summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Improve 'authz manager not found' message stringFraser Tweedale2016-01-141-1/+1
|
* Fix escaping of password fields to prevent interpolationChristian Heimes2016-01-131-2/+6
| | | | | | | | | | Some password and pin fields are missing from the no_interpolation list. One entry is misspelled. A '%' in password field such as pki_clone_pkcs12_password causes an installation error. https://fedorahosted.org/pki/ticket/1703 Signed-off-by: Christian Heimes <cheimes@redhat.com>
* Fixed mismatching certificate validity calculation.Endi S. Dewata2016-01-082-14/+67
| | | | | | | | The CAValidityDefault has been modified to use Calendar API to calculate the certificate validity range to be consistent with the ValidityConstraint and ValidityDefault. https://fedorahosted.org/pki/ticket/1682
* Fixed external CA case for IPA compatibility.Endi S. Dewata2016-01-084-8/+40
| | | | | | | | | | | | | The installation code for external CA case has been fixed such that IPA can detect step 1 completion properly. The code that handles certificate data conversion has been fixed to reformat base-64 data for PEM output properly. The installation summary for step 1 has been updated to provide more accurate information. https://fedorahosted.org/pki/ticket/456
* Remove unused constantFraser Tweedale2015-12-221-3/+0
|
* sslget must set Host HTTP headerChristian Heimes2015-12-151-13/+10
| | | | | | | | | | | | | | | The sslget tool sends a TLS SNI header. Apache doesn't like server name indication without a matching HTTP header. Requests without a Host header are refused with HTTP/1.1 400 Bad Request Hostname example.org provided via SNI, but no hostname provided in HTTP request sslget now sets a Host HTTP header for all requests. https://fedorahosted.org/pki/ticket/1704 Signed-off-by: Christian Heimes <cheimes@redhat.com>
* Fixed selftest error handling.Endi S. Dewata2015-12-019-158/+161
| | | | | | | | The selftest has been modified to throw an exception and provide more specific error message if a test fails in order to help troubleshoot the problem. https://fedorahosted.org/pki/ticket/1328
* Avoid superfluous ConfigStore commit during profile creationFraser Tweedale2015-11-261-2/+1
| | | | Part of: https://fedorahosted.org/pki/ticket/1700
* Updated pki-cert and pki-server-subsystem man pages.Endi S. Dewata2015-11-252-8/+41
| | | | | | | The pki-cert and pki-server-subsystem man pages have been updated to include recent changes. https://fedorahosted.org/pki/ticket/456
* Added mechanism to import existing CA certificate.Endi S. Dewata2015-11-259-66/+557
| | | | | | | | | | | The deployment procedure for external CA has been modified such that it generates the CA CSR before starting the server. This allows the same procedure to be used to import CA certificate from an existing server. It also removes the requirement to keep the server running while waiting to get the CSR signed by an external CA. https://fedorahosted.org/pki/ticket/456
* Added CLI options to simplify submitting CSR.Endi S. Dewata2015-11-161-10/+136
| | | | | | | | | | The pki ca-cert-request-submit command has been modified to provide options to specify the profile name and the CSR which will be used to create and populate the request object. This way it's no longer necessary to download the request template and insert the CSR manually. https://fedorahosted.org/pki/ticket/456
* Added pki-server subsystem-cert-export command.Endi S. Dewata2015-11-143-0/+468
| | | | | | | | A new command has been added to export a system certificate, the CSR, and the key. This command can be used to migrate a system certificate into another instance. https://fedorahosted.org/pki/ticket/456
* Added automatic Tomcat migration.Endi S. Dewata2015-10-307-31/+64
| | | | | | | | | | | | | | | | | | | The pki-core.spec has been modified to execute pki-server migrate when the package is installed. This way when upgrading from F22 to F23 all PKI instances will be migrated automatically to Tomcat 8. The pki-server migrate command has been modified such that if there is no specific Tomcat version specified it will use the current Tomcat version. The top attribute in the CLI class was not functioning properly, so it has been replaced with get_top_module() method. The getopt() invocations in pki-server subcommands have been replaced with gnu_getopt() to allow intermixing options and arguments. https://fedorahosted.org/pki/ticket/1310
