summaryrefslogtreecommitdiffstats
path: root/base/server/cms/src/com/netscape/cms/servlet/csadmin
Commit message (Collapse)AuthorAgeFilesLines
* Add script to enable USN pluginAde Lee2016-04-151-0/+17
| | | | | | | | | | | | | | New authority monitor code requires the USN plugin to be enabled in the database to ensure that the entryUSN attribute is added to authority entries. In the case where this plugin was disabled, accessing this attribute resulted in a null pointer exception whch prevented server startup. The code has been changed so as not to throw a null pointer exception on startup if the entryusn is not present, and also to call an LDIF to enable the plugin when a subsystem is configured through pkispawn.
* Fixed exception handling in CertUtil.Endi S. Dewata2016-04-122-14/+18
| | | | | | | The CertUtil.createLocalCert() has been modified to re-throw the exception instead of ignoring it. https://fedorahosted.org/pki/ticket/1654
* Fixed pki pkcs12-import backward compatibility.Endi S. Dewata2016-04-081-7/+22
| | | | | | | | | | | | | For backward compatibility the pki pkcs12-import has been modified to generate default nicknames and trust flags for CA certificates if they are not specified in the PKCS #12 file. The PKCS12Util was also modified to find the certificate corresponding to a key more accurately using the local ID instead of the subject DN. The configuration servlet has been modified to provide better debugging information when updating the security domain. https://fedorahosted.org/pki/ticket/2255
* Fixed missing trust flags in certificate backup.Endi S. Dewata2016-04-041-22/+18
| | | | | | | | | | | | | | | | | | | | The ConfigurationUtils.backupKeys() has been modified to use PKCS12Util to export the certificates and their trust flags into a PKCS #12 file such that the file can be used for cloning. The code to generate PFX object has been refactored from the PKCS12Util.storeIntoFile() into a separate generatePFX() method. The PKCS12Util.loadCertFromNSS() has been modified to provide options to load a certificate from NSS database without the key or the certificate chain. The CLIs have been modified to provide the same options. The PKCS12Util.getCertInfo() has modified to ignore missing certificate attributes in the PKCS #12 file and generate a new local ID. https://fedorahosted.org/pki/ticket/2255
* Removed unnecessary URL encoding for admin cert request.Endi S. Dewata2016-03-211-2/+4
| | | | | | | | | Due to changes in aaacd71a2f125501645885d3da1de18459782572, when pki_import_admin_cert is set to False the installation code performs an unnecessary URL encoding for the admin certificate request. The extra URL encoding has now been removed. https://fedorahosted.org/pki/ticket/1803
* Added mechanism to import system certs via PKCS #12 file.Endi S. Dewata2016-02-261-37/+39
| | | | | | | | | | | | | | | | | | | | | | The installation tool has been modified to provide an optional pki_server_pkcs12_path property to specify a PKCS #12 file containing certificate chain, system certificates, and third-party certificates needed by the subsystem being installed. If the pki_server_pkcs12_path is specified the installation tool will no longer download the certificate chain from the security domain directly, and it will no longer import the PKCS #12 containing the entire master NSS database specified in pki_clone_pkcs12_path. For backward compatibility, if the pki_server_pkcs12_path is not specified the installation tool will use the old mechanism to import the system certificates. The ConfigurationUtils.verifySystemCertificates() has been modified not to catch the exception to help troubleshooting. https://fedorahosted.org/pki/ticket/1742
* Added mechanism to import existing CA certificate.Endi S. Dewata2015-11-251-0/+101
| | | | | | | | | | | The deployment procedure for external CA has been modified such that it generates the CA CSR before starting the server. This allows the same procedure to be used to import CA certificate from an existing server. It also removes the requirement to keep the server running while waiting to get the CSR signed by an external CA. https://fedorahosted.org/pki/ticket/456
* Refactored LDAPSecurityDomainSessionTable.Endi S. Dewata2015-10-291-3/+2
| | | | | | | The LDAPSecurityDomainSessionTable has been modified to throw an exception if there is a failure. https://fedorahosted.org/pki/ticket/1633
* Replaced legacy HttpClient.Endi S. Dewata2015-10-222-275/+245
| | | | | | | | | | | | | The ConfigurationUtils and CertUtil have been modified to use PKIConnection which uses Apache HttpClient instead of the legacy custom HttpClient. The POST request content is now created using MultivaluedMap. The PKIConnection has been modified to provide a get() method to send an HTTP GET request. The post() method was modified to accept a path parameter. https://fedorahosted.org/pki/ticket/342
