summaryrefslogtreecommitdiffstats
path: root/base
Commit message (Collapse)AuthorAgeFilesLines
* Added selftest resource.Endi S. Dewata2013-10-0824-1/+827
| | | | | | | New REST service and clients have been added for managing selftests in all subsystems. Ticket #652
* Add audit logging for new security data operations in kraAde Lee2013-10-076-26/+276
| | | | Ticket 97
* Fixed pylint issue in pkiparser.py.Endi S. Dewata2013-10-071-1/+1
| | | | | | The exception handler in pkiparser.py has been modified to re-raise the exception such that it will be handled by the caller instead of exitting to the system immediately.
* Ticket 755 - Detect unescaped percent characters in deployment filesNathan Kinder2013-10-074-0/+18
| | | | | | | | | | | | The deployment config files used by pkispawn support interpolation as supplied by ConfigParser. Interpolation uses the '%' character, which means values that need to contain a '%' character need to be properly escaped. This patch detects errors with unescaped '%' characters and reports a useful message bac kto the user who is running pkispawn. This patch also adds notes to the pkispawn and pki_default.cfg man pages to explain that escaping of '%' characters is required.
* Fixed CLI authentication issue.Endi S. Dewata2013-10-0130-180/+245
| | | | | | | Previously the CLI authentication could fail because it's using a fixed default subsystem which may not match the command it's trying to execute. The CLI has now been modified to use the appropriate default subsystem depending on the command to be executed.
* Added TPS profile mapping resource.Endi S. Dewata2013-10-0118-1/+1434
| | | | | | | A new REST service and clients have been added to manage the profile mappings in the TPS configuration file. Ticket #652
* Added TPS connection service implementation.Endi S. Dewata2013-10-0114-558/+263
| | | | | | | The implementation of the TPS connection service has been modified to use the configuration database to read and write the configuration file. Ticket #652
* Added TPS authenticator service implementation.Endi S. Dewata2013-10-0114-559/+264
| | | | | | | The implementation of the TPS authenticator service has been modified to use the configuration database to read and write the configuration file. Ticket #652
* Refactored TPS configuration resource.Endi S. Dewata2013-10-0113-313/+401
| | | | | | | | The REST interface for TPS configuration has been modified to provide access to TPS general configuration as originally designed. The configuration database has been modified such that it can be reused by other configuration resources. Ticket #652
* Refactored CLI framework.Endi S. Dewata2013-10-0117-319/+86
| | | | | The CLI framework has been modified to remove duplicate code in various CLI modules.
* DRM Transport Key RotationAndrew Wnuk2013-09-3011-12/+211
| | | | | | | | | | | | This patch provides basic support for DRM Transport Key Rotation described in http://pki.fedoraproject.org/wiki/DRM_Transport_Key_Rotation This patch provides implementation for tickets: - 729 - CA to include transport certificate when submitting archival request to DRM - 730 - DRM to detect presence of transport certificate attribute in submitted archival request and validate transport certificate against DRM's transport key list - 731 - DRM to provide handling for alternative transport key based on detected and validated transport certificate arriving as a part of extended archival request
* Added method to modify connectorAde Lee2013-09-305-3/+123
| | | | | Also changed permissions to allow admin users to delete a connector and its associated shared secret.
* Changes to TPSConnectorService based on reviewAde Lee2013-09-3010-129/+202
|
* Modify TKS self tests and execution to use new shared secret namesAde Lee2013-09-303-13/+73
| | | | | | | | The self tests and TokenServlet are modified to use the new shared secret names. A parameter has been added to allow legacy systems to continue running as-is. With a new system, the TKS self test will not fail on startup if no shared secret keys are configured. It will fail, however, if the keys are configured, but the ComputeSessionKey operation fails.
* Add service to generate and retrieve a shared secretAde Lee2013-09-3020-2/+1298
| | | | | | | | | | | | | | | | A new REST service has been added to the TKS to manage shared secrets. The shared secret is tied to the TKS-TPS connector, and is created at the end of the TPS configuration. At this point, the TPS contacts the TKS and requests that the shared secret be generated. The secret is returned to the TPS, wrapped using the subsystem certificate of the TPS. The TPS should then decrypt the shared secret and store it in its certificate database. This operations requires JSS changes, though, and so will be deferred to a later patch. For now, though, if the TPS and TKS share the same certdb, then it is sufficient to generate the shared secret. Clients and CLI are also provided. The CLI in particular is used to remove the TPSConnector entries and the shared secret when the TPS is pkidestroyed.
