summaryrefslogtreecommitdiffstats
path: root/base/server
Commit message (Collapse)AuthorAgeFilesLines
...
* Add parameters to disable cert or crl publishingAde Lee2016-05-248-71/+87
| | | | | | | | | | | | | | | | | | | | | | | | | | Right now, if publishing is enabled, both CRLs and Cert publishing is enabled. This causes a bunch of spurious error messages on IPA servers as cert publishing is not configured. As it is impossible to determine if cert publishing is not desired or simply misconfigured, we provide options to explicitly disable either cert or crl publishing. Specifically: * to enable/disable both cert and crl publishing: ca.publish.enable = True/False This is the legacy behavior. * to enable CRL publishing only: ca.publish.enable = True ca.publish.cert.enable = False * to enable cert publishing only: ca.publish.enable = True ca.publish.crl.enable = False Ticket 2275
* Ignoring blank and comment lines in configuration files.Endi S. Dewata2016-05-241-2/+11
| | | | | | | | | The PKISubsystem.load() and PKIInstance.load() have been modified to ignore blank and comment lines in CS.cfg and password.conf. If the code fails to parse a line it will throw an exception showing the location of the invalid line. https://fedorahosted.org/pki/ticket/2314
* Added TPS UI for managing user certificates.Endi S. Dewata2016-05-242-14/+30
| | | | | | | | | The TPS UI has been modified to provide an interface to manage the user certificates. The UserService has been modified to provide better error messages. https://fedorahosted.org/pki/ticket/1434
* Added TPS UI for managing user roles.Endi S. Dewata2016-05-241-21/+27
| | | | | | | | | | The TPS UI has been modified to provide an interface to manage the user roles. The ErrorDialog was modified to handle both text and JSON error responses. https://fedorahosted.org/pki/ticket/2267
* Port symkey JNI to Java classes.Jack Magne2016-05-235-64/+2080
| | | | | | | | | | | | | | | | | | | | | Ticket #801 : Merge pki-symkey into jss What is supported: 1. Everything that is needed to support Secure Channel Protocol 01. 2. Supports the nist sp800 kdf and the original kdf. 3. Supports key unwrapping used by TPS which was formerly in the symkey JNI. Requires: 1. A new JSS that supports more advanced symkey operations such as key derivation, more advanced key unwrapping , and a way to list and identify a given symmetric key by name. Version of new Jss will be forthcoming. Still to do: 1. Port over the 2 or 3 SCP02 routines from Symkey to use this code. 2. The original symkey will remain in place until we can port over everything. 3. SCP03 support can be added later.
* Lightweight CAs: add missing authoritySerial attr to default schemaFraser Tweedale2016-05-141-1/+2
|
* Renamed pki-server ca-db-upgrade to db-upgrade.Endi S. Dewata2016-05-143-81/+133
| | | | | | | | | The pki-server ca-db-upgrade command has been renamed to db-upgrade to be more general. In the future the command can be refactored to handle additional upgrade scripts. Additional log messages have been added to show the upgrade activities in verbose mode. https://fedorahosted.org/pki/ticket/1667
* Add pki-server ca-db-upgrade commandFraser Tweedale2016-05-141-0/+81
| | | | | | | | | Add the 'ca-db-upgrade' command to 'pki-server'. This command updates certificate records to add the issuerName attribute where missing. If other database updates are needed in future, they can be added to this command. Part of: https://fedorahosted.org/pki/ticket/1667
* Fixed pki-server subsystem-cert-validate command.Endi S. Dewata2016-05-131-32/+83
| | | | | | | | | | | | | | | | | The system certificate validation command has been modified to check for both 'internal' and 'Internal Key Storage Token' since both are valid names for the internal token. Additional checks have been added to validate the certificate parameters in CS.cfg. The output of the command has been modified to be more consistent with other pki-server commands. The pki client-cert-validate invocation has been fixed to use -C option to specify the NSS database password in a file. https://fedorahosted.org/pki/ticket/2043
* Added log messages for pre-op mode.Endi S. Dewata2016-05-1311-62/+89
| | | | | | | To help troubleshooting the code has been modified to log more detailed information in pre-op mode. https://fedorahosted.org/pki/ticket/1654
* Reject cert request if resultant subject DN is invalidFraser Tweedale2016-05-131-10/+6
| | | | | | | | | An unparseable subject DN is ignored, causing NPE in subsequent processing becaues the subject DN was not set. Throw ERejectException if the subject DN is invalid, to ensure that a useful response can be returned to the requestor. Fixes: https://fedorahosted.org/pki/ticket/2317
* Update default values of connectionTimeout to format smart cardsJack Magne2016-05-122-2/+4
| | | | | | | Ticket #1921 Trivial fix to add or up this connectionTimeout value to 80000 or 80 secs. Fix already tested informally in the field by QE.
