summaryrefslogtreecommitdiffstats
path: root/base/deploy/src/scriptlets/pkiparser.py
Commit message (Collapse)AuthorAgeFilesLines
* Make admin cert p12 file location configurableAde Lee2012-12-191-59/+2
| | | | | Ticket 437. Also moved a bunch of client path parameters to default.cfg template file.
* Revert to using default config file for pkidestroyAde Lee2012-12-181-5/+0
| | | | | | | | Previously, we archived the default config file when an instance was created, and used that file in running pkidestroy. We plan to replace this mechanism in favor of actually reading the instance's config files. For now, we return to using the standard default config template, so that we can change it without breaking pkidestroy.
* Hardcode setting of resteasy-lib for instanceAde Lee2012-12-181-0/+2
| | | | | | | | | | Tomcat in f17 expects the file under /etc/sysconfig/foo to be a set of environment variables being set, and parses it that way. We recently added some logic to source the global pki.conf file. This works in f18, but breaks instance startup in f17. While this works in f18, its an indication that we are using the tomcat config file incorrectly. Reverting to hardcoding resteasy lib.
* interpolate more pathsAde Lee2012-12-181-231/+8
|
* interpolated jarsAde Lee2012-12-181-300/+8
|
* interpolation for paths part 1Ade Lee2012-12-181-137/+1
|
* Removed duplicate pki_instance_id parameter.Ade Lee2012-12-181-21/+21
| | | | Ticket 435
* Parameterizing RESTEasy paths.Endi Sukma Dewata2012-12-061-5/+12
| | | | | | | | | The paths to RESTEasy jar files have been modified such that it can be configured globally at build time using the spec file to support different distributions, and at deployment time using a system-wide configuration in /etc/pki/pki.conf. Ticket #422, #423.
* Implemented ability to utilize an external CAMatthew Harmsen2012-12-061-9/+24
| | | | * TRAC Ticket #231 - Dogtag 10: Update PKI Deployment to handle external CA
* Archiving default deployment configuration.Endi Sukma Dewata2012-12-041-97/+76
| | | | | | | | | | | The default deployment configuration has been renamed and moved to /etc/pki/default.cfg to make it more accessible to users. The pkispawn has been modified to archive the default deployment configuration along with the user-provided configuration in the registry. The pkidestroy will now use both archived configuration files to ensure proper removal of the subsystem. Ticket #399
* Interpolation correction patch based on review commentsAde Lee2012-12-041-10/+6
|
* Use interpolation to build default parametersAde Lee2012-12-041-679/+51
| | | | | | This patch replaces the code in pkiparser with defaults that are built up using ConfigParser interpolation. The patch gets most (but not all) default parameters.
* Change the structure of the client directory.Ade Lee2012-12-031-11/+12
| | | | | We need to keep the admin cert and p12 file in case the client directory is purged.
