summaryrefslogtreecommitdiffstats
path: root/base/tps
Commit message (Collapse)AuthorAgeFilesLines
...
* Customized TPS UI menu based on user roles.Endi S. Dewata2015-04-1714-49/+92
| | | | | | | | | | | The TPS UI has been modified to customize the navigation menu based on the roles of the user currently logged in. TPS agents do not have access to users, groups, config, authenticators, connectors, profile mappings, audit, and self tests, so the corresponding menu items will be hidden. TPS admins have access to all menu items. https://fedorahosted.org/pki/ticket/1292
* Ticket#1028 phase2: TPS rewrite: provide externalReg functionalityChristina Fu2015-04-148-126/+240
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is the 2nd phase of the externalReg feature, it makes the following improvements: * added feature: recovery by keyid (v.s. by cert) * fixed some auditing message errors * added some missing ldapStringAttributes needed for delegation to work properly * added missing externalReg required config parameters * made corrections to some externalReg related parameters to allow delegation to work properly * added handle of some error cases * made sure externalReg enrollment does not go half-way (once fails, bails out) tested: * enrollment of the three default TPS profiles (tokenTypes) * format of the tokens enrolled with the three default tps profiles * delegation enrollments * cuid match check next phase: * cert/key retention (allow preserving existing certs/keys on the token) note: * some of the activity log and cert status related issues that are not specifically relating to externalReg will be addressed in other more relevant tickets.
* Fixed problem deleting newly created TPS profiles.Endi S. Dewata2015-04-084-17/+27
| | | | | | | | | All TPS services have been fixed to set the default status of a new record to Disabled if the client does not provide the initial status. This will ensure a newly created profile to always have a status so it can be deleted normally. https://fedorahosted.org/pki/ticket/1273
* Fixed problem with TPS profile default status.Endi S. Dewata2015-04-087-63/+67
| | | | | | | | | | The base class of ProfileDatabase (i.e. CSCfgDatabase) has been modified to return the correct default value (i.e. Enabled) if the status parameter doesn't exist. The TPSProcessor has been modified to use ProfileDatabase and other TPS codes have also been changed to use constants instead of string literals to ensure consistency. https://fedorahosted.org/pki/ticket/1270
* Fixed incorrect link in TPS UI.Endi S. Dewata2015-04-081-1/+1
| | | | | | | The "Subsystem Connections" link in the home.html has been fixed to point to #connectors. https://fedorahosted.org/pki/ticket/1274
* Added interface to show TPS token certificates.Endi S. Dewata2015-04-087-7/+45
| | | | | | | The TPS REST service, CLI, and UI have been modified to provide an interface to search for certificates belonging to a token. https://fedorahosted.org/pki/ticket/1164
* NISTSP8000 feature.Jack Magne2015-03-178-52/+515
| | | | | | | | | | | | | | | | | | | Implementation of the nistSP800 dervication feature. Works for both supported scp01 cards and scp02 cards. During the various session key and key upgrade functions, the nist dervication code is being called. Review comments addressed Cleanup of some input validation on the TKS. Added some sanity checking on the TPS side for key versions and token cuid's and kdd's. Final review comments. Fixed issue with extracting the kdd from the AppletInfo class. Fixed issue with sending the KDD to the encryptData TKS servlet. Added requested entries to the CS.cfg .
* Allow use of secure LDAPS connectionMatthew Harmsen2015-03-131-1/+1
| | | | - PKI TRAC Ticket #1144 - pkispawn needs option to specify ca cert for ldap
* Ticket: TPS Rewrite: Implement Secure Channel Protocol 02 (#883).Jack Magne2015-02-277-148/+1269
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | First cut of gp211 and scp protocol 02 for tokens. Allow token operations using a GP211 token over secure channel protocol 02. This patch supports the following: 1. Token operations with a GP211 card and SCP02 protocol, implementation 15. 2. Token still supports GP201 cards with SCP01. 3. SCP02 tested with SC650 gp211/scp02 card. Things still to do: 1. Right now the SCP02 support has been tested with the current gp201 applet and enrollment and formatting works just fine. We need to modify and compile the applet against the GP211 spec and retest to see if any further changes are needed. 2. The nistSP800 key derivation stuff is not completed for the SCP02 protocol. Some of the routines are self contained vs similar SCP01 ones. We have another ticket to complete the nistSP800 support from end to end. This work will be done for that ticket. 3. One of the new scp02 deriviation functions can make use of a new NSS derive mechanism. As of now this work is done by simple encryption, this can be done later. 4. The security APDU level of "RMAC" is not supported because the card does not support it. It could have been done to the spec, but it having the card to test is more convenient and there were more crucial issues to this point.