* Removed unused WizardServlet.Endi S. Dewata2015-10-2223-6355/+40
| | | | | | | | | | The unused configuration wizard servlet has been removed to simplify refactoring other codes. The remaining references in CertUtil and ConfigurationUtils have been removed as well. https://fedorahosted.org/pki/ticket/1120
* Refactored SecurityDomainProcessor.Endi S. Dewata2015-10-132-42/+34
| | | | | | | | | | The SecurityDomainProcessor.getEnterpriseGroupName() has been added to simplify ConfigurationUtils.getGroupName(). The SecurityDomainProcessor.getInstallToken() has been modified to validate the user role and to generate safer session ID. https://fedorahosted.org/pki/ticket/1633
* Lightweight CAs: initial supportFraser Tweedale2015-09-261-9/+29
| | | | | | | | | | | | | This commit adds initial support for "lightweight CAs" - CAs that inhabit an existing CA instance and share the request queue and certificate database of the "top-level CA". We initially support only sub-CAs under the top-level CA - either direct sub-CAs or nested. The general design will support hosting unrelated CAs but creation or import of unrelated CAs is not yet implemented. Part of: https://fedorahosted.org/pki/ticket/1213
* Fixed pkidbuser group memberships.Endi S. Dewata2015-09-151-28/+59
| | | | | | | | | | | | Due to a certificate mapping issue the subsystem certificate can be mapped into either the subsystem user or pkidbuser, which may cause problems since the users don't belong to the same groups. As a temporary solution the pkidbuser is now added into the same groups. This way the client subsystem can always access the services regardless of which user the certificate is actually mapped to. https://fedorahosted.org/pki/ticket/1595
* Add code to reindex data during cloning without replicationAde Lee2015-07-311-30/+67
| | | | | | | | | | | | | When setting up a clone, indexes are added before the replication agreements are set up and the consumer is initialized. Thus, as data is replicated and added to the clone db, the data is indexed. When cloning is done with the replication agreements already set up and the data replicated, the existing data is not indexed and cannot be accessed in searches. The data needs to be reindexed. Related to ticket 1414
* Fix exception when talking to dogtag 9 systemsAde Lee2015-07-161-6/+3
| | | | | | | | | | | | | When getting a token from the security domain for a Dogtag 9 system, we first attempt to reach the REST interfaces. When this fails (with 404 exception), we catch the exception and try the old interfaces. The exception being thrown has been changed from the deprecated ClientResponseFailure to being wrapped in a PKIException, so the code catching the exception needs to be modified accordingly. Ticket 1495
* Fixed PKCS12Export output.Endi S. Dewata2015-07-151-1/+3
| | | | | | | | | | | | The PKCS12Export has been modified such that if an error occurs in normal mode it will display the error message and in debug mode it will display the full stack trace. The code has also been refactored such that it can be reused as a library in addition to command-line tool. The code will now throw exceptions instead of exiting to the system. https://fedorahosted.org/pki/ticket/1224
* Fixed user-cert-add --serial with remote CA.Endi S. Dewata2015-07-091-6/+4
| | | | | | | | | | | | | | | | | The user-cert-add command has been modified to ask the user for the CA server URI if the CA is not available locally. A new SubsystemClient.exists() method has been added to check whether a subsystem is deployed on the target instance. The SubsystemCLI has been modified to call logout() only if the operation is executed successfully. The certificate approval callback class has been refactored out of PKIConnection into a separate class to clean up circular dependency with PKIClient. https://fedorahosted.org/pki/ticket/1448
* Fixed thread leaks during shutdown.Endi S. Dewata2015-06-183-12/+12
| | | | | | | | Various codes have been modified to properly stop threads during shutdown. A new ID attribute has been added to the LDAP connection factory classes to help identify leaking threads. https://fedorahosted.org/pki/ticket/1327
* Fix for HSM cloning issueMatthew Harmsen2015-06-171-0/+39
|
* Cleaned up log messages in ConfigurationUtils.getPortFromSecurityDomain().Endi S. Dewata2015-05-221-4/+16
| | | | https://fedorahosted.org/pki/ticket/1372
* Add nuxwdog functionality to DogtagAde Lee2015-04-221-4/+4
