summaryrefslogtreecommitdiffstats
path: root/base/deploy/src
Commit message (Collapse)AuthorAgeFilesLines
* WIPticket-380Endi Sukma Dewata2012-12-186-82/+149
|
* Parameterizing RESTEasy paths.Endi Sukma Dewata2012-12-066-117/+60
| | | | | | | | | The paths to RESTEasy jar files have been modified such that it can be configured globally at build time using the spec file to support different distributions, and at deployment time using a system-wide configuration in /etc/pki/pki.conf. Ticket #422, #423.
* Implemented ability to utilize an external CAMatthew Harmsen2012-12-067-52/+134
| | | | * TRAC Ticket #231 - Dogtag 10: Update PKI Deployment to handle external CA
* Archiving default deployment configuration.Endi Sukma Dewata2012-12-047-137/+194
| | | | | | | | | | | The default deployment configuration has been renamed and moved to /etc/pki/default.cfg to make it more accessible to users. The pkispawn has been modified to archive the default deployment configuration along with the user-provided configuration in the registry. The pkidestroy will now use both archived configuration files to ensure proper removal of the subsystem. Ticket #399
* Run restorecon on top-level log directoryNathan Kinder2012-12-041-0/+1
| | | | | | | | | | | We currently run a restorecon on the instance log directory, but not on the top level log directory. Restorecon is required for the top level log directory since pkispawn creates it. Without running a restorecon, it gets the label of the parent directory (var_log_t) instead of consulting the fcontext rule in the base policy and using pki_var_log_t. Ticket #431
* Interpolation correction patch based on review commentsAde Lee2012-12-044-41/+14
|
* Use interpolation to build default parametersAde Lee2012-12-044-688/+51
| | | | | | This patch replaces the code in pkiparser with defaults that are built up using ConfigParser interpolation. The patch gets most (but not all) default parameters.
* I18n for ProfileList.template.Endi Sukma Dewata2012-12-032-22/+38
| | | | | | | | | | | | | The messages in ProfileList.template in CA EE has been extracted into a properties file which can be translated separately. The original messages in the template have been marked as follows: <span class="message" name="...key...">...message...</span> When the page is loaded into the browser, the original message will be replaced with the translated messages. Ticket #406
* Change the structure of the client directory.Ade Lee2012-12-033-14/+15
| | | | | We need to keep the admin cert and p12 file in case the client directory is purged.
* Common User: pkispawn changesAde Lee2012-12-032-149/+51
|
* Replaced links of scriptlets with lists.Endi Sukma Dewata2012-11-302-32/+10
| | | | | | | | | Previously the deployment tools used symbolic links to determine the scriplets to execute and their order. The code has been changed such that now the scriplets are listed as parameters (spawn_scriplets and destroy_scriplets) in the configuration file. Ticket #403
* Simplified the configuration file using defaults.Endi Sukma Dewata2012-11-304-10/+17
| | | | | | | | | | | | | | Previously to create a subsystem the admin would have to copy the entire default deployment configuration, which contains many parameters, and then customize it. Now the deployment code has been changed such that the default config file will be used to provide the default values, so the admin will only need to provide the non-default parameters, thus reducing the size of the file. Sample configuration files are provided in /usr/share/pki/ deployment/config. Ticket #399
* Reorganized sensitive parameters.Endi Sukma Dewata2012-11-3011-96/+101
| | | | | | | | | | | | | | | Previously sensitive parameters are stored in the Sensitive section in the configuration file, separate from the hierarchical structure used by non-sensitive parameters. To allow defining multiple subsystems in a single configuration file the sensitive and non-sensitive parameters have been reorganized into the same hierarchical structure. To maintain the security a new meta-parameter has been added to list all sensitive parameter names. This way the deployment code will know whether a parameter is sensitive, which then will mask the value before displaying it to the screen or storing it in a log file. Ticket #399
* Fixed default security domain user.Endi Sukma Dewata2012-11-301-18/+39
| | | | | | | | | The deployment code has been modified such that if the security domain user is not specified it will use the CA admin uid, or Common uid, if it is defined. Otherwise it will use the default "caadmin". Ticket #399
* Refactored pkiparser.py into PKIConfigParser.Endi Sukma Dewata2012-11-304-2239/+2244
| | | | | | | The code in pkiparser.py has been converted into PKIConfigParser class to facilitate further improvements. Ticket #399
* Link to resteasy-base on rhel systems when running pkispawnalee-91Ade Lee2012-11-213-12/+28