* Added TPS config resource.Endi S. Dewata2013-09-2015-98/+1073
| | | | | | | | A new REST service and clients have been added to manage the TPS configuration in CS.cfg. When the configuration is updated, the previous configuration will be stored as a backup. Ticket #652
* Added interactive install for tomcat TPSAde Lee2013-09-205-3/+111
| | | | | | Up to now, only pkispawn with a config file worked for tomcat-tps installation. This patch adds the functionality for the interactive installation.
* Upgrade script to fix JAVA_OPTSAde Lee2013-09-182-10/+49
|
* Workaround for resteasy context problemAde Lee2013-09-1721-96/+428
| | | | | | Resteasy 3.0.1 is not populating the @Context parameters if they are defined in a super class. This is a workaround until that problem is fixed. See https://issues.jboss.org/browse/RESTEASY-952
* Added new link for resteasy dependencyAde Lee2013-09-178-16/+28
| | | | | Resteasy 3.0.1 uses apache-commons-io. Also fixed PKIErrorInterceptor with correct method call and reformatted the interceptors.
* fixing for new tomcat systemd filesAde Lee2013-09-176-330/+76
| | | | | | | | tomcat now uses systemd unit files. We will reuse and customize those files accordingly. As a result, startup is simplified considerably - and pkidaemon has been gutted accordingly. We'll need to add migration scripts for older instances in a subsequent patch.
* Change interceptors to use jaxrs 2.0Ade Lee2013-09-173-36/+21
| | | | | | | | RESTEasy 3.0.1 provides JAX-RS 2.0 interceptors. We need to either use these or the proprietary ones in order to compile. These ones appear to be working just fine. It does turn out that the change to getStringHeaders() is not yet implemented in 3.0.1 so we'll have to fix that.
* Connected TPS certificate database to LDAP.Endi S. Dewata2013-09-174-45/+56
| | | | | | | | The TPSCertDatabase has been reimplemented using LDAPDatabase. The TPSCertRecord has been modified to specify the object class and attribute mappings. Ticket #652
* Connected TPS activity database to LDAP.Endi S. Dewata2013-09-174-39/+44
| | | | | | | | The ActivityDatabase has been reimplemented using LDAPDatabase. The ActivityRecord has been modified to specify the object class and attribute mappings. Ticket #652
* Connected token database to LDAP.Endi S. Dewata2013-09-174-38/+54
| | | | | | | | The TokenDatabase has been reimplemented using LDAPDatabase. The TokenRecord has been modified to specify the object class and attribute mappings. Ticket #652
* Added LDAPDatabase.Endi S. Dewata2013-09-176-4/+337
| | | | | | | A new LDAPDatabase class was added as a base class for LDAP-based databases. A new DBRecord class was added to provide the default implementation for record classes. New annotation classes were added to specify the object class and attribute mappings.
* Fixed dependency issue on RenewableCertificateCollection.Endi S. Dewata2013-09-173-33/+55
| | | | | | The RenewableCertificateCollection class is in the server package but it's used by ICertificateRepository in the base package, so the class has been moved into the base package.
* Fixed dependency issue on ProfilePolicy.Endi S. Dewata2013-09-174-28/+25
| | | | | | The ProfilePolicy is in the server package but it's used by IProfile interface in the base package. The interface have been modified to use IProfilePolicy instead.
* Fixed duplicate TPSSubsystem instance.Endi S. Dewata2013-09-176-27/+24
| | | | | | Previously there were two TPSSubsystem instances: one created by CMSEngine and the other created by the static code in TPSSubsystem. The second instance has been removed since it's a duplicate and not initialized properly.
