summaryrefslogtreecommitdiffstats
path: root/base/common/src/com/netscape/certsrv
Commit message (Collapse)AuthorAgeFilesLines
* Additional output attributes for cert-find.ticket-498Endi Sukma Dewata2013-02-061-0/+138
| | | | | | | | The cert-find command has been modified to include some additional attributes including certificate type and version, key algorithm name and length, validity dates, creation time and issuer. Ticket #498
* Fixed getInstallToken() invocation.Endi Sukma Dewata2013-02-042-5/+5
| | | | | | | The configuration code has been modified to use the REST interface to get the installation token and ignore CA cert validation errors. Ticket #476
* Session-based nonces.Endi Sukma Dewata2013-02-042-83/+37
| | | | | | | | | | | | | | | | | | | | | | | Previously nonces were stored in a global map which might not scale well due to some issues: 1. The map uses the nonces as map keys. There were possible nonce collisions which required special handling. 2. The collision handling code was not thread safe. There were possible race conditions during concurrent modifications. 3. The map was shared and size limited. If there were a lot of users using the system, valid nonces could get pruned. 4. The map maps the nonces to client certificates. This limits the possible authentication methods that can be supported. Now the code has been modified such that each user has a private map in the user's session to store the nonces. Additional locking has been implemented to protect against concurrent modifications. The map now uses the target of the operation as the map key, eliminating possible collisions and allowing the use of other authentication methods. Since this is a private map, it's not affected by the number of users using the system. Ticket #474
* Merged cert-request-review/approve commands.Endi Sukma Dewata2013-02-041-0/+24
| | | | | | | The cert-request-approve has been merged into cert-request-review to ensure that these operations are executed in the same session. Ticket #474
* Fixed CLI 'cert-find' clientAuth FQDN hostname issueMatthew Harmsen2013-01-252-10/+91
| | | | * TRAC Ticket #488 - Dogtag 10: Fix CLI 'cert-find' clientAuth issue
* Ticket 419 - REST interface for cert requestsAde Lee2013-01-221-0/+6
|
* Added LDAP exception converter.Endi Sukma Dewata2013-01-151-0/+46
| | | | | | | A utility class has been added to convert LDAP exceptions into PKI exceptions. Ticket #191, #214
* Added nonce validation for certificate revocation.Endi Sukma Dewata2013-01-154-0/+45
| | | | | | | The certificate REST service has been modified to validate nonce when revoking a certificate. Ticket #213
* Resolved Trac Ticket 367 - pkidestroy does not remove connectorAde Lee2013-01-155-0/+301
| | | | | | | | | | | * Added RESTful servlet to add/remove a KRA connector from the CA. * Modified ACL to allow KRA subsystem user to remove connector. * Modified connector code to allow the connector to be replaced without a server restart. * Added functionality to pki CLI to add/remove connector * Added code to pkidestroy to remove the connector (using both pki CLI and sslget) When the issues with pki connection are resolved, we will use that method instead. * Modified sslget to accept HTTP return codes != 200. In this case, we were returning 204 - which is perfectly legitimate.
* Ticket 191 - Mapping HTTP Exception to their proper HTTP error codesAbhishek Koneru2013-01-0410-27/+185
|
* Remove server code from CertSearchRequestAde Lee2012-12-071-308/+0
| | | | Ticket #418
* Common admin user: config servlet changesAde Lee2012-12-031-0/+28
| | | | As oer review, changed useCommonAdmin to importAdminCert
* Fixed issuedOn parameters for cert-find.Endi Sukma Dewata2012-11-301-2/+6
| | | | | | | | The CertSearchRequest has been modified to fix the infinite loop in getIssuedOnTo(). The CertFindCLI has been modified to accept dates with format YYYY-MM-DD instead of epoch time. Ticket #416
* Added ACLInterceptor.Endi Sukma Dewata2012-11-0814-11/+237
| | | | | | | | | Previously ACL checking was done in PKIRealm by matching the URL. This code has been replaced by ACLInterceptor which will intercept RESTEasy method invocations. This allows more precise mapping of REST methods to ACL entries in acl.ldif. Ticket #287
* Set paths for default instanceAde Lee2012-11-041-1/+14
| | | | | | | | | | | | | | With this patch, it will be possible to install a default instance simply by adding the passwords in the pkideployment.cfg. This file can then be used without additional alteration to add subsystems to the same instance, by re-running pkispawn against the config file. The patch makes sure that cert nicknames, database and baseDN , admin users and client db are unique per subsystem. An option is added to reuse the existing server cert generated by the first subsystem and copy the required data to all subsystems. Ticket 379, 385
* Enabled authentication for key services.Endi Sukma Dewata2012-10-2911-46/+556
| | | | | | | | The web.xml in KRA has been modified to enable the authentication for key and key request services. Some tools have been added to access the services via command-line. Ticket #376
* Fixed synchronization problem in CertificateRepository.Endi Sukma Dewata2012-10-291-12/+0
| | | | | | | | Some synchronized methods in CertificateRepository may block modifyCeritifcateRecord() too long, so they have been moved into CRLIssuingPoint and CertStatusUpdateThread. Ticket #313
* Added REST interface to get domain info.Endi Sukma Dewata2012-10-267-162/+456
| | | | | | | | The REST interface for security domain has been updated to provide a method to get the domain info. A CLI has been provided to access this method. Ticket #309
* Fixed KRA test.Endi Sukma Dewata2012-10-225-7/+7
| | | | | The security configuration, JAXB mappings, and test script for KRA have been updated to run properly.