* Common User: pkispawn changesAde Lee2012-12-031-131/+21
|
* Simplified the configuration file using defaults.Endi Sukma Dewata2012-11-301-4/+6
| | | | | | | | | | | | | | Previously to create a subsystem the admin would have to copy the entire default deployment configuration, which contains many parameters, and then customize it. Now the deployment code has been changed such that the default config file will be used to provide the default values, so the admin will only need to provide the non-default parameters, thus reducing the size of the file. Sample configuration files are provided in /usr/share/pki/ deployment/config. Ticket #399
* Reorganized sensitive parameters.Endi Sukma Dewata2012-11-301-19/+24
| | | | | | | | | | | | | | | Previously sensitive parameters are stored in the Sensitive section in the configuration file, separate from the hierarchical structure used by non-sensitive parameters. To allow defining multiple subsystems in a single configuration file the sensitive and non-sensitive parameters have been reorganized into the same hierarchical structure. To maintain the security a new meta-parameter has been added to list all sensitive parameter names. This way the deployment code will know whether a parameter is sensitive, which then will mask the value before displaying it to the screen or storing it in a log file. Ticket #399
* Fixed default security domain user.Endi Sukma Dewata2012-11-301-18/+39
| | | | | | | | | The deployment code has been modified such that if the security domain user is not specified it will use the CA admin uid, or Common uid, if it is defined. Otherwise it will use the default "caadmin". Ticket #399
* Refactored pkiparser.py into PKIConfigParser.Endi Sukma Dewata2012-11-301-2227/+2230
| | | | | | | The code in pkiparser.py has been converted into PKIConfigParser class to facilitate further improvements. Ticket #399
* Fix issue with pki_external being referenced for non-CAAde Lee2012-11-101-3/+7
| | | | | This fixes an error in a previous commit which breaks creation and removal of non-CA subsystems
* removed dry_run from pkispawnAde Lee2012-11-101-7/+0
| | | | Ticket 411
* Move default location for client certificate databaseMatthew Harmsen2012-11-091-2/+2
| | | | | | * TRAC Ticket #395 - Dogtag 10: Add a Tomcat 7 runtime requirement to 'pki-server' * TRAC Ticket #398 - Move default location for client certificate database
* Enable Subordinate CAMatthew Harmsen2012-11-081-4/+23
| | | | * TRAC Ticket #185 - Dogtag 10: Update PKI Deployment to handle subordinate CA
* Set paths for default instanceAde Lee2012-11-041-16/+36
| | | | | | | | | | | | | | With this patch, it will be possible to install a default instance simply by adding the passwords in the pkideployment.cfg. This file can then be used without additional alteration to add subsystems to the same instance, by re-running pkispawn against the config file. The patch makes sure that cert nicknames, database and baseDN , admin users and client db are unique per subsystem. An option is added to reuse the existing server cert generated by the first subsystem and copy the required data to all subsystems. Ticket 379, 385
* Allow a PKI instance to be installed/configured independentlyMatthew Harmsen2012-10-301-0/+30
| | | | | * TRAC Ticket #286 - Dogtag 10: Create parameter for optionally allowing a user to skip configuration . . .
* Renamed "shared" folder to "server".Endi Sukma Dewata2012-10-071-11/+7
| | | | | | | The "shared" folder in /usr/share/pki has been renamed to "server" since it contains only server files. Ticket #353
* add selinux context for pkidaemon, remove unneeded pid and lock codeAde Lee2012-10-051-1/+1
| | | | | remove runcon from operations, add rules for spawn/destroy, add mgrepl changes to policy
* Fixed conflicting log4j.properties.Endi Sukma Dewata2012-09-191-4/+4
| | | | | | | | | The <instance>/lib link has been replaced with a real folder which contains links to the files in /usr/share/tomcat/lib. This way the log4j.properties can be placed in this folder without causing conflicts with other instances. Ticket: #284
* Added common ROOT webapp.Endi Sukma Dewata2012-09-121-20/+2
| | | | | | | | | | | The current ROOT webapp will redirect users coming to the root URL path to the proper path of the subsystem's webapp. Since now a single Tomcat instance may have multiple subsystems, a new ROOT webapp has been added to present the user with a menu of all available webapps from all subsystems in the instance. Ticket #89
* Added common theme webapp.Endi Sukma Dewata2012-09-121-0/+3
| | | | | | | | | A new theme webapp has been added to store the theme files for all PKI webapps. In the future the subsystem webapps can be modified to use the theme files provided by this common webapp instead of having to include duplicate files in each webapp. Ticket #89
* Added proxy realm.Endi Sukma Dewata2012-09-051-46/+37
| | | | | | | | | | | | | | | | | CMS engine is a singleton and it's used by PKI realm to authenticate users accessing the subsystem. Since a Tomcat instance may contain multiple subsystems, each having separate realm, the PKI JAR links need to be moved into WEB-INF/lib so that they will run inside separate class loaders. Tomcat also requires that the authenticator and realm classes be available in common/lib. To address this a new package pki-tomcat.jar has been added. The package contains the authenticator and a proxy realm. When the subsystems start running, they will register their own realms into the proxy realms such that the authentications will be forwarded to the appropriate subsystems. Ticket #89
* Moved webapp deployment code into pkispawn.Endi Sukma Dewata2012-09-051-7/+0
| | | | | | | | | | | | Previously the WAR files were generated at build time, so it would include theme files that were installed on the build machine. The code has been changed such that instead of generating WAR files pkispawn will copy the webapp files from the theme folders and combine them with subsystem webapp files at deployment time. This way it will use the actual theme files installed on the deployment machine. Ticket #89
* Verify symbolic links and update CS.cfg for Dogtag 10Matthew Harmsen2012-08-291-1/+1
| | | | | | | * TRAC Ticket #301 - Need to modify init scripts to verify needed symlinks in an instance * TRAC Ticket #303 - Dogtag 10: CS.cfg parameters for Dogtag 9 instance running under Dogtag 10 packages . . .