| | | | | | | | | | | | This is the first of several commits. This adds a LifecycleListener to call init() on the nuxwdog client before any connectors or webapps start up, and call sendEndInit() once initialization completes. Code is also added to prompt for and test required passwords on startup. All that is required to use nuxwdog is to start the server using nuxwdog. An environment variable will be set that will trigger creation of the NuxwdogPasswordStore. We expect tags for the required passwords to be in cms.passwordList
* Ticket 1316 Allow adding SAN to server cert during the install processChristina Fu2015-04-212-6/+103
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Usage: * under /usr/share/pki/ca/conf, you will find a new file called serverCert.profile.exampleWithSANpattern * copy existing serverCert.profile away and replace with serverCert.profile.exampleWithSANpattern * edit serverCert.profile.exampleWithSANpattern - follow the instruction right above 8.default. - save and quit * cd /usr/share/pki/ca/profiles/ca , edit caInternalAuthServerCert.cfg - follow the instruction right above policyset.serverCertSet.9 - save and quit * save away and edit the ca config file for pkispawn: (note: you can add multiple SAN's delimited by ',' for pki_san_server_cert - add the following lines, e.g. pki_san_inject=True pki_san_server_cert=host1.Example.com - do the same pkispawn cfg changes for kra or any other instances that you plan on creating * create your instance(s) check the sl sever cert, it should contain something like the following: Identifier: Subject Alternative Name - 2.5.29.17 Critical: no Value: DNSName: host1.Example.com
* Fixed exception chains in ConfigurationUtils.Endi S. Dewata2015-01-211-16/+24
| | | | | | | The ConfigurationUtils has been modified such that if an exception is triggered by another exception the exceptions will be chained. https://fedorahosted.org/pki/ticket/915
* Ticket #864 866 (part 1 symkey, common) NIST SP800-108 KDFChristina Fu2014-12-191-0/+3
| | | | | - this patch does not include TPS side of changes: (#865 needs to be rewritten in Java)
* Cleaned up clone installation code.Endi S. Dewata2014-12-121-107/+97
| | | | | The code in ConfigurationUtils has been cleaned up and reformatted to improve readability.
* Fixed problem importing renewed system certificate.Endi S. Dewata2014-12-121-46/+137
| | | | | | | | | | | | Previously during clone installation if the PKCS12 file contains both expired and renewed certificates the code might incorrectly import the expired certificate instead of the renewed one, thus failing the installation. The code has been fixed to validate the certificates in the PKCS12 file such that only the valid ones will be imported into the clone. https://fedorahosted.org/pki/ticket/1093
* Bug1151147 issuerDN encoding correctionChristina Fu2014-10-231-2/+14
|
* ticket #1110 pkispawn (configuration) does not provide CA extensions in ↵Christina Fu2014-09-251-1/+77
| | | | subordinate certificate signing requests (CSR)
* Check for null values in GetConfigEntriesAde Lee2014-09-041-4/+7
| | | | Ticket 1142
* Fix kra-connector-removeAde Lee2014-09-021-2/+5
| | | | | | | | | | | | | | | | | | | | The code to remove the connector from the pki CLI was found to be broken because of invalid message type (partly due to void returns). On uninstall, we need to remove the kra-connector from all relevant CA's in the security domain. The best way to do this is to keep kra-connector info in LDAP, so that only one call is needed. Until that change has been made, we are adding a hack to remove the connector from all CA's in the secutrity domain (if it exists). Due to issues with proxy configurations, we will continue to use sslget and a url-encoded-form version of the servlet. In addition, it was found that when removing a KRA from a shared subsystem, the updateDomainXML servlet was erroneously returning failure when it was unsuccessful in removing a non-existent user from a group. Ticket 1113
* Add ability to create database as subtree of existing treeAde Lee2014-07-171-158/+237
| | | | | | | | | | | | | | | | This patch adds the ability to create a subsystem that uses an existing subtree to create the internal basedn. This is useful for instance, for IPA which will use the original o=ipaca as the top level DN for a KRA, which will be situated at o=ipadrm, o=ipaca. The patch also allows such a system to be cloned, but not to setup the replication agreements, on the assumption that the data is already being replicated at the top-level DN or some higher level. The patch also contains some minor cleanups - removing unused imports and removal of an invalid reference in the python code. Ticket 1051
* Remove legacy 'systemctl' filesMatthew Harmsen2014-07-032-13/+28
| | | | - PKI TRAC Ticket #832 - Remove legacy 'systemctl' files . . .
