summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Added CLI to manage certs in PKCS #12 file.Endi S. Dewata2016-02-196-10/+368
| | | | | | | New CLIs have been added to add a certificate from NSS database and to remove a certificate from the PKCS #12 file. https://fedorahosted.org/pki/ticket/1742
* Refactored PKCS12Util to use PKCS12 object.Endi S. Dewata2016-02-1911-214/+308
| | | | | | | | | | | | The PKCS12Util has been modified such that it stores the certs and keys in PKCS12 object instead of PFX object. The PKCS12 object can be loaded either from NSS database or PKCS #12 file. The PKCS12 object can later be stored into NSS database or PKCS #12 file. The pki pkcs12-cert-find and pkcs12-key-find commands were modified to require PKCS #12 password. https://fedorahosted.org/pki/ticket/1742
* Refactored PKCS12CertInfo and PKCS12KeyInfo classes.Endi S. Dewata2016-02-197-35/+133
| | | | | | | | | | The PKCS12CertInfo and PKCS12KeyInfo classes have been moved out of PKCS12Util into separate classes. The createLocalKeyID() has been modified to return BigInteger instead of byte array. https://fedorahosted.org/pki/ticket/1742
* Modify dnsdomainname test in pkispawnAde Lee2016-02-173-3/+3
| | | | | | We do a check for the dnsdomainname, which fails in Openstack CI because this is not set. Instead of exiting, default to the hostname.
* Added PKCS #12 attribute to store certificate trust flags.Endi S. Dewata2016-02-176-52/+291
| | | | | | | | | A new PKCS #12 attribute has been defined to store NSS certificate trust flags in PKCS #12 file. The PKCS12Util has been modified to store the trust flags during export and reset the trust flags in NSS database during import. https://fedorahosted.org/pki/ticket/1742
* Added CLIs to import and export PKCS #12.Endi S. Dewata2016-02-175-0/+422
| | | | | | | | The pki pkcs12-import and pki pkcs12-export commands have been added to import and export PKCS #12 file into and from NSS database. https://fedorahosted.org/pki/ticket/1742
* Remove vestiges of NISAuth pluginFraser Tweedale2016-02-1612-533/+0
| | | | Fixes: https://fedorahosted.org/pki/ticket/1674
* Ticket #1007 TPS audit eventsChristina Fu2016-02-1520-122/+757
| | | | | | This patch implements the TPS operation auditing: TOKEN_APPLET_UPGRADE_SUCCESS,TOKEN_APPLET_UPGRADE_FAILURE,TOKEN_CERT_ENROLLMENT,TOKEN_CERT_RENEWAL,TOKEN_CERT_RETRIEVAL,TOKEN_KEY_RECOVERY,TOKEN_CERT_STATUS_CHANGE_REQUEST,TOKEN_OP_REQUEST,TOKEN_FORMAT_SUCCESS,TOKEN_FORMAT_FAILURE,TOKEN_KEY_CHANGEOVER,TOKEN_KEY_CHANGEOVER_FAILURE,TOKEN_PIN_RESET_SUCCESS,TOKEN_PIN_RESET_FAILURE,TOKEN_STATE_CHANGE,TOKEN_AUTH_SUCCESS,TOKEN_AUTH_FAILURE Administrative auditing (via REST interface) will be covered in a separate ticket
* Weaken PKIPrincipal to superclass in several placesFraser Tweedale2016-02-155-21/+33
| | | | | | | | | | In several places we are casting a `Principal' to `PKIPrincpal', when `GenericPrincpal' or even no cast will suffice. In upcoming external authentication support externally authenticated principals will not be instances of `PKIPrincipal', so weaken assumptions about type of the principal where possible. Part of: https://fedorahosted.org/pki/ticket/1359
* Use correct textual encoding for PKCS #7 objectsFraser Tweedale2016-02-156-43/+12
| | | | | | | | | | | PKCS #7 objects are being output with the "CERTIFICATE CHAIN" label which is invalid (RFC 7468) and unrecognised by many programs (including OpenSSL). Use the correct "PKCS7" label instead. Also do a drive-by refactor of the normalizeCertAndReq to remove some redundant code. Fixes: https://fedorahosted.org/pki/ticket/1699
* Remove execute permissions from systemd unit filesFraser Tweedale2016-02-151-4/+4
| | | | Fixes: https://fedorahosted.org/pki/ticket/1723
* Remove unused TOKEN_AUTHMGR_IMPL_NAME AuthToken attributeFraser Tweedale2016-02-151-19/+0
|
* Profile service: respond 409 on conflicting operationsFraser Tweedale2016-02-151-7/+8
| | | | | | | | The REST profile service current responds 400 on conflicting operations, indicating that the client sent a bad request when this not the case. Respond with 409 Conflict instead. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1257518
* Added CLIs to inspect PKCS #12 file.Endi S. Dewata2016-02-128-1/+599
| | | | | | | The pki pkcs12-cert-find and pki pkcs12-key-find commands have been added to list the certificates and keys in a PKCS #12 file. https://fedorahosted.org/pki/ticket/1742
* Refactored PKCS12Export.Endi S. Dewata2016-02-126-195/+273
