summaryrefslogtreecommitdiffstats
path: root/base/common
Commit message (Collapse)AuthorAgeFilesLines
...
* Added log message in PKIClient.Endi S. Dewata2016-07-301-1/+10
| | | | | | | To help troubleshooting the PKIClient class has been modified to log the certificate chain retrieved from the CA. https://fedorahosted.org/pki/ticket/2399
* Re-license the python client files to LGPLv3Ade Lee2016-07-2920-110/+314
|
* Added upgrade scripts to fix server library.Endi S. Dewata2016-07-282-0/+8
| | | | | | | | An upgrade script has been added to replace the <instance>/common in existing instances with a link to /usr/share/pki/server/common which contains links to server dependencies. https://fedorahosted.org/pki/ticket/2403
* Make starting CRL Number configurable.Jack Magne2016-07-271-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | Ticket #2406 Make starting CRL Number configurable This simple patch provides a pkispawn config param that passes some starting crl number value to the config process. Here is a sample: [CA] pki_ca_starting_crl_number=4000 After the CA comes up the value of "crlNumber" in the db will reflect that value of 4000. Currently no other values are changed. We can talk about if we need more values reset in the given case. Also, this creates a setting in the CS.cfg ca.crl.MasterCrl.startingCrlNumber=4000 This setting is only consulted when the crl Issuing Point record is created for the first time.
* Removed hard-coded paths in pki CLI.Endi S. Dewata2016-07-262-0/+48
| | | | | | | | | | The pki CLI has been modified to use java.ext.dirs property to load the dependencies instead of listing them individually. The dependencies are stored as links in /usr/share/pki/lib folder. This allows the RPM spec to customize the links for different platforms. https://fedorahosted.org/pki/ticket/2403
* Fixed pki pkcs12-import output.Endi S. Dewata2016-07-071-1/+4
| | | | | | | | The pki pkcs12-import has been modified to suppress the output of external command execution and display a completion message more consistently. https://fedorahosted.org/pki/ticket/2399
* Fixed problem with pki pkcs12-import --no-trust-flags.Endi S. Dewata2016-07-071-3/+0
| | | | | | | | The pki pkcs12-import CLI has been fixed such that when it calls pki pkcs12-cert-find internally it does not add --no-trust-flags option. https://fedorahosted.org/pki/ticket/2399
* Fixed exception chain in SigningUnit.init().Endi S. Dewata2016-07-062-0/+6
| | | | | | | The SigningUnit.init() has been modified to chain the exceptions to help troubleshooting. https://fedorahosted.org/pki/ticket/2399
* Separated TPS does not automatically receive shared secret from remote TKS.Jack Magne2016-07-011-7/+14
| | | | | | | | | | | | | | | | | | | | | Support to allow the TPS to do the following: 1. Request that the TKS creates a shared secret with the proper ID, pointing to the TPS. 2. Have the TKS securely return the shared secret back to the TPS during the end of configuration. 3. The TPS then imports the wrapped shared secret into it's own internal NSS db permanenty and. 4. Given a name that is mapped to the TPS's id string. Additional fixes: 1. The TKS was modified to actually be able to use multiple shared secrets registered by multiple TPS instances. Caveat: At this point if the same remote TPS instance is created over and over again, the TPS's user in the TKS will accumulate "userCert" attributes, making the exportation of teh shared secret not functional. At this point we need to assume that the TPS user has ONE "userCert" registered at this time.
