From 17d6be4d85741bffa21d93aceaff00223bc77dec Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Tue, 13 Aug 2013 15:56:50 -0400 Subject: Moved Tomcat-based TPS to separate folder. The source files for the new Tomcat-based TPS has been moved from base/tps to base/tps-tomcat. The new TPS will now be build in pki-core and packaged in pki-tps-tomcat RPM. The old TPS and RA have been restored to the previous state before adding the new TPS. Once the new TPS is complete, the old TPS can be removed, the new TPS can be moved back to base/tps and the package can be renamed back to pki-tps. Ticket #702 --- .classpath | 2 +- base/CMakeLists.txt | 1 + base/ra/CMakeLists.txt | 2 +- base/ra/doc/CMakeLists.txt | 8 + base/ra/doc/CS.cfg.in | 242 +++ base/ra/shared/conf/CMakeLists.txt | 8 - base/ra/shared/conf/CS.cfg.in | 242 --- base/tps-tomcat/CMakeLists.txt | 67 + base/tps-tomcat/LICENSE | 469 ++++++ base/tps-tomcat/setup/CMakeLists.txt | 6 + base/tps-tomcat/setup/registry_instance | 60 + base/tps-tomcat/shared/conf/CMakeLists.txt | 8 + base/tps-tomcat/shared/conf/CS.cfg.in | 1603 +++++++++++++++++++ base/tps-tomcat/shared/conf/acl.ldif | 22 + base/tps-tomcat/shared/conf/catalina.policy | 182 +++ base/tps-tomcat/shared/conf/catalina.properties | 87 ++ base/tps-tomcat/shared/conf/context.xml | 40 + base/tps-tomcat/shared/conf/database.ldif | 9 + base/tps-tomcat/shared/conf/db.ldif | 54 + base/tps-tomcat/shared/conf/etc/init.d/pki-tpsd | 86 ++ base/tps-tomcat/shared/conf/index.ldif | 76 + base/tps-tomcat/shared/conf/jk2.manifest | 2 + base/tps-tomcat/shared/conf/jk2.properties | 31 + base/tps-tomcat/shared/conf/jkconf.ant.xml | 55 + base/tps-tomcat/shared/conf/jkconfig.manifest | 2 + base/tps-tomcat/shared/conf/logging.properties | 70 + base/tps-tomcat/shared/conf/manager.ldif | 46 + base/tps-tomcat/shared/conf/schema.ldif | 58 + base/tps-tomcat/shared/conf/server-minimal.xml | 29 + base/tps-tomcat/shared/conf/server.xml | 258 ++++ base/tps-tomcat/shared/conf/shm.manifest | 2 + base/tps-tomcat/shared/conf/tomcat-jk2.manifest | 7 + base/tps-tomcat/shared/conf/tomcat-users.xml | 45 + base/tps-tomcat/shared/conf/tomcat6.conf | 58 + .../tps-tomcat/shared/conf/uriworkermap.properties | 18 + base/tps-tomcat/shared/conf/vlv.ldif | 51 + base/tps-tomcat/shared/conf/vlvtasks.ldif | 28 + base/tps-tomcat/shared/conf/web.xml | 993 ++++++++++++ base/tps-tomcat/shared/conf/workers.properties | 209 +++ .../shared/conf/workers.properties.minimal | 22 + base/tps-tomcat/shared/conf/workers2.properties | 136 ++ .../shared/conf/workers2.properties.minimal | 60 + base/tps-tomcat/shared/etc/init.d/pki-tpsd | 86 ++ .../shared/lib/systemd/system/pki-tpsd.target | 6 + .../shared/lib/systemd/system/pki-tpsd@.service | 12 + base/tps-tomcat/shared/webapps/tps/404.html | 145 ++ base/tps-tomcat/shared/webapps/tps/500.html | 138 ++ .../shared/webapps/tps/GenUnexpectedError.template | 67 + .../shared/webapps/tps/META-INF/context.xml | 37 + .../shared/webapps/tps/WEB-INF/auth.properties | 10 + .../shared/webapps/tps/WEB-INF/velocity.properties | 13 + base/tps-tomcat/shared/webapps/tps/WEB-INF/web.xml | 188 +++ base/tps-tomcat/shared/webapps/tps/index.html | 23 + .../shared/webapps/tps/services.template | 106 ++ base/tps-tomcat/src/CMakeLists.txt | 138 ++ .../src/org/dogtagpki/tps/TPSConnection.java | 98 ++ .../src/org/dogtagpki/tps/TPSMessage.java | 101 ++ .../org/dogtagpki/tps/server/TPSApplication.java | 84 + .../src/org/dogtagpki/tps/server/TPSServlet.java | 61 + .../src/org/dogtagpki/tps/server/TPSSubsystem.java | 115 ++ .../src/org/dogtagpki/tps/token/TokenDatabase.java | 76 + .../src/org/dogtagpki/tps/token/TokenRecord.java | 188 +++ .../src/org/dogtagpki/tps/token/TokenService.java | 245 +++ base/tps-tomcat/src/pki-tps.mf | 3 + base/tps/CMakeLists.txt | 19 +- base/tps/doc/CMakeLists.txt | 8 + base/tps/doc/CS.cfg.in | 1608 ++++++++++++++++++++ base/tps/java/CMakeLists.txt | 136 -- base/tps/java/org/dogtagpki/tps/TPSConnection.java | 98 -- base/tps/java/org/dogtagpki/tps/TPSMessage.java | 101 -- .../org/dogtagpki/tps/server/TPSApplication.java | 84 - .../java/org/dogtagpki/tps/server/TPSServlet.java | 61 - .../org/dogtagpki/tps/server/TPSSubsystem.java | 115 -- .../org/dogtagpki/tps/token/TokenDatabase.java | 76 - .../java/org/dogtagpki/tps/token/TokenRecord.java | 188 --- .../java/org/dogtagpki/tps/token/TokenService.java | 245 --- base/tps/java/pki-tps.mf | 3 - base/tps/shared/conf/CMakeLists.txt | 8 - base/tps/shared/conf/CS.cfg.in | 1603 ------------------- base/tps/shared/conf/acl.ldif | 22 - base/tps/shared/conf/catalina.policy | 182 --- base/tps/shared/conf/catalina.properties | 87 -- base/tps/shared/conf/context.xml | 40 - base/tps/shared/conf/database.ldif | 9 - base/tps/shared/conf/db.ldif | 54 - base/tps/shared/conf/etc/init.d/pki-tpsd | 86 -- base/tps/shared/conf/index.ldif | 76 - base/tps/shared/conf/jk2.manifest | 2 - base/tps/shared/conf/jk2.properties | 31 - base/tps/shared/conf/jkconf.ant.xml | 55 - base/tps/shared/conf/jkconfig.manifest | 2 - base/tps/shared/conf/logging.properties | 70 - base/tps/shared/conf/manager.ldif | 46 - base/tps/shared/conf/schema.ldif | 58 - base/tps/shared/conf/server-minimal.xml | 29 - base/tps/shared/conf/server.xml | 258 ---- base/tps/shared/conf/shm.manifest | 2 - base/tps/shared/conf/tomcat-jk2.manifest | 7 - base/tps/shared/conf/tomcat-users.xml | 45 - base/tps/shared/conf/tomcat6.conf | 58 - base/tps/shared/conf/uriworkermap.properties | 18 - base/tps/shared/conf/vlv.ldif | 51 - base/tps/shared/conf/vlvtasks.ldif | 28 - base/tps/shared/conf/web.xml | 993 ------------ base/tps/shared/conf/workers.properties | 209 --- base/tps/shared/conf/workers.properties.minimal | 22 - base/tps/shared/conf/workers2.properties | 136 -- base/tps/shared/conf/workers2.properties.minimal | 60 - base/tps/shared/etc/init.d/pki-tpsd | 86 -- base/tps/shared/lib/systemd/system/pki-tpsd.target | 6 - .../shared/lib/systemd/system/pki-tpsd@.service | 12 - base/tps/shared/webapps/tps/404.html | 145 -- base/tps/shared/webapps/tps/500.html | 138 -- .../shared/webapps/tps/GenUnexpectedError.template | 67 - base/tps/shared/webapps/tps/META-INF/context.xml | 37 - .../tps/shared/webapps/tps/WEB-INF/auth.properties | 10 - .../shared/webapps/tps/WEB-INF/velocity.properties | 13 - base/tps/shared/webapps/tps/WEB-INF/web.xml | 188 --- base/tps/shared/webapps/tps/index.html | 23 - base/tps/shared/webapps/tps/services.template | 106 -- scripts/compose_dogtag_pki_meta_packages | 2 +- scripts/compose_dogtag_pki_theme_packages | 2 +- scripts/compose_ipa_pki_theme_packages | 2 +- scripts/compose_pki_console_packages | 2 +- scripts/compose_pki_core_packages | 25 +- scripts/compose_pki_migrate_packages | 2 +- scripts/compose_pki_ra_packages | 2 +- scripts/compose_pki_tps_packages | 2 +- specs/pki-core.spec | 72 +- specs/pki-tps.spec | 8 +- 130 files changed, 8859 insertions(+), 6574 deletions(-) create mode 100644 base/ra/doc/CMakeLists.txt create mode 100644 base/ra/doc/CS.cfg.in delete mode 100644 base/ra/shared/conf/CMakeLists.txt delete mode 100644 base/ra/shared/conf/CS.cfg.in create mode 100644 base/tps-tomcat/CMakeLists.txt create mode 100644 base/tps-tomcat/LICENSE create mode 100644 base/tps-tomcat/setup/CMakeLists.txt create mode 100644 base/tps-tomcat/setup/registry_instance create mode 100644 base/tps-tomcat/shared/conf/CMakeLists.txt create mode 100644 base/tps-tomcat/shared/conf/CS.cfg.in create mode 100644 base/tps-tomcat/shared/conf/acl.ldif create mode 100644 base/tps-tomcat/shared/conf/catalina.policy create mode 100644 base/tps-tomcat/shared/conf/catalina.properties create mode 100644 base/tps-tomcat/shared/conf/context.xml create mode 100644 base/tps-tomcat/shared/conf/database.ldif create mode 100644 base/tps-tomcat/shared/conf/db.ldif create mode 100755 base/tps-tomcat/shared/conf/etc/init.d/pki-tpsd create mode 100644 base/tps-tomcat/shared/conf/index.ldif create mode 100644 base/tps-tomcat/shared/conf/jk2.manifest create mode 100644 base/tps-tomcat/shared/conf/jk2.properties create mode 100644 base/tps-tomcat/shared/conf/jkconf.ant.xml create mode 100644 base/tps-tomcat/shared/conf/jkconfig.manifest create mode 100644 base/tps-tomcat/shared/conf/logging.properties create mode 100644 base/tps-tomcat/shared/conf/manager.ldif create mode 100644 base/tps-tomcat/shared/conf/schema.ldif create mode 100644 base/tps-tomcat/shared/conf/server-minimal.xml create mode 100644 base/tps-tomcat/shared/conf/server.xml create mode 100644 base/tps-tomcat/shared/conf/shm.manifest create mode 100644 base/tps-tomcat/shared/conf/tomcat-jk2.manifest create mode 100644 base/tps-tomcat/shared/conf/tomcat-users.xml create mode 100644 base/tps-tomcat/shared/conf/tomcat6.conf create mode 100644 base/tps-tomcat/shared/conf/uriworkermap.properties create mode 100644 base/tps-tomcat/shared/conf/vlv.ldif create mode 100644 base/tps-tomcat/shared/conf/vlvtasks.ldif create mode 100644 base/tps-tomcat/shared/conf/web.xml create mode 100644 base/tps-tomcat/shared/conf/workers.properties create mode 100644 base/tps-tomcat/shared/conf/workers.properties.minimal create mode 100644 base/tps-tomcat/shared/conf/workers2.properties create mode 100644 base/tps-tomcat/shared/conf/workers2.properties.minimal create mode 100755 base/tps-tomcat/shared/etc/init.d/pki-tpsd create mode 100644 base/tps-tomcat/shared/lib/systemd/system/pki-tpsd.target create mode 100644 base/tps-tomcat/shared/lib/systemd/system/pki-tpsd@.service create mode 100755 base/tps-tomcat/shared/webapps/tps/404.html create mode 100755 base/tps-tomcat/shared/webapps/tps/500.html create mode 100644 