| | | | | | | | | | | | | The code to export NSS database into PKCS #12 file in PKCS12Export tool has been refactored into PKCS12Util class to simplify further enhancements. The PKCS12Export tool has also been modified to use Java Logging API. A default logging configuration file has been added. The command-line wrapper has been modified to get the path to the logging configuration file from pki.conf. https://fedorahosted.org/pki/ticket/1742
* PKI TRAC Ticket #1850 - Rename DRMTool --> KRATool (spec file)Matthew Harmsen2016-02-111-3/+11
|
* PKI TRAC Ticket #1850 - Rename DRMTool --> KRAToolMatthew Harmsen2016-02-116-888/+888
|
* Fixed token change status operation.Endi S. Dewata2016-02-101-0/+8
| | | | | | | The TokenService has been modified to ignore token change status operation if the status is unchanged. https://fedorahosted.org/pki/ticket/1684
* Fixed token modify operation.Endi S. Dewata2016-02-083-61/+1
| | | | | | | The TPS UI and CLI have been modified to accept only user ID and policy attributes when modifying a token. https://fedorahosted.org/pki/ticket/1687
* Allow cert and key indexes > 9.Jack Magne2016-02-055-149/+380
| | | | | | | | | | | | | | | | | | | | | | | | | Ticket: Ticket #1734 : TPS issue with overflowing PKCS#11 cert index numbers This patch contains the following: 1. Fixes in TPS to allow the server to set and read muscle object ID's that are greater than 9. The id is stored as a single ASCII byte in the object id. Previous libcoolkey patches exist to now support numbers larger than 9, by the following: 0-9 is represented by the ascii chars for 0 through 9,. 10 - 35 represented by the ascii chars for 'A' through 'Z'. 36 - 61 represented by the ascii chars for 'a' through 'z'. Once coolkey is updated it will be able to read these id's. TPS with this patch will be able to both read number 0 - 62 and to set them when creating pkcs#11 objects to be stored on the token. When the proper libcoolkey is installed, the coolkey driver will be able to read certs and keys with id's > 9. Thus, for instance a cert with an id of C6, with keys of k12, and k13, will be supported and viewable in the Firefox cert viewer. Also the certs will be usable for operations. 2. A fix to the routine that finds a free id number to assign to a soon to be recovered cert will now have the ability to find unused slots instead of just inrementing one over the highest currently used index. 3. Made a couple of minor cleanup fixes to externalReg functionality discovered during testing of this feature.
* Added resource bundle for token state labels.Endi S. Dewata2016-02-059-39/+162
| | | | | | | | | | | | | | | The labels for token states and the transitions are now stored in token-states.properties. The default file will be stored in the /usr/share/pki/tps/conf, but it can be overriden by copying and customizing the file into <instance>/tps/conf. When the UI retrieves the token data the labels for the current state and the valid transitions will be loaded from the file and returned to the UI. The UI will show the transition labels in the dropdown list for changing token status. https://fedorahosted.org/pki/ticket/1289 https://fedorahosted.org/pki/ticket/1291
* Fixed token add operation.Endi S. Dewata2016-02-055-36/+65
| | | | | | | | The TPS UI and CLI have been modified to accept only token ID, and optionally user ID and policy attributes when adding a token. https://fedorahosted.org/pki/ticket/1477 https://fedorahosted.org/pki/ticket/1687
* Fixed LDAP error handling in TokenService.Endi S. Dewata2016-02-053-14/+71
| | | | | | | | | | The DBSSession has been modified to attach the LDAPException to the EDBException. The TokenService will catch the EDBException and obtain the orignal LDAPException. This way the TokenService can obtain the LDAP error code and throw the proper exception the client. https://fedorahosted.org/pki/ticket/1646
* Resolves: PKI TRAC Ticket #1714Matthew Harmsen2016-02-041-3/+5
| | | | | - PKI TRAC Ticket #1714 - mod_revocator and mod_nss dependency for tps should be removed
* Fixed error handling in TokenService.Endi S. Dewata2016-02-031-21/+52
| | | | | | | | | The TokenService has been modified to re-throw the original PKIException. This way on invalid token state transition the client will receive the original BadRequestException. Other types of exception will be wrapped with PKIException. https://fedorahosted.org/pki/ticket/1684
* Fixed TPS token state transitions.Endi S. Dewata2016-02-0312-70/+160
