summaryrefslogtreecommitdiffstats
path: root/base/ca/src
Commit message (Collapse)AuthorAgeFilesLines
* Add script to enable USN pluginAde Lee2016-04-151-4/+9
| | | | | | | | | | | | | | New authority monitor code requires the USN plugin to be enabled in the database to ensure that the entryUSN attribute is added to authority entries. In the case where this plugin was disabled, accessing this attribute resulted in a null pointer exception whch prevented server startup. The code has been changed so as not to throw a null pointer exception on startup if the entryusn is not present, and also to call an LDIF to enable the plugin when a subsystem is configured through pkispawn.
* Lightweight CAs: indicate when CA does not yet have keysFraser Tweedale2016-04-143-10/+31
| | | | | | | | | | When a lightweight CA is created, clones will initialise a local object when the LDAP replication takes place, however, the signing keys will not yet have been replicated. Therefore, indicate CA readiness in authority data and respond appropriately (HTTP 503) when signing operations are attempted. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: set DN based on data from LDAPFraser Tweedale2016-04-141-2/+9
| | | | | | | | | | | | When initialising a lightweight CA, if we do not have the signing cert and key in the NSSDB yet, we do not initialise the DN. This causes NPE in other code that expects getX500Name() to return a value, e.g. REST API to list or show CA. To work around this, when loading lightweight CAs set the DN based on the 'authorityDN' value stored in its LDAP entry. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: monitor database for changesFraser Tweedale2016-04-141-87/+342
| | | | | | | | | | | Implement a thread that performs an LDAP persistent search to keep a running CA's view of lightweight CAs in sync with the database. Signing key replication is not yet supported; this will be implemented in a later patch and will not use the database to propagate keys. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: extract LDAP commit/delete methodsFraser Tweedale2016-04-141-96/+116
| | | | | | | | | LDAP code to add, modify and delete authority entries exists in multiple places. Extract these methods to remove this duplication and provide a cleaner basis for upcoming implementation of replication handling. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: move host authority creation out of load methodFraser Tweedale2016-04-141-17/+25
| | | | | | | | To reduce the amount of code that would be run in the persistent search thread, extract the host authority entry creation out of the 'loadLightweightCAs' method, into 'CertificateAuthority.init'. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: avoid repeat definition of authorities DNFraser Tweedale2016-04-141-12/+11
| | | | Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: use static db connection factoryFraser Tweedale2016-04-141-15/+10
| | | | | | | Use a static database connection factory that is initialised by the host authority and used by all CertificateAuthority instances. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: add exceptions for missing signing key or certFraser Tweedale2016-04-142-7/+29
| | | | | | | | | | Add the CAMissingCertException and CAMissingKeyException classes and throw when signing unit initialisation fails due to a missing object. In CertificateAuthority, store the exception if it occurs for possible re-throwing later. Also add the private 'hasKeys' field for internal use. Part of: https://fedorahosted.org/pki/ticket/1625
* Fixed exception handling in CertificateAuthority.Endi S. Dewata2016-04-122-44/+48
| | | | | | | | The CertificateAuthority.getCACert() has been modified to re-throw the exception instead of ignoring it. All callers have been modified to bubble up the exception. https://fedorahosted.org/pki/ticket/1654
* Remove unused variables from profile classesFraser Tweedale2016-03-221-12/+1
| | | | | Also drive-by refactor 'createProfileData' to use 'getProfile', reducing code size.
* Do not leak status of certs issued by other CAsFraser Tweedale2016-03-031-1/+18
| | | | | | If an OCSP request includes CertIDs for certificates issued by multiple CAs, return 'unknown' CertStatus for all certificates not issued by the "signing" CA.