* Refactored LDAPSecurityDomainSessionTable.Endi S. Dewata2015-10-296-121/+134
| | | | | | | The LDAPSecurityDomainSessionTable has been modified to throw an exception if there is a failure. https://fedorahosted.org/pki/ticket/1633
* Ticket #1527 TPS connector always goes to "ca1"Christina Fu2015-10-272-25/+30
|
* Checking in under the one line trivial change rule.Matthew Harmsen2015-10-222-2/+2
|
* Replaced legacy HttpClient.Endi S. Dewata2015-10-225-310/+278
| | | | | | | | | | | | | The ConfigurationUtils and CertUtil have been modified to use PKIConnection which uses Apache HttpClient instead of the legacy custom HttpClient. The POST request content is now created using MultivaluedMap. The PKIConnection has been modified to provide a get() method to send an HTTP GET request. The post() method was modified to accept a path parameter. https://fedorahosted.org/pki/ticket/342
* Removed unused WizardServlet.Endi S. Dewata2015-10-2230-7472/+67
| | | | | | | | | | The unused configuration wizard servlet has been removed to simplify refactoring other codes. The remaining references in CertUtil and ConfigurationUtils have been removed as well. https://fedorahosted.org/pki/ticket/1120
* CRLIP: omit certs not issued by associated CAFraser Tweedale2015-10-211-4/+14
| | | | | | | | | | | | Lightweight CAs mean that a single database can include certificates from many issuers. Update CRLIssuingPoint to only include certificates issued by its associated CA. For backwards compatibility, if the associated CA is the host CA, certificate records with missing 'issuerName' attribute are also included. Fixes: https://fedorahosted.org/pki/ticket/1626
* Store issuer DN in certificate recordsFraser Tweedale2015-10-215-2/+21
| | | | | | | | Lightweight CAs mean that we may wish to filter certificates based on the issuer. Update X509CertImplMapper to store the issuer DN in each certificate record, using exiting schema. Also add indices for the 'issuerName' LDAP attribute.
* Ticket #1648 [RFE] provide separate cipher lists for CS instances acting as ↵Christina Fu2015-10-2011-20/+303
| | | | client and server This patch provides subsystem->subsystem cipher configuration when acting as a client
* Updated TPS UI element IDs.Endi S. Dewata2015-10-1519-44/+47
| | | | | | | | | | | | The TPS UI navigation elements have been updated to add the missing names and to use better names. The checkbox IDs in various pages have also been renamed for consistency. The pki-ui.js has been modified to use the checkbox ID of the template row instead of table name to construct the checkbox ID of the actual rows. https://fedorahosted.org/pki/ticket/1622
* Refactored SecurityDomainProcessor.Endi S. Dewata2015-10-133-45/+47
| | | | | | | | | | The SecurityDomainProcessor.getEnterpriseGroupName() has been added to simplify ConfigurationUtils.getGroupName(). The SecurityDomainProcessor.getInstallToken() has been modified to validate the user role and to generate safer session ID. https://fedorahosted.org/pki/ticket/1633
* Add delete_ca functionality to the Python APIAde Lee2015-10-062-2/+61
|
* Lightweight CAs: implement deletion API and CLIFraser Tweedale2015-10-0612-4/+236
| | | | | | | Implement lightweight authority deletion including CLI command. To be deleted an authority must be disabled and have no sub-CAs. Fixes: https://fedorahosted.org/pki/ticket/1324
* Add common profilesNiranjan Mallapadi2015-10-051-0/+115
| | | | Signed-off-by: Niranjan Mallapadi <mrniranjan@redhat.com>
* Added Java client and CLI support for Feature resource.Ade Lee2015-10-028-8/+284
|
* Fix compilation error in eclipse for caMapAde Lee2015-10-021-23/+23
|
* Fixed user search in PasswdUserDBAuthentication.Endi S. Dewata2015-10-023-73/+50
| | | | | | | | | The PasswdUserDBAuthentication.authenticate() has been modified such that it uses the UGSubsystem to find the user in the proper LDAP subtree to avoid matching other LDAP entries that contain a uid attribute. https://fedorahosted.org/pki/ticket/1580
* Added python-nss runtime dependencyMatthew Harmsen2015-10-021-1/+5
| | | | - PKI TRAC Ticket #1623 - Runtime dependency on python-nss is missing
* Ticket #1593 auto-shutdown - for HSM failover supportChristina Fu2015-10-0110-20/+220