|
* Reorganized CA, KRA, OCSP, TKS templates.Endi Sukma Dewata2012-11-121-8/+3
| | | | | | | | | | | All remaining theme files for Tomcat subsystems which include the templates and JS files have been moved from the theme folder at <subsystem>-ui/shared/webapps/<subsystem> into the subsystem webapp folder at base/<subsystem>/shared/webapps/<subsystem>. The deployment tools have been updated to use the new location. Ticket #407
* Reorganized common templates.Endi Sukma Dewata2012-11-122-44/+11
| | | | | | | The common templates have moved from common-ui into base/common. The deployment tools have been updated to use the new location. Ticket #407
* Updated tools to deploy combined images and CSS files.Endi Sukma Dewata2012-11-112-67/+36
| | | | | | | | | | | The pkispawn and pkicreate have been updated to deploy the combined images and CSS files from the common-ui into /pki/images and /pki/css. The common Velocity templates and JavaScript files still need to be deployed from the <subsystem>-ui packages into each subsystem. Ticket #328
* Fix issue with pki_external being referenced for non-CAAde Lee2012-11-101-3/+7
| | | | | This fixes an error in a previous commit which breaks creation and removal of non-CA subsystems
* removed dry_run from pkispawnAde Lee2012-11-1012-1108/+724
| | | | Ticket 411
* Remove unused respawn code.Ade Lee2012-11-109-400/+0
| | | | Ticket 412
* Move default location for client certificate databaseMatthew Harmsen2012-11-091-2/+2
| | | | | | * TRAC Ticket #395 - Dogtag 10: Add a Tomcat 7 runtime requirement to 'pki-server' * TRAC Ticket #398 - Move default location for client certificate database
* Enable Subordinate CAMatthew Harmsen2012-11-084-16/+30
| | | | * TRAC Ticket #185 - Dogtag 10: Update PKI Deployment to handle subordinate CA
* Merged theme files.Endi Sukma Dewata2012-11-061-4/+160
| | | | | | | | | | | | | | Currently the theme files are copied into each subsystem during deployment creating duplicates. To reduce the problem the files should be combined into a common folder /pki. The process will be done over several patches. Initially this patch will copy the images and CSS files into /pki/images and /pki/css. Subsequent patches will update references to these files to the new location. When it's done, the files no longer need to be copied into each subsystem. Ticket #328
* Convert admin cert from ascii to binary before importing into certdbAde Lee2012-11-042-3/+17
| | | | | Sometimes importing the ascii admin cert into th client certdb fails. The binary always appears to work though.
* Set paths for default instanceAde Lee2012-11-043-40/+130
| | | | | | | | | | | | | | With this patch, it will be possible to install a default instance simply by adding the passwords in the pkideployment.cfg. This file can then be used without additional alteration to add subsystems to the same instance, by re-running pkispawn against the config file. The patch makes sure that cert nicknames, database and baseDN , admin users and client db are unique per subsystem. An option is added to reuse the existing server cert generated by the first subsystem and copy the required data to all subsystems. Ticket 379, 385
* Allow a PKI instance to be installed/configured independentlyMatthew Harmsen2012-10-3013-3/+121
| | | | | * TRAC Ticket #286 - Dogtag 10: Create parameter for optionally allowing a user to skip configuration . . .
* Provide option to install, rather than replicate schema in a cloneAde Lee2012-10-221-0/+1
|
* Added pki_tomcat_cert_t type and interface to access itAde Lee2012-10-102-0/+12
| | | | | Added permissions to certmonger to access the certdb. Also added some missing selinux permissions for pki_tomcat_t
* Renamed "shared" folder to "server".Endi Sukma Dewata2012-10-072-15/+11
| | | | | | | The "shared" folder in /usr/share/pki has been renamed to "server" since it contains only server files. Ticket #353
* add selinux context for pkidaemon, remove unneeded pid and lock codeAde Lee2012-10-051-1/+1
| | | | | remove runcon from operations, add rules for spawn/destroy, add mgrepl changes to policy
* Added package checking for pkispawn.Endi Sukma Dewata2012-10-012-0/+7
| | | | | | | The pkispawn has been modified such that it will check whether the package for the subsystem being created has been installed. Ticket #332
* Correctly resolve symlinks in subdirectoriesMatthew Harmsen2012-09-251-3/+4
| | | | | | | | | | | | * TRAC Ticket #338 - Dogtag 10: pkihelper.py directory.set_mode() does not resolve symlinks correctly This patch fixes the problem that although top-level symlinks are correctly identified as symbolic links, symlinks which exist under a subdirectory are incorrectly identified as files, and thus the 'chown' and 'chmod' commands are applied to the symlink which in turn actually get applied to the target file instead.
