summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Ticket 2271 2298 key archival/recovery, not to record certain data in ldapChristina Fu2016-05-274-4/+51
| | | | | | This patch handles Ticket 2298 non-TMS key archival/recovery, as well as Ticket 2271 TMS recovery request ldap entries Fields are zeroed out before being deleted in KRA request records
* Fixed error handling in ProxyRealm.Endi S. Dewata2016-05-274-2/+94
| | | | | | | | All methods in ProxyRealms for Tomcat 7 and 8 have been modified to check whether the subsystem is available, then generate a proper error message instead of null pointer exception. https://fedorahosted.org/pki/ticket/2326
* Fixed hard-coded database name for TPS VLV indexes.Endi S. Dewata2016-05-279-46/+68
| | | | | | | | | | | | | The vlv.ldif for TPS has been modified to remove the hard-coded database name and to use customizable parameter instead. The token and activity REST services have been modified to search the database using VLV. The existing database can be fixed using the following procedure: http://pki.fedoraproject.org/wiki/Database_Upgrade_for_PKI_10.3.x#Relocating_VLV_indexes https://fedorahosted.org/pki/ticket/2342
* Add parameters to purge old published filesAde Lee2016-05-262-10/+150
| | | | Ticket 2254
* Ticket 1665 - Cert Revocation Reasons not being updated when on-holdChristina Fu2016-05-259-16/+99
| | | | | | | | | | | | | | This patch fixes the following areas: * In the CA, when revokeCert is called, make it possible to move from on_hold to revoke. * In the servlet that handles TPS revoke (DoRevokeTPS), make sure it allows the on_hold cert to be put in the bucket to be revoked. * there are a few minor fixes such as typos and one have to do with the populate method in SubjectDNInput.java needs better handling of subject in case it's null. Note: This patch does not make attempt to allow agents to revoke certs that are on_hold from agent interface. The search filter needs to be modified to allow that.
* Fixed support for generic CSR extensions.Endi S. Dewata2016-05-256-61/+144
| | | | | | | | The deployment tool has been modified to support adding Subordinate CA extension into the CSR for Microsoft CA, and also adding generic extensions to any system certificate. https://fedorahosted.org/pki/ticket/2312
* Add revocation information to pki CLI output.Ade Lee2016-05-244-9/+105
| | | | | | | The date on which the certificate is revoked and the agent that revoked it is displayed now in cert-find and cert-show output. Ticket 1055
* Allow cert-find using revocation reasonsAde Lee2016-05-241-2/+21
| | | | | | | | | The REST API expects the integer revocation code to be passed in a certificate search. We have modified the client to allow the user to provide either a revocation code or a revocation reason as a search parameter. Ticket 1053
* Fixed cert enrollment problem with empty rangeUnit in profile.Endi S. Dewata2016-05-243-9/+9
| | | | | | | | | | | | Previously cert enrollment might fail after editing the profile using the console. This is because the console added an empty rangeUnit parameter, but the server rejected the empty value. The convertRangeUnit() methods in several classes have been modified to accept the empty value and convert it into the default value (i.e. day). https://fedorahosted.org/pki/ticket/2308
* Add parameters to disable cert or crl publishingAde Lee2016-05-2413-102/+130
| | | | | | | | | | | | | | | | | | | | | | | | | | Right now, if publishing is enabled, both CRLs and Cert publishing is enabled. This causes a bunch of spurious error messages on IPA servers as cert publishing is not configured. As it is impossible to determine if cert publishing is not desired or simply misconfigured, we provide options to explicitly disable either cert or crl publishing. Specifically: * to enable/disable both cert and crl publishing: ca.publish.enable = True/False This is the legacy behavior. * to enable CRL publishing only: ca.publish.enable = True ca.publish.cert.enable = False * to enable cert publishing only: ca.publish.enable = True ca.publish.crl.enable = False Ticket 2275
* Ignoring blank and comment lines in configuration files.Endi S. Dewata2016-05-241-2/+11
