summaryrefslogtreecommitdiffstats
path: root/base/server/python/pki/server
Commit message (Collapse)AuthorAgeFilesLines
...
* Fixed migration tool to update Tomcat libraries.Endi S. Dewata2015-05-062-7/+44
| | | | | | | | The migration tool has been fixed to update the links to Tomcat libraries in the instance folder to match the current Tomcat version installed on the system. https://fedorahosted.org/pki/ticket/1353
* Fix interactive install to not reprompt for portsAde Lee2015-04-291-0/+20
| | | | | Ports are already set when deploying into an existing instance. Having a user re-enter these is repetitious and error prone.
* Trac Ticket 1196 - serverCertNick.conf is replaced incorrectlyAde Lee2015-04-291-1/+3
| | | | | When second subsystem is installed, serverCertNick.conf and other top level tomcat config files should not be replaced.
* Code cleanup - simplify pkispawn codeAde Lee2015-04-2910-749/+716
| | | | | All subsystems are now tomcat instances. Conditionals based on whether the subsystem is a tomcat instance or not are no longer required.
* Add ability to pki-server to enable/disable nuxwdog for an instanceAde Lee2015-04-282-2/+444
| | | | | | This adds the ability to either enable or disable an instance using the pki-server utility. Additional documentation and additions to the man pages will be added in a separate patch.
* Fixed problem deploying without theme.Endi S. Dewata2015-04-241-12/+13
| | | | | | | The deployment tool has been modified to deploy the pki.xml only if the theme package is installed. https://fedorahosted.org/pki/ticket/499
* Added direct deployment for theme.Endi S. Dewata2015-04-231-25/+35
| | | | | | | | The deployment tool has been modified to deploy the theme files directly from /usr/share/pki. New deployment descriptors have been added for admin templates and JS library. https://fedorahosted.org/pki/ticket/499
* Added direct deployment for all subsystems.Endi S. Dewata2015-04-223-114/+3
| | | | | | | | The deployment tool has been modified to deploy all subsystems directly from the /usr/share/pki. This will simplify updating the templates in the web applications. https://fedorahosted.org/pki/ticket/499
* Changes to config files to support nuxwdogAde Lee2015-04-221-0/+7
| | | | Specifically changes to CS.cfg, server.xml and tomcat.conf
* Add nuxwdog functionality to DogtagAde Lee2015-04-221-0/+7
| | | | | | | | | | | | This is the first of several commits. This adds a LifecycleListener to call init() on the nuxwdog client before any connectors or webapps start up, and call sendEndInit() once initialization completes. Code is also added to prompt for and test required passwords on startup. All that is required to use nuxwdog is to start the server using nuxwdog. An environment variable will be set that will trigger creation of the NuxwdogPasswordStore. We expect tags for the required passwords to be in cms.passwordList
* Only read pki_profiles_in_ldap when spawning CA instanceFraser Tweedale2015-04-221-5/+4
|
* Ticket 1316 Allow adding SAN to server cert during the install processChristina Fu2015-04-212-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Usage: * under /usr/share/pki/ca/conf, you will find a new file called serverCert.profile.exampleWithSANpattern * copy existing serverCert.profile away and replace with serverCert.profile.exampleWithSANpattern * edit serverCert.profile.exampleWithSANpattern - follow the instruction right above 8.default. - save and quit * cd /usr/share/pki/ca/profiles/ca , edit caInternalAuthServerCert.cfg - follow the instruction right above policyset.serverCertSet.9 - save and quit * save away and edit the ca config file for pkispawn: (note: you can add multiple SAN's delimited by ',' for pki_san_server_cert - add the following lines, e.g. pki_san_inject=True pki_san_server_cert=host1.Example.com - do the same pkispawn cfg changes for kra or any other instances that you plan on creating * create your instance(s) check the sl sever cert, it should contain something like the following: Identifier: Subject Alternative Name - 2.5.29.17 Critical: no Value: DNSName: host1.Example.com
* Added server migration command.Endi S. Dewata2015-04-213-2/+527
| | | | | | | | | | | | New pki-server CLI commands have been added to migrate the server configuration from Tomcat 7 to Tomcat 8 and vice versa. These commands can be used later during system upgrade to migrate existing instances from Tomcat 7 in F22 to Tomcat 8 in F23. The Python CLI framework has been refactored to provide a way to find other CLI modules by the command names. https://fedorahosted.org/pki/ticket/1264
* Add HSM passwords to pkispawnMatthew Harmsen2015-04-213-4/+66
| | | | - PKI TRAC Ticket #1200 - make sure pkispawn works with hsm (passwords)
* Add HSM options to pkispawnMatthew Harmsen2015-04-143-0/+74
| | | | - PKI TRAC Ticket #1346 - pkispawn should have an HSM library option
* pki-tomcatd fails to start on system bootMatthew Harmsen2015-04-134-14/+133
| | | | | - PKI TRAC Ticket #1315 - pki-tomcatd fails to start on system boot - PKI TRAC Ticket #1340 - pkidestroy should not remove /var/lib/pki
* Add pkispawn config option for ldap profilesFraser Tweedale2015-04-131-0/+6
| | | | | | Add the `pki_profiles_in_ldap' pkispawn config to control whether profiles are stored on the filesystem (old behaviour) or LDAP (new behaviour). The default is file-based profiles.
