java @@ -79,4 +79,41 @@ public class ProfilePolicy { return null; } + @Override + public int hashCode() { + final int prime = 31; + int result = 1; + result = prime * result + ((constraint == null) ? 0 : constraint.hashCode()); + result = prime * result + ((def == null) ? 0 : def.hashCode()); + result = prime * result + ((id == null) ? 0 : id.hashCode()); + return result; + } + + @Override + public boolean equals(Object obj) { + if (this == obj) + return true; + if (obj == null) + return false; + if (getClass() != obj.getClass()) + return false; + ProfilePolicy other = (ProfilePolicy) obj; + if (constraint == null) { + if (other.constraint != null) + return false; + } else if (!constraint.equals(other.constraint)) + return false; + if (def == null) { + if (other.def != null) + return false; + } else if (!def.equals(other.def)) + return false; + if (id == null) { + if (other.id != null) + return false; + } else if (!id.equals(other.id)) + return false; + return true; + } + } diff --git a/base/common/src/com/netscape/certsrv/property/Descriptor.java b/base/common/src/com/netscape/certsrv/property/Descriptor.java index f5069d046..63e154466 100644 --- a/base/common/src/com/netscape/certsrv/property/Descriptor.java +++ b/base/common/src/com/netscape/certsrv/property/Descriptor.java @@ -115,4 +115,47 @@ public class Descriptor implements IDescriptor { return "Descriptor [mSyntax=" + mSyntax + ", mConstraint=" + mConstraint + ", mDescription=" + mDescription + ", mDef=" + mDef + "]"; } + + @Override + public int hashCode() { + final int prime = 31; + int result = 1; + result = prime * result + ((mConstraint == null) ? 0 : mConstraint.hashCode()); + result = prime * result + ((mDef == null) ? 0 : mDef.hashCode()); + result = prime * result + ((mDescription == null) ? 0 : mDescription.hashCode()); + result = prime * result + ((mSyntax == null) ? 0 : mSyntax.hashCode()); + return result; + } + + @Override + public boolean equals(Object obj) { + if (this == obj) + return true; + if (obj == null) + return false; + if (getClass() != obj.getClass()) + return false; + Descriptor other = (Descriptor) obj; + if (mConstraint == null) { + if (other.mConstraint != null) + return false; + } else if (!mConstraint.equals(other.mConstraint)) + return false; + if (mDef == null) { + if (other.mDef != null) + return false; + } else if (!mDef.equals(other.mDef)) + return false; + if (mDescription == null) { + if (other.mDescription != null) + return false; + } else if (!mDescription.equals(other.mDescription)) + return false; + if (mSyntax == null) { + if (other.mSyntax != null) + return false; + } else if (!mSyntax.equals(other.mSyntax)) + return false; + return true; + } } diff --git a/base/common/src/com/netscape/cms/servlet/profile/ProfileService.java b/base/common/src/com/netscape/cms/servlet/profile/ProfileService.java index d4b23d95c..2bf58520e 100644 --- a/base/common/src/com/netscape/cms/servlet/profile/ProfileService.java +++ b/base/common/src/com/netscape/cms/servlet/profile/ProfileService.java @@ -32,6 +32,7 @@ import java.util.Vector; import javax.ws.rs.PathParam; import javax.ws.rs.core.UriBuilder; +import org.apache.commons.lang.StringUtils; import org.jboss.resteasy.plugins.providers.atom.Link; import com.netscape.certsrv.apps.CMS; @@ -41,6 +42,9 @@ import com.netscape.certsrv.base.IConfigStore; import com.netscape.certsrv.base.PKIException; import com.netscape.certsrv.base.UnauthorizedException; import com.netscape.certsrv.common.NameValuePairs; +import com.netscape.certsrv.common.OpDef; +import com.netscape.certsrv.common.ScopeDef; +import com.netscape.certsrv.logging.ILogger; import com.netscape.certsrv.profile.EProfileException; import com.netscape.certsrv.profile.IProfile; import com.netscape.certsrv.profile.IProfileEx; @@ -76,6 +80,11 @@ public class