summaryrefslogtreecommitdiffstats
path: root/base/tps/src/org
Commit message (Collapse)AuthorAgeFilesLines
* Renamed token status UNINITIALIZED to READY.Endi S. Dewata2016-05-036-18/+18
| | | | | | | | | | | The token status UNINITIALIZED has been renamed to READY for clarity. To simplify the transition, the CLIs and the REST API will continue to accept UNINITIALIZED but it will be converted internally into READY and a deprecation warning will be generated. https://fedorahosted.org/pki/ticket/2288
* Renamed token status TEMP_LOST to SUSPENDED.Endi S. Dewata2016-05-033-5/+5
| | | | | | | | | | | The token status TEMP_LOST has been renamed to SUSPENDED such that it can be used more general contexts. To simplify the transition, the CLIs and the REST API will continue to accept TEMP_LOST but it will be converted internally into SUSPENDED and a deprecation warning will be generated. https://fedorahosted.org/pki/ticket/2286
* Refactored TokenStatus enumeration.Endi S. Dewata2016-05-032-14/+13
| | | | | | | | The TokenStatus enumeration has been converted into a class to allow overriding the TokenStatus.valueOf() to provide backward compatibility. https://fedorahosted.org/pki/ticket/2286
* Fixed activity logs for certificate revocations.Endi S. Dewata2016-04-262-38/+25
| | | | | | | | The TPSTokendb.shouldRevoke() has been modified such that it throws an exception instead of returning boolean. The method has also been renamed to checkShouldRevoke(). The revokeCert() and unrevokeCert() have been modified to catch the exception and log the failed operation.
* Added TPSTokendb.revokeCert() and unrevokeCert().Endi S. Dewata2016-04-261-55/+121
| | | | | | The code in TPSTokendb.revokeCertsByCUID() has been split into revokeCert() and unrevokeCert() to allow handling each operation separately.
* Moved TPSTokendb.tdbGetTokenEntry() invocations.Endi S. Dewata2016-04-261-11/+19
| | | | | The TPSTokendb.tdbGetTokenEntry() invocations in shouldRevoke() have been moved into revokeCertsByCUID().
* Added TPSCertRecord.getSerialNumberInBigInteger().Endi S. Dewata2016-04-262-18/+22
| | | | | The code that parses the token certificate serial number has been refactored into a new method in TPSCertRecord.
* Replaced TPS OP_DO_TOKEN activity.Endi S. Dewata2016-04-223-11/+14
| | | | | | | | For clarity the TPS operatons that generate OP_DO_TOKEN activity has been modified to generate OP_TOKEN_MODIFY instead, except for the changeTokenStatus() which will generate OP_TOKEN_STATUS_CHANGE. https://fedorahosted.org/pki/ticket/2268
* Ticket #2271 TMS- clean up key archival request records in ldapChristina Fu2016-04-133-18/+17
| | | | | | | | | This patch does the following: * it adds in the kra request an extra field called "delayLDAPCommit" * when the request comes in to be processed, it sets this field to "false" * by default, if this field does not exist, the updateRequest() method will just write to ldap, just like before; however, if this field exists and it contains "true" then it will delay the write * once the request is processed and all unwanted fields are cleared from the request record, it will set "delayLDAPCommit" to "false", and call updateRequest(), which will then do the actual write to ldap * In addition, I also screened through both KRA and TPS code and removed debug messages that contain those fields.
* Ticket #1519 token format should delete certs from token recordChristina Fu2016-04-062-0/+13
| | | | This patch removes certs from token record when it is formatted.