* Fixed missing CSR extensions for external CA case.Endi S. Dewata2016-05-121-1/+22
| | | | | | | | The deployment tool has been modified to generate CSR with basic constraints and key usage extensions for the externally-signed CA signing certificate. https://fedorahosted.org/pki/ticket/2312
* Fixed error handling ConfigurationUtils.handleCertRequest().Endi S. Dewata2016-05-122-29/+36
| | | | | | | The ConfigurationUtils.handleCertRequest() has been modified to throw an exception on error during CSR generation instead of silently ignoring it. The method has also been renamed to generateCertRequest() for clarity.
* Fixed install-only message in external CA case.Endi S. Dewata2016-05-124-21/+12
| | | | | | | | | | | | | | | | | | Previously, in external CA case if pkispawn was executed with pki_skip_configuration=True, it would stop the execution before the step 1 was fully completed (i.e. generating CSR), but it would incorrectly show a message indicating the CSR has been generated. The code that displays the installation summary has been fixed to check for pki_skip_configuration first before checking for external CA case to ensure that it displays the appropriate message for each step. The code that generates the Tomcat instance systemd service link was moved into instance_layout.py to avoid redundant executions. The pkispawn and pkidestroy have also be modified to remove redundant log of deployment parameters in master dictionary.
* Fix existing ca setup to work with HSMAde Lee2016-05-122-2/+7
| | | | | | If the existing CA keys are in an HSM, the code fails to load the keys becauseit does not take into account the full nickname. This small fix addresses this bug.
* Support certificate search by issuer DN.Fraser Tweedale2016-05-101-0/+10
| | | | | | | | Now that Dogtag can host multiple CAs in a single instance, add a certificate search parameter for limiting searches to a particular issuer. Fixes: https://fedorahosted.org/pki/ticket/2321
* Add migration script for realm changes in registry.cfgAde Lee2016-05-091-0/+80
| | | | Part of Ticket 2041
* Add authz realm check for cert enrollmentAde Lee2016-05-092-0/+14
| | | | Ticket 2041
* Fix error output when request is rejectedAde Lee2016-05-097-16/+62
| | | | | | | With this fix, error messages are returned to the user when a request is rejected - either in the UI or from the pki CLI. Trac Ticket 1247 (amongst others)
* Add realm to requests coming in from CAAde Lee2016-05-095-12/+237
| | | | | | | | | | | | | | | | Requests to the KRA through the CA-KRA connector use the Enrollment Service. This has been modified to read and store any realm passed in. The realm can be added to the request by havibg the admin add a AuthzRealmDefault and AuthzRealmConstraint in a profile. At this point, all the constraint does is verify that the realm is one of a specified list of realms. More verification will be added in a subsequent patch. No attempt is made yet to allow users to specify the realm. This would need to be added as a ProfileInput. Part of Ticket 2041
* Added deployment parameters for number ranges.Endi S. Dewata2016-05-093-5/+15
| | | | | | | | | | | New deployment parameters have been added to customize the serial number range, request number range, and replica number range in CS.cfg during installation. The code that generates the CS.cfg has been moved closer to the code that generates the subsystem configuration folder. https://fedorahosted.org/pki/ticket/2278
* Simplified slot substitution.Endi S. Dewata2016-05-091-0/+54
| | | | | | | | | Previously a deployment parameter has to be added to pkislots.cfg before it can be used in copy_with_slot_substitution(). The method has been modified to support substitutions using the deployment parameters directly, which simplifies the development. https://fedorahosted.org/pki/ticket/2278
* Lightweight CAs: fix bad import in key retriever scriptFraser Tweedale2016-05-091-1/+1
| | | | Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: allow specifying authority via ProfileSubmitServletFraser Tweedale2016-05-091-1/+19
| | | | | | | | Lightweight CAs were supported in REST-based request submission, but not via ProfileSubmitServlet, however, FreeIPA currently uses ProfileSubmitServlet, so make it possible to use lightweight CAs. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: add IPACustodiaKeyRetrieverFraser Tweedale2016-05-032-0/+56