| | | | | | | | | The PKISubsystem.load() and PKIInstance.load() have been modified to ignore blank and comment lines in CS.cfg and password.conf. If the code fails to parse a line it will throw an exception showing the location of the invalid line. https://fedorahosted.org/pki/ticket/2314
* Added TPS UI for managing user certificates.Endi S. Dewata2016-05-246-14/+258
| | | | | | | | | The TPS UI has been modified to provide an interface to manage the user certificates. The UserService has been modified to provide better error messages. https://fedorahosted.org/pki/ticket/1434
* Added TPS UI for managing user roles.Endi S. Dewata2016-05-246-35/+252
| | | | | | | | | | The TPS UI has been modified to provide an interface to manage the user roles. The ErrorDialog was modified to handle both text and JSON error responses. https://fedorahosted.org/pki/ticket/2267
* Port symkey JNI to Java classes.Jack Magne2016-05-239-91/+2147
| | | | | | | | | | | | | | | | | | | | | Ticket #801 : Merge pki-symkey into jss What is supported: 1. Everything that is needed to support Secure Channel Protocol 01. 2. Supports the nist sp800 kdf and the original kdf. 3. Supports key unwrapping used by TPS which was formerly in the symkey JNI. Requires: 1. A new JSS that supports more advanced symkey operations such as key derivation, more advanced key unwrapping , and a way to list and identify a given symmetric key by name. Version of new Jss will be forthcoming. Still to do: 1. Port over the 2 or 3 SCP02 routines from Symkey to use this code. 2. The original symkey will remain in place until we can port over everything. 3. SCP03 support can be added later.
* Updated version number to 10.3.2-0.1Matthew Harmsen2016-05-187-11/+23
|
* Ticket #1527 reopened: retrieved wrong ca connector config parameterChristina Fu2016-05-183-9/+62
| | | | | | | | | | | | | | | | | This ticket was reopened due to retrieving wrong ca connector config param for the case when format is done within an enrollment. The following is attempted: op.enroll.userKey.ca.conn while the following is intended: op.format.userKey.ca.conn In addition, this patch also fixes the following issues; a. reason param name is not conforming: "reason" instead of "revokeReason" b. adding default reason to format TPS profiles c. by default mappingResolver.formatProfileMappingResolver resolves to tokenKey, while enroll resolves to userKey. -> now changed the userKey d. if revocation fails during format, it was forgiving. -> now changed so that error is logged in activity log and exception thrown and bail out
* Updated version number to 10.3.1-1 (to allow upgrade from 10.3.0.b1)Matthew Harmsen2016-05-177-7/+19
|
* Updated version number to 10.3.0-1.Matthew Harmsen2016-05-161-0/+9
| | | | | - python-flake8 2.5.4 package should require pyflakes >= 1.2.3 - python3-flake8 2.5.4 package should require python3-pyflakes >= 1.2.3
* Updated version number to 10.3.0-1.Matthew Harmsen2016-05-167-7/+19
|
* quick typo fixChristina Fu2016-05-161-3/+3
|
* Lightweight CAs: add missing authoritySerial attr to default schemaFraser Tweedale2016-05-141-1/+2
|
* Detect inability to submit ECC CSR on ChromeMatthew Harmsen2016-05-131-0/+11
| | | | - PKI TRAC Ticket #2306 - Chrome Can Not Submit EC Client Cert Requests
* Renamed pki-server ca-db-upgrade to db-upgrade.Endi S. Dewata2016-05-143-81/+133
| | | | | | | | | The pki-server ca-db-upgrade command has been renamed to db-upgrade to be more general. In the future the command can be refactored to handle additional upgrade scripts. Additional log messages have been added to show the upgrade activities in verbose mode. https://fedorahosted.org/pki/ticket/1667
* Add pki-server ca-db-upgrade commandFraser Tweedale2016-05-141-0/+81
| | | | | | | | | Add the 'ca-db-upgrade' command to 'pki-server'. This command updates certificate records to add the issuerName attribute where missing. If other database updates are needed in future, they can be added to this command. Part of: https://fedorahosted.org/pki/ticket/1667
* Fixed pki-server subsystem-cert-validate command.Endi S. Dewata2016-05-131-32/+83