* Ticket #1006 Audit logging for TPS REST operationsChristina Fu2016-03-286-184/+842
| | | | | | | | | | | | | This patch adds audit logging to TPS REST wrote-specific operations. The read-specific operations are already captured by AuditEvent=AUTHZ_* The affected (new or modified) log messages include: LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_GENERAL_5 LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_PROFILE_6 LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_MAPPING_RESOLVER_6 LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_AUTHENTICATOR_6 LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_CONNECTOR_6 LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_RECORD_6 LOGGING_SIGNED_AUDIT_TOKEN_STATE_CHANGE_8
* Generating TEMP_LOST to UNINITIALIZED/ACTIVE transitions dynamically.Endi S. Dewata2016-03-283-128/+95
| | | | | | | | | | | | | The TPS subsystem has been modified to generate the token state transitions from TEMP_LOST to UNINITIALIZED or ACTIVE dynamically depending on whether the token has certificates. The TEMP_LOST to ACTIVE transition has been removed from the CS.cfg. Duplicate code that loads the allowed transitions list has been merged and moved into TPSSubsystem. https://fedorahosted.org/pki/ticket/1808
* Added TPS token filter dialog.Endi S. Dewata2016-03-171-2/+27
| | | | | | | | | | | The TPS UI Tokens page and the pki tps-token-find CLI have been modified to provide an interface to filter tokens based on their attributes. The TokenService.findTokens() has been modified to accept additional search criteria based on token attributes. https://fedorahosted.org/pki/ticket/1482
* Fixed illegal token state transition via TEMP_LOST.Endi S. Dewata2016-03-174-23/+42
| | | | | | | | | | | | | | | | The TokenService.setTokenStatus() has been modified to restore the temporarily lost token back into either uninitialized or active state based on whether the token has certificates. The TPSTokendb.tdbGetCertRecordsByCUID() has been modified to use only tokenID attribute to search for token certificates more accurately. It also has been simplified to return the certificate records collection object directly. Some constructors were added to the TPSException to allow chaining the exception cause. https://fedorahosted.org/pki/ticket/1808
* Ticket #1007 TPS audit eventsChristina Fu2016-02-1514-106/+629
| | | | | | This patch implements the TPS operation auditing: TOKEN_APPLET_UPGRADE_SUCCESS,TOKEN_APPLET_UPGRADE_FAILURE,TOKEN_CERT_ENROLLMENT,TOKEN_CERT_RENEWAL,TOKEN_CERT_RETRIEVAL,TOKEN_KEY_RECOVERY,TOKEN_CERT_STATUS_CHANGE_REQUEST,TOKEN_OP_REQUEST,TOKEN_FORMAT_SUCCESS,TOKEN_FORMAT_FAILURE,TOKEN_KEY_CHANGEOVER,TOKEN_KEY_CHANGEOVER_FAILURE,TOKEN_PIN_RESET_SUCCESS,TOKEN_PIN_RESET_FAILURE,TOKEN_STATE_CHANGE,TOKEN_AUTH_SUCCESS,TOKEN_AUTH_FAILURE Administrative auditing (via REST interface) will be covered in a separate ticket
* Fixed token change status operation.Endi S. Dewata2016-02-101-0/+8
| | | | | | | The TokenService has been modified to ignore token change status operation if the status is unchanged. https://fedorahosted.org/pki/ticket/1684
* Fixed token modify operation.Endi S. Dewata2016-02-081-30/+0
| | | | | | | The TPS UI and CLI have been modified to accept only user ID and policy attributes when modifying a token. https://fedorahosted.org/pki/ticket/1687
* Allow cert and key indexes > 9.Jack Magne2016-02-055-149/+380
| | | | | | | | | | | | | | | | | | | | | | | | | Ticket: Ticket #1734 : TPS issue with overflowing PKCS#11 cert index numbers This patch contains the following: 1. Fixes in TPS to allow the server to set and read muscle object ID's that are greater than 9. The id is stored as a single ASCII byte in the object id. Previous libcoolkey patches exist to now support numbers larger than 9, by the following: 0-9 is represented by the ascii chars for 0 through 9,. 10 - 35 represented by the ascii chars for 'A' through 'Z'. 36 - 61 represented by the ascii chars for 'a' through 'z'. Once coolkey is updated it will be able to read these id's. TPS with this patch will be able to both read number 0 - 62 and to set them when creating pkcs#11 objects to be stored on the token. When the proper libcoolkey is installed, the coolkey driver will be able to read certs and keys with id's > 9. Thus, for instance a cert with an id of C6, with keys of k12, and k13, will be supported and viewable in the Firefox cert viewer. Also the certs will be usable for operations. 2. A fix to the routine that finds a free id number to assign to a soon to be recovered cert will now have the ability to find unused slots instead of just inrementing one over the highest currently used index. 3. Made a couple of minor cleanup fixes to externalReg functionality discovered during testing of this feature.