| | | | | | | | | | | | Add 'IPACustodiaKeyRetriever', a 'KeyRetriever' implementation for use when Dogtag is deployed as a FreeIPA CA. The Java class invokes 'pki-ipa-retrieve-key', a Python script that retrieves lightweight CA keys from the Custodia server on a replica that possesses the keys. 'pki-ipa-retrieve-key' depends on FreeIPA libraries, FreeIPA server configuration, and Kerberos and Custodia keys owned by 'pkiuser'. Part of: https://fedorahosted.org/pki/ticket/1625
* Lightweight CAs: authority schema changesFraser Tweedale2016-05-032-14/+17
| | | | | | | | | | | | Add the 'authorityKeyHost' attribute which will contain names of hosts that possess the authority's signing keys. Add the 'authoritySerial' attribute which may contain the serial number of the certificate most recently issued for the authority. Change other attributes to be single-valued. Part of: https://fedorahosted.org/pki/ticket/1625
* Fix NSSDB certificate search methodFraser Tweedale2016-05-031-1/+1
| | | | | | | | | | | | | | | 'getX509CertFromToken' erroneously compares Issuer DN of given cert with Subject DNs of cert in NSSDB. It falsely returns the parent of the target cert, if the certs have the same serial number. In the context of how this method is used, it causes the deletion of an external CA certificate from the NSSDB if the serial numbers match, and subsequent certificate verification failure when connecting to LDAP. Update the method to check the Issuer DN. Fixes: https://fedorahosted.org/pki/ticket/2301
* Add validity check for the signing certificate in pkispawnAde Lee2016-05-022-15/+68
| | | | | | | | When either an existing CA or external CA installation is performed, use the pki-server cert validation tool to check the signing certiticate and chain. Ticket #2043
* Add CLI to check system certificate statusAde Lee2016-05-022-0/+120
| | | | | | | | | | | | | | | | | | | We add two different calls: 1. pki client-cert-validate - which checks a certificate in the client certdb and calls the System cert verification call performed by JSS in the system self test. This does some basic extensions and trust tests, and also validates cert validity and cert trust chain. 2. pki-server subsystem-cert-validate <subsystem> This calls pki client-cert-validate using the nssdb for the subsystem on all of the system certificates by default (or just one if the nickname is defined). This is a great thing to call when healthchecking an instance, and also will be used by pkispawn to verify the signing cert in the externally signed CA case. Trac Ticket 2043
* Fixed duplicate executions of finalization scriptlet.Endi S. Dewata2016-04-303-69/+125
| | | | | | | | | | | | | | | | | Previously the finalization scriptlet was always executed in each pkispawn execution. In multi-step installations (e.g. external CA, standalone, or installation/configuration-only mode) some of the code in the scriptlet such as enabling systemd service, restarting the service, and purging client database will be redundant. Now the scriptlet has been modified to execute only in the final step of the installation. The code that archives the deployment and manifest files has been moved into pkispawn to ensure that it is always executed in each pkispawn execution. For clarity the method that displays the installation summary has been broken up into separate methods for standalone step 1, installation-only mode, and configuration-only/full installation.
* Removed unused code for existing CA installation.Endi S. Dewata2016-04-301-16/+1
| | | | | | | | The print_existing_ca_step_one_information() has been removed from pkispawn since existing CA installation no longer requires two-step operation. https://fedorahosted.org/pki/ticket/1736
* Fixed problem uninstalling standalone KRA.Endi S. Dewata2016-04-291-0/+1
| | | | | | | | When installing a standalone KRA the admin certificate is base-64 encoded and stored in the kra.admin.cert property in the CS.cfg. Previously the encoded certificate contains EOL characters which may cause uninstall to fail due to parsing error. The install code has been fixed to normalize the encoded certificate properly.
* Fixed incorrect clone installation summaryMatthew Harmsen2016-04-281-0/+6
| | | | - PKI TRAC Ticket #856 - Incorrect clone installation summary
* Fixed build issue with apache-commons-codec 1.8.Endi S. Dewata2016-04-281-3/+1
| | | | | | The StringUtils.equals() invocation in AuthzSubsystem has been replaced with regular String.equals() since it's unavailable in apache-commons-codec 1.8.