| | | | | | | | | | | | | | | | | | | | The TPS service has been modified to provide a list of allowed state transitions based on the current token state. The TPS UI was modified to display only the allowed state transitions when changing the token status. The allowed state transition list has been modified to remove invalid token transitions including: * UNINITIALIZED -> FOUND * UNINITIALIZED -> TEMP_LOST_PERM_LOST The token FOUND state has been renamed to ACTIVE for clarity. The token TEMP_LOST_PERM_LOST state has been merged into PERM_LOST since they are identical in the database. https://fedorahosted.org/pki/ticket/1289 https://fedorahosted.org/pki/ticket/1291 https://fedorahosted.org/pki/ticket/1684
* Fixed KRA installation.Endi S. Dewata2016-02-033-3/+3
| | | | | | | | | Due to a recent change the KRA installation failed because the installer was trying to read the pki_external_csr_path parameter which is not available for KRA installation. The installer has been fixed to read the parameter in external CA case only. https://fedorahosted.org/pki/ticket/456
* Fixed TPS UI logout error message.Endi S. Dewata2016-02-021-1/+1
| | | | | | | | The TPS UI has been modified such that if the browser does not support logout operation it will show a message asking the user to clear the Active Logins or close the browser. https://fedorahosted.org/pki/ticket/1344
* Fix flake8 / PEP 8 violationsChristian Heimes2016-01-2512-81/+62
| | | | https://fedorahosted.org/pki/ticket/1738
* Run flake8 and pylint --py3k tests during RPM buildChristian Heimes2016-01-252-1/+22
| | | | | | | pki-core.spec now ensures that Python code stays compatible with Python 3 and is nicely formatted, too. https://fedorahosted.org/pki/ticket/1738
* Renamed pki.nss into pki.nssdb.Endi S. Dewata2016-01-234-8/+8
| | | | | | | The pki.nss module has been renamed into pki.nssdb to prevent conflicts with the nss module. https://fedorahosted.org/pki/ticket/456
* Fixed installation summary for existing CA.Endi S. Dewata2016-01-233-10/+26
| | | | | | | The pkispawn has been modified to display the proper summary for external CA and existing CA cases. https://fedorahosted.org/pki/ticket/456
* Extract common base class for SSLAuthenticatorWithFallbackFraser Tweedale2016-01-215-253/+199
| | | | | | | | | Two Tomcat version-specific implementations of SSLAuthenticatorWithFallback exist, with much duplicate code. Extract an abstract base class 'AbstractPKIAuthenticator' and implement just the unique bits in the concrete classes. Part of: https://fedorahosted.org/pki/ticket/1359
* Allow encoded slashes in HTTP pathsFraser Tweedale2016-01-212-0/+39
| | | | | | | | | | | | | | Properly formed GET-based OCSP requests can contain URL-encoded slashes in the HTTP path[1] but our Tomcat configuration does not permit this (returns 400 Bad Request). Change catalina.properties to allow URL-encoded slashes in HTTP paths. [1] https://tools.ietf.org/html/rfc6960#appendix-A.1 Also add an upgrade script to update catalina.properties in existing instances. Fixes: https://fedorahosted.org/pki/ticket/1658
* Block startup until initial profile load completedFraser Tweedale2016-01-211-2/+35
| | | | | | | | | It is possible for the CMS getStatus resource to indicate that CMS is ready when the initial loading of profiles (which is performed by another thread) is not complete. During startup, wait for the initial loading of profiles to complete before continuing. Fixes: https://fedorahosted.org/pki/ticket/1702
* Ensure config store commits refresh file-based profile dataFraser Tweedale2016-01-211-1/+38
| | | | | | | | The file-based LDAP profile subsystem does not update profiles correctly. Ensure that each commit of the underlying config store refreshes the profile inputs, outputs and policy objects. Part of: https://fedorahosted.org/pki/ticket/1700
* Handle LDAPProfileSubsystem delete-then-recreate racesFraser Tweedale2016-01-211-20/+92
| | | | | | | | | | | | Deleting and then immediately recreating a profile can result in the new profile temporarily going missing, if the DELETE EntryChangeControl is processed after profile readdition. Handle this case by tracking the nsUniqueId of entries that are deleted by an LDAPProfileSubsystem and NOT (re-)forgetting the profile when the subsequent EntryChangeControl gets processed. Fixes: https://fedorahosted.org/pki/ticket/1700
* Remove obsolete catalina config filesFraser Tweedale2016-01-2110-1353/+0
|
* Ticket #1007 preparation work - replace auditMsg with logMsgChristina Fu2016-01-205-302/+302
| | | | | | | | For ticket #1007 TPS Audit Events, we need to add audit messages. The existing parameter name "auditMsg" has been used broadly for TPS logging, which could be confused for the actual audit messages. This patch is to replace all the existing "auditMsg" parameters with "logMsg" instead.