* Add granularity to token termination in TPSAde Lee2015-02-264-35/+160
| | | | | | BZ 1163987. Added revocation checks to optionally revoke expired certs, and handle cases where certs are shared on multiple tokens.
* Refactored LDAPDatabase.createFilter().Endi S. Dewata2015-02-113-20/+42
| | | | | | | | | | The createFilter() method in LDAPDatabase has been changed to construct an LDAP filter based on a keyword and a set of attributes with their values. This will allow searching the database based on specific attribute values. The subclasses of LDAPDatabase have been updated accordingly. https://fedorahosted.org/pki/ticket/1164
* Ticket#1028 Phase1:TPS rewrite: provide externalReg functionalityChristina Fu2015-02-1010-159/+1579
|
* Fix-for-Bug-1170867-TPS-Installation-FailedJack Magne2014-12-164-116/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix now includes last review comments where we decided to consolidate 3 of the ldif files: schema.ldif,database.ldif, and manager.ldif. Each one of these 3 files contains the data needed for any subsystem for that file. The subsystem specific files for these 3 go away in the source tree. The first iteration of this fix was copying these 3 files into an undesirable directory. This is no longer the case. Extra code in the python installer allows one to establish a "file exclusion" callback to keep a set of desired files from being copied when the installer does a directory copy. All subsystems have been tested, including TPS with a brand new DS (which was the original reason for this fix), and they appear to work fine. Addressed further review comments: 1. Removed trailing whitespace instances from schema.ldif which had some. 2. Used pycharm to remove the few PEP violations I had previously added to the Python code. 3. Changed the format of the schema.ldif file to make all the entries use the same style. Previously the TPS entries was using an all in one syntax. No more since now each entry is separate. 4. Changed the name of an argument in one of the new Python methods to get rid of a camelCase instance. 5. Tested everything to work as before, including basic TPS operations such as Format. Fixed a method comment string and fixed some typos.
* Provide standalone Pin Reset Processor.Jack Magne2014-09-234-202/+295
| | | | | | | Now an enrolled token can have its pin changed with esc without doing another enrollment. Actually call authentication for this pin reset operation now. Review fix.
* Ticket #882 - remove all certs belong to a token in tokendb before addChristina Fu2014-09-051-0/+9
|
* Ticket #1146 Tomcat TPS: missing "keyType" for renewed certs in the cert recordsChristina Fu2014-09-041-5/+2
|
* Ticket #882 - delete certs associated to a token when token is removedChristina Fu2014-09-042-0/+30
|
* Revert "Enabled certificate revocation checking by default."Endi S. Dewata2014-09-041-4/+0
| | | | | | | This reverts commit 223d15539b7bcc0df025025036af2935726e52e3. The patch does not work for subsystems installed on separate instance since it will require additional OCSP setup.
* Rename pki-tps-tomcat to pki-tpsMatthew Harmsen2014-09-03177-0/+29919
| | | | * PKI TRAC Ticket #1017 - Rename pki-tps-tomcat to pki-tps
* Misc TPS packaging tasks:Jack Magne2014-08-22520-124678/+0
| | | | | | | | | | | | | 1. Make sure the new TPS packages all the applet files, like the old TPS has done. 2. Create a small new package called "pki-tps-client", which will hold ONLY the command line utility "tpsclient" and all of its supporting libraries. 3. Move the directory pki/base/tps to pki/base/tps-client We will do this until we can rewrite "tpclien" on the new Java TPS system. Add package pki-tps-client.