* Lightweight CAs: lookup correct issuer for OCSP responsesFraser Tweedale2016-03-031-1/+38
|
* Ticket #1963 CRL generation enters loop when CA loses connection to netHSM.Christina Fu2016-03-021-0/+78
| | | | | | | | | | | | | | | | | | | | | | | | | This patch makes a low risk attempt to slow down the loop that could be caused by an unexpected exception caused by the unavailability of a dependant component (e.g. HSM, LDAP) in the middle of CRL generation/update. New configuration parameters are: ca.crl.MasterCRL.unexpectedExceptionWaitTime - the wait time in minutes; default is 30 - normally you want it to be less than ca.crl.MasterCRL.autoUpdateInterval and ca.crl.MasterCRL.cacheUpdateInterval ca.crl.MasterCRL.unexpectedExceptionLoopMax - the max number of tries allowed before the slow down mechanism kicks in; default is 10 When such unexpected failure happens, a loop counter is kept and checked against the unexpectedExceptionLoopMax. If the loop counter exceeds the unexpectedExceptionLoopMax, then the current time is checked against the time of the failure, where the time lapse must exceed the unexpectedExceptionWaitTime to trigger a delay. This delay is the counter measure to mitigate the amount of log messages that could flood the log(s). The delay is calcuated like this: waitTime = mUnexpectedExceptionWaitTime - (now - timeOfUnexpectedFailure);
* Lightweight CAs: add audit eventsFraser Tweedale2016-03-011-21/+51
| | | | | | Add audit events for lightweight CA administration. Fixes: https://fedorahosted.org/pki/ticket/1590
* Lightweight CAs: enrol cert via profile subsystemFraser Tweedale2016-02-222-10/+61
| | | | | | | | | | | | Enrol new CA certs via the profile subsystem to ensure that the usual audit events are logged and to avoid the nasty ConfigStore hack used to generate the cert via CertUtil. This commit also fixes an issue where the new CA certificate does not have the correct Authority Key Identifier extension. Fixes: https://fedorahosted.org/pki/ticket/1624 Fixes: https://fedorahosted.org/pki/ticket/1632
* Lightweight CAs: ensure disabled CA cannot create sub-CAsFraser Tweedale2016-02-222-1/+5
| | | | Fixes: https://fedorahosted.org/pki/ticket/1628
* Weaken PKIPrincipal to superclass in several placesFraser Tweedale2016-02-152-14/+22
| | | | | | | | | | In several places we are casting a `Principal' to `PKIPrincpal', when `GenericPrincpal' or even no cast will suffice. In upcoming external authentication support externally authenticated principals will not be instances of `PKIPrincipal', so weaken assumptions about type of the principal where possible. Part of: https://fedorahosted.org/pki/ticket/1359
* Profile service: respond 409 on conflicting operationsFraser Tweedale2016-02-151-7/+8
| | | | | | | | The REST profile service current responds 400 on conflicting operations, indicating that the client sent a bad request when this not the case. Respond with 409 Conflict instead. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1257518
* Avoid profile race conditions by tracking entryUSNFraser Tweedale2016-01-191-4/+8
| | | | | | | | | | | | | Avoid race conditions in the LDAPProfileSubsystem by tracking the most recently known entryUSN of profiles' LDAP entries. As part of this change, add the commitProfile method to the IProfileSubsystem interface, remove commit behaviour from the enableProfile and disableProfile methods and update ProfileService and ProfileApproveServlet to commit the profile (using the commitProfile method) where needed. Part of: https://fedorahosted.org/pki/ticket/1700
* Avoid superfluous ConfigStore commit during profile creationFraser Tweedale2015-11-261-2/+1
| | | | Part of: https://fedorahosted.org/pki/ticket/1700
* CRLIP: omit certs not issued by associated CAFraser Tweedale2015-10-211-4/+14
| | | | | | | | | | | | Lightweight CAs mean that a single database can include certificates from many issuers. Update CRLIssuingPoint to only include certificates issued by its associated CA. For backwards compatibility, if the associated CA is the host CA, certificate records with missing 'issuerName' attribute are also included. Fixes: https://fedorahosted.org/pki/ticket/1626
* Ticket #1648 [RFE] provide separate cipher lists for CS instances acting as ↵Christina Fu2015-10-201-2/+4
| | | | client and server This patch provides subsystem->subsystem cipher configuration when acting as a client
* Lightweight CAs: implement deletion API and CLIFraser Tweedale2015-10-062-4/+107
| | | | | | | Implement lightweight authority deletion including CLI command. To be deleted an authority must be disabled and have no sub-CAs. Fixes: https://fedorahosted.org/pki/ticket/1324
* Fix compilation error in eclipse for caMapAde Lee2015-10-021-23/+23