* Fix minor user creation issueAde Lee2014-05-291-5/+11
|
* Prevent LDAP Attributes from being affected by LocaleMatthew Harmsen2014-05-201-5/+5
| | | | | * PKI TRAC Ticket #946 - Installation of IPA hangs up when LANG is set to tr_TR.UTF8
* Fixed ConfigurationUtils.setupDBUser().Endi S. Dewata2014-05-051-10/+16
| | | | | | | | | | Previously the ConfigurationUtils.setupDBUser() was using findUsers() to get a list of users and then only use the first one. It has been replaced with getUser() which will return the user directly. If the user doesn't exist, findUsers() will throw an exception whereas the getUser() will return null, so the try-catch block has been removed. Ticket #920
* Fixed TPS connector configuration.Endi S. Dewata2014-04-301-45/+0
| | | | | | | | | | | | | | | | | | | | The code that configures the TPS connectors during installation has been modified to use the ConnectionDatabase, which is also used by the CLI/UI after the installation. The code has also been fixed to configure the correct properties as defined in CS.cfg. The static properties have been removed from CS.cfg because now they will be generated dynamically by the ConnectionDatabase. Due to class dependency issue, the methods for configuring the TPS connectors have been moved from ConfigurationUtils into a new TPSInstaller class. The URI's in ConfigurationRequest have been converted from String into URI to simplify validation. Ticket #890
* Reorganized TPS installer classes.Endi S. Dewata2014-04-253-461/+0
| | | | | | | | Some TPS-specific installation wizard panels have been moved from the common server package into the TPS package. The build script has been fixed accordingly. Ticket #890
* Share subsystem cert in shared tomcat instancesAde Lee2014-03-311-2/+2
| | | | | | | | | | In shared tomcat instances, we need to share the subsystem cert and not create a new one for each additional subsystem added to the instance. In addition, if the instances share the same database, then only one pkidbuser should be created with the relevant subsystem cert and seeAlso attribute. Ticket 893
* Sign CA clone sslserver certificate using CA master.Matthew Harmsen2014-03-201-2/+64
| | | | | * Dogtag TRAC Ticket #816 - pki-tomcat cannot be started after installation of ipa replica with ca
* Changes to KeyClient on the java side.Abhishek Koneru2014-03-191-3/+3
| | | | | The KeyClient class on the java side is modified to have a similar design as the KeyClient class on the python side.
* Reorganized REST service classes.Endi S. Dewata2014-02-283-1371/+2
| | | | | | | | The REST service classes have been moved into org.dogtagpki.server namespace. A new upgrade script has been added to update existing instances. Ticket #114
* Upgraded RESTEasy client library.Endi S. Dewata2014-02-273-15/+52
| | | | | | | | | | The Dogtag client library has been modified to use RESTEasy 3.0 client library. A new upgrade script has been added to update existing servers. The JAXB annotation in ResourceMessage has been modified to require explicit property mapping. Ticket #554
* Fix eclipse warnings.Ade Lee2014-02-191-5/+0
|
* Fixed database cleanup issues.Endi S. Dewata2013-11-082-228/+207
| | | | | | | | | The configuration code has been modified not to remove the LDAP database folder since it may not have access to it. It will also not continue with the cleanup if the database is used by another subtree. Manual removal of old entries in the subtree is redundant so the code has been removed. The exception handling has been improved as well.
* Fixed return code for user and group services.Endi S. Dewata2013-11-073-32/+24
| | | | | | | | | The user and group services have been modified to return consistent HTTP return codes under various situations. The UGSubsystem has been modified to capture any LDAP exceptions and throw the proper PKIException subclass that represents the appropriate HTTP error code for the situation. Ticket #669, #749
* Renamed Processor to CAProcessor.Endi S. Dewata2013-11-011-2/+2
| | | | | | The Processor class depends on CertificateAuthority subsystem which only exists on CA, so the class has been renamed to CAProcessor to reflect the dependency.
* Fixed logic for setting admin cert signing algorithmAde Lee2013-10-311-44/+79
| | | | | Should now be SHA256 by default. Bugzilla BZ 1024445
* Reorganized server packages.Endi S. Dewata2013-10-2553-0/+17433
The tomcat, cms, and cmscore packages have been moved from base/common into separate folders in base/server so that they can be built separately.
generated by cgit (git 2.34.1) at 2024-05-20 02:13:44 +0000