| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The shutdown() methods in several classes have been fixed to allow
more graceful shutdown and clean restart. There are two types of
object attributes that need to be handled differently.
Attributes that are initialized by the constructor should not be
nulled during shutdown because they won't be reinitialized during
restart. If they require a cleanup (e.g. emptying collections,
closing LDAP connections) it's not necessary to check for null
before calling the cleanup method because they're never null.
For attributes that are initialized during init(), it may not be
necessary to do a cleanup or null the attribute since they might
still be used by other threads and they will be reinitialized
during restart so the old objects will be garbage collected. If
they do need a cleanup they should be checked for null because
they might still be null due to init() failure or initialization
conditionals.
If the attributes are initialized conditionally, the logic has been
modified to ensure the attributes are either initialized or set to
null.
Ticket #247
|
|
|
|
| |
TPS ECC: when TPS server acts as an ECC SSL client to CA, TKS, or DRM, it needs to support ECC ciphers
|
|
|
|
|
|
|
|
| |
generation
This patch calls with the right flags for each supported HSM to the new
certutil that addressed the following bug:
Bug 820684 - certutil support for EC on HSMs - need to call PK11_GenerateKeyPairWithOpFlags()
|
|
|
|
|
|
|
|
|
| |
This patch corrects process of attaching OCSP subsystem to CA.
It improves handling of adding subsequent OCSP subsystems to CA.
This patch also prevents DRM connector to be overwritten
by subsequent DRM installations.
Bug 804179.
|
|
|
|
|
|
|
|
|
|
|
| |
* TRAC Ticket #266 - for non-master CA subsystems, pkidestroy needs to
contact the security domain to update the domain
* Made Fedora 17 rely upon tomcatjss 7.0.0 or later
* Changed Dogtag 10 build-time and runtime requirements for 'pki-deploy'
* Altered PKI Package Dependency Chain (top-to-bottom):
pki-ca, pki-kra, pki-ocsp, pki-tks --> pki-deploy --> pki-common
* Changed TPS to require a build-time dependency of 'httpd-devel >= 2.4.2'
* Clarified RPM build script's usage message
|
| |
|
| |
|
|
|
|
|
| |
The CLI help message has been fixed to show the correct default
port number.
|
|
|
|
| |
TPS installation wizard: SizePanel needs to support ECC curve selection
|
|\ |
|
| |
| |
| |
| |
| |
| | |
Added systemd scripts for RA and TPS. Modified init scripts
and configuration files to use correct directives for httpd 2.4.
TPS and RA subsystems are now installable using pkicreate
|
|\ \
| |/
|/| |
|
| |
| |
| |
| |
| |
| |
| | |
ECC support for tpsclient
two parameters are added in the config file (see enroll.tps.ec for example): slotnamefile - this points to a file that contains the slot name. The reason why the slot name goes into another file instead of the conf file is because the existing conf file uses spaces for deliminator and I don't want to change the usage (and QE's tests) by changing it to something else. tokpasswod is the tokebn password
This ECC feature requires the up-coming ECC supporting TPS to trigger. Testing of the ECC specific areas requires the availability of such ECC TPS. Without it, one can test with the old RSA method to see if it's broken.
|
| |
| |
| |
| |
| |
| |
| | |
A new pki-client.jar has been created to package the REST client
and CLI classes.
Ticket #215
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The ConfigurationResponse previously has a method that uses a class
that exists on the server only, creating a dependency issue since
the ConfigurationResponse will be used by the client as well. The
method now has been moved into a separate factory class.
Ticket #259
|
| |
| |
| |
| |
| |
| |
| | |
The common classes used by REST client and services have been moved
into the com.netscape.certsrv.<component> packages.
Ticket #215
|
| |
| |
| |
| |
| |
| |
| | |
The factory and DAO classes used by REST services have been moved
into the com.netscape.cms.servlet.<component> packages.
Ticket #215
|
| |
| |
| |
| |
| |
| |
| | |
The REST client classes have been moved into the
com.netscape.cms.client.<component> packages.