* Change LDAP Attributes to allow for tr_TR localeMatthew Harmsen2014-05-201-3/+3
| | | | | * PKI TRAC Ticket #946 - Installation of IPA hangs up when LANG is set to tr_TR.UTF8
* Further progress Format operation.Jack Magne2014-04-141-0/+9
| | | | | | | | | | | | 1. Read applet into memory to prepare to write to token. 2. With tpsclient create secure channel by implementing Initialize Update and ExternalAuthenticate messages. 3. Support for MAC and encryption for messages going on after secure channel has been created. 4. Implemented method to remove an aid file or instance from the token. 5. Added some symkey methods to allow TPS to manipulate session keys. 6. Performed some cfu feedback fixes such as changing al the names of APDU classes to have APDU in the name. Have not tried this with real token as of yet. The tpsclient does verify of the MAC coming from the server and decrypts encrypted messages. Decrypted messages have to be correct for the MAC verification to work. Next step will be to add the phone home servlet to the TPS and give it a try with a real token and esc.
* Debian - replace arch specificationAde Lee2014-01-083-6/+6
| | | | | | | uname -i returns "unknown" on a debian system. "arch" on the other hand works for fedora, rhel and debian. Replacing these for all packages except for the migration ones which will not be built on debian in any case.
* Replace '-Wformat-security' warning with '-Werror=format-security' errorMatthew Harmsen2013-12-181-2/+2
| | | | | Bugzilla Bug #1037248 - pki-core FTBFS if "-Werror=format-security" flag is used Bugzilla Bug #1037249 - pki-tps FTBFS if "-Werror=format-security" flag is used
* Fix tpsclient failureMatthew Harmsen2013-11-051-1/+7
| | | | * TRAC Ticket #760 - Tpsclient Failure on F20 and TPS
* Moved Tomcat-based TPS to separate folder.Endi S. Dewata2013-08-1554-5909/+1223
| | | | | | | | | | | The source files for the new Tomcat-based TPS has been moved from base/tps to base/tps-tomcat. The new TPS will now be build in pki-core and packaged in pki-tps-tomcat RPM. The old TPS and RA have been restored to the previous state before adding the new TPS. Once the new TPS is complete, the old TPS can be removed, the new TPS can be moved back to base/tps and the package can be renamed back to pki-tps. Ticket #702
* Added ldif files to add VLV indexes to TPS installationAde Lee2013-08-153-3/+82
|
* Initial code to configure a TPS in tomcatAde Lee2013-08-134-2027/+1351
| | | | | This code allows pkispawn to configure a tps in tomcat. It does not include any config using the web UI panels.
* Added skeleton for token services.Endi S. Dewata2013-08-137-3/+537
| | | | | | | | A skeleton for token service and the clients has been added. Currently it's storing the database in memory. The actual implementation using LDAP database will be added after the TPS configuration code is ready. Ticket #652
* Enabled debug log for Tomcat-based TPS.Endi S. Dewata2013-07-311-0/+6
| | | | The CS.cfg for Tomcat-based TPS has been modified to enable debug log.
* Storing authentication info in session.Endi S. Dewata2013-07-291-1/+3
| | | | | | | | | The authenticator configuration has been modified to store the authentication info in the session so it can be used by the servlets. An upgrade script has been added to update the configuration in existing instances. The SSLAuthenticatorWithFalback was modified to propagate the configuration to the actual authenticator handling the request.
* Added TPS servlet.Endi Sukma Dewata2013-06-104-0/+270
| | | | | A basic TPS servlet has been added to demonstrate sending and receiving TPS messages using chunked encoding.
* Added Tomcat-based TPS instance.Endi S. Dewata2013-06-1045-0/+4471
| | | | | | | | | The build and deployment tools have been modified to support creating a basic Tomcat instance to run TPS. New configuration and template files for TPS have been copied from another Tomcat subsystem. The TPS functionality itself will be added in future patches. Ticket #526
* Renamed CA_PORT into PKI_CA_PORT.Endi Sukma Dewata2013-06-032-4/+4
| | | | | The CA_PORT variable has been renamed into PKI_CA_PORT for consistency.