* Added resource bundle for token state labels.Endi S. Dewata2016-02-051-4/+23
| | | | | | | | | | | | | | | The labels for token states and the transitions are now stored in token-states.properties. The default file will be stored in the /usr/share/pki/tps/conf, but it can be overriden by copying and customizing the file into <instance>/tps/conf. When the UI retrieves the token data the labels for the current state and the valid transitions will be loaded from the file and returned to the UI. The UI will show the transition labels in the dropdown list for changing token status. https://fedorahosted.org/pki/ticket/1289 https://fedorahosted.org/pki/ticket/1291
* Fixed token add operation.Endi S. Dewata2016-02-051-19/+15
| | | | | | | | The TPS UI and CLI have been modified to accept only token ID, and optionally user ID and policy attributes when adding a token. https://fedorahosted.org/pki/ticket/1477 https://fedorahosted.org/pki/ticket/1687
* Fixed LDAP error handling in TokenService.Endi S. Dewata2016-02-051-0/+53
| | | | | | | | | | The DBSSession has been modified to attach the LDAPException to the EDBException. The TokenService will catch the EDBException and obtain the orignal LDAPException. This way the TokenService can obtain the LDAP error code and throw the proper exception the client. https://fedorahosted.org/pki/ticket/1646
* Fixed error handling in TokenService.Endi S. Dewata2016-02-031-21/+52
| | | | | | | | | The TokenService has been modified to re-throw the original PKIException. This way on invalid token state transition the client will receive the original BadRequestException. Other types of exception will be wrapped with PKIException. https://fedorahosted.org/pki/ticket/1684
* Fixed TPS token state transitions.Endi S. Dewata2016-02-033-16/+16
| | | | | | | | | | | | | | | | | | | | The TPS service has been modified to provide a list of allowed state transitions based on the current token state. The TPS UI was modified to display only the allowed state transitions when changing the token status. The allowed state transition list has been modified to remove invalid token transitions including: * UNINITIALIZED -> FOUND * UNINITIALIZED -> TEMP_LOST_PERM_LOST The token FOUND state has been renamed to ACTIVE for clarity. The token TEMP_LOST_PERM_LOST state has been merged into PERM_LOST since they are identical in the database. https://fedorahosted.org/pki/ticket/1289 https://fedorahosted.org/pki/ticket/1291 https://fedorahosted.org/pki/ticket/1684
* Ticket #1007 preparation work - replace auditMsg with logMsgChristina Fu2016-01-205-302/+302
| | | | | | | | For ticket #1007 TPS Audit Events, we need to add audit messages. The existing parameter name "auditMsg" has been used broadly for TPS logging, which could be confused for the actual audit messages. This patch is to replace all the existing "auditMsg" parameters with "logMsg" instead.
* Ticket #1375 Provide cert/key retention for externalRegChristina Fu2016-01-153-56/+368
| | | | | | | | | | | | | | | | | | | | | Ticket #1514 TPS: Recovered certs on a token has status expired Ticket #1587 External Registration Recovery only works for 1024 sized keys out of the box This patch provides the cert/key retention feature for externalReg. If the certsToAdd field contains (serial,ca#) instead of the full (serial, ca#, keyId, kra#), then it is expecting the cert/keys to be retained from token without having to do a full retrieval (recovery); If an exisiting cert (and its keys) on the token is not explicitly retained then it is deleted. This patch also fixes the issues reported in #1514 and #1587 as testing of #1375 is easier with those two issues addressed. An issue was found during development where Coolkey puts limits on the cert/key ids on the token and make it impossible to inject cert ID higher than 4, as it would then result in key ids into two digits. Another issue that adds to running into the limit is that the function that gets the next free certid number does not make any attempt to search for "holes" to reuse. The cert/key id assignment/limit issue will be filed as a separte ticket and addressed separately. More complicated testing will be conducted then.