ProfileService extends PKIService implements ProfileResource { private IPluginRegistry registry = (IPluginRegistry) CMS.getSubsystem(CMS.SUBSYSTEM_REGISTRY); private IConfigStore cs = CMS.getConfigStore().getSubStore("profile"); + private final static String LOGGING_SIGNED_AUDIT_CERT_PROFILE_APPROVAL = + "LOGGING_SIGNED_AUDIT_CERT_PROFILE_APPROVAL_4"; + private final static String LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE = + "LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE_3"; + public ProfileDataInfos listProfiles() { List<ProfileDataInfo> list = new ArrayList<ProfileDataInfo>(); ProfileDataInfos infos = new ProfileDataInfos(); @@ -85,10 +94,10 @@ public class ProfileService extends PKIService implements ProfileResource { return null; } - PKIPrincipal principal = (PKIPrincipal)servletRequest.getUserPrincipal(); + PKIPrincipal principal = (PKIPrincipal) servletRequest.getUserPrincipal(); if ((principal != null) && - (principal.hasRole("Certificate Manager Agents") || - principal.hasRole("Certificate Manager Administrators"))) { + (principal.hasRole("Certificate Manager Agents") || + principal.hasRole("Certificate Manager Administrators"))) { visibleOnly = false; } Enumeration<String> profileIds = ps.getProfileIds(); @@ -120,10 +129,10 @@ public class ProfileService extends PKIService implements ProfileResource { return null; } - PKIPrincipal principal = (PKIPrincipal)servletRequest.getUserPrincipal(); + PKIPrincipal principal = (PKIPrincipal) servletRequest.getUserPrincipal(); if ((principal != null) && - (principal.hasRole("Certificate Manager Agents") || - principal.hasRole("Certificate Manager Administrators"))) { + (principal.hasRole("Certificate Manager Agents") || + principal.hasRole("Certificate Manager Administrators"))) { visibleOnly = false; } @@ -197,18 +206,10 @@ public class ProfileService extends PKIService implements ProfileResource { Enumeration<String> inputIds = profile.getProfileInputIds(); if (inputIds != null) { - IConfigStore inputStore = profile.getConfigStore().getSubStore("input"); while (inputIds.hasMoreElements()) { - String inputId = inputIds.nextElement(); - IProfileInput profileInput = profile.getProfileInput(inputId); - - if (profileInput == null) { + ProfileInput input = createProfileInput(profile, inputIds.nextElement()); + if (input == null) continue; - } - - String classId = inputStore.getString(inputId + ".class_id"); - - ProfileInput input = new ProfileInput(profileInput, inputId, classId, getLocale()); data.addProfileInput(input); } } @@ -216,18 +217,10 @@ public class ProfileService extends PKIService implements ProfileResource { // profile outputs Enumeration<String> outputIds = profile.getProfileOutputIds(); if (outputIds != null) { - IConfigStore outputStore = profile.getConfigStore().getSubStore("output"); while (outputIds.hasMoreElements()) { - String outputId = outputIds.nextElement(); - IProfileOutput profileOutput = profile.getProfileOutput(outputId); - - if (profileOutput == null) { + ProfileOutput output = createProfileOutput(profile, outputIds.nextElement()); + if (output == null) continue; - } - - String classId = outputStore.getString(outputId + ".class_id"); - - ProfileOutput output = new ProfileOutput(profileOutput, outputId, classId, getLocale()); data.addProfileOutput(output); } } @@ -238,22 +231,12 @@ public class ProfileService extends PKIService implements ProfileResource { while (policySetIds.hasMoreElements()) { Vector<ProfilePolicy> pset = new Vector<ProfilePolicy>(); String policySetId = policySetIds.nextElement(); - Enumeration<com.netscape.cms.profile.common.ProfilePolicy> policies = - profile.getProfilePolicies(policySetId); - if (policies != null) { - while (policies.hasMoreElements()) { - com.netscape.cms.profile.common.ProfilePolicy policy = policies.nextElement(); - IConfigStore