* Fix build on Fedora 25Fraser Tweedale2016-07-011-7/+0
| | | | | | | | Look for the right JAX-RS API JAR (it has moved in Fedora 25). Also remove a lot of redundant 'find_file' operations for this JAR. Fixes: https://fedorahosted.org/pki/ticket/2373
* Fixed KRA cloning issue.Endi S. Dewata2016-06-292-6/+35
| | | | | | | | | | | | | The pki pkcs12-import CLI has been modified not to import certificates that already exist in the NSS database unless specifically requested with the --overwrite parameter. This will avoid changing the trust flags of the CA signing certificate during KRA cloning. The some other classes have been modified to provide better debugging information. https://fedorahosted.org/pki/ticket/2374
* Added upgrade script to fix JAVA_HOME.Endi S. Dewata2016-06-173-0/+12
| | | | https://fedorahosted.org/pki/ticket/2363
* Fixed Java dependency.Endi S. Dewata2016-06-171-0/+3
| | | | | | | | | | The code has been modified to use the JAVA_HOME path specified in the pki.conf. The spec file has been modified to depend specifically on OpenJDK 1.8.0 and to provide the default JAVA_HOME path for the pki.conf. https://fedorahosted.org/pki/ticket/2363
* Ticket #2298 exclude some ldap record attributes with key archival This is ↵Christina Fu2016-06-162-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | part 2 of: https://fedorahosted.org/pki/ticket/2298 [non-TMS] for key archival/recovery, not to record certain data in ldap and logs This patch allows one to exclude certain ldap attributes from the enrollment records for crmf requests (both CRMF, and CMC CRMF). The following are the highlights: * CRMF Manual approval profile is disabled: caDualCert.cfg - If excludedLdapAttrs.enabled is true, then this profile will not work, as the crmf requests (by default it is false) are not written to ldap record for agents to act on * excludedLdapAttrs.attrs can be used to configure the attribute list to be excluded * a new CRMF "auto approval" (directory based, needs to be setup) is provided * if excludedLdapAttrs.enabled is true (in both ca and kra), the following fields are not written to the ldap record in case of CRMF: (note: the code deliberately use literal strings on purpose for the reason that the exact literal strings need to be spelled out in excludedLdapAttrs.attrs if the admin chooses to override the default) "req_x509info", "publickey", "req_extensions", "cert_request", "req_archive_options", "req_key" * Because of the above (possible exclusion of cert requests in record, profiles that require agent manual approval will no longer function in the case that excludedLdapAttrs.enabled is true * a sleepOneMinute() method is added for debugging purpose. It is not called in the final code, but is left there for future debugging purpose * code was fixed so that in KRA request will display subject name even though the x509info is missing from request * cmc requests did not have request type in records, so they had to be added for differentiation The following have been tested: * CRMF auto enroll * CRMF manual enroll/approval * CMC-CRMF enroll * both CA and KRA internal ldap are examined for correct data exclusion Note: CRMF could potentially not include key archival option, however, I am not going to differentiate them at the moment. An earlier prototype I had built attempted to do that and the signing cert's record isn't excluded for attrs write while it's CRMF request is the same as that of its encryption cert counterpart within the same request. Due to this factor (multiple cert reqs with the same request blob), I am treating them the same for exclusion.
* Fixed problem with headerless PKCS #7 data.Endi S. Dewata2016-06-141-0/+7
| | | | | | Due to a recently added validation code, the headerless PKCS #7 data generated by IPA needs to be joined into a single line before storing it in CS.cfg.
* Add man page and clarify CLI for kra-connectorAde Lee2016-06-132-6/+7
|
* Fixed TPS VLV sort orders.Endi S. Dewata2016-06-101-2/+17
| | | | | | | | | | | | | | | The TPS VLVs for tokens and activities has been modified to sort the results by date in reverse order. The DBRegistry.getLDAPAttributes() was modified to support reverse sort order by recognizing the "-" prefix in the list of sort keys and pass it to LDAP. The DBVirtualList.setSortKey() was modified to ignore bubble up the exceptions that happen during LDAP attribute mapping. https://fedorahosted.org/pki/ticket/2263 https://fedorahosted.org/pki/ticket/2269
* Added TPS VLV management CLI.Endi S. Dewata2016-06-081-0/+12
| | | | | | | | | A set of pki-server commands has been added to simplify upgrading TPS VLV indexes. https://fedorahosted.org/pki/ticket/2354 https://fedorahosted.org/pki/ticket/2263 https://fedorahosted.org/pki/ticket/2269
* Lightweight CAs: add method to renew certificateFraser Tweedale2016-06-052-0/+13
| | | | | | | | | | | | | | | Add the CertificateAuthority.renewAuthority() method that creates and processes a renewal request for the lightweight CA's signing cert. The new certificate replaces the old certificate in the NSSDB and the serial number is stored in the 'authoritySerial' attribute. Clones observe when the 'authoritySerial' attribute has changed and update the certificate in their NSSDB, too. The renewal behaviour is available in the REST API as a POST to /ca/rest/authorities/<id>/renew. Fixes: https://fedorahosted.org/pki/ticket/2327
* Ticket #2271 Part2:TMS:removing/reducing debug log printout of dataChristina Fu2016-06-023-5/+31
| | | | | | | This patch comments out unneeded data in TMS debug logs (TPS&TKS); It reduces the size of the debug logs by a lot. Note that for ease of later development debugging, the debug lines are commented out instead of being removed
* Fix legacy servlets to check realm when requesting recoveryAde Lee2016-06-021-3/+5
|
* Fixed problem submitting renewal request.Endi S. Dewata2016-06-021-5/+9
| | | | | | | | | | | The RenewalProcessor.processRenewal() has been modified to get the serial number of the certificate to renew from the profile input in addition to the <SerialNumber> attribute and client certificate. The serialNum field in CertEnrollmentRequest has been modified to use CertId which accepts both decimal and hexadecimal value. https://fedorahosted.org/pki/ticket/999
* Ticket 1665 - Cert Revocation Reasons not being updated when on-holdChristina Fu2016-05-252-0/+8
| | | | | | | | | | | | | | This patch fixes the following areas: * In the CA, when revokeCert is called, make it possible to move from on_hold to revoke. * In the servlet that handles TPS revoke (DoRevokeTPS), make sure it allows the on_hold cert to be put in the bucket to be revoked. * there are a few minor fixes such as typos and one have to do with the populate method in SubjectDNInput.java needs better handling of subject in case it's null. Note: This patch does not make attempt to allow agents to revoke certs that are on_hold from agent interface. The search filter needs to be modified to allow that.