* Removed unused variables in deployment scriptlets.Endi S. Dewata2016-04-2812-78/+76
| | | | | | | | The unused rv instance variables in all deployment scriptlets have been removed. The spawn() and destroy() are now returning None instead of error code. If an error happens during execution the scriptlet will throw an exception which will be caught by pkispawn or pkidestroy and then displayed to the user.
* Removed pkidaemon support of apache instancesMatthew Harmsen2016-04-275-255/+59
| | | | - PKI TRAC Ticket #2248 - support only tomcat instances
* fix bashismsMatthew Harmsen2016-04-263-7/+7
| | | | | | - PKI TRAC Ticket #2249 - fix bashisms - changes 'source' to '.' - changes 'bash' to 'sh'
* Fix problem in creating certificate requestsAde Lee2016-04-221-2/+2
| | | | | | | | | | | | | | | Some incorrect code was added to request processing in the realm patches. In the request LDAP modification code, if the realm was not present, we added a modification to remove the realm attribute. Unfortunately, if the realm was not present to begin with, this resulted in LDAP returning a "No Such Attribute (16)" error, causing all kinds of requests - including certificate requests to fail to be submitted. At this point, we do not permit users to change the realm of a request. Therefore, there is no reason to remove the realm. If we ever need to do this in future, we'll have to be smarter about it.
* Realm: allow auth instances to support multiple realmsAde Lee2016-04-202-11/+28
| | | | | | | | | | | | | | | | In practice, most folks will use something like DirAclAuthz to manage their realm. Rather than requiring a new authz plugin for each realm, we allow the authz plugin to support multiple realms (as a comma separated list). For the Acl plugins in particular, we expand the authorize call to allow the caller to pass in the realm as well as the resource and operation. The resource queried would then be constructed on the fly as realm.resource Examples will be provided in the wiki page. Trac Ticket 2041
* Realms - Address comments from reviewAde Lee2016-04-206-26/+34
| | | | | | | | | | | | Review comments addressed: 1. when archiving or generating keys, realm is checked 2. when no plugin is found for a realm, access is denied. 3. rename mFoo to foo for new variables. 4. add chaining of exceptions 5. remove attributes from KeyArchivalRequest etc. when realm is null 6. Add more detail to denial in BasicGroupAuthz Part of Trac Ticket 2041
* Add authz checks for all operationsAde Lee2016-04-202-11/+52
| | | | | | | We add authz realm checks as appropriate for each operation. Part of Trac Ticket #2041
* Make recovery methods more consistentAde Lee2016-04-201-4/+43
| | | | | | | | | | | The async recovery request mechanism was implemented differently from other requests. This makes it difficult to add tings like authorization consisitently. We move the required methods to the KeyRequestDAO to be more consistent. Part of Ticket #2041
* Added realm to methods for listing requests and keysAde Lee2016-04-201-0/+6
| | | | | | | | | | | 1. Added query parameters for the realm. If a realm is specified, then only the key requests and keys associated with the realm are returned. If no realm is specified, then only those requests and keys without a realm are returned. 2. Added parameters to keyClient and the CLI Part of Trac Ticket #2041
* Added realm for archival and key generation through RESTAde Lee2016-04-201-1/+25
| | | | | | | | This will allow users to specify the realm when generating or archiving a request. No interface change is needed (yet) because the extra parameter is passed through the request. Part of Ticket #2041
* Added new authz methods to check realmAde Lee2016-04-202-1/+225
| | | | | | | | | | | | * Added method to check realm. This method will look for an authz instance for a specified realm and invoke it to determine access. * Added a basic group based authz plugin mostly for testing. This plugin simply checks if the requestor is in the correct group. In practice, customers will probably want something more complex maybe subclassing BasicAclAuthz. Part of Trac Ticket #2041
* Add realm to the key recordAde Lee2016-04-203-6/+19
| | | | Part of Trac Ticket# 2041
* Add realm to the request recordAde Lee2016-04-205-17/+54
| | | | Part of Trac Ticket #2041
* Add realm schema changesAde Lee2016-04-201-2/+7
| | | | | Added realm attribute and index. Added to request and keyRecord. Part of Trac Ticket 2041
* Fixed PKCS #12 export options.Endi S. Dewata2016-04-202-2/+40
| | | | | | | | The CLIs for exporting PKCS #12 file have been modified to accept options to export without trust flags, keys, and/or certificate chain. https://fedorahosted.org/pki/ticket/1736
generated by cgit (git 2.34.1) at 2025-09-27 10:47:50 +0000