* Ticket #1527 TPS connector always goes to "ca1"Christina Fu2015-10-272-25/+30
|
* Removed unused WizardServlet.Endi S. Dewata2015-10-223-475/+0
| | | | | | | | | | The unused configuration wizard servlet has been removed to simplify refactoring other codes. The remaining references in CertUtil and ConfigurationUtils have been removed as well. https://fedorahosted.org/pki/ticket/1120
* Ticket #1648 [RFE] provide separate cipher lists for CS instances acting as ↵Christina Fu2015-10-201-2/+8
| | | | client and server This patch provides subsystem->subsystem cipher configuration when acting as a client
* Ticket 1307 - CUID range issue for [RFE] Support multiple keySets for ↵Christina Fu2015-08-263-5/+5
| | | | | | | | | | different cards for ExternalReg The patch fixes an issue that the CUID comes in from the client has a different format than that of the config cuid range strings. With the right conversion, the cuid range would then be evaluated correctly. The issue may only be discovered with certain cuid data, as it was not reproduceable in the dev environment.
* SC650 format/enroll failsJack Magne2015-08-241-1/+11
| | | | Simple fix to correctly identify scp01/gp201 sc650 card.
* Reverse previous merge commit.Jack Magne2015-08-241-11/+1
|
* SC650 format/enroll failsJack Magne2015-08-241-1/+11
| | | | Simple fix to correctly identify scp01/gp201 sc650 card.
* Ticket 1307 issue: FilterMappingResolver always returns targetChristina Fu2015-07-282-7/+12
|
* TPS UI: After successful key upgrade during pin reset operation the token db ↵Jack Magne2015-07-281-0/+15
| | | | | | | still shows old key Simple matter of not updating the token record at the end of the pin reset operation. Also, make sure the activity log is correct.
* Fix Pin Reset tokenType resolution.Jack Magne2015-07-011-12/+30
| | | | | | | Ticket #1423 Pin reset operation using tpsclient fails. Recently we had added a new way to resolve the profile. That new method was not used in the PinReset Processor. This fix addresses that and allows the Pin Reset operation to complete.
* Add GP211 applet and latest GP201 applet for RSA.Jack Magne2015-07-011-0/+2
| | | | | | | | | Ticket # 793: Add support for Secure Channel Protocol 02 Properly select the coolkey applet in the "getAppletVersion" routine. For some reason the gp211 applet revealed this issue. Tested to work with both gp211 scp02 card and gp201 scp01 card.
* Cleaned up SystemConfigService.configureClone().Endi S. Dewata2015-07-011-1/+1
| | | | | | The getCloningData() in SystemConfigService has been renamed to configureClone(). Redundant try-catch blocks have been removed. Some exception messages have been modified to include more info.
* Fixed selftests log message.Endi S. Dewata2015-06-232-32/+49
| | | | | | | | | | | | | The SelfTestSubsystem has been modified to display a 'successful' message only if all tests have passed. If a test fails, it will log a failure, subsequent tests will not be executed, and the subsystem will shutdown immediately. The runSelfTest() in various tests have been cleaned up to throw the original exception to help troubleshooting. The unused RAPresence test has been removed. https://fedorahosted.org/pki/ticket/1249
* Ticket 1309 Recovering of a revoked cert erroneously reflects "active" in ↵Christina Fu2015-05-227-3/+196
| | | | the token db cert entry
* Ticket 1307 (part2 keySet mapping) [RFE] Support multiple keySets for ↵Christina Fu2015-05-219-111/+293
| | | | different cards for ExternalReg This patch adds support to keyset mapping
* Ticket 1307 (part1 refactoring) [RFE] Support multiple keySets for different ↵Christina Fu2015-05-217-150/+153
| | | | cards for ExternalReg This patch is mainly refactoring the names of the Mapping Resolver framework in preparation for ticket 1307 to support keySet mapping in addition to the original purpose of resolving tokenType mapping. The reason to separate out refactoring from the real code is for ease of reviewing. TPS is currently a Tech Preview feature, so upgrade is not of consideration at the moment.