* Fixed support for generic CSR extensions.Endi S. Dewata2016-05-251-1/+26
| | | | | | | | The deployment tool has been modified to support adding Subordinate CA extension into the CSR for Microsoft CA, and also adding generic extensions to any system certificate. https://fedorahosted.org/pki/ticket/2312
* Add revocation information to pki CLI output.Ade Lee2016-05-242-0/+69
| | | | | | | The date on which the certificate is revoked and the agent that revoked it is displayed now in cert-find and cert-show output. Ticket 1055
* Add parameters to disable cert or crl publishingAde Lee2016-05-243-9/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | Right now, if publishing is enabled, both CRLs and Cert publishing is enabled. This causes a bunch of spurious error messages on IPA servers as cert publishing is not configured. As it is impossible to determine if cert publishing is not desired or simply misconfigured, we provide options to explicitly disable either cert or crl publishing. Specifically: * to enable/disable both cert and crl publishing: ca.publish.enable = True/False This is the legacy behavior. * to enable CRL publishing only: ca.publish.enable = True ca.publish.cert.enable = False * to enable cert publishing only: ca.publish.enable = True ca.publish.crl.enable = False Ticket 2275
* Lightweight CAs: add issuer DN and serial to AuthorityDataFraser Tweedale2016-05-131-0/+22
| | | | | | | | Add issuer DN and serial number to the AuthorityData object, as read-only attributes. Values are displayed in the CLI, when present in the response data. Fixes: https://fedorahosted.org/pki/ticket/1618
* Added token status UNFORMATTED.Endi S. Dewata2016-05-131-0/+2
| | | | | | | A new token status UNFORMATTED has been added for new tokens added via UI/CLI and for TERMINATED tokens that are to be reused. https://fedorahosted.org/pki/ticket/2287
* Renamed token status READY to FORMATTED.Endi S. Dewata2016-05-131-5/+5
| | | | | | The token status READY has been renamed to FORMATTED for clarity. https://fedorahosted.org/pki/ticket/2288
* Reject cert request if resultant subject DN is invalidFraser Tweedale2016-05-131-0/+8
| | | | | | | | | An unparseable subject DN is ignored, causing NPE in subsequent processing becaues the subject DN was not set. Throw ERejectException if the subject DN is invalid, to ensure that a useful response can be returned to the requestor. Fixes: https://fedorahosted.org/pki/ticket/2317
* TPS auth special characters fix.Jack Magne2016-05-121-6/+6
| | | | | | | | Ticket #1636. Smartcard token enroll/format fails when the ldap user has special characters in userid or password Tested with both esc and tpsclient. The problem was when using a real card because the client uri encodes the authentication creds and the server needs to decode them.