* Fixed conflicting log4j.properties.Endi Sukma Dewata2012-09-192-20/+22
| | | | | | | | | The <instance>/lib link has been replaced with a real folder which contains links to the files in /usr/share/tomcat/lib. This way the log4j.properties can be placed in this folder without causing conflicts with other instances. Ticket: #284
* Fixed problems with optional pki-symkey.Endi Sukma Dewata2012-09-182-6/+10
| | | | | | | | The deployment and init scripts have been fixed to create and check the link to symkey.jar if a TKS instance is added, and remove the link if the instance is removed. Ticket #331
* Deregister subsystem in merged instanceMatthew Harmsen2012-09-132-1/+9
| | | | * TRAC Ticket #311 - Unable to deregister subsystem in merged instance
* Various fixes to installation servlet and pki-deployAde Lee2012-09-123-254/+164
| | | | | | | Added logging so that we can see what is passed in to server from pkispawn. Fixed incorrect dbuser specification. Added required replication config items to pkispawn. Initial refactoring of construct_pki_configuration_data in pkijython.py
* Fixed SELinux error during pkidestroy.Endi Sukma Dewata2012-09-121-28/+68
| | | | | | | | | When removing a subsystem the pkidestroy would also remove the SELinux contexts for the instance regardless of whether there are still other subsystems in the instance. The code has been fixed such that it's removing the SELinux contexts when deleting the last subsystem only. Ticket #89
* Added common ROOT webapp.Endi Sukma Dewata2012-09-123-36/+19
| | | | | | | | | | | The current ROOT webapp will redirect users coming to the root URL path to the proper path of the subsystem's webapp. Since now a single Tomcat instance may have multiple subsystems, a new ROOT webapp has been added to present the user with a menu of all available webapps from all subsystems in the instance. Ticket #89
* Added common theme webapp.Endi Sukma Dewata2012-09-122-0/+21
| | | | | | | | | A new theme webapp has been added to store the theme files for all PKI webapps. In the future the subsystem webapps can be modified to use the theme files provided by this common webapp instead of having to include duplicate files in each webapp. Ticket #89
* Added proxy realm.Endi Sukma Dewata2012-09-053-58/+51
| | | | | | | | | | | | | | | | | CMS engine is a singleton and it's used by PKI realm to authenticate users accessing the subsystem. Since a Tomcat instance may contain multiple subsystems, each having separate realm, the PKI JAR links need to be moved into WEB-INF/lib so that they will run inside separate class loaders. Tomcat also requires that the authenticator and realm classes be available in common/lib. To address this a new package pki-tomcat.jar has been added. The package contains the authenticator and a proxy realm. When the subsystems start running, they will register their own realms into the proxy realms such that the authentications will be forwarded to the appropriate subsystems. Ticket #89
* Moved webapp deployment code into pkispawn.Endi Sukma Dewata2012-09-053-18/+55
| | | | | | | | | | | | Previously the WAR files were generated at build time, so it would include theme files that were installed on the build machine. The code has been changed such that instead of generating WAR files pkispawn will copy the webapp files from the theme folders and combine them with subsystem webapp files at deployment time. This way it will use the actual theme files installed on the deployment machine. Ticket #89
* Moved REST CLI into pki-tools.Endi Sukma Dewata2012-08-292-2/+2
| | | | | | | | | | The pki-client.jar has been split and merged into pki-certsrv.jar and pki-tools.jar. The REST client classes are now packaged in com.netscape.certsrv.<component> packages. The REST CLI classes are now packaged in com.netscape.cmstools.<component> packages. The "pki" script has been moved into pki-tools RPM package. Ticket #215
* Verify symbolic links and update CS.cfg for Dogtag 10Matthew Harmsen2012-08-291-1/+1
| | | | | | | * TRAC Ticket #301 - Need to modify init scripts to verify needed symlinks in an instance * TRAC Ticket #303 - Dogtag 10: CS.cfg parameters for Dogtag 9 instance running under Dogtag 10 packages . . .
* PKI Deployment ScriptletsMatthew Harmsen2012-08-174-0/+242
| | | | | | | | | | | * TRAC Ticket #266 - for non-master CA subsystems, pkidestroy needs to contact the security domain to update the domain * Made Fedora 17 rely upon tomcatjss 7.0.0 or later * Changed Dogtag 10 build-time and runtime requirements for 'pki-deploy' * Altered PKI Package Dependency Chain (top-to-bottom): pki-ca, pki-kra, pki-ocsp, pki-tks --> pki-deploy --> pki-common * Changed TPS to require a build-time dependency of 'httpd-devel >= 2.4.2' * Clarified RPM build script's usage message
* Added pki-client.jar.Endi Sukma Dewata2012-08-151-1/+1
| | | | | | | A new pki-client.jar has been created to package the REST client and CLI classes. Ticket #215
* Reorganized REST common classes.Endi Sukma Dewata2012-08-151-3/+4
| | | | | | | The common classes used by REST client and services have been moved into the com.netscape.certsrv.<component> packages. Ticket #215
* Reorganized REST client classes.Endi Sukma Dewata2012-08-152-2/+2
| | | | | | | The REST client classes have been moved into the com.netscape.cms.client.<component> packages. Ticket #215
* Cleaned up REST common class names.Endi Sukma Dewata2012-08-151-16/+16
| | | | | | | The REST common classes have been renamed for better clarity and consistency. Ticket #259
generated by cgit (git 2.34.1) at 2024-04-25 02:08:14 +0000