summaryrefslogtreecommitdiffstats
path: root/base/server/cms/src/com/netscape/cms/servlet/base
Commit message (Collapse)AuthorAgeFilesLines
* Consolidated log() for audit events.Endi S. Dewata2017-06-272-20/+13
| | | | | | | | | Duplicate log() methods for audit events have been merged into the Logger class. https://pagure.io/dogtagpki/issue/2689 Change-Id: I7a5147ff3221a52a82e69f56faf2156c04256db2
* Refactored signed audit logger.Endi S. Dewata2017-06-241-28/+6
| | | | | | | | | | | | | | | Signed audit logger creation has been simplified into: Logger signedAuditLogger = SignedAuditLogger.getLogger(); The null checks on signed audit logger have been removed since it cannot be null. Audit messages can be logged as follows: signedAuditLogger.log(message); https://pagure.io/dogtagpki/issue/2689 Change-Id: I3bf781b0194a6cbb166f71751c098d1c2a3a657a
* Added LogSource enumeration.Endi S. Dewata2017-06-222-2/+4
| | | | | | | | | A LogSource enumeration has been added to replace the integer log source in the Logger class. https://pagure.io/dogtagpki/issue/2689 Change-Id: I6f69219fbbfa00d83f26a32174c75ff2782eb6af
* Added LogCategory enumeration.Endi S. Dewata2017-06-221-1/+2
| | | | | | | | | A LogCategory enumeration has been added to replace the integer log category in the Logger class. https://pagure.io/dogtagpki/issue/2689 Change-Id: Ic92e64c3abdf859841eaf1006afc61bbf573086d
* Ticket#2737 CMC: check HTTPS client authentication cert against CMC signerChristina Fu2017-06-151-1/+9
| | | | | This patch adds enforcement in CMCUserSignedAuth to make sure SSL client authentication is performed and the authenticated cert matches that of the CMC signing cert. Some auditing adjustments are also done.
* Fixed access banner encoding (part 2).Endi S. Dewata2017-06-141-1/+1
| | | | | | | | | | | | The code that reads the access banner from file has been modified to explicitly use UTF-8 encoding. The Info class and the PKI UI have been modified not to encode the access banner in Base64 since it is not necessary. https://pagure.io/dogtagpki/issue/2671 Change-Id: I5f41a8ebac0bc91623b27f14608bca294bc9bc38
* Fixed access banner normalization.Endi S. Dewata2017-06-141-1/+1
| | | | | | | | | | The PKIService has been modified to trim whitespaces in access banner before returning the value to the client. The clients have been modified to no longer trim the banner. https://pagure.io/dogtagpki/issue/2671 Change-Id: I51c5e78d11c89c711e369328def27bb352aa49e6
* Encapsulate the archival audit logAde Lee2017-05-231-0/+10
| | | | | | | | | | | | | This patch encapsulates the SECURITY_DATA_ARCHIVAL_REQUEST and PRIVATE_DATA_ARCHIVAL_REQUEST audit logs as audit events. The PRIVATE_DATA_ARCHIVAL_REQUEST events are mapped to the SECURITY_DATA ones to simplify the whole structure. They used to provide an archivalID parameter which was pretty much meaningless as it was at best just the same as the request id which is alreadty logged. So this is now dropped. Change-Id: I705d25ce716c73f2c954c5715b0aafdad80b99d2
* Added log messages for server shutdown.Endi S. Dewata2017-05-161-0/+1
| | | | | | | Some log messages have been added to help troubleshoot the cause of server shutdown. Change-Id: Ie2a91647a0986fdb11cafed2aec48cce208ef1a2
* Added RoleAssumeEvent.Endi S. Dewata2017-04-241-39/+17