* TRAC Ticket #707 - Do not "require" the following pkispawn parameters for ↵Matthew Harmsen2013-09-162-19/+43
| | | | GUI-based configuration
* Patch to get rid of introduced warnings.Jack Magne2013-09-103-7/+7
|
* Bug 1005025 - Unable to view Curve details of ECC Cert request from Agent ↵Christina Fu2013-09-103-326/+346
| | | | interface
* Catch all exceptions when checking for status.Ade Lee2013-09-062-10/+16
| | | | | | | | | | | | python-requests now throws a ProxyError if the server is not yet up. Previously only connect exceptions were seen. To ensure that we are not broken again when python-requests and the underlying libraries are changed, we will catch and log all exceptions. If the connection ultimately fails, we will time out in any case. Also fixed some new warnings from Pylint 1.0 Ticket 717
* manager.ldif referenced incorrectly in CS.cfgAde Lee2013-09-043-3/+3
| | | | Ticket 719
* TRAC Ticket #641 - Incorrect interface labels in pkidaemon outputMatthew Harmsen2013-09-047-58/+70
|
* Provide enrollment template per profileAde Lee2013-09-038-12/+301
| | | | | | | | | | | This adds an API call to get a template which can be used to generate an enrollment request which can be passed into the REST API. The template is simply a CertRequest with the relevant inputs for that profile added in. Per code review comments, have added the templates interface to CertRequestResource instead. This patch now includes /certrequests/profiles and /certrequests/profiles/{id}. In a subsequent patch, all calls in ProfileResource will be restricted to admins and agents.
* Add audit logging to profile interfaceAde Lee2013-09-029-113/+785
| | | | | | This patch adds initial audit logging to the Profile interface. A more complete review of audit logging will probably be done for Common Criteria testing.
* Fixed filter code for revocationReasonAde Lee2013-09-022-3/+4
| | | | | | | Filter was incorrectly setting ldap query to revocationReason* resulting in a reach for revocationReason 1 returning 1 and 10 Ticket 712
* Changed systemd service file so that target starts up correctlyAde Lee2013-09-022-3/+2
| | | | | | | Also added SuccessExitStatus directive to unit file to ignore exit value 143. As a result of this setting, exit status 0 is returned. Ticket 716
* Move status marker from CS.cfg to a variable.Ade Lee2013-09-025-24/+20
|
* Bug 986831 - Some tools are broken for ECC with NSS token aloneChristina Fu2013-09-012-2/+4
|
* Added TPS authenticator resource.Endi S. Dewata2013-09-0119-0/+1669
| | | | | | | A skeleton for TPS authenticator services and the clients have been added. The service implementation will be added later. Ticket #652
* Added TPS connection resource.Endi S. Dewata2013-09-0122-10/+1698
| | | | | | | A skeleton for TPS connection services and the clients have been added. The service implementation will be added later. Ticket #652
* Reorganized TPS classes.Endi S. Dewata2013-09-0132-60/+60
| | | | | | | | | | | The TPS classes have been reorganized as follows: * common: com.netscape.certsrv.tps * CLI: com.netscape.cmstools.tps * server: org.dogtagpki.server.tps TPSConnection and TPSMessage were moved from server package into common package. The build script and configuration files have been modified accordingly.
* Pre-registration of CA cross signing profileAndrew Wnuk2013-08-291-1/+3
| | | | | | This patch provides pre-registration of CA cross signing profile. Ticket #681.
* CA cross signing profileAndrew Wnuk2013-08-291-0/+92
| | | | | | This patch provides new profile to support CA cross signing enrollment. Ticket #681
* Pre-registration of UserSubjectNameConstraint plug-inAndrew Wnuk2013-08-291-1/+4
| | | | | | This patch provides pre-registration of UserSubjectNameConstraint plug-in. Ticket #682.
* UserSubjectNameConstraint plug-inAndrew Wnuk2013-08-292-0/+94
| | | | | | This patch provides new UserSubjectNameConstraint plug-in allowing to include user subject name with its original encoding into certificate. Ticket #682
* CRMFPopClient updateAndrew Wnuk2013-08-281-10/+84
| | | | | | This patch provides enhancement to CRMFPopClient allowing to control encoding for components of the subject name. Ticket #676
* PKCS10Client updateAndrew Wnuk2013-08-261-9/+85
| | | | | | This patch provides enhancement to PKCS10Client allowing to control encoding for components of the subject name. Ticket #677
generated by cgit (git 2.34.1) at 2024-10-05 11:41:51 +0000