* Renamed CA_HOST into PKI_CA_HOSTNAME.Endi Sukma Dewata2013-06-032-4/+4
| | | | | The CA_HOST variable has been renamed into PKI_CA_HOSTNAME for consistency.
* Renamed PKI_INSTANCE_ID into PKI_INSTANCE_NAME.Endi Sukma Dewata2013-05-305-26/+26
| | | | | The PKI_INSTANCE_ID variable has been renamed into PKI_INSTANCE_NAME for consistency.
* Renamed SERVER_NAME and PKI_MACHINE_NAME into PKI_HOSTNAME.Endi Sukma Dewata2013-05-309-24/+24
| | | | | The SERVER_NAME and PKI_MACHINE_NAME variables have been renamed into PKI_HOSTNAME for consistency.
* Renamed SERVER_ROOT into PKI_INSTANCE_PATH.Endi Sukma Dewata2013-05-308-52/+52
| | | | | The SERVER_ROOT variable in RA and tps has been renamed into PKI_INSTANCE_PATH to match the Tomcat-based subsystems.
* Renamed PORT and UNSECURE_PORT into PKI_UNSECURE_PORT.Endi Sukma Dewata2013-05-305-17/+17
| | | | | The PORT and UNSECURE_PORT variables in RA and TPS has been renamed into PKI_UNSECURE_PORT to match the Tomcat-based subsystems.
* Renamed SECURE_PORT into PKI_SECURE_PORT.Endi Sukma Dewata2013-05-304-7/+7
| | | | | The SECURE_PORT variable in RA and TPS has been renamed into PKI_SECURE_PORT to match the Tomcat-based subsystems.
* Reorganized CS.cfg.in in RA and TPS.Endi Sukma Dewata2013-05-303-1/+1
| | | | | The CS.cfg.in in RA and TPS has been moved from doc into shared/conf to match the Tomcat-based subsystems.
* pki-tps various flawsAndrew Wnuk2013-05-232-12/+58
| | | | | | This patch provides fixes to various pki-tps flaws. Bug 966189.
* Minor fixes in a few configuration UI panels of RA and TPS.Abhishek Koneru2013-04-224-21/+12
| | | | | | | | Changed the status check and restart commands to systemctl. The text $errorString will not be seen when the security domain login panel is launched for the first time. Ticket #452
* Tracking upgrade using existing config files.Endi Sukma Dewata2013-04-172-2/+2
| | | | | | | | | | | The upgrade framework has been modified to use pki.conf to track system upgrade, tomcat.conf to track instance upgrade, and CS.cfg to track subsystem upgrade. The preop.product.version in CS.cfg has been renamed into cms.product.version and is now used to track upgrade. Ticket #544
* Bug 902952 - RFE: Revocation routing with TPS and multiple non-cloned CAsChristina Fu2013-03-248-27/+420
|
* Bug 903401 - TMS: RSA token enrollment failed : public key decode errorChristina Fu2013-01-261-9/+15
|
* Latest TPS memory related fixes.Jack Magne2012-12-063-292/+400
|
* Removed RA and TPS theme packages.Endi Sukma Dewata2012-12-031-15/+4
| | | | | | | | The RA and TPS theme packages are no longer necessary due to the reorganization of the theme files. The build and deployment scripts have been updated accordingly. Ticket #407
* Reorganized TPS CSS files.Endi Sukma Dewata2012-12-0325-38/+38
| | | | | | | The CSS files for TPS have been moved into the server theme package. All references have been modified accordingly. Ticket #407
* Reorganized TPS templates and scripts.Endi Sukma Dewata2012-12-03151-63/+32533
| | | | | | | The templates, JS, and CGI scripts for TPS have been moved into the TPS core package. Removed unused cfg.pl. Ticket #407
generated by cgit (git 2.34.1) at 2025-09-27 01:36:59 +0000