* Allow use of secure LDAPS connectionMatthew Harmsen2015-03-134-7/+52
| | | | - PKI TRAC Ticket #1144 - pkispawn needs option to specify ca cert for ldap
* PKI TRAC Ticket #1284 - pkispawn URL redirect issue (simple fix)Matthew Harmsen2015-03-061-1/+3
|
* Fixed pylint report.Endi S. Dewata2015-02-055-20/+20
| | | | | | | | | | | | | | | Previously pylint report was saved it into a file which may not be accessible on a build system. The pylint-build-scan.sh has been changed to display the report so it will appear in the build log. The pylint configuration has also been modified to disable C and R messages by default. This way when other errors or warnings occur the build will fail without having to check for specific codes. Some Python codes have been modified to reduce the number of pylint warnings. https://fedorahosted.org/pki/ticket/703
* Updated Resteasy and Jackson dependenciesEndi S. Dewata2015-02-031-30/+0
| | | | | | | | | | In Fedora 22 the Resteasy package has been split into several subpackages. The pki-core.spec has been modified to depend on more specific Resteasy packages which depend only on Jackson 1.x. The classpaths and various scripts have been modified to remove unused references to Jackson 2.x. https://fedorahosted.org/pki/ticket/1254
* Added server management CLI.Endi S. Dewata2015-01-283-0/+561
| | | | | | | | | | | | | A new pki-server CLI has been added to manage the instances and subsystems using the server management library. This CLI manages the system files directly, so it can only be run locally on the server by the system administrator. The autoDeploy setting in server.xml has been enabled by default. An upgrade script has been added to enable the autoDeploy setting in existing instances. https://fedorahosted.org/pki/ticket/1183
* Added server management library.Endi S. Dewata2015-01-282-28/+143
| | | | | | | | | | | | | | | The PKISubsystem and PKIInstance classes used by the upgrade framework have been converted into a server management library. They have been enhanced to provide the following functionalities: * starting and stopping instances * enabling and disabling subsystems * checking instance and subsystem statuses The validate() invocation has been moved out of the constructors into the upgrade framework such that these objects can be created to represent subsystems and instances that do not exist yet. https://fedorahosted.org/pki/ticket/1183
* Moved web application deployment locations.Endi S. Dewata2015-01-284-37/+89
| | | | | | | | | | | | | Currently web applications are deployed into Host's appBase (i.e. <instance>/webapps). To allow better control of individual subsystem deployments, the web applications have to be moved out of the appBase so that the autoDeploy can work properly later. This patch moves the common web applications to <instance>/ common/webapps and subsystem web applications to <instance>/ <subsystem>/webapps. An upgrade script has been added to update existing deployments. https://fedorahosted.org/pki/ticket/1183
* Fix-for-Bug-1170867-TPS-Installation-FailedJack Magne2014-12-163-6/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix now includes last review comments where we decided to consolidate 3 of the ldif files: schema.ldif,database.ldif, and manager.ldif. Each one of these 3 files contains the data needed for any subsystem for that file. The subsystem specific files for these 3 go away in the source tree. The first iteration of this fix was copying these 3 files into an undesirable directory. This is no longer the case. Extra code in the python installer allows one to establish a "file exclusion" callback to keep a set of desired files from being copied when the installer does a directory copy. All subsystems have been tested, including TPS with a brand new DS (which was the original reason for this fix), and they appear to work fine. Addressed further review comments: 1. Removed trailing whitespace instances from schema.ldif which had some. 2. Used pycharm to remove the few PEP violations I had previously added to the Python code. 3. Changed the format of the schema.ldif file to make all the entries use the same style. Previously the TPS entries was using an all in one syntax. No more since now each entry is separate. 4. Changed the name of an argument in one of the new Python methods to get rid of a camelCase instance. 5. Tested everything to work as before, including basic TPS operations such as Format. Fixed a method comment string and fixed some typos.