* PKI Deployment ScriptletsMatthew Harmsen2012-08-171-0/+26
| | | | | | | | | | | * TRAC Ticket #266 - for non-master CA subsystems, pkidestroy needs to contact the security domain to update the domain * Made Fedora 17 rely upon tomcatjss 7.0.0 or later * Changed Dogtag 10 build-time and runtime requirements for 'pki-deploy' * Altered PKI Package Dependency Chain (top-to-bottom): pki-ca, pki-kra, pki-ocsp, pki-tks --> pki-deploy --> pki-common * Changed TPS to require a build-time dependency of 'httpd-devel >= 2.4.2' * Clarified RPM build script's usage message
* PKI Deployment ScriptletsMatthew Harmsen2012-08-131-138/+38
| | | | | | | * TRAC Ticket #184 - Dogtag 10: Update PKI Deployment to handle cloning CA/KRA/OCSP/TKS . . . * TRAC Ticket #285 - Dogtag 10: Fix installation issues for KRA, OCSP, and TKS
* TRAC Ticket #283 - Dogtag 10: Integrate Tomcat 6 'tomcatjss.jar' and Tomcat 7Matthew Harmsen2012-08-031-1/+1
| | | | | | 'tomcat7jss.jar' in Fedora 18 tomcatjss package * Requires tomcatjss 7.0.0-3 as links for instances created by 'pkispawn' will now point to 'tomcat7jss.jar'
* Enabled SSL authenticator and PKI realm.Endi Sukma Dewata2012-08-031-1/+13
| | | | | | | | | | | The SSL connection has been configured with clientAuth="want" so users can choose whether to provide a client certificate or username and password. The authentication and authorization will be handled by the SSL authenticator with fallback and PKI realm. New access control rules have been added for users, groups, and certs REST services. Ticket #107
* PKI Deployment ScriptletsMatthew Harmsen2012-08-021-17/+32
| | | | | | | | | * PKI TRAC Ticket #279 - Dogtag 10: Fix remaining 'cloning' issues in 'pkispawn' . . . * PKI TRAC Ticket #280 - Dogtag 10: Fix remaining issues in 'pkidestroy' related to deletion of more than one instance . . . * PKI TRAC Ticket #281 - Dogtag 10: Fix 'pkidaemon'/'operations' issue to handle individual instance . . .
* PKI Deployment ScriptletsMatthew Harmsen2012-07-301-349/+305
| | | | | | | | | | | | | | | | | | | | | | | * TRAC Ticket #263 - Dogtag 10: Fix 'pkidestroy' problem of sporadically "not" removing "/etc/sysconfig/{pki_instance_id}" . . . * TRAC Ticket #264 - Dogtag 10: Enable various other subsystems for configuration . . . * TRAC Ticket #261 - Dogtag 10: Revisit command-line options of 'pkispawn' and 'pkidestroy' . . . * TRAC Ticket #268 - Dogtag 10: Create a parameter for optional restart of configured PKI instance . . . * TRAC Ticket #270 - Dogtag 10: Add missing parameters to 'pkideployment.cfg' . . . * TRAC Ticket #265 - Dogtag 10: Provide configurable options for PKI client information . . . * TRAC Ticket #275 - Dogtag 10: Add debug information (comments) to Tomcat 7 "logging.properties" * TRAC Ticket #276 - Dogtag 10: Relocate all 'pin' data to the 'sensitive' dictionary * TRAC Ticket #277 - Dogtag 10: Create an 'archive' for 'manifest' and 'pkideployment.cfg' files * TRAC Ticket #278 - Dogtag 10: Fix Miscellaneous PKI Deployment Scriptlet Issues . . .