|
* Ticket #1593 auto-shutdown - for HSM failover supportChristina Fu2015-10-011-0/+13
| | | | | | | | | | | | | | | This is an interim solution for supporting HSM failover by automatically shutting down the server when signing key becomes inaccessible. At auto-shutdown, a crumb fiile will be left in the instance directory for an external daemon to detect and restart, if necessary. Due to limitation of the watch dog (nuxwdog) at present time, the restart option currently only works if started with watch dog (nuxwdog), and it will prompt for passwords on the terminals. The restart counter is to prevent the server from going into an infinite restart loop. Administrator will have to reset autoShutdown.restart.count to 0 when max is reached. (cherry picked from commit 5a9ecad9172f76ca1b94b40aedcdd49d009aceb1)
* Refactored certificate processors.Endi S. Dewata2015-09-301-0/+2
| | | | | | | | | | | | | The CertProcessor.setCredentialsIntoContext() and CAProcessor. authenticate() methods have been modified such that they can accept credentials provided via the AuthCredentials (for REST services) or via the HttpServletRequest (for legacy servlets). The CertEnrollmentRequest has been modified to inherit from ResourceMessage such that REST clients can provide the credentials via request attributes. https://fedorahosted.org/pki/ticket/1463
* Lightweight CAs: fix caMap synchronizationFraser Tweedale2015-09-301-8/+9
| | | | | | | | | Some access to caMap was not correctly synchronized, with authorities (of which there could be many) acquiring their own intrinsic lock rather than the shared caMap. Use 'Collections.synchronizedSortedMap' to fix this. As a bonus, locking is now more fine-grained.
* Added Features REST API resourceAde Lee2015-09-271-0/+4
| | | | | | | | | This will help us track whether or not a server has a feature either offered or enabled. Ultimately, it could be used by an admin to enable or disable features. The Java client is not included in this commit. Will add in a subsequent commit.
* Lightweight CAs: REST cert request param to specify authorityFraser Tweedale2015-09-261-3/+38
| | | | | | | | Add the optional "ca" query parameter for REST cert request submission. Also update the ca-cert-request-submit CLI command with an option to provide an AuthorityID. Part of: https://fedorahosted.org/pki/ticket/1213
* Lightweight CAs: initial supportFraser Tweedale2015-09-266-99/+946
| | | | | | | | | | | | | This commit adds initial support for "lightweight CAs" - CAs that inhabit an existing CA instance and share the request queue and certificate database of the "top-level CA". We initially support only sub-CAs under the top-level CA - either direct sub-CAs or nested. The general design will support hosting unrelated CAs but creation or import of unrelated CAs is not yet implemented. Part of: https://fedorahosted.org/pki/ticket/1213
* remove obsolete code from CertificateAuthority classFraser Tweedale2015-08-251-11/+0
|
* Separate range and cert status threadsAde Lee2015-08-121-0/+5
| | | | | | | | | | | | | | We currently disable the cert status maintenance thread on clone CAs because CRL processing should only be done on the master CA. Currently, the maintenance thread also performs other checks on serial number ranges and settings. By disabling the maintenance thread, we disable these checks too. To fix this, we have separated the serial number checks into a different maintenance thread, so that these tasks will occur even if the cert status thread is disabled. Bugzilla # 1251606
* Fixed missing cert request hostname and address.Endi S. Dewata2015-08-051-10/+5
| | | | | | | | | | | | The CA services have been modified to inject request hostname and address into the certificate request object such that they will be stored in the database. This fixes the problem with requests submitted either via the UI or the CLI. An unused method in CertRequestResource has been removed. Some debug messages have been cleaned as well. https://fedorahosted.org/pki/ticket/1535
* Removed audit CLI from non-TPS subsystems.Endi S. Dewata2015-07-171-4/+0
| | | | | | | | | | Due to database upgrade issue the pki <subsystem>-audit CLI has been removed from all subsystems except TPS. The AuditModifyCLI has been modified to clarify that the --action and the --input parameters are mutually exclusive. https://fedorahosted.org/pki/ticket/1437
* Fixed cert-find performance.Endi S. Dewata2015-07-151-20/+18
| | | | | | | | The CertService.searchCerts() has been modified to use the VLV properly to retrieve just the entries in the requested page, thus reducing the response time and memory requirement. Some classes have been modified to clean up the debugging logs.