* Remove legacy multilib JNI_JAR_DIR logicMatthew Harmsen2014-12-041-1/+2
| | | | | | | | | | | | | | | | * Bugzilla Bug #1165351 - Errata TPS test fails due to dependent packages not found (cherry picked from commit d7a0807b7493fc3d86900ee4aaf8199efd824907) Conflicts: base/java-tools/templates/pki_java_command_wrapper.in base/java-tools/templates/pretty_print_cert_command_wrapper.in base/java-tools/templates/pretty_print_crl_command_wrapper.in base/server/python/pki/server/deployment/pkiparser.py base/server/scripts/operations (cherry picked from commit c8d73ade2c651fd5ca01226c89d5d19828bfc9b7)
* Ticket 1198 Bugzilla 1158410 add TLS range support to server.xml by default ↵Christina Fu2014-11-241-2/+41
| | | | and upgrade
* Fix sub-CA installation with own security domainAde Lee2014-10-012-12/+20
| | | | | | | | | Installation code failed to anticipate installation of a subordinate CA that would host its own security domain. This patch includes changes to python installation code, java configuration servlet and changes to man pages. Ticket 1132
* ticket #1110 pkispawn (configuration) does not provide CA extensions in ↵Christina Fu2014-09-252-0/+28
| | | | subordinate certificate signing requests (CSR)
* Remove Apache info from pkispawn and pkidestroyMatthew Harmsen2014-09-0211-208/+20
| | | | - PKI TRAC Ticket #1077 - Consider removing [Apache] section from 'default.cfg'
* Fix kra-connector-removeAde Lee2014-09-023-20/+69
| | | | | | | | | | | | | | | | | | | | The code to remove the connector from the pki CLI was found to be broken because of invalid message type (partly due to void returns). On uninstall, we need to remove the kra-connector from all relevant CA's in the security domain. The best way to do this is to keep kra-connector info in LDAP, so that only one call is needed. Until that change has been made, we are adding a hack to remove the connector from all CA's in the secutrity domain (if it exists). Due to issues with proxy configurations, we will continue to use sslget and a url-encoded-form version of the servlet. In addition, it was found that when removing a KRA from a shared subsystem, the updateDomainXML servlet was erroneously returning failure when it was unsuccessful in removing a non-existent user from a group. Ticket 1113
* Disable PKI GUI ConfigurationMatthew Harmsen2014-08-284-47/+0
| | | | - PKI TRAC Ticket #1120 - Remove Firefox PKI GUI Configuration Panel Interface
* Fix issues found by pycharmAde Lee2014-08-061-12/+15
| | | | Some formatting, uninitialized variables.
* Fix pkidestroy for proxy portsAde Lee2014-08-061-0/+8
| | | | | | | | Current pkidestroy fails to remove a system that has been configured to use proxy ports because the wrong ports are passed into the updateDomainXML servlet. This small patch fixes this problem. Ticket #1095
* Fix independent pkispawn installation and configurationMatthew Harmsen2014-08-044-21/+22
| | | | | * PKI TRAC Ticket #905 - 2 Step Configuration of CA instance using pkispawn fails
* Add ability to create database as subtree of existing treeAde Lee2014-07-171-1/+2
| | | | | | | | | | | | | | | | This patch adds the ability to create a subsystem that uses an existing subtree to create the internal basedn. This is useful for instance, for IPA which will use the original o=ipaca as the top level DN for a KRA, which will be situated at o=ipadrm, o=ipaca. The patch also allows such a system to be cloned, but not to setup the replication agreements, on the assumption that the data is already being replicated at the top-level DN or some higher level. The patch also contains some minor cleanups - removing unused imports and removal of an invalid reference in the python code. Ticket 1051
* Remove legacy 'systemctl' filesMatthew Harmsen2014-07-031-1/+1
| | | | - PKI TRAC Ticket #832 - Remove legacy 'systemctl' files . . .