* Added ClientConfig.Endi Sukma Dewata2012-07-301-1/+1
| | | | | | | | A new ClientConfig class has been added to encapsulate client configuration parameters. These parameters include server URI, certificate database, certificate nickname, and password. Ticket #107
* PKI Deployment ScriptletsMatthew Harmsen2012-07-251-107/+187
| | | | | | | | | | | | | | | | | * PKI TRAC Ticket #244 - Non-user-friendly message when deleting non-existent subsystem with pkidestroy * PKI TRAC Ticket #246 - Incorrect parameter names in pkispawn configuration * PKI TRAC Ticket #248 - pki_ds_database should not be a DN * PKI TRAC Ticket #249 - pki_ds_base_dn causing pkispawn failure * PKI TRAC Ticket #250 - Creating/removing custom instances should not require http/ajp ports * PKI TRAC Ticket #251 - Instance name may conflict with other files * PKI TRAC Ticket #253 - Fix pki-destroy removal of '/var/log/pki/{pki_instance_id}' directory . . . * PKI TRAC Ticket #254 - Dogtag 10: Fix spec file to build successfully via mock on Fedora 17 . . . * PKI TRAC Ticket #255 - Missing resteasy-atom-provider.jar * PKI TRAC Ticket #260 - Dogtag 10: Change the layout of 'pki_instance_id' . . .
* PKI Deployment ScriptletsMatthew Harmsen2012-07-191-12/+82
| | | | | | | | | | | | | | | | | | | | | | * In 'catalina.properties', removed commented out jars for each of the subsystems in the 'common.loader' * In 'server.xml', removed the line containing a '1' * Moved all parameters from the [Mandatory] and [Optional] sections of the 'pkideployment.cfg' file to other more appropriate sections (e.g. - [Common], [CA], [KRA], etc.), and removed these sections and all of their associated logic from the 'pki-deploy' package * Resolved Dogtag TRAC Ticket #225 Dogtag 10: Move "pkispawn"/"pkidestroy" logs * Removed all security domain references from external CA logic * Added new 'pki_subsystem_name' parameter to 'pkideployment.cfg' file, and applied logic throughout 'pki-deploy' * Added new error message in the case of an unset DNS domain name, and replaced the log message with a simple print in the case of a 'domainname' exception
* PKI Deployment ScriptletsMatthew Harmsen2012-07-191-4/+99
| | | | | | | | | Saved Admin Certificate, imported it into NSS client security databases, and exported it to a PKCS #12 file such that it may be imported into a browser. TRAC Ticket #221 Dogtag 10: Create a PKCS #12 file containing the Admin Certificate (https://fedorahosted.org/pki/ticket/221)
* PKI Deployment ScriptletsMatthew Harmsen2012-07-191-46/+1205
| | | | | | | | | | | | | | | | | | | | * Integration of Tomcat 7 * Introduction of dependency upon tomcatjss 7.0 * Removal of http filtering configuration mechanisms * Introduction of additional slot substitution to support revised filesystem layout * Addition of 'pkiuser' uid:gid creation methods * Inclusion of per instance '*.profile' files * Introduction of configurable 'configurationRoot' parameter * Introduction of default configuration of 'log4j' mechanism (alee) * Modify web.xml to use new Application classes to bootstrap servers (alee) * Introduction of "Wrapper" logic to support Tomcat 6 --> Tomcat 7 API change (jmagne) * Added jython helper function to allow attaching a remote java debugger (e. g. - eclipse)
* PKI Deployment ScriptletsMatthew Harmsen2012-05-251-69/+167
| | | | | | | * Integration of Tomcat 7 * Addition of centralized 'pki-tomcatd' systemd functionality to the PKI Deployment strategy * Removal of 'pki_flavor' attribute