policyStore = profile.getConfigStore().getSubStore( - "policyset." + policySetId + "." + policy.getId()); - ProfilePolicy p = new ProfilePolicy(); - String constraintClassId = policyStore.getString("constraint.class_id"); - p.setConstraint(PolicyConstraintFactory.create(getLocale(), policy.getConstraint(), constraintClassId)); - String defaultClassId = policyStore.getString("default.class_id"); - p.setDef(PolicyDefaultFactory.create(getLocale(), policy.getDefault(), defaultClassId)); - p.setId(policy.getId()); - pset.add(p); - } + Enumeration<String> policyIds = profile.getProfilePolicyIds(policySetId); + while (policyIds.hasMoreElements()) { + String policyId = policyIds.nextElement(); + pset.add(createProfilePolicy(profile, policySetId, policyId)); } + if (!pset.isEmpty()) { data.addProfilePolicySet(policySetId, pset); } @@ -268,6 +251,42 @@ public class ProfileService extends PKIService implements ProfileResource { return data; } + public ProfilePolicy createProfilePolicy(IProfile profile, String setId, String policyId) throws EBaseException { + IProfilePolicy policy = profile.getProfilePolicy(setId, policyId); + IConfigStore policyStore = profile.getConfigStore().getSubStore( + "policyset." + setId + "." + policy.getId()); + + ProfilePolicy p = new ProfilePolicy(); + String constraintClassId = policyStore.getString("constraint.class_id"); + p.setConstraint(PolicyConstraintFactory.create(getLocale(), policy.getConstraint(), constraintClassId)); + String defaultClassId = policyStore.getString("default.class_id"); + p.setDef(PolicyDefaultFactory.create(getLocale(), policy.getDefault(), defaultClassId)); + p.setId(policy.getId()); + return p; + } + + public ProfileInput createProfileInput(IProfile profile, String inputId) throws EBaseException { + IProfileInput profileInput = profile.getProfileInput(inputId); + if (profileInput == null) + return null; + + IConfigStore inputStore = profile.getConfigStore().getSubStore("input"); + String classId = inputStore.getString(inputId + ".class_id"); + + return new ProfileInput(profileInput, inputId, classId, getLocale()); + } + + public ProfileOutput createProfileOutput(IProfile profile, String outputId) throws EBaseException { + IProfileOutput profileOutput = profile.getProfileOutput(outputId); + if (profileOutput == null) + return null; + + IConfigStore outputStore = profile.getConfigStore().getSubStore("output"); + String classId = outputStore.getString(outputId + ".class_id"); + + return new ProfileOutput(profileOutput, outputId, classId, getLocale()); + } + public ProfileDataInfo createProfileDataInfo(String profileId, boolean visibleOnly) throws EBaseException { if (profileId == null) { @@ -307,6 +326,11 @@ public class ProfileService extends PKIService implements ProfileResource { throw new PKIException("Error modifying profile state. Profile Service not available"); } + if (profileId == null) { + CMS.debug("modifyProfileState: invalid request. profileId is null"); + throw new BadRequestException("Invalid ProfileId"); + } + Principal principal = servletRequest.getUserPrincipal(); switch (action) { @@ -316,9 +340,11 @@ public class ProfileService extends PKIService implements ProfileResource { } try { ps.enableProfile(profileId, principal.getName()); + auditProfileChangeState(profileId, "approve", ILogger.SUCCESS); } catch (EProfileException e) { CMS.debug("modifyProfileState: error enabling profile. " + e); e.printStackTrace(); + auditProfileChangeState(profileId, "approve", ILogger.FAILURE); throw new PKIException("Error enabling profile"); } break; @@ -331,26 +357,30 @@ public class ProfileService extends PKIService implements ProfileResource { if (ps.checkOwner()) { if (ps.getProfileEnableBy(profileId).equals(userid)) { ps.disableProfile(profileId); + auditProfileChangeState(profileId, "disapprove", ILogger.SUCCESS); } else { - // audit log messages + auditProfileChangeState(profileId, "disapprove", ILogger.FAILURE); throw new UnauthorizedException( "Profile can only be disabled by the agent that enabled it"); } } else { ps.disableProfile(profileId); + auditProfileChangeState(profileId, "disapprove", ILogger.SUCCESS); } } catch (EProfileException e) { CMS.debug("modifyProfileState: Error disabling profile: " + e); e.printStackTrace(); + auditProfileChangeState(profileId, "disapprove", ILogger.FAILURE); throw new PKIException("Error disabling profile"); } break; default: + auditProfileChangeState(profileId, "invalid", ILogger.FAILURE); throw new BadRequestException("Invalid operation"); } } - public void createProfile(ProfileData data){ + public void createProfile(ProfileData data) { if (ps == null) { CMS.debug("createProfile: ps is null"); throw new PKIException("Error creating profile. Profile Service not available"); @@ -358,11 +388,18 @@ public class ProfileService extends PKIService implements ProfileResource { IProfile profile = null; String profileId = data.getId(); + Map<String, String> auditParams = new LinkedHashMap<String, String>(); try { profile = ps.getProfile(profileId); if (profile != null) { throw new BadRequestException("Profile already exists"); } + + auditParams.put("class_id", data.getClassId()); + auditParams.put("name", data.getName()); + auditParams.put("description", data.getDescription()); + auditParams.put("visible", Boolean.toString(data.isVisible())); + String config = CMS.getConfigStore().getString("instanceRoot") + "/ca/profiles/ca/" + profileId + ".cfg"; File configFile = new File(config); @@ -370,7 +407,7 @@ public class ProfileService extends PKIService implements ProfileResource { IPluginInfo info = registry.getPluginInfo("profile", data.getClassId()); profile = ps.createProfile(profileId, data.getClassId(), info.getClassName(), config); - profile.setName(getLocale(),data.getName()); + profile.setName(getLocale(), data.getName()); profile.setDescription(getLocale(), data.getDescription()); profile.setVisible(data.isVisible()); profile.getConfigStore().commit(false); @@ -381,16 +418,31 @@ public class ProfileService extends PKIService implements ProfileResource { // policies, inputs and outputs with defaults ((IProfileEx) profile).populate(); } + + auditProfileChange( + ScopeDef.SC_PROFILE_RULES, + OpDef.OP_ADD, + profileId, + ILogger.SUCCESS, + auditParams); } catch (EBaseException | IOException e) { CMS.debug("createProfile: error in creating profile: " + e); e.printStackTrace(); + + auditProfileChange( + ScopeDef.SC_PROFILE_RULES, + OpDef.OP_ADD, + profileId, + ILogger.FAILURE, + auditParams); + throw new PKIException("Error in creating profile"); } changeProfileData(data, profile); } - public void modifyProfile(String profileId, ProfileData data){ + public void modifyProfile(String profileId, ProfileData data) { if (ps == null) { CMS.debug("modifyProfile: ps is null"); throw new PKIException("Error modifying profile. Profile Service not available"); @@ -429,7 +481,7 @@ public class ProfileService extends PKIService implements ProfileResource { auditParams.put("authenticatorId", data.getAuthenticatorId()); } - if (differs(profile.getAuthzAcl(),data.getAuthzAcl())) { + if (differs(profile.getAuthzAcl(), data.getAuthzAcl())) { profile.setAuthzAcl(data.getAuthzAcl()); auditParams.put("authzAcl", data.getAuthzAcl()); } @@ -439,48 +491,46 @@ public class ProfileService extends PKIService implements ProfileResource { auditParams.put("description", data.getDescription()); } - if (differs(profile.getId(),data.getId())) { + if (differs(profile.getId(), data.getId())) { profile.setId(data.getId()); auditParams.put("id", data.getId()); } - if (differs(profile.getName(getLocale()),data.getName())) { - profile.setName(getLocale(),data.getName()); + if (differs(profile.getName(getLocale()), data.getName())) { + profile.setName(getLocale(), data.getName()); auditParams.put("name", data.getName()); } // TODO renewal is a string in Profile, should be changed - if (differs(profile.isRenewal(),Boolean.toString(data.isRenewal()))) { + if (differs(profile.isRenewal(), Boolean.toString(data.isRenewal()))) { profile.setRenewal(data.isRenewal()); auditParams.put("renewal", Boolean.toString(data.isRenewal())); } - if (! profile.isVisible() == data.isVisible()) { + if (!profile.isVisible() == data.isVisible()) { profile.setVisible(data.isVisible()); auditParams.put("visible", Boolean.toString(data.isVisible())); } // TODO xmloutput is a string in Profile, should be changed - if (differs(profile.isXmlOutput(),Boolean.toString(data.isXMLOutput()))) { + if (differs(profile.isXmlOutput(), Boolean.toString(data.isXMLOutput()))) { profile.setXMLOutput(data.isXMLOutput()); auditParams.put("xmloutput", Boolean.toString(data.isXMLOutput())); } - // add audit log for auditParams + if (!auditParams.isEmpty()) { + auditProfileChange( + ScopeDef.SC_PROFILE_RULES, + OpDef.OP_MODIFY, + profileId, + ILogger.SUCCESS, + auditParams); + } try { populateProfileInputs(data, profile); - - // add audit log for profile inputs - populateProfileOutputs(data, profile); - - // add audit log for profile outputs - populateProfilePolicies(data, profile); - - // add audit log for profile policies - profile.getConfigStore().commit(false); } catch (EBaseException e) { CMS.debug("changeProfileData: Error changing profile inputs/outputs/policies: " + e); @@ -502,75 +552,310 @@ public class ProfileService extends PKIService implements ProfileResource { return false; } - private void populateProfilePolicies(ProfileData data, IProfile profile) throws EProfileException, EPropertyException { - profile.deleteAllProfilePolicies(); - for (Map.Entry<String,List<ProfilePolicy>> policySet: - data.getPolicySets().entrySet()) { + private void populateProfilePolicies(ProfileData data, IProfile profile) throws EBaseException { + // get list of changes for auditing + List<String> auditAdd = new ArrayList<String>(); + List<String> auditModify = new ArrayList<String>(); + + Enumeration<String> existingSetIds = profile.getProfilePolicySetIds(); + Map<String, ProfilePolicy> existingPolicies = new LinkedHashMap<String, ProfilePolicy>(); + while (existingSetIds.hasMoreElements()) { + String setId = existingSetIds.nextElement(); + Enumeration<String> policyIds = profile.getProfilePolicyIds(setId); + while (policyIds.hasMoreElements()) { + String policyId = policyIds.nextElement(); + existingPolicies.put( + setId + ":" + policyId, + createProfilePolicy(profile, setId, policyId)); + } + } + + for (Map.Entry<String, List<ProfilePolicy>> policySet : data.getPolicySets().entrySet()) { String setId = policySet.getKey(); - for (ProfilePolicy policy: policySet.getValue()) { - PolicyDefault def = policy.getDef(); - PolicyConstraint con = policy.getConstraint(); - - // create policy using defaults for PolicyDefault and PolicyConstraint - IProfilePolicy p = profile.createProfilePolicy(setId, policy.getId(), - def.getClassId(), con.getClassId()); - - // change specific elements to match incoming data for PolicyDefault - IConfigStore pstore = profile.getConfigStore().getSubStore( - "policyset." + setId + "." + policy.getId()); - if (!def.getName().isEmpty()) { - pstore.putString("default.name", def.getName()); - } - /*if (!def.getText().isEmpty()) { - pstore.putString("default.description", def.getText()); - }*/ - for (ProfileParameter param: def.getParams()) { - if (!param.getValue().isEmpty()) { - p.getDefault().setConfig(param.getName(), param.getValue()); + for (ProfilePolicy policy : policySet.getValue()) { + String id = setId + ":" + policy.getId(); + if (!existingPolicies.containsKey(id)) { + auditAdd.add(id); + } else { + if (!policy.equals(existingPolicies.get(id))) { + auditModify.add(id); } } + existingPolicies.remove(id); + } + } - // change specific elements to match incoming data for PolicyConstraint - if (!con.getName().isEmpty()) { - pstore.putString("constraint.name", con.getName()); - } - /*if (!con.getText().isEmpty()) { - pstore.putString("constraint.description", con.getText()); - }*/ - for (PolicyConstraintValue pcv : con.getConstraints()) { - if (!pcv.getValue().isEmpty()) { - p.getConstraint().setConfig(pcv.getName(), pcv.getValue()); + List<String> auditDelete = new ArrayList<String>(existingPolicies.keySet()); + + //perform actions + try { + profile.deleteAllProfilePolicies(); + for (Map.Entry<String, List<ProfilePolicy>> policySet : data.getPolicySets().entrySet()) { + String setId = policySet.getKey(); + for (ProfilePolicy policy : policySet.getValue()) { + PolicyDefault def = policy.getDef(); + PolicyConstraint con = policy.getConstraint(); + + // create policy using defaults for PolicyDefault and PolicyConstraint + IProfilePolicy p = profile.createProfilePolicy(setId, policy.getId(), + def.getClassId(), con.getClassId()); + + // change specific elements to match incoming data for PolicyDefault + IConfigStore pstore = profile.getConfigStore().getSubStore( + "policyset." + setId + "." + policy.getId()); + if (!def.getName().isEmpty()) { + pstore.putString("default.name", def.getName()); + } + /*if (!def.getText().isEmpty()) { + pstore.putString("default.description", def.getText()); + }*/ + for (ProfileParameter param : def.getParams()) { + if (!param.getValue().isEmpty()) { + p.getDefault().setConfig(param.getName(), param.getValue()); + } + } + + // change specific elements to match incoming data for PolicyConstraint + if (!con.getName().isEmpty()) { + pstore.putString("constraint.name", con.getName()); + } + /*if (!con.getText().isEmpty()) { + pstore.putString("constraint.description", con.getText()); + }*/ + for (PolicyConstraintValue pcv : con.getConstraints()) { + if (!pcv.getValue().isEmpty()) { + p.getConstraint().setConfig(pcv.getName(), pcv.getValue()); + } } } } + + if (!auditDelete.isEmpty()) { + Map<String, String> auditParams = new LinkedHashMap<String, String>(); + auditParams.put("inputs", StringUtils.join(auditDelete, ",")); + auditProfileChange( + ScopeDef.SC_PROFILE_POLICIES, + OpDef.OP_DELETE, + profile.getId(), + ILogger.SUCCESS, + auditParams); + } + + if (!auditAdd.isEmpty()) { + Map<String, String> auditParams = new LinkedHashMap<String, String>(); + auditParams.put("inputs", StringUtils.join(auditAdd, ",")); + auditProfileChange( + ScopeDef.SC_PROFILE_POLICIES, + OpDef.OP_ADD, + profile.getId(), + ILogger.SUCCESS, + auditParams); + } + + if (!auditModify.isEmpty()) { + Map<String, String> auditParams = new LinkedHashMap<String, String>(); + auditParams.put("inputs", StringUtils.join(auditModify, ",")); + auditProfileChange( + ScopeDef.SC_PROFILE_POLICIES, + OpDef.OP_MODIFY, + profile.getId(), + ILogger.SUCCESS, + auditParams); + } + } catch (EProfileException | EPropertyException e) { + Map<String, String> auditParams = new LinkedHashMap<String, String>(); + auditParams.put("added", StringUtils.join(auditAdd, ",")); + auditParams.put("deleted", StringUtils.join(auditDelete, ",")); + auditParams.put("modified", StringUtils.join(auditModify, ",")); + auditProfileChange( + ScopeDef.SC_PROFILE_POLICIES, + OpDef.OP_MODIFY, + profile.getId(), + ILogger.FAILURE, + auditParams); + throw e; } } - private void populateProfileOutputs(ProfileData data, IProfile profile) throws EProfileException { - profile.deleteAllProfileOutputs(); + private void populateProfileOutputs(ProfileData data, IProfile profile) throws EBaseException { + // get list of changes for auditing + List<String> auditAdd = new ArrayList<String>(); + List<String> auditModify = new ArrayList<String>(); + + Enumeration<String> existingIds = profile.getProfileOutputIds(); + Map<String, ProfileOutput> existingOutputs = new LinkedHashMap<String, ProfileOutput>(); + while (existingIds.hasMoreElements()) { + String id = existingIds.nextElement(); + ProfileOutput output = createProfileOutput(profile, id); + if (output == null) + continue; + existingOutputs.put(id, output); + } + List<ProfileOutput> outputs = data.getOutputs(); - for (ProfileOutput output: outputs) { + for (ProfileOutput output : outputs) { String id = output.getId(); - String classId = output.getClassId(); + if (!existingOutputs.containsKey(id)) { + auditAdd.add(id); + } else { + if (!output.equals(existingOutputs.get(id))) { + auditModify.add(id); + } + existingOutputs.remove(id); + } + } + List<String> auditDelete = new ArrayList<String>(existingOutputs.keySet()); + + // perform operations + + try { + profile.deleteAllProfileOutputs(); + for (ProfileOutput output : outputs) { + String id = output.getId(); + String classId = output.getClassId(); + + NameValuePairs nvp = new NameValuePairs(); + // TODO - add a field for params in ProfileOuput + // No current examples + profile.createProfileOutput(id, classId, nvp); + } + + if (!auditDelete.isEmpty()) { + Map<String, String> auditParams = new LinkedHashMap<String, String>(); + auditParams.put("outputs", StringUtils.join(auditDelete, ",")); + auditProfileChange( + ScopeDef.SC_PROFILE_OUTPUT, + OpDef.OP_DELETE, + profile.getId(), + ILogger.SUCCESS, + auditParams); + } + + if (!auditAdd.isEmpty()) { + Map<String, String> auditParams = new LinkedHashMap<String, String>(); + auditParams.put("outputs", StringUtils.join(auditAdd, ",")); + auditProfileChange( + ScopeDef.SC_PROFILE_OUTPUT, + OpDef.OP_ADD, + profile.getId(), + ILogger.SUCCESS, + auditParams); + } - NameValuePairs nvp = new NameValuePairs(); - // TODO - add a field for params in ProfileOuput - // No current examples - profile.createProfileOutput(id, classId, nvp); + if (!auditModify.isEmpty()) { + Map<String, String> auditParams = new LinkedHashMap<String, String>(); + auditParams.put("outputs", StringUtils.join(auditModify, ",")); + auditProfileChange( + ScopeDef.SC_PROFILE_OUTPUT, + OpDef.OP_MODIFY, + profile.getId(), + ILogger.SUCCESS, + auditParams); + } + } catch (EProfileException e) { + Map<String, String> auditParams = new LinkedHashMap<String, String>(); + + auditParams.put("added", StringUtils.join(auditAdd, ",")); + auditParams.put("deleted", StringUtils.join(auditDelete, ",")); + auditParams.put("modified", StringUtils.join(auditModify, ",")); + auditProfileChange( + ScopeDef.SC_PROFILE_OUTPUT, + OpDef.OP_MODIFY, + profile.getId(), + ILogger.FAILURE, + auditParams); + throw e; } } - private void populateProfileInputs(ProfileData data, IProfile profile) throws EProfileException { - profile.deleteAllProfileInputs(); - List<ProfileInput> inputs = data.getInputs(); - for (ProfileInput input: inputs) { + private void populateProfileInputs(ProfileData data, IProfile profile) throws EBaseException { + // get list of changes for auditing + List<String> auditAdd = new ArrayList<String>(); + List<String> auditModify = new ArrayList<String>(); + Enumeration<String> existingIds = profile.getProfileInputIds(); + Map<String, ProfileInput> existingInputs = new LinkedHashMap<String, ProfileInput>(); + + while (existingIds.hasMoreElements()) { + String id = existingIds.nextElement(); + ProfileInput input = createProfileInput(profile, id); + if (input == null) + continue; + existingInputs.put(id, input); + } + + List<ProfileInput> inputs = data.getInputs(); + for (ProfileInput input : inputs) { String id = input.getId(); - String classId = input.getClassId(); + if (!existingInputs.containsKey(id)) { + auditAdd.add(id); + } else { + if (!input.equals(existingInputs.get(id))) { + auditModify.add(id); + } + existingInputs.remove(id); + } + } + List<String> auditDelete = new ArrayList<String>(existingInputs.keySet()); + + try { + // perform the operations + profile.deleteAllProfileInputs(); + + for (ProfileInput input : inputs) { + String id = input.getId(); + String classId = input.getClassId(); + + NameValuePairs nvp = new NameValuePairs(); + // TODO - add a field for params in ProfileInput. + // an example of this is DomainController.cfg + profile.createProfileInput(id, classId, nvp); + } - NameValuePairs nvp = new NameValuePairs(); - // TODO - add a field for params in ProfileInput. - // an example of this is DomainController.cfg - profile.createProfileInput(id, classId, nvp); + if (!auditDelete.isEmpty()) { + Map<String, String> auditParams = new LinkedHashMap<String, String>(); + auditParams.put("inputs", StringUtils.join(auditDelete, ",")); + auditProfileChange( + ScopeDef.SC_PROFILE_INPUT, + OpDef.OP_DELETE, + profile.getId(), + ILogger.SUCCESS, + auditParams); + } + + if (!auditAdd.isEmpty()) { + Map<String, String> auditParams = new LinkedHashMap<String, String>(); + auditParams.put("inputs", StringUtils.join(auditAdd, ",")); + auditProfileChange( + ScopeDef.SC_PROFILE_INPUT, + OpDef.OP_ADD, + profile.getId(), + ILogger.SUCCESS, + auditParams); + } + + if (!auditModify.isEmpty()) { + Map<String, String> auditParams = new LinkedHashMap<String, String>(); + auditParams.put("inputs", StringUtils.join(auditModify, ",")); + auditProfileChange( + ScopeDef.SC_PROFILE_INPUT, + OpDef.OP_MODIFY, + profile.getId(), + ILogger.SUCCESS, + auditParams); + } + } catch (EProfileException e) { + Map<String, String> auditParams = new LinkedHashMap<String, String>(); + + auditParams.put("added", StringUtils.join(auditAdd, ",")); + auditParams.put("deleted", StringUtils.join(auditDelete, ",")); + auditParams.put("modified", StringUtils.join(auditModify, ",")); + auditProfileChange( + ScopeDef.SC_PROFILE_INPUT, + OpDef.OP_MODIFY, + profile.getId(), + ILogger.FAILURE, + auditParams); + throw e; } } @@ -589,6 +874,13 @@ public class ProfileService extends PKIService implements ProfileResource { if (ps.isProfileEnable(profileId)) { CMS.debug("Delete profile not permitted. Profile must be disabled first."); + auditProfileChange( + ScopeDef.SC_PROFILE_RULES, + OpDef.OP_DELETE, + profileId, + ILogger.FAILURE, + null); + throw new BadRequestException("Cannot delete profile `" + profileId + "`. Profile must be disabled first."); } @@ -596,12 +888,44 @@ public class ProfileService extends PKIService implements ProfileResource { String configFile = CMS.getConfigStore().getString("profile." + profileId + ".config"); ps.deleteProfile(profileId, configFile); + + auditProfileChange( + ScopeDef.SC_PROFILE_RULES, + OpDef.OP_DELETE, + profileId, + ILogger.FAILURE, + null); } catch (EBaseException e) { CMS.debug("deleteProfile: error in deleting profile `" + profileId + "`: " + e); e.printStackTrace(); + + auditProfileChange( + ScopeDef.SC_PROFILE_RULES, + OpDef.OP_DELETE, + profileId, + ILogger.FAILURE, + null); + throw new PKIException("Error deleting profile."); } + } + public void auditProfileChangeState(String profileId, String op, String status) { + String msg = CMS.getLogMessage( + LOGGING_SIGNED_AUDIT_CERT_PROFILE_APPROVAL, + auditor.getSubjectID(), + status, + profileId, + op); + auditor.log(msg); + } + public void auditProfileChange(String scope, String type, String id, String status, Map<String, String> params) { + String msg = CMS.getLogMessage( + LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE, + auditor.getSubjectID(), + status, + auditor.getParamString(scope, type, id, params)); + auditor.log(msg); } } |