| | | | | | | | | A new RoleAssumeEvent class of has been added to encapsulate the ROLE_ASSUME events. https://pagure.io/dogtagpki/issue/2641 Change-Id: I12e47ea13198b6532b1fdfee2e20765c0cab15e9
* Added AuthzFailEvent.Endi S. Dewata2017-04-241-28/+16
| | | | | | | | | A new AuthzFailEvent class of has been added to encapsulate the AUTHZ_FAIL events. https://pagure.io/dogtagpki/issue/2641 Change-Id: Id4ab9bd889a1a9314264c0ef2ff7b2389aed8f9c
* Added AuthzSuccessEvent.Endi S. Dewata2017-04-241-11/+7
| | | | | | | | | A new AuthzSuccessEvent class of has been added to encapsulate the AUTHZ_SUCCESS events. https://pagure.io/dogtagpki/issue/2641 Change-Id: I2f45fb2c3ba8acdc82777644cf4ad0ec2eff35a5
* Added AuthFailEvent.Endi S. Dewata2017-04-241-6/+5
| | | | | | | | | A new AuthFailEvent class of has been added to encapsulate the AUTH_FAIL events. https://pagure.io/dogtagpki/issue/2641 Change-Id: I870398f6a56df007c9520e50947a7b3c85baf79b
* Added AuthSuccessEvent.Endi S. Dewata2017-04-241-6/+3
| | | | | | | | | A new AuthSuccessEvent class of has been added to encapsulate the AUTH_SUCCESS events. https://pagure.io/dogtagpki/issue/2641 Change-Id: Ie7cc751728ac079e30ece354ca44c5266474bcd3
* Added methods to log AuditEvent object.Endi S. Dewata2017-04-131-0/+10
| | | | | | | New audit(AuditEvent) methods have been added alongside the existing audit(String) methods. Change-Id: Ia02a7daa8b9e8693208fe34309d8d727cc32ce54
* Reorganized audit event constants for configuration.Endi S. Dewata2017-04-121-10/+7
| | | | Change-Id: Ie05572677de0e8eb1244dc6caf2b4a48514a2542
* Reorganized audit event constants for authentication.Endi S. Dewata2017-04-121-17/+10
| | | | Change-Id: Iade8cb7fdf3c3f93afb13ff814da0f72dc8f8049
* Added audit event constants for TPS.Endi S. Dewata2017-04-121-1/+2
| | | | Change-Id: Id7845ebf2a14cebe25189a8363cee759030a16cb
* Added CLIs to access audit log files.Endi S. Dewata2017-04-041-0/+1
| | | | | | | New pki audit commands have been added to list and retrieve audit log files. Change-Id: I785fa6f55d9b143f513d9210ebf82d04e06eaed5
* Added audit logs for SSL/TLS events.Endi S. Dewata2017-03-281-0/+7
| | | | | | | | | | | | | | | The CMSStartServlet has been modified to register an SSL socket listener called PKIServerSocketListener to TomcatJSS. The PKIServerSocketListener will receive the alerts generated by SSL server sockets and generate ACCESS_SESSION_* audit logs. The CS.cfg for all subsystems have been modified to include ACCESS_SESSION_* audit events. https://pagure.io/dogtagpki/issue/2602 Change-Id: If7fb6c1b096ec8c68d1fd08f9132baf099816f11
* Added InfoService and LoginService.Endi S. Dewata2017-02-241-2/+20
| | | | | | | | | | | New REST services classes have been added to PKIApplication. The InfoService provides general information about the server including version number and access banner. The LoginService provides a way to notify the server that the banner has been displayed on the client, which in that case the InfoService will no longer return the banner again in the same session. https://fedorahosted.org/pki/ticket/2582
* Refactored PKIService class.Endi S. Dewata2017-02-152-86/+105
| | | | | | | | | The subsystem-based methods and fields in PKIService class have been moved into a new SubsystemService class to allow creating more generic non-subsystem-based services. The classes that use these methods and fields have been updated accordingly.