Ticket #215
|
| |
| |
| |
| |
| |
| |
| | |
The REST common classes have been renamed for better clarity
and consistency.
Ticket #259
|
| |
| |
| |
| |
| |
| |
| | |
The REST server classes have been renamed for better clarity
and consistency.
Ticket #259
|
| |
| |
| |
| |
| |
| |
| | |
The REST client classes have been renamed for better clarity
and consistency.
Ticket #259
|
| |
| |
| |
| |
| |
| |
| | |
The remaining build scripts have been updated to automatically
find the source codes.
Ticket #62
|
|/
|
|
|
|
|
|
| |
The build scripts for test, util test, and common test
components have been updated to automatically find the
source codes and not create unnecessary test jar files.
Ticket #62
|
|
|
|
|
|
|
| |
* TRAC Ticket #184 - Dogtag 10: Update PKI Deployment to handle
cloning CA/KRA/OCSP/TKS . . .
* TRAC Ticket #285 - Dogtag 10: Fix installation issues for
KRA, OCSP, and TKS
|
|
|
|
|
|
|
|
|
| |
Search function call supporting various already present.
Changes the ds call from searchCertificates to CertificateRepository.findCertRecords().
Added pagination using start and size options . provided in command line.
Conflicts:
base/common/src/com/netscape/cms/client/cert/CertRestClient.java
|
|
|
|
|
|
|
|
|
| |
pki-cert-find <filename> [OPTIONS]
Available search options
pki-cert-find - lists all the certificates.
pki-cert-find --input <filename> - reads the search criteria from the file (Unmarshalled CertSearchData object)
pki-cert-find [Options] - custom build of search criteria
pki-cert-find --help - shows all the available options.
|
| |
|
|
|
|
|
|
| |
The API changed between httpd 2.2 and 2.4. We now need to pass
the module index to ap_log_error() when calling it. The remote_ip
member of the connection struct also was renamed to client_ip.
|
|
|
|
|
|
| |
This patch corrects certificate import for IE
Bug: 845387.
|
|
|
|
|
|
|
| |
In the new selinux policy, pki_ca_t etc. are all replaced by
pki_tomcat_t. To allow old instances to work under dogtag 10, the
context in the run scripts needs to change.
Also added a rule needed by selinux policy.
|
|
|
|
|
|
|
| |
Reverted previous fix to pkidaemon and operations. Now, as
expected, systemctl start/stop pki-tomcatd@foo.service will stop
instance foo, whereas pki-tomcatd.target will affect all tomcatd
instances.
|
|
|
|
|
|
| |
This patch corrects certificate import for IE
Bug: 845387.
|
|
|
|
|
|
| |
'tomcat7jss.jar' in Fedora 18 tomcatjss package
* Requires tomcatjss 7.0.0-3 as links for instances created by 'pkispawn' will
now point to 'tomcat7jss.jar'
|
|
|
|
|
|
|
|
|
|
|
| |
The SSL connection has been configured with clientAuth="want" so
users can choose whether to provide a client certificate or username
and password. The authentication and authorization will be handled
by the SSL authenticator with fallback and PKI realm. New access
control rules have been added for users, groups, and certs REST
services.
Ticket #107
|
|
|
|
|
|
|
|
|
|
|
| |
To support different access control configurations the REST
services have been separated by roles. Services that don't
need authentication will be available under /rest. Services
that require agent rights will be available under /rest/agent.
Services that require admin rights will be available under
/rest/admin.
Ticket #107
|
|
|
|
|
|
| |
This patch adds ECC directory enrollment profile.
Bug: 748514.
|
|
|
|
|
|
| |
This patch enables ECC enrollments for IE.
Bug: 748514.
|
|
|
|
|
|
|
|
|
| |
* PKI TRAC Ticket #279 - Dogtag 10: Fix remaining 'cloning' issues in
'pkispawn' . . .
* PKI TRAC Ticket #280 - Dogtag 10: Fix remaining issues in 'pkidestroy'
related to deletion of more than one instance . . .