* Fixed missing CSR extensions for external CA case.Endi S. Dewata2016-05-121-2/+48
| | | | | | | | The deployment tool has been modified to generate CSR with basic constraints and key usage extensions for the externally-signed CA signing certificate. https://fedorahosted.org/pki/ticket/2312
* Include issuer DN in CertDataInfoFraser Tweedale2016-05-101-0/+16
| | | | | | | | Now that Dogtag can host multiple CAs in a single instance, indicate the issuer DN in the CertDataInfo structure that is returned for certificate searches. Fixes: https://fedorahosted.org/pki/ticket/2322
* Support certificate search by issuer DN.Fraser Tweedale2016-05-101-0/+11
| | | | | | | | Now that Dogtag can host multiple CAs in a single instance, add a certificate search parameter for limiting searches to a particular issuer. Fixes: https://fedorahosted.org/pki/ticket/2321
* Add migration script for realm changes in registry.cfgAde Lee2016-05-091-0/+4
| | | | Part of Ticket 2041
* Fix error output when request is rejectedAde Lee2016-05-091-0/+10
| | | | | | | With this fix, error messages are returned to the user when a request is rejected - either in the UI or from the pki CLI. Trac Ticket 1247 (amongst others)
* Add realm to requests coming in from CAAde Lee2016-05-091-0/+6
| | | | | | | | | | | | | | | | Requests to the KRA through the CA-KRA connector use the Enrollment Service. This has been modified to read and store any realm passed in. The realm can be added to the request by havibg the admin add a AuthzRealmDefault and AuthzRealmConstraint in a profile. At this point, all the constraint does is verify that the realm is one of a specified list of realms. More verification will be added in a subsequent patch. No attempt is made yet to allow users to specify the realm. This would need to be added as a ProfileInput. Part of Ticket 2041
* Renamed token status UNINITIALIZED to READY.Endi S. Dewata2016-05-031-2/+7
| | | | | | | | | | | The token status UNINITIALIZED has been renamed to READY for clarity. To simplify the transition, the CLIs and the REST API will continue to accept UNINITIALIZED but it will be converted internally into READY and a deprecation warning will be generated. https://fedorahosted.org/pki/ticket/2288
* Renamed token status TEMP_LOST to SUSPENDED.Endi S. Dewata2016-05-031-2/+7
| | | | | | | | | | | The token status TEMP_LOST has been renamed to SUSPENDED such that it can be used more general contexts. To simplify the transition, the CLIs and the REST API will continue to accept TEMP_LOST but it will be converted internally into SUSPENDED and a deprecation warning will be generated. https://fedorahosted.org/pki/ticket/2286
* Refactored TokenStatus enumeration.Endi S. Dewata2016-05-033-20/+120
| | | | | | | | The TokenStatus enumeration has been converted into a class to allow overriding the TokenStatus.valueOf() to provide backward compatibility. https://fedorahosted.org/pki/ticket/2286
* Realm: allow auth instances to support multiple realmsAde Lee2016-04-201-0/+3
| | | | | | | | | | | | | | | | In practice, most folks will use something like DirAclAuthz to manage their realm. Rather than requiring a new authz plugin for each realm, we allow the authz plugin to support multiple realms (as a comma separated list). For the Acl plugins in particular, we expand the authorize call to allow the caller to pass in the realm as well as the resource and operation. The resource queried would then be constructed on the fly as realm.resource Examples will be provided in the wiki page. Trac Ticket 2041
* Realms - Address comments from reviewAde Lee2016-04-204-17/+42
| | | | | | | | | | | | Review comments addressed: 1. when archiving or generating keys, realm is checked 2. when no plugin is found for a realm, access is denied. 3. rename mFoo to foo for new variables. 4. add chaining of exceptions 5. remove attributes from KeyArchivalRequest etc. when realm is null 6. Add more detail to denial in BasicGroupAuthz Part of Trac Ticket 2041
* Python client changes for realmAde Lee2016-04-201-19/+40
| | | | Part of Trac Ticket #2041
* Added realm to methods for listing requests and keysAde Lee2016-04-203-6/+34
| | | | | | | | | | | 1. Added query parameters for the realm. If a realm is specified, then only the key requests and keys associated with the realm are returned. If no realm is specified, then only those requests and keys without a realm are returned. 2. Added parameters to keyClient and the CLI Part of Trac Ticket #2041
* Added realm for archival and key generation through RESTAde Lee2016-04-205-11/+116
| | | | | | | | This will allow users to specify the realm when generating or archiving a request. No interface change is needed (yet) because the extra parameter is passed through the request. Part of Ticket #2041
* Added new authz methods to check realmAde Lee2016-04-201-0/+19
| | | | | | | | | | | | * Added method to check realm. This method will look for an authz instance for a specified realm and invoke it to determine access. * Added a basic group based authz plugin mostly for testing. This plugin simply checks if the requestor is in the correct group. In practice, customers will probably want something more complex maybe subclassing BasicAclAuthz. Part of Trac Ticket #2041
* Add realm to the key recordAde Lee2016-04-202-3/+23
| | | | Part of Trac Ticket# 2041
* Add realm to the request recordAde Lee2016-04-203-3/+36
| | | | Part of Trac Ticket #2041
* Fixed PKCS #12 export options.Endi S. Dewata2016-04-201-0/+12
| | | | | | | | The CLIs for exporting PKCS #12 file have been modified to accept options to export without trust flags, keys, and/or certificate chain. https://fedorahosted.org/pki/ticket/1736
* Updated pki pkcs12-export CLI.Endi S. Dewata2016-04-151-1/+9
| | | | | | | | | | | | For consistency the pki pkcs12-export has been modified to overwrite the PKCS #12 output file by default. A new option has been added to append the exported certificates and keys into the output file if the file already exists. The same option has been added to the The pki-server instance-cert-export and subsystem-cert-export commands. https://fedorahosted.org/pki/ticket/1736
generated by cgit (git 2.34.1) at 2025-09-26 05:44:58 +0000