* Fixed authentication data in audit log.Endi S. Dewata2015-05-051-1/+3
| | | | | | | | | | | The REST methods may be executed by different threads even though they are invoked in the same session. A new interceptor has been added to all subsystems to make sure the SessionContext is created properly for each thread. This will fix the authentication data in the audit log. The SessionContext has also been improved to use ThreadLocal instead of a global Hashtable. https://fedorahosted.org/pki/ticket/1054
* Fixed TPS REST services.Endi S. Dewata2015-04-174-65/+191
| | | | | | | | The REST services have been modified to support submit and cancel actions. The ACL has been fixed to allow admins and agents to change the status. https://fedorahosted.org/pki/ticket/1292
* Ticket#1028 phase2: TPS rewrite: provide externalReg functionalityChristina Fu2015-04-147-120/+208
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is the 2nd phase of the externalReg feature, it makes the following improvements: * added feature: recovery by keyid (v.s. by cert) * fixed some auditing message errors * added some missing ldapStringAttributes needed for delegation to work properly * added missing externalReg required config parameters * made corrections to some externalReg related parameters to allow delegation to work properly * added handle of some error cases * made sure externalReg enrollment does not go half-way (once fails, bails out) tested: * enrollment of the three default TPS profiles (tokenTypes) * format of the tokens enrolled with the three default tps profiles * delegation enrollments * cuid match check next phase: * cert/key retention (allow preserving existing certs/keys on the token) note: * some of the activity log and cert status related issues that are not specifically relating to externalReg will be addressed in other more relevant tickets.
* Fixed problem deleting newly created TPS profiles.Endi S. Dewata2015-04-084-17/+27
| | | | | | | | | All TPS services have been fixed to set the default status of a new record to Disabled if the client does not provide the initial status. This will ensure a newly created profile to always have a status so it can be deleted normally. https://fedorahosted.org/pki/ticket/1273
* Fixed problem with TPS profile default status.Endi S. Dewata2015-04-087-63/+67
| | | | | | | | | | The base class of ProfileDatabase (i.e. CSCfgDatabase) has been modified to return the correct default value (i.e. Enabled) if the status parameter doesn't exist. The TPSProcessor has been modified to use ProfileDatabase and other TPS codes have also been changed to use constants instead of string literals to ensure consistency. https://fedorahosted.org/pki/ticket/1270
* Added interface to show TPS token certificates.Endi S. Dewata2015-04-081-5/+12
| | | | | | | The TPS REST service, CLI, and UI have been modified to provide an interface to search for certificates belonging to a token. https://fedorahosted.org/pki/ticket/1164
* NISTSP8000 feature.Jack Magne2015-03-177-52/+413
| | | | | | | | | | | | | | | | | | | Implementation of the nistSP800 dervication feature. Works for both supported scp01 cards and scp02 cards. During the various session key and key upgrade functions, the nist dervication code is being called. Review comments addressed Cleanup of some input validation on the TKS. Added some sanity checking on the TPS side for key versions and token cuid's and kdd's. Final review comments. Fixed issue with extracting the kdd from the AppletInfo class. Fixed issue with sending the KDD to the encryptData TKS servlet. Added requested entries to the CS.cfg .
* Ticket: TPS Rewrite: Implement Secure Channel Protocol 02 (#883).Jack Magne2015-02-276-147/+1268
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | First cut of gp211 and scp protocol 02 for tokens. Allow token operations using a GP211 token over secure channel protocol 02. This patch supports the following: 1. Token operations with a GP211 card and SCP02 protocol, implementation 15. 2. Token still supports GP201 cards with SCP01. 3. SCP02 tested with SC650 gp211/scp02 card. Things still to do: 1. Right now the SCP02 support has been tested with the current gp201 applet and enrollment and formatting works just fine. We need to modify and compile the applet against the GP211 spec and retest to see if any further changes are needed. 2. The nistSP800 key derivation stuff is not completed for the SCP02 protocol. Some of the routines are self contained vs similar SCP01 ones. We have another ticket to complete the nistSP800 support from end to end. This work will be done for that ticket. 3. One of the new scp02 deriviation functions can make use of a new NSS derive mechanism. As of now this work is done by simple encryption, this can be done later. 4. The security APDU level of "RMAC" is not supported because the card does not support it. It could have been done to the spec, but it having the card to test is more convenient and there were more crucial issues to this point.
* Add granularity to token termination in TPSAde Lee2015-02-264-35/+160
| | | | | | BZ 1163987. Added revocation checks to optionally revoke expired certs, and handle cases where certs are shared on multiple tokens.
generated by cgit (git 2.34.1) at 2024-06-07 15:01:51 +0000