* PKI TRAC Ticket #281 - Dogtag 10: Fix 'pkidaemon'/'operations' issue to
handle individual instance . . .
|
|
|
|
|
|
|
|
| |
On Tomcat 7 it's no longer necessary to have a separate package
for the authenticator and realm classes. They are now packaged
in pki-cmscore.jar which is deployed in Tomcat's common/lib.
Ticket #126
|
|
|
|
|
|
|
|
|
| |
The PKI JNDI realm has been modified to utilize the authentication
and authorization subsystems in PKI engine directly. It's no longer
necessary to define the LDAP connection settings in Tomcat's
configuration files.
Ticket #126
|
|
|
|
|
|
|
|
| |
A custom Tomcat authenticator has been added to authenticate users
using client certificate if provided, otherwise it will fallback to
BASIC/FORM authentication.
Ticket #107
|
|
|
|
|
|
|
| |
Selinux policy has been changed to use standard tomcat ports. Corresponding
changes have been made in the pki-deploy scripts.
Minor change in config script for password check.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* TRAC Ticket #263 - Dogtag 10: Fix 'pkidestroy' problem of sporadically "not"
removing "/etc/sysconfig/{pki_instance_id}" . . .
* TRAC Ticket #264 - Dogtag 10: Enable various other subsystems for
configuration . . .
* TRAC Ticket #261 - Dogtag 10: Revisit command-line options of 'pkispawn' and
'pkidestroy' . . .
* TRAC Ticket #268 - Dogtag 10: Create a parameter for optional restart of
configured PKI instance . . .
* TRAC Ticket #270 - Dogtag 10: Add missing parameters to
'pkideployment.cfg' . . .
* TRAC Ticket #265 - Dogtag 10: Provide configurable options for PKI client
information . . .
* TRAC Ticket #275 - Dogtag 10: Add debug information (comments) to Tomcat 7
"logging.properties"
* TRAC Ticket #276 - Dogtag 10: Relocate all 'pin' data to the 'sensitive'
dictionary
* TRAC Ticket #277 - Dogtag 10: Create an 'archive' for 'manifest' and
'pkideployment.cfg' files
* TRAC Ticket #278 - Dogtag 10: Fix Miscellaneous PKI Deployment Scriptlet
Issues . . .
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The CMSRestClient has been modified to support basic authentication
and handle HTTP redirection. The basic authentication can be used as
follows:
pki -U <server uri> -u <username> -w <password> user-find
Some protected REST services might require secure connection. If the
user tries to call these services over HTTP the CLI will handle the
redirection automatically to an HTTPS port.
Ticket #107
|
|
|
|
|
|
|
|
| |
A new ClientConfig class has been added to encapsulate client
configuration parameters. These parameters include server URI,
certificate database, certificate nickname, and password.
Ticket #107
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* PKI TRAC Ticket #244 - Non-user-friendly message when deleting non-existent
subsystem with pkidestroy
* PKI TRAC Ticket #246 - Incorrect parameter names in pkispawn configuration
* PKI TRAC Ticket #248 - pki_ds_database should not be a DN
* PKI TRAC Ticket #249 - pki_ds_base_dn causing pkispawn failure
* PKI TRAC Ticket #250 - Creating/removing custom instances should not require
http/ajp ports
* PKI TRAC Ticket #251 - Instance name may conflict with other files
* PKI TRAC Ticket #253 - Fix pki-destroy removal of
'/var/log/pki/{pki_instance_id}' directory . . .
* PKI TRAC Ticket #254 - Dogtag 10: Fix spec file to build successfully via mock
on Fedora 17 . . .
* PKI TRAC Ticket #255 - Missing resteasy-atom-provider.jar
* PKI TRAC Ticket #260 - Dogtag 10: Change the layout of 'pki_instance_id' . . .
|
| |
|
| |
|
|
|
|
|
|
| |
Added tomcat_t for java processes. Added aliases for old types to allow
compatibility of existng subsystems. Added install scripts for pkispawn
and pkidestroy
|