| | | | | | | | | | | | | | | | | The system certificate validation command has been modified to check for both 'internal' and 'Internal Key Storage Token' since both are valid names for the internal token. Additional checks have been added to validate the certificate parameters in CS.cfg. The output of the command has been modified to be more consistent with other pki-server commands. The pki client-cert-validate invocation has been fixed to use -C option to specify the NSS database password in a file. https://fedorahosted.org/pki/ticket/2043
* Ticket #2303 Key recovery fails with KRA on lunaSAChristina Fu2016-05-131-1/+3
| | | | | | This patch requires JSS with the jss-lunasaUnwrap.patch to work properly on the lunaSA. It is also required for the lunaSA to be of the following model: CKE – Key Export Models
* Lightweight CAs: add issuer DN and serial to AuthorityDataFraser Tweedale2016-05-136-7/+53
| | | | | | | | Add issuer DN and serial number to the AuthorityData object, as read-only attributes. Values are displayed in the CLI, when present in the response data. Fixes: https://fedorahosted.org/pki/ticket/1618
* Added log messages for pre-op mode.Endi S. Dewata2016-05-1313-83/+126
| | | | | | | To help troubleshooting the code has been modified to log more detailed information in pre-op mode. https://fedorahosted.org/pki/ticket/1654
* Added warning message for token reuse.Endi S. Dewata2016-05-134-0/+37
| | | | | | | | The TPS UI has been modified to show a warning message about removing the certificates and keys from the token when marking it for reuse. https://fedorahosted.org/pki/ticket/2287
* Added token status UNFORMATTED.Endi S. Dewata2016-05-137-25/+46
| | | | | | | A new token status UNFORMATTED has been added for new tokens added via UI/CLI and for TERMINATED tokens that are to be reused. https://fedorahosted.org/pki/ticket/2287
* Renamed token status READY to FORMATTED.Endi S. Dewata2016-05-1310-37/+37
| | | | | | The token status READY has been renamed to FORMATTED for clarity. https://fedorahosted.org/pki/ticket/2288
* Reject cert request if resultant subject DN is invalidFraser Tweedale2016-05-132-10/+14
| | | | | | | | | An unparseable subject DN is ignored, causing NPE in subsequent processing becaues the subject DN was not set. Throw ERejectException if the subject DN is invalid, to ensure that a useful response can be returned to the requestor. Fixes: https://fedorahosted.org/pki/ticket/2317
* Added Chrome keygen warningMatthew Harmsen2016-05-121-4/+109
| | | | | - PKI TRAC Ticket #2323 - Firefox Warning appears in EE page launched from within Chrome
* TPS auth special characters fix.Jack Magne2016-05-121-6/+6
| | | | | | | | Ticket #1636. Smartcard token enroll/format fails when the ldap user has special characters in userid or password Tested with both esc and tpsclient. The problem was when using a real card because the client uri encodes the authentication creds and the server needs to decode them.
* Update default values of connectionTimeout to format smart cardsJack Magne2016-05-122-2/+4
| | | | | | | Ticket #1921 Trivial fix to add or up this connectionTimeout value to 80000 or 80 secs. Fix already tested informally in the field by QE.
* Enhance tkstool for capabilities and securityJack Magne2016-05-122-9/+13
| | | | | | | | | | | | | | The key is now generated with the flags needed to keep the data from being displayed with simple tools such as symkeyutil. As per cfu's instructions, I was able to test this with the nethsm only. I also was able to make the key des3 and everything works fine with the master key. This will help all the warnings we get about insecure des2 keys. If there is a problem with luna, we can file another ticket. Also there could be a built in tool for luna to generate keys such as is present on hsm.
* Fixed missing CSR extensions for external CA case.Endi S. Dewata2016-05-122-3/+70
| | | | | | | | The deployment tool has been modified to generate CSR with basic constraints and key usage extensions for the externally-signed CA signing certificate. https://fedorahosted.org/pki/ticket/2312
* Fixed error handling ConfigurationUtils.handleCertRequest().Endi S. Dewata2016-05-122-29/+36
| | | | | | | The ConfigurationUtils.handleCertRequest() has been modified to throw an exception on error during CSR generation instead of silently ignoring it. The method has also been renamed to generateCertRequest() for clarity.