* Ticket #2298 Part3- trim down debug log in non-TMS crmf enrollmentsChristina Fu2016-06-171-1/+2
|
* Ticket #2271 Part2:TMS:removing/reducing debug log printout of dataChristina Fu2016-06-021-1/+5
| | | | | | | This patch comments out unneeded data in TMS debug logs (TPS&TKS); It reduces the size of the debug logs by a lot. Note that for ease of later development debugging, the debug lines are commented out instead of being removed
* Add authz checks for all operationsAde Lee2016-04-201-0/+3
| | | | | | | We add authz realm checks as appropriate for each operation. Part of Trac Ticket #2041
* Fixed exception handling in CertificateAuthority.Endi S. Dewata2016-04-121-1/+1
| | | | | | | | The CertificateAuthority.getCACert() has been modified to re-throw the exception instead of ignoring it. All callers have been modified to bubble up the exception. https://fedorahosted.org/pki/ticket/1654
* Ticket #1006 Audit logging for TPS REST operationsChristina Fu2016-03-281-0/+15
| | | | | | | | | | | | | This patch adds audit logging to TPS REST wrote-specific operations. The read-specific operations are already captured by AuditEvent=AUTHZ_* The affected (new or modified) log messages include: LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_GENERAL_5 LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_PROFILE_6 LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_MAPPING_RESOLVER_6 LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_AUTHENTICATOR_6 LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_CONNECTOR_6 LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_RECORD_6 LOGGING_SIGNED_AUDIT_TOKEN_STATE_CHANGE_8
* Added resource bundle for token state labels.Endi S. Dewata2016-02-051-0/+41
| | | | | | | | | | | | | | | The labels for token states and the transitions are now stored in token-states.properties. The default file will be stored in the /usr/share/pki/tps/conf, but it can be overriden by copying and customizing the file into <instance>/tps/conf. When the UI retrieves the token data the labels for the current state and the valid transitions will be loaded from the file and returned to the UI. The UI will show the transition labels in the dropdown list for changing token status. https://fedorahosted.org/pki/ticket/1289 https://fedorahosted.org/pki/ticket/1291
* Remove unused constantFraser Tweedale2015-12-221-3/+0
|
* Refactored LDAPSecurityDomainSessionTable.Endi S. Dewata2015-10-291-12/+12
| | | | | | | The LDAPSecurityDomainSessionTable has been modified to throw an exception if there is a failure. https://fedorahosted.org/pki/ticket/1633
* Lightweight CAs: initial supportFraser Tweedale2015-09-261-1/+4
| | | | | | | | | | | | | This commit adds initial support for "lightweight CAs" - CAs that inhabit an existing CA instance and share the request queue and certificate database of the "top-level CA". We initially support only sub-CAs under the top-level CA - either direct sub-CAs or nested. The general design will support hosting unrelated CAs but creation or import of unrelated CAs is not yet implemented. Part of: https://fedorahosted.org/pki/ticket/1213
* Fixed key archival problem in CLI with separate KRA instance.Endi S. Dewata2015-05-221-24/+13
| | | | | | | | | | The CLI has been modified such that when enrolling a certificate with key archival it will obtain the transport certificate from the CA instead of KRA because the KRA may not reside on the same instance. The CA REST service has been modified such that it will obtain the transport certificate from the KRA connector. https://fedorahosted.org/pki/ticket/1384
* Fix kra-connector-removeAde Lee2014-09-021-1/+2
| | | | | | | | | | | | | | | | | | | | The code to remove the connector from the pki CLI was found to be broken because of invalid message type (partly due to void returns). On uninstall, we need to remove the kra-connector from all relevant CA's in the security domain. The best way to do this is to keep kra-connector info in LDAP, so that only one call is needed. Until that change has been made, we are adding a hack to remove the connector from all CA's in the secutrity domain (if it exists). Due to issues with proxy configurations, we will continue to use sslget and a url-encoded-form version of the servlet. In addition, it was found that when removing a KRA from a shared subsystem, the updateDomainXML servlet was erroneously returning failure when it was unsuccessful in removing a non-existent user from a group. Ticket 1113
* Added transport cert attributes.Endi S. Dewata2014-07-091-0/+13
| | | | | | | | The REST service has been modified to return additional attributes for transport certificate including serial number, issuer DN, subject DN, and resource link. Ticket #1065
* Fixed transport certificate delimiters.Endi S. Dewata2014-07-091-1/+1
| | | | | | | | | | The REST service and client library have been fixed to use the correct delimiters for transport certificate. The REST service was also modified to insert a new line between the header and the certificate data. Ticket #1063