* PKI Deployment ScriptletsMatthew Harmsen2012-05-181-107/+161
| | | | | | | | | | | | | | | | | * Introduced concept of "admin-domain" originally as a separate folder, and later incorporated this concept into an optional instance prefix * Revised definition of <pki_instance_id> to be identified as "[<pki_admin_domain_name>-]<pki_instance_name> * Changed NSS security database model from one shared database by BOTH a single Tomcat AND single Apache instance into one per Tomcat instance (shared by CA/KRA/OCSP/TKS) and one per Apache instance (shared by RA/TPS) * Altered Configuration 'scriptlet' to invoke Jython for access to new Java configuration servlet * Renamed various "scriptlets" to comply with this new layout * Re-aligned code to account for revised layout documented at http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment
* PKI Deployment ScriptletsMatthew Harmsen2012-05-071-136/+641
| | | | | | | | | | | | | | | * Re-aligned code to account for revised layout documented at http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment * Massaged logic to comply with PKI subsystem running within a shared instance * Developed code to take advantage of a single shared NSS security database model * Completed the following two 'scriptlets': * Dogtag 10: Python 'slot_assignment.py' Installation Scriptlet (https://fedorahosted.org/pki/ticket/146) * Dogtag 10: Python 'security_databases.py' Installation Scriptlet (https://fedorahosted.org/pki/ticket/136) * Created several additional PKI deployment helper utilities.
* PKI Deployment ScriptletsMatthew Harmsen2012-04-261-0/+362
* Completed the following six 'scriptlets': * Dogtag 10: Python 'initialization.py' Installation Scriptlet (https://fedorahosted.org/pki/ticket/147) * Dogtag 10: Python 'instance_layout.py' Installation Scriptlet (https://fedorahosted.org/pki/ticket/75) * Dogtag 10: Python 'webserver_layout.py' Installation Scriptlet (https://fedorahosted.org/pki/ticket/140) * Dogtag 10: Python 'subsystem_layout.py' Installation Scriptlet (https://fedorahosted.org/pki/ticket/141) * Dogtag 10: Python 'war_explosion.py' Installation Scriptlet (https://fedorahosted.org/pki/ticket/76) * Dogtag 10: Python 'finalization.py' Installation Scriptlet (https://fedorahosted.org/pki/ticket/148) * Created numerous PKI deployment helper utilities. * Augmented logging to provide indentation. * Generated logic for installation 'manifest'. * Tested logic using '--dry_run' option and '-p' prefix options. * Per initial review, removed numerous "constants" and consolidated logic into "master" dictionary. * Corrected the following ticket: * Dogtag 10: Fix 'build_dogtag_pki' script to account for 'pki-deploy' RPM (https://fedorahosted.org/pki/ticket/138) Resolves Bugzilla Bug #810047 - build_dogtag_pki fails with requirements for pki-deploy (https://bugzilla.redhat.com/show_bug.cgi?id=810047) * Created the following three 'scriptlets' as 'NOT YET IMPLEMENTED' place-holders: * Dogtag 10: Python 'security_databases.py' Installation Scriptlet (https://fedorahosted.org/pki/ticket/136) * Dogtag 10: Python 'slot_assignment.py' Installation Scriptlet (https://fedorahosted.org/pki/ticket/146) * Dogtag 10: Python 'configuration.py' Configuration Scriptlet (https://fedorahosted.org/pki/ticket/137)
generated by cgit (git 2.34.1) at 2024-04-27 15:49:43 +0000