* Added REST account service.Endi Sukma Dewata2012-10-222-0/+91
| | | | | | | | | A REST account service has been added to allow client to login to establish a session and to logout to destroy the session. This way multiple operations can be executed using the same session without having to re-authenticate. Ticket #357
* Provide option to install, rather than replicate schema in a cloneAde Lee2012-10-221-0/+14
|
* Added PKIConnection.Endi Sukma Dewata2012-10-188-299/+374
| | | | | | | | | The code in PKIClient has been refactored into PKIConnection such that a single connection object can be used by several REST clients. The PKIClient will remain the base class for all REST clients. Ticket #357
* Enabled authentication for security domain REST interface.Endi Sukma Dewata2012-10-186-112/+84
| | | | | | | | The REST interface for security domain has been refactored and configured such that it requires authentication. A CLI has been added to get an installation token. Ticket #309
* fall back to old interface for installtoken if neededAde Lee2012-09-271-1/+16
|
* Renamed escapeDN() into escapeRDNValue().Endi Sukma Dewata2012-09-271-3/+3
| | | | | | | The escapeDN() has been renamed into escapeRDNValue() for better clarity. Ticket #193
* Changes to use standard dbuserAde Lee2012-09-192-0/+10
| | | | | | | | | | | | | | | | | We create a user that can be used to connect to the database using the subsystem cert for client auth. We identified this user, using the seeAlso attribute and provided certmap rules to this effect. For this user, we used to reuse the uid = user CA-hostname-port, which is already created for inter-system communication. But this is problematic if more than one dbuser exists, as the directory server may bind as the incorrect user. In any replication topology, there must be only one dbuser using the subsystem cert. To simplify things, we create a new user specifically for this purpose (pkidbuser), and we remove the seeAlso attribute from the older dbusers. A script is needed to convert existing dogtag 9 istances to use the new user, and set the relevant acls. This will be done in a separate commit.