* Refactored SystemCertClient.get_transport_cert().Endi S. Dewata2014-07-071-0/+1
| | | | | | | | | | | | | | | To simplify the usage, the SystemCertClient.get_transport_cert() has been modified to parse and decode the PEM certificate in CertData object, store the DER certificate back into the object, and return the CertData object to the client. This way the client will have access to the certificate attributes and both PEM and DER certificates. The PKIService.sendConditionalGetResponse() has been fixed to use the requested format. This is needed to display the transport certificate properly in the browser. Ticket #1062
* Added minimum search keyword length requirement.Endi S. Dewata2014-05-121-0/+3
| | | | | | | | | | Some REST services that accept search keywords have been modified to require a minimum length of 3 characters. The DEFAULT_SIZE constant has been moved into the base PKIService class to reduce multiple declarations. Ticket #920
* Fixed message format for PKIException.Endi S. Dewata2014-05-071-2/+10
| | | | | | | | | | | Previously PKIException was not displayed properly in browser because it doesn't have a writer for HTML. Now the exception mapper will compute the message format properly, and will default to XML. The exception mapper itself has been moved into a server package due to class dependency. The REST application classes have been updated accordingly. Ticket #554
* Fixed missing Accept header handling.Endi S. Dewata2014-04-151-1/+20
| | | | | | | Some clients might not send the Accept header when invoking the REST services. To handle this the REST services have been modified to use the Content-type if the Accept header is missing, or use a default message format if Content-type is not specified.
* Changes to KeyClient on the java side.Abhishek Koneru2014-03-191-4/+1
| | | | | The KeyClient class on the java side is modified to have a similar design as the KeyClient class on the python side.
* Removed redundant GenericServlet.destroy() invocation.Endi S. Dewata2014-03-171-1/+0
| | | | | | | | The CMSStartServlet has been modified to remove the code that calls GenericServlet.destroy() because it is an empty default implementation which was intended to provide convenience for writing servlets. Ticket #896
* Direct deployment for TPS.Endi S. Dewata2014-03-071-7/+24
| | | | | | | | | | | | | | | | | | | The deployment tool has been modified to deploy TPS directly from the share folder. This way the TPS UI can be upgraded automatically with RPM upgrade without having to write upgrade scripts. For this to work, the TPS web application files cannot contain any slot parameters. So, the cfgPath parameter has been removed from web.xml, and the CMSStartServlet has been modified such that if the parameter is missing it would generate a default path matching the original value in web.xml. Also, the velocity.properties has been modified to use a fixed value for the file.resource.loader.path parameter pointing to the share folder. In the future other subsystems may be modified to use the same deployment mechanism. Ticket #748, #752, #499
* trac ticket #862 - TPS rewrite: provide connector service for JAVA-based TPS ↵Christina Fu2014-03-061-0/+11
| | | | subsystem
* Added CLI parameter to select message format.Endi S. Dewata2014-03-041-0/+41
| | | | | | | | | | | A new CLI parameter has been added to allow the user select the REST message format. This is done by setting the default consumes and produces when creating the client proxy. For this to work the hard-coded @Consumes and @Produces annotations need to be removed from the interface definition. A new interceptor has been added to validate the message format before executing the operation. Ticket #554
* Updated REST interface for users.Endi S. Dewata2014-02-181-2/+24
| | | | | | | | | | The REST interface for users has been modified to return Response objects to allow better handling of server responses. Other REST interfaces will be modified in subsequent patches. Once all interfaces are updated, the client library can be updated to use RESTEasy 3.0 API. Clients using the client library or XML/JSON directly are not affected by these changes. Ticket #554
* Fixed errors during Tomcat shutdown.Endi S. Dewata2013-10-281-0/+3
| | | | | | | | | Previously the CMS.shutdown() was called multiple times during Tomcat shutdown, one by CMSStarServlet.destroy() and the other by the shutdown hook, causing some errors. The shutdown hook should only be used in a standalone application, so it has been moved into CMS.main(). Bugzilla #1018628
* Reorganized server packages.Endi S. Dewata2013-10-2512-0/+4029
The tomcat, cms, and cmscore packages have been moved from base/common into separate folders in base/server so that they can be built separately.
generated by cgit (git 2.34.1) at 2024-06-21 20:48:53 +0000