| | | | | | | | | | | | | | | This is an interim solution for supporting HSM failover by automatically shutting down the server when signing key becomes inaccessible. At auto-shutdown, a crumb fiile will be left in the instance directory for an external daemon to detect and restart, if necessary. Due to limitation of the watch dog (nuxwdog) at present time, the restart option currently only works if started with watch dog (nuxwdog), and it will prompt for passwords on the terminals. The restart counter is to prevent the server from going into an infinite restart loop. Administrator will have to reset autoShutdown.restart.count to 0 when max is reached. (cherry picked from commit 5a9ecad9172f76ca1b94b40aedcdd49d009aceb1)
* Python packaging of PKI client libraryChristian Heimes2015-10-013-0/+110
| | | | | | | | | | | | | | | | | | | | | | A new setup.py in base/common/python makes it possible to bundle the pki client library and upload it on PyPI. The setup.py in the root directory is only used for tox and testing. It's a cleaner and less fragile approach than to support two different build flavors with one setup.py The 'release' alias from setup.cfg creates and uploads a source distribution and an universal wheel: $ sudo yum install python-wheel python-setuptools $ cd base/common/python $ python setup.py release The 'packages' alias just creates the source distribution and wheel: $ python setup.py packages The version number is taken from the Version and Release fields of pki-core.spec.
* Replace legacy Python base64 invocations with Py3-safe codeChristian Heimes2015-10-015-27/+62
| | | | | | | | | Replace deprecated decodestring() and encodestring() with b64decode() and b64encode(). Provice specialized encode_cert() / decode_cert() functions to handle base64 encoding and decoding for X.509 certs in JSON strings. In Python 3 the base64 function don't suppor ASCII text, just ASCII bytes.
* shared functions/classes created to setup DSNiranjan Mallapadi2015-10-0129-0/+1828
| | | | | | | | | created a library called pkilib containing functions to setup directory services. python/docs contain the pkilib api documentation Signed-off-by: Niranjan Mallapadi <mrniranjan@redhat.com>
* Add pytest tests and documentation.Niranjan Mallapadi2015-10-0116-0/+2048
| | | | | | | | | | | Currently only installation tests have been written. pytest/docs contain the documentation of how to use multihost plugin and documentation of shared functions used Signed-off-by: Niranjan Mallapadi <mrniranjan@redhat.com>
* Added default subject DN for pki client-cert-request.Endi S. Dewata2015-10-012-12/+29
| | | | | | | | The pki client-cert-request CLI has been modified to generate a default subject DN if it's not specified. The man page has been updated accordingly. https://fedorahosted.org/pki/ticket/1463
* Fixup for subcasAde Lee2015-09-301-3/+3
| | | | | | The attribute used in requests to specify the authority has changed from authority to issuer_id. This updates the python client accordingly.
* Added support for directory-authenticated profiles in CLI.Endi S. Dewata2015-09-302-30/+89
| | | | | | | | The pki cert-request-submit and client-cert-request CLIs have been modified to provide options to specify the username and password for directory-authenticated certificate enrollments. https://fedorahosted.org/pki/ticket/1463
* Refactored certificate processors.Endi S. Dewata2015-09-3010-52/+113
| | | | | | | | | | | | | The CertProcessor.setCredentialsIntoContext() and CAProcessor. authenticate() methods have been modified such that they can accept credentials provided via the AuthCredentials (for REST services) or via the HttpServletRequest (for legacy servlets). The CertEnrollmentRequest has been modified to inherit from ResourceMessage such that REST clients can provide the credentials via request attributes. https://fedorahosted.org/pki/ticket/1463
* Relocated legacy cert enrollment methods.Endi S. Dewata2015-09-304-52/+73
| | | | | | | | | The EnrollmentProcessor.processEnrollment() and RenewalProcessor. processRenewal() methods that take CMSRequest object have been moved into ProfileSubmitServlet because they are only used by the legacy servlet. https://fedorahosted.org/pki/ticket/1463
* Lightweight CAs: fix caMap synchronizationFraser Tweedale2015-09-301-8/+9
| | | | | | | | | Some access to caMap was not correctly synchronized, with authorities (of which there could be many) acquiring their own intrinsic lock rather than the shared caMap. Use 'Collections.synchronizedSortedMap' to fix this. As a bonus, locking is now more fine-grained.