* Fixed default cert-find filter.Endi S. Dewata2015-07-061-8/+8
| | | | | | | | To improve the performance the default LDAP filter generated by cert-find has been changed to (certStatus=*) to match an existing VLV index. https://fedorahosted.org/pki/ticket/1449
* Verify raw profile config before accepting itFraser Tweedale2015-07-061-1/+42
| | | | | | | | | | | | Creating or modifying a profile with bad profile data in the "raw" format succeeds and saves the bad data. After restart, the profile cannot be loaded and attempting to use, modify or delete or recreate the profile will fail. Verify raw profile data by instantiating a temporary profile and attempting to initialise it with the received configuration. Fixes: https://fedorahosted.org/pki/ticket/1462
* Fixed fail-over in HttpConnection.Endi S. Dewata2015-07-021-3/+2
| | | | | | | | | | | The HttpConnection class has been modified to support fail-over and timeout more consistently. The targets are parsed into a list during initialization. All direct calls to HttpClient.connect() are replaced with a method that will connect to the first available target. All connections are now created with a timeout (which by default is 0). https://fedorahosted.org/pki/ticket/891
* Ability to toggle profile usablity in Web vs CLI tools.Jack Magne2015-07-011-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Ticket #1442. This fix gives the command line enrollment commands the ability to enroll a cert against a profile that has been marked as not visible but "enabled". With the simple fix the following scenarios tested to work: The "caUserCert" Profile was marked as not visible, but enabled. 1. pki -c Secret123 client-cert-request --profile caUserCert uid=jmagne This is the simplest form of user cert enrollment. 2. pki ca-cert-request-profile-show caUserCert --output testuser.xml pki ca-cert-request-submit testuser.xml The first command gives us the profile's xml file, which after modification is used to enroll. 3. pki -d ~/.dogtag/pki -c "" -n "PKI Administrator for localdomain" ca-profile-show caUserCert This one shows that we can view the contents of a non visible profile. Listing is not allowed. We felt this appropiate to allow a command line user to get the details of a non visible profile that they know aobut and want to use.
* Fixed thread leaks during shutdown.Endi S. Dewata2015-06-181-1/+1
| | | | | | | | Various codes have been modified to properly stop threads during shutdown. A new ID attribute has been added to the LDAP connection factory classes to help identify leaking threads. https://fedorahosted.org/pki/ticket/1327
* NPE when modifying profile without 'action' paramChristian Heimes2015-06-161-0/+5
| | | | | | | In modifyProfileState check the 'action' query paramter for NULL and raise a BadRequestException when the paramater is not set. https://fedorahosted.org/pki/ticket/1361
* Use SimpleProperties to handle raw profile formatFraser Tweedale2015-05-221-2/+21
| | | | | | | | The store() method of the 'Properties' class escapes '=' and ':' in values, corrupting the profile data. Continue using 'Properties' to read the input (unescaping values) then copy the properties into a 'SimpleProperties' object so that unwanted backslashes do not appear in the output.
