summaryrefslogtreecommitdiffstats
path: root/base/common/src
Commit message (Collapse)AuthorAgeFilesLines
* Additional output attributes for cert-find.ticket-498Endi Sukma Dewata2013-02-062-7/+168
| | | | | | | | The cert-find command has been modified to include some additional attributes including certificate type and version, key algorithm name and length, validity dates, creation time and issuer. Ticket #498
* Fixed date format for cert-find parameters.Endi Sukma Dewata2013-02-061-6/+1
| | | | | | | | All date parameters for cert-find have been modified to use the YYYY-MM-DD date format. Date parsing code in FilterBuilder has been modified not to ignore parsing errors. Ticket #497
* Fixed getInstallToken() invocation.Endi Sukma Dewata2013-02-043-6/+8
| | | | | | | The configuration code has been modified to use the REST interface to get the installation token and ignore CA cert validation errors. Ticket #476
* Session-based nonces.Endi Sukma Dewata2013-02-0414-230/+215
| | | | | | | | | | | | | | | | | | | | | | | Previously nonces were stored in a global map which might not scale well due to some issues: 1. The map uses the nonces as map keys. There were possible nonce collisions which required special handling. 2. The collision handling code was not thread safe. There were possible race conditions during concurrent modifications. 3. The map was shared and size limited. If there were a lot of users using the system, valid nonces could get pruned. 4. The map maps the nonces to client certificates. This limits the possible authentication methods that can be supported. Now the code has been modified such that each user has a private map in the user's session to store the nonces. Additional locking has been implemented to protect against concurrent modifications. The map now uses the target of the operation as the map key, eliminating possible collisions and allowing the use of other authentication methods. Since this is a private map, it's not affected by the number of users using the system. Ticket #474
* Merged cert-request-review/approve commands.Endi Sukma Dewata2013-02-041-0/+24
| | | | | | | The cert-request-approve has been merged into cert-request-review to ensure that these operations are executed in the same session. Ticket #474
* Fixed CLI 'cert-find' clientAuth FQDN hostname issueMatthew Harmsen2013-01-252-10/+91
| | | | * TRAC Ticket #488 - Dogtag 10: Fix CLI 'cert-find' clientAuth issue
* Ticket 419 - REST interface for cert requestsAde Lee2013-01-221-0/+6
|
* https://fedorahosted.org/pki/ticket/362 RFE: CMC ECCChristina Fu2013-01-153-6/+95
|
* Added LDAP exception converter.Endi Sukma Dewata2013-01-152-3/+50
| | | | | | | A utility class has been added to convert LDAP exceptions into PKI exceptions. Ticket #191, #214
* Added nonce validation for certificate revocation.Endi Sukma Dewata2013-01-158-60/+157
| | | | | | | The certificate REST service has been modified to validate nonce when revoking a certificate. Ticket #213
* Resolved Trac Ticket 367 - pkidestroy does not remove connectorAde Lee2013-01-1511-88/+663
| | | | | | | | | | | * Added RESTful servlet to add/remove a KRA connector from the CA. * Modified ACL to allow KRA subsystem user to remove connector. * Modified connector code to allow the connector to be replaced without a server restart. * Added functionality to pki CLI to add/remove connector * Added code to pkidestroy to remove the connector (using both pki CLI and sslget) When the issues with pki connection are resolved, we will use that method instead. * Modified sslget to accept HTTP return codes != 200. In this case, we were returning 204 - which is perfectly legitimate.
* Bug 839426 - [RFE] ECC CRL support for OCSPChristina Fu2013-01-091-1/+23
|
* Increase root CA validity to 20 yearsAde Lee2013-01-072-2/+2
| | | | Trac Ticket #466
* Ticket 191 - Mapping HTTP Exception to their proper HTTP error codesAbhishek Koneru2013-01-0420-162/+333
|
* Remove server code from CertSearchRequestAde Lee2012-12-073-310/+334
| | | | Ticket #418
* Parameterizing RESTEasy paths.Endi Sukma Dewata2012-12-061-6/+3
| | | | | | | | | The paths to RESTEasy jar files have been modified such that it can be configured globally at build time using the spec file to support different distributions, and at deployment time using a system-wide configuration in /etc/pki/pki.conf. Ticket #422, #423.