* Fixed install-only message in external CA case.Endi S. Dewata2016-05-124-21/+12
| | | | | | | | | | | | | | | | | | Previously, in external CA case if pkispawn was executed with pki_skip_configuration=True, it would stop the execution before the step 1 was fully completed (i.e. generating CSR), but it would incorrectly show a message indicating the CSR has been generated. The code that displays the installation summary has been fixed to check for pki_skip_configuration first before checking for external CA case to ensure that it displays the appropriate message for each step. The code that generates the Tomcat instance systemd service link was moved into instance_layout.py to avoid redundant executions. The pkispawn and pkidestroy have also be modified to remove redundant log of deployment parameters in master dictionary.
* Fix existing ca setup to work with HSMAde Lee2016-05-122-2/+7
| | | | | | If the existing CA keys are in an HSM, the code fails to load the keys becauseit does not take into account the full nickname. This small fix addresses this bug.
* Ticket#1508 Missing token prefix for connectors in TPS Installation with HSMChristina Fu2016-05-111-4/+10
| | | | This patch adds the token prefix to connector nickName's when installed with HSM
* Include issuer DN in CertDataInfoFraser Tweedale2016-05-102-0/+17
| | | | | | | | Now that Dogtag can host multiple CAs in a single instance, indicate the issuer DN in the CertDataInfo structure that is returned for certificate searches. Fixes: https://fedorahosted.org/pki/ticket/2322
* Support certificate search by issuer DN.Fraser Tweedale2016-05-102-0/+21
| | | | | | | | Now that Dogtag can host multiple CAs in a single instance, add a certificate search parameter for limiting searches to a particular issuer. Fixes: https://fedorahosted.org/pki/ticket/2321
* Add migration script for realm changes in registry.cfgAde Lee2016-05-092-0/+84
| | | | Part of Ticket 2041
* Add authz realm check for cert enrollmentAde Lee2016-05-092-0/+14
| | | | Ticket 2041
* Fix error output when request is rejectedAde Lee2016-05-098-16/+72
| | | | | | | With this fix, error messages are returned to the user when a request is rejected - either in the UI or from the pki CLI. Trac Ticket 1247 (amongst others)
* Add realm to requests coming in from CAAde Lee2016-05-0910-58/+303
| | | | | | | | | | | | | | | | Requests to the KRA through the CA-KRA connector use the Enrollment Service. This has been modified to read and store any realm passed in. The realm can be added to the request by havibg the admin add a AuthzRealmDefault and AuthzRealmConstraint in a profile. At this point, all the constraint does is verify that the realm is one of a specified list of realms. More verification will be added in a subsequent patch. No attempt is made yet to allow users to specify the realm. This would need to be added as a ProfileInput. Part of Ticket 2041
* Added deployment parameters for number ranges.Endi S. Dewata2016-05-094-11/+21
| | | | | | | | | | | New deployment parameters have been added to customize the serial number range, request number range, and replica number range in CS.cfg during installation. The code that generates the CS.cfg has been moved closer to the code that generates the subsystem configuration folder. https://fedorahosted.org/pki/ticket/2278
* Simplified slot substitution.Endi S. Dewata2016-05-091-0/+54
| | | | | | | | | Previously a deployment parameter has to be added to pkislots.cfg before it can be used in copy_with_slot_substitution(). The method has been modified to support substitutions using the deployment parameters directly, which simplifies the development. https://fedorahosted.org/pki/ticket/2278
* Renamed CS.cfg.in to CS.cfg.Endi S. Dewata2016-05-0917-16/+6
| | | | | | | | The CS.cfg.in have been renamed to CS.cfg to clean up the CMake scripts and for consistency. This change does not affect the actual files shipped in the RPM packages. https://fedorahosted.org/pki/ticket/2278
generated by cgit (git 2.34.1) at 2025-10-01 01:49:34 +0000