* Ticket #572 - CRL scheduler adds extra CRL generation at midnight for daily ↵Jack Magne2015-05-061-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | schedules. Addresses the complaint of this ticket. Tested to work in a few basic cases. The minor code change was designed to only affect the specific scenario when we have a daily scedule that spans only one day. More Info: How to duplicate and test: Perform a manual crl generate from the agent interface because the code to be tested relies heavily upon the "lastUpdate" which will appear in the logs. Do this to have a nice launching off point. Go to the ca's pkiconsole and select : Certificate Manager -> CRL Issuing Points -> MasterCRL. Check "updateCRL at: " and give a schedule such as : 15:03, 15:10 .. This gives us a chance to watch the two regularly scheduled updates happen. When the first event triggers, have a look at the CA's "debug" log and note the following or similar entry: [CRLIssuingPoint-MasterCRL]: findNextUpdate: Wed May 06 15:10:00 PDT 2015 delay: 86301873 Wait for the 15:00 even to happen. When that triggers at the end of that cycle, we should see one more similar entry. [CRLIssuingPoint-MasterCRL]: findNextUpdate: Wed May 06 15:03 PDT 2015 delay: 86301873 That is the correct behavior after the fix. We want the next update to be at the first entry of the daily schedule , but tomorrow. The current bug would print out this value as something like: Wed May 06 00:00:00 or similar to indicate midnight. This is not what we want.
* Fixed authentication data in audit log.Endi S. Dewata2015-05-051-1/+3
| | | | | | | | | | | The REST methods may be executed by different threads even though they are invoked in the same session. A new interceptor has been added to all subsystems to make sure the SessionContext is created properly for each thread. This will fix the authentication data in the audit log. The SessionContext has also been improved to use ThreadLocal instead of a global Hashtable. https://fedorahosted.org/pki/ticket/1054
* OCSP and CA minor cloning fixesJack Magne2015-05-011-18/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Tickets #1294, #1058 The patch does the following: 1. Allows an OCSP clone to actually install and operate. It also sets a param appropriate for an OCSP clone. Ticket #1058 The controversial part of this one is the fact that I have disabled having OCSP clones register themselves to the CA as publishing target. The master is already getting the updates and we rely upon replication to keep the clones updated. The current downside is the master is on an island with respect to updates and could be considered a single point of failure. Thus my proposal for this simple patch is to get the OCSP clone working as in existing functionality. Then we come back and propose a ticket to allow the installer OCSP clones to set up the publishers in such a way that all clones and master are registered, but when it is actually time to publish, the CRL publisher has the smarts to know that members of a clone cluster are in a group and the first successfull publish should end the processing of that group. 2. Allows the CA clone to set some params to disable certain things that a clone should not do. This was listed as a set of misc post install tasks that we are trying to automate. Code tested to work. 1. OCSP clones can be installed and the CRL were checked to be in sync when an update occured to the master. 2. The CA clone has been seen to have the required params and it looks to come up just fine. Final review minor changes to tickets, 1294, and 1058.
* Update pki-profile CLI commands to work with "raw" formatFraser Tweedale2015-04-071-22/+158
| | | | | | | | Update CLI commands for working with the (now LDAP-based) profiles in the same format as was used by the files, by way of the --raw option. Also add the "edit" command to interactively edit a profile.
* Import profiles when spawning CA instanceFraser Tweedale2015-04-071-0/+116
|
* Add LDAPProfileSubsystem to store profiles in LDAPFraser Tweedale2015-04-071-12/+4
| | | | | | | | | | | | Add the LDAPProfileSubsystem as another IProfileSubsystem implementation that can be used instead of ProfileSubsystem (which stores profiles on the file system) to store files in LDAP so that changes can be replicated. Extract common behaviour in to new AbstractProfileSubsystem superclass. Also address the minor issue #1220.
* Added rangeUnit property to certificate profiles.Endi S. Dewata2014-12-151-2/+3
| | | | | | | | | A new optional property has been added to certificate profiles to specify the range unit. The default range unit is 'day'. The code has been modified to use the Calendar API to calculate the end of validity range based on the range unit. https://fedorahosted.org/pki/ticket/1226
generated by cgit (git 2.34.1) at 2024-09-25 10:44:45 +0000