* Don't use settings like HTTP proxy from env vars during installationChristian Heimes2016-01-203-6/+16
| | | | | | | | | | | | | | | | | | The PKIConnection class uses python-requests for HTTPS. The library picks up several settings from environment variables, e.g. HTTP proxy server, certificate bundle with trust anchors and authentication. A proxy can interfere with the Dogtag installer and cause some operations to fail. With session.trust_env = False python-requests no longer inspects the environment and Dogtag has full controll over its connection settings. For backward compatibility reasons trust_env is only disabled during installation and removal of Dogtag. https://requests.readthedocs.org/en/latest/api/?highlight=trust_env#requests.Session.trust_env https://fedorahosted.org/pki/ticket/1733 https://fedorahosted.org/freeipa/ticket/5555
* Remove #!python shebang from non-executablesChristian Heimes2016-01-1941-46/+0
| | | | | | | | | A lot of Python files start with a #!/usr/bin/python shebang although the files are neither executables nor designed as scripts. Shebangs are only required for executable scripts. Without unnecessary shebangs it's a bit easier to track Python 3 porting.
* Avoid profile race conditions by tracking entryUSNFraser Tweedale2016-01-196-30/+119
| | | | | | | | | | | | | Avoid race conditions in the LDAPProfileSubsystem by tracking the most recently known entryUSN of profiles' LDAP entries. As part of this change, add the commitProfile method to the IProfileSubsystem interface, remove commit behaviour from the enableProfile and disableProfile methods and update ProfileService and ProfileApproveServlet to commit the profile (using the commitProfile method) where needed. Part of: https://fedorahosted.org/pki/ticket/1700
* Add LDAPPostReadControl classFraser Tweedale2016-01-191-0/+106
| | | | | | | | The LDAPPostReadControl can be used to read an entry after perfoming an add, modify or modrdn, giving atomic access to operational attributes. Part of: https://fedorahosted.org/pki/ticket/1700
* Extract LDAPControl search function to LDAPUtilFraser Tweedale2016-01-192-11/+22
|
* Make sure the ESC auth dialog displays the User Id field first.Jack Magne2016-01-181-10/+21
| | | | | | With the latest TPS the ESC auth dialog has displayed the password field before the UID field. This patch addresses this in the simplest fashion by modifying the class that presents the field data to the client to make sure that UID field is encountered first.
* Added interface to run selftest in TPS UI.Endi S. Dewata2016-01-184-18/+217
| | | | | | | The TPS UI has been modified to provide an interface to run the selftests and display the results. https://fedorahosted.org/pki/ticket/1502
* Updated CLI to run individual selftests.Endi S. Dewata2016-01-188-45/+353
| | | | | | | | | The pki selftest-run command has been modified to execute the specified selftests, or all selftests if nothing is specified. The command will also display the status of each test and the stack trace if it fails. https://fedorahosted.org/pki/ticket/1502
* Added table to manage TPS user profiles.Endi S. Dewata2016-01-185-106/+357
| | | | | | | | | | | The TPS UI has been modified to provide a table as an interface to manage the user profiles. When adding a profile, the profile can be selected from a list of available profiles. The UserService and UGSubsystem have been modified to allow adding a user with no assigned profiles. https://fedorahosted.org/pki/ticket/1478
* Fixed TPS UI to display accessible services only.Endi S. Dewata2016-01-183-8/+35
| | | | | | | | | | The TPS UI has been modified to display the accessible services based on the user's roles. A TPS admin has access to all services. A TPS agent has access to tokens, certificates, activities, and profiles. A TPS operator has access to tokens, certificates, and activities only. https://fedorahosted.org/pki/ticket/1476
* Ticket #1375 Provide cert/key retention for externalRegChristina Fu2016-01-154-61/+379
| | | | | | | | | | | | | | | | | | | | | Ticket #1514 TPS: Recovered certs on a token has status expired Ticket #1587 External Registration Recovery only works for 1024 sized keys out of the box This patch provides the cert/key retention feature for externalReg. If the certsToAdd field contains (serial,ca#) instead of the full (serial, ca#, keyId, kra#), then it is expecting the cert/keys to be retained from token without having to do a full retrieval (recovery); If an exisiting cert (and its keys) on the token is not explicitly retained then it is deleted. This patch also fixes the issues reported in #1514 and #1587 as testing of #1375 is easier with those two issues addressed. An issue was found during development where Coolkey puts limits on the cert/key ids on the token and make it impossible to inject cert ID higher than 4, as it would then result in key ids into two digits. Another issue that adds to running into the limit is that the function that gets the next free certid number does not make any attempt to search for "holes" to reuse. The cert/key id assignment/limit issue will be filed as a separte ticket and addressed separately. More complicated testing will be conducted then.
generated by cgit (git 2.34.1) at 2025-09-29 08:11:52 +0000