* number verificationAndrew Wnuk2012-12-064-6/+30
| | | | | | This patch improves number verification. Bug 864397.
* Implemented ability to utilize an external CAMatthew Harmsen2012-12-061-12/+14
| | | | * TRAC Ticket #231 - Dogtag 10: Update PKI Deployment to handle external CA
* Common admin user: config servlet changesAde Lee2012-12-032-35/+78
| | | | As oer review, changed useCommonAdmin to importAdminCert
* Fixed issuedOn parameters for cert-find.Endi Sukma Dewata2012-11-301-2/+6
| | | | | | | | The CertSearchRequest has been modified to fix the infinite loop in getIssuedOnTo(). The CertFindCLI has been modified to accept dates with format YYYY-MM-DD instead of epoch time. Ticket #416
* Fix for improper crl retrieval from CA.Abhishek Koneru2012-11-211-21/+22
|
* Misc changes to get rhel 7 build to workAde Lee2012-11-211-0/+3
| | | | | | | 1. Modified cmake dependency 2. Corrected conditionals in spec file 3. Added paths for resteasy-base 4. Added paths to policy for resteasy-base
* Change cmake projects from Java to NONEAde Lee2012-11-201-1/+1
|
* Added ACLInterceptor.Endi Sukma Dewata2012-11-0818-240/+255
| | | | | | | | | Previously ACL checking was done in PKIRealm by matching the URL. This code has been replaced by ACLInterceptor which will intercept RESTEasy method invocations. This allows more precise mapping of REST methods to ACL entries in acl.ldif. Ticket #287
* Set paths for default instanceAde Lee2012-11-042-1/+33
| | | | | | | | | | | | | | With this patch, it will be possible to install a default instance simply by adding the passwords in the pkideployment.cfg. This file can then be used without additional alteration to add subsystems to the same instance, by re-running pkispawn against the config file. The patch makes sure that cert nicknames, database and baseDN , admin users and client db are unique per subsystem. An option is added to reuse the existing server cert generated by the first subsystem and copy the required data to all subsystems. Ticket 379, 385
* Fix for ticket 384 - Incorrect profiles path referencedAbhishek Koneru2012-10-291-17/+20
|
* Removal of version numbers from jar file namesMatthew Harmsen2012-10-291-59/+9
| | | | * TRAC Ticket #350 - Dogtag 10: Remove version numbers from PKI jar files . . .
* Enabled authentication for key services.Endi Sukma Dewata2012-10-2916-98/+597
| | | | | | | | The web.xml in KRA has been modified to enable the authentication for key and key request services. Some tools have been added to access the services via command-line. Ticket #376
* Fixed synchronization problem in CertificateRepository.Endi Sukma Dewata2012-10-292-69/+43
| | | | | | | | Some synchronized methods in CertificateRepository may block modifyCeritifcateRecord() too long, so they have been moved into CRLIssuingPoint and CertStatusUpdateThread. Ticket #313
* Refactored GetDomainXML servlet.Endi Sukma Dewata2012-10-261-119/+10
| | | | | | | The GetDomainXML servlet has been refactored to use the new SecurityDomainProcessor. Ticket #309
* Added REST interface to get domain info.Endi Sukma Dewata2012-10-2611-174/+750
| | | | | | | | The REST interface for security domain has been updated to provide a method to get the domain info. A CLI has been provided to access this method. Ticket #309
* Fixed error handling in RetrieveModificationsTask.Endi Sukma Dewata2012-10-231-47/+70
| | | | | | | | | | | | | The RetrieveModificationsTask has been modified such that it can recover from errors while still allowing graceful shutdown. The task is scheduled to run once. When it's done it will schecule another one depending on the situation. If the search is abandoned or the connection is closed it will wait one minute before reconnecting. If the system is being shutdown it will not schedule any more task. Ticket #365
* Fixed KRA test.Endi Sukma Dewata2012-10-225-7/+7
| | | | | The security configuration, JAXB mappings, and test script for KRA have been updated to run properly.