* More formatting changesAde Lee2014-06-103-185/+199
| | | | | Improve the layout of strings in pkimessages and fix a couple more PEP 8 issues.
* Fix pycharm warnings for server python classesAde Lee2014-06-109-659/+847
| | | | | Mostly reformatting due to PEP8. Not all pycharm warnings are addressed, but the vast majority are.
* Reformat scriptlets to be in line with PEP8Ade Lee2014-06-109-248/+400
| | | | Mostly handle pycharm warnings about code formatting.
* Modify master_dict to mdict to improve readabilityAde Lee2014-06-1012-1199/+1204
| | | | | | Most of the install python scripts do not meet PEP8 including being less than 80 chars. Changing master_dict to mdict helps fix this and improves or at least does not degrade readability.
* TPS Token Profile Resolver Framework - part2Christina Fu2014-06-042-0/+7
|
* fix issues identified by pycharm for system.pyAde Lee2014-05-292-4/+4
|
* Correct debug message in 'pkiconfig.py'Fraser Tweedale2014-05-211-3/+5
| | | | | | | The instructions for enabling external debugging shown during installation is incorrect. Fix the message. Ticket #937
* PhoneHome feature:Jack Magne2014-04-152-0/+10
| | | | | | 1. Provides an xml file served by TPS to allow the client(esc) to configure itself to contact TPS. 2. Edewata review fixes. Return application/xml instead of text/xml, and fix how the phone home file path is calculated.
* Share subsystem cert in shared tomcat instancesAde Lee2014-03-311-0/+32
| | | | | | | | | | In shared tomcat instances, we need to share the subsystem cert and not create a new one for each additional subsystem added to the instance. In addition, if the instances share the same database, then only one pkidbuser should be created with the relevant subsystem cert and seeAlso attribute. Ticket 893
* Added 'daemon-reload' methodMatthew Harmsen2014-03-181-4/+130
| | | | | | | | | | | | * PKI TRAC Ticket #869 - f19 ipa-server-install fails at step 6/22 of cert sys install - systemctl start pki-tomcatd.target fails * Cleaned up Pylint errors on Python Systemd class - Changed Systemd from old-style class to new-style class - Added Docstrings to all Systemd methods and functions - R:3078, 4: Method could be a function (no-self-use): NOTE: Although pylint reports that daemon_reload() could be declared as a function rather than a method, removal of the 'self' argument resulted in a compilation error.
* Direct deployment for TPS.Endi S. Dewata2014-03-072-22/+47
| | | | | | | | | | | | | | | | | | | The deployment tool has been modified to deploy TPS directly from the share folder. This way the TPS UI can be upgraded automatically with RPM upgrade without having to write upgrade scripts. For this to work, the TPS web application files cannot contain any slot parameters. So, the cfgPath parameter has been removed from web.xml, and the CMSStartServlet has been modified such that if the parameter is missing it would generate a default path matching the original value in web.xml. Also, the velocity.properties has been modified to use a fixed value for the file.resource.loader.path parameter pointing to the share folder. In the future other subsystems may be modified to use the same deployment mechanism. Ticket #748, #752, #499
* Upgraded RESTEasy client library.Endi S. Dewata2014-02-271-0/+4
| | | | | | | | | | The Dogtag client library has been modified to use RESTEasy 3.0 client library. A new upgrade script has been added to update existing servers. The JAXB annotation in ResourceMessage has been modified to require explicit property mapping. Ticket #554
* Added decorator to handle exceptionsAde Lee2014-02-192-5/+5
| | | | | | Decorator catches HttpErrorExceptions from Requests and extracts the relevant PKIException object, and rethrows it.
generated by cgit (git 2.34.1) at 2024-06-16 13:03:48 +0000