* Fixup for CS.cfg for authority featureAde Lee2015-09-281-1/+1
| | | | Set enable -> enabled
* Fixup for python client for subcasAde Lee2015-09-271-7/+7
|
* Python client for subcasAde Lee2015-09-275-28/+650
| | | | | | Includes python code (and unit tests!) to list, get and create subCAs. Also fixed a couple of PEP 8 violations that crept in.
* Added Features REST API resourceAde Lee2015-09-276-0/+438
| | | | | | | | | This will help us track whether or not a server has a feature either offered or enabled. Ultimately, it could be used by an admin to enable or disable features. The Java client is not included in this commit. Will add in a subsequent commit.
* Lightweight CAs: REST cert request param to specify authorityFraser Tweedale2015-09-267-13/+111
| | | | | | | | Add the optional "ca" query parameter for REST cert request submission. Also update the ca-cert-request-submit CLI command with an option to provide an AuthorityID. Part of: https://fedorahosted.org/pki/ticket/1213
* Lightweight CAs: add ca-authority CLIFraser Tweedale2015-09-269-1/+459
| | | | | | Add CLI commands for creating, listing and showing lightweight CAs. Part of: https://fedorahosted.org/pki/ticket/1213
* Lightweight CAs: initial supportFraser Tweedale2015-09-2633-133/+1506
| | | | | | | | | | | | | This commit adds initial support for "lightweight CAs" - CAs that inhabit an existing CA instance and share the request queue and certificate database of the "top-level CA". We initially support only sub-CAs under the top-level CA - either direct sub-CAs or nested. The general design will support hosting unrelated CAs but creation or import of unrelated CAs is not yet implemented. Part of: https://fedorahosted.org/pki/ticket/1213
* KRA: key archival/recovery via cli - should honor encryption/decryption flags.Jack Magne2015-09-252-30/+138
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ticket # 1597 Currently, KRA allows sites to opt for doing encryption/decryption instead of wrapping/unwrapping for key archival and recovery. The new cli code was later added without such support. We should honor the same flags when cli is called to do key archival and recovery. This feature was due to a specific customer request. Here is what is now supported: 1. When the pki cli tool is used to recover a asymmetric private key, support is there to do so with encrypt / decrypt. 2. The passphrase and generic data facility already uses encrypt / decrypt so nothing here was needed. Calling it out since this will possibly be a customer issue. 3. While under the hood, it made sense to add this functionality to the Symmetric key archival and recovery operations. 4. All tests in DRMTest.java worked successfully when the kra was configured to support this feature and configured to not observe this feature. What is missing: We have since added a method to do a server side key generation of an asymmetric key pair in the kra and also archive it there at the same time. In order to do encrypt / decrypt in this case we need to extract the key contents out of a key object that is used to generate this key. It proved problematic to extract said key. This should be ok since the customer only needs to recover an asymmetric key in their test cases. We could look into doing this later if a pressing need arises.
* Added support for secure database connection in CLI.Endi S. Dewata2015-09-223-75/+200
| | | | | | | | | | The pki-server subsystem-cert-update has been modified to support secure database connection with client certificate authentication. The pki client-cert-show has been modified to provide an option to export client certificate's private key. https://fedorahosted.org/pki/ticket/1551
generated by cgit (git 2.34.1) at 2025-09-29 12:49:47 +0000