* Added REST account service.Endi Sukma Dewata2012-10-223-0/+141
| | | | | | | | | A REST account service has been added to allow client to login to establish a session and to logout to destroy the session. This way multiple operations can be executed using the same session without having to re-authenticate. Ticket #357
* Provide option to install, rather than replicate schema in a cloneAde Lee2012-10-224-4/+53
|
* Reorder VLV indexing for clones to avoid errorsAde Lee2012-10-223-12/+11
|
* Added PKIPrincipal.Endi Sukma Dewata2012-10-182-26/+60
| | | | | | | | | | | Previously in PKIRealm the authentication token was stored in a thread local variable. This does not work for multiple operations executed using the same session because each operation may be handled by different threads. A new PKIPrincipal has been added to store the authentication token so that the threads can get the correct token for the session. Ticket #357
* Added PKIConnection.Endi Sukma Dewata2012-10-189-307/+380
| | | | | | | | | The code in PKIClient has been refactored into PKIConnection such that a single connection object can be used by several REST clients. The PKIClient will remain the base class for all REST clients. Ticket #357
* Refactored GetCookie servlet.Endi Sukma Dewata2012-10-181-89/+43
| | | | | | | The GetCookie servlet has been refactored to use the new SecurityDomainProcessor. Ticket #309
* Enabled authentication for security domain REST interface.Endi Sukma Dewata2012-10-1811-155/+248
| | | | | | | | The REST interface for security domain has been refactored and configured such that it requires authentication. A CLI has been added to get an installation token. Ticket #309
* Reverted to old interface and httpclient to get installation token.Ade Lee2012-10-121-0/+22
| | | | | This is a workaround until we can get the new interface working on IPA clones.
* Return to d9 behavior for RetrieveModificationsTaskAde Lee2012-10-111-3/+3
|
* Using RPM version number in CMake.Endi Sukma Dewata2012-10-015-5/+10
| | | | | | | | | | | | The RPM spec files have been modified to pass the full RPM version number to CMake. The version number contains the product version number, release number, milestone, and platform. The CMake scritps will parse and use this version number to generate Java manifest files. The product version number will be used as the specification version and full version number will be used as the implementation version. Ticket #339
* Added version number into server status.Endi Sukma Dewata2012-09-281-0/+2
| | | | | | | The GetStatus servlet has been modified to include the server version number. Ticket #339
* Added VERSION file.Endi Sukma Dewata2012-09-286-0/+55
| | | | | | | | | | | The CMake scripts have been modified to store the version number in /usr/share/pki/VERSION and in JAR manifest files. These files can be read by PKI applications to obtain the version number without having to query the RPM database. Fixed warnings in Java.cmake file. Ticket #339
* fall back to old interface for installtoken if neededAde Lee2012-09-272-4/+87
|
* Renamed escapeDN() into escapeRDNValue().Endi Sukma Dewata2012-09-277-46/+46
| | | | | | | The escapeDN() has been renamed into escapeRDNValue() for better clarity. Ticket #193
* (fixed warning for) task #304 TMS ECC infrastructure (enrollment with ↵Christina Fu2012-09-261-2/+2
| | | | client-side and server-side key generation, and key archival)
* Use getStatus servlet to provide startup statusAde Lee2012-09-212-0/+8
| | | | Ticket 314
* Changes to use standard dbuserAde Lee2012-09-197-26/+111
| | | | | | | | | | | | | | | | | We create a user that can be used to connect to the database using the subsystem cert for client auth. We identified this user, using the seeAlso attribute and provided certmap rules to this effect. For this user, we used to reuse the uid = user CA-hostname-port, which is already created for inter-system communication. But this is problematic if more than one dbuser exists, as the directory server may bind as the incorrect user. In any replication topology, there must be only one dbuser using the subsystem cert. To simplify things, we create a new user specifically for this purpose (pkidbuser), and we remove the seeAlso attribute from the older dbusers. A script is needed to convert existing dogtag 9 istances to use the new user, and set the relevant acls. This will be done in a separate commit.
generated by cgit (git 2.34.1) at 2024-05-10 07:17:40 +0000