* Removed duplicate DN escaping methods.Endi Sukma Dewata2012-09-191-3/+3
| | | | | | | | The duplicate methods to escape DN value have been removed. The codes that used the duplicate methods have been modified to use LDAPUtil.escapeDN(). Ticket #193
* https://fedorahosted.org/pki/ticket/304Christina Fu2012-09-181-0/+2
| | | | TMS ECC infrastructure (enrollment with client-side and server-side key generation, and key archival)
* Various fixes to installation servlet and pki-deployAde Lee2012-09-121-0/+42
| | | | | | | Added logging so that we can see what is passed in to server from pkispawn. Fixed incorrect dbuser specification. Added required replication config items to pkispawn. Initial refactoring of construct_pki_configuration_data in pkijython.py
* Moved REST CLI into pki-tools.Endi Sukma Dewata2012-08-2910-1/+1113
| | | | | | | | | | The pki-client.jar has been split and merged into pki-certsrv.jar and pki-tools.jar. The REST client classes are now packaged in com.netscape.certsrv.<component> packages. The REST CLI classes are now packaged in com.netscape.cmstools.<component> packages. The "pki" script has been moved into pki-tools RPM package. Ticket #215
* Fixed REST common class dependency.Endi Sukma Dewata2012-08-151-17/+0
| | | | | | | | | The ConfigurationResponse previously has a method that uses a class that exists on the server only, creating a dependency issue since the ConfigurationResponse will be used by the client as well. The method now has been moved into a separate factory class. Ticket #259
* Reorganized REST common classes.Endi Sukma Dewata2012-08-1554-0/+6803
| | | | | | | The common classes used by REST client and services have been moved into the com.netscape.certsrv.<component> packages. Ticket #215
* Moved REST services into separate URLs.Endi Sukma Dewata2012-08-034-14/+14
| | | | | | | | | | | To support different access control configurations the REST services have been separated by roles. Services that don't need authentication will be available under /rest. Services that require agent rights will be available under /rest/agent. Services that require admin rights will be available under /rest/admin. Ticket #107
* Refactored PKI JNDI realm.Endi Sukma Dewata2012-07-313-0/+22
| | | | | | | | | The PKI JNDI realm has been modified to utilize the authentication and authorization subsystems in PKI engine directly. It's no longer necessary to define the LDAP connection settings in Tomcat's configuration files. Ticket #126
* Cert CLI - cert-request-review and cert-request-approve implementationsAbhishek Koneru2012-07-301-0/+1
|
* Merged changes in com.netscape.certsrv.common.Endi Sukma Dewata2012-07-187-3/+14
| | | | | | | | | | Due to packaging issue the source code in com.netscape.certsrv.common were duplicated into common and console packages and over time they have become out-of-sync. This patch merges the changes such that they are now identical. When the packaging issue is fixed later the duplicate copy can be removed. Ticket #113
* NO_HASHCODE_OVERRIDDENAbhishek Koneru2012-07-122-22/+34
|
* Added cert revocation REST service.Endi Sukma Dewata2012-07-115-15/+61
| | | | | | | The cert revocation REST service is based on DoRevoke and DoUnrevoke servlets. It provides an interface to manage certificate revocation. Ticket #161
* Refactored RequestStatus.Endi Sukma Dewata2012-07-102-62/+92
| | | | | | | | | The RequestStatus has been modified to use a map to convert string into RequestStatus instance. The string constants in RequestStatus are no longer needed because instances can be compared using equal sign directly or equals(). Ticket #161
* SE_BAD_FIELD, MIGHT_IGNORE , STATIC_INNER_CLASSAbhishek Koneru2012-07-104-4/+12
|
* Coverity CATCH_REXCEPTION and UNREAD_FIELD_CASESAbhishek Koneru2012-07-061-53/+49
|
* Adding restful interface to create certificate requests and issue certificates.Ade Lee2012-07-033-0/+45
| | | | | | | | | | Refactored ProfileSubmitServlet to make the flow clearer. Both the legacy servlets and the new RESTful servlets use common ProfileProcessor objects that contain the main business logic, so that the amount of duplicated code is minimized. Refactored ProfileProcessServlet to use the new common classes. Addressed review comments. Removed an unneeded class and reverted some unneeded jaxb annotations. Added factory methods.
* Fixes for Guarded_By_Violation issues shown in CoverityAbhishek Koneru2012-07-021-1/+3
|
* Fixes for Coverity Issues of type Null Returns - Part 3Abhishek Koneru2012-06-201-2/+4
|
* Fixes for Coverity issues of type Stringbuffer, NO_EQUALS_METHOD , ↵Abhishek Koneru2012-06-151-4/+4
| | | | REVERSE_INULL,Wrong_Map_Iterators
* Fixes for NULL_RETURNS Coverity Issues - Part 2Abhishek Koneru2012-06-142-37/+29
|
* Fixes for NULL_RETURN cases review commentsAbhishek Koneru2012-06-051-5/+1
|
* Fixes for Null_Returns Cases - 1 For CommitAbhishek Koneru2012-06-051-19/+11
|
* Fixes for Coverity Issues CALL_SUPER,UNCONFIRMEDCAST,DEAD_STORE,TOSTRING_ARRAYAbhishek Koneru2012-06-011-2/+2
|
* Added group REST service.Endi Sukma Dewata2012-05-318-0/+473
| | | | | | | The group REST service is based on UsrGrpAdminServlet. It provides an interface to manage groups and group members. Ticket #160
generated by cgit (git 2.34.1) at 2024-05-18 05:13:29 +0000