base/tps-tomcat/shared/webapps/tps/GenUnexpectedError.template create mode 100644 base/tps-tomcat/shared/webapps/tps/META-INF/context.xml create mode 100644 base/tps-tomcat/shared/webapps/tps/WEB-INF/auth.properties create mode 100644 base/tps-tomcat/shared/webapps/tps/WEB-INF/velocity.properties create mode 100644 base/tps-tomcat/shared/webapps/tps/WEB-INF/web.xml create mode 100644 base/tps-tomcat/shared/webapps/tps/index.html create mode 100644 base/tps-tomcat/shared/webapps/tps/services.template create mode 100644 base/tps-tomcat/src/CMakeLists.txt create mode 100644 base/tps-tomcat/src/org/dogtagpki/tps/TPSConnection.java create mode 100644 base/tps-tomcat/src/org/dogtagpki/tps/TPSMessage.java create mode 100644 base/tps-tomcat/src/org/dogtagpki/tps/server/TPSApplication.java create mode 100644 base/tps-tomcat/src/org/dogtagpki/tps/server/TPSServlet.java create mode 100644 base/tps-tomcat/src/org/dogtagpki/tps/server/TPSSubsystem.java create mode 100644 base/tps-tomcat/src/org/dogtagpki/tps/token/TokenDatabase.java create mode 100644 base/tps-tomcat/src/org/dogtagpki/tps/token/TokenRecord.java create mode 100644 base/tps-tomcat/src/org/dogtagpki/tps/token/TokenService.java create mode 100644 base/tps-tomcat/src/pki-tps.mf create mode 100644 base/tps/doc/CMakeLists.txt create mode 100644 base/tps/doc/CS.cfg.in delete mode 100644 base/tps/java/CMakeLists.txt delete mode 100644 base/tps/java/org/dogtagpki/tps/TPSConnection.java delete mode 100644 base/tps/java/org/dogtagpki/tps/TPSMessage.java delete mode 100644 base/tps/java/org/dogtagpki/tps/server/TPSApplication.java delete mode 100644 base/tps/java/org/dogtagpki/tps/server/TPSServlet.java delete mode 100644 base/tps/java/org/dogtagpki/tps/server/TPSSubsystem.java delete mode 100644 base/tps/java/org/dogtagpki/tps/token/TokenDatabase.java delete mode 100644 base/tps/java/org/dogtagpki/tps/token/TokenRecord.java delete mode 100644 base/tps/java/org/dogtagpki/tps/token/TokenService.java delete mode 100644 base/tps/java/pki-tps.mf delete mode 100644 base/tps/shared/conf/CMakeLists.txt delete mode 100644 base/tps/shared/conf/CS.cfg.in delete mode 100644 base/tps/shared/conf/acl.ldif delete mode 100644 base/tps/shared/conf/catalina.policy delete mode 100644 base/tps/shared/conf/catalina.properties delete mode 100644 base/tps/shared/conf/context.xml delete mode 100644 base/tps/shared/conf/database.ldif delete mode 100644 base/tps/shared/conf/db.ldif delete mode 100755 base/tps/shared/conf/etc/init.d/pki-tpsd delete mode 100644 base/tps/shared/conf/index.ldif delete mode 100644 base/tps/shared/conf/jk2.manifest delete mode 100644 base/tps/shared/conf/jk2.properties delete mode 100644 base/tps/shared/conf/jkconf.ant.xml delete mode 100644 base/tps/shared/conf/jkconfig.manifest delete mode 100644 base/tps/shared/conf/logging.properties delete mode 100644 base/tps/shared/conf/manager.ldif delete mode 100644 base/tps/shared/conf/schema.ldif delete mode 100644 base/tps/shared/conf/server-minimal.xml delete mode 100644 base/tps/shared/conf/server.xml delete mode 100644 base/tps/shared/conf/shm.manifest delete mode 100644 base/tps/shared/conf/tomcat-jk2.manifest delete mode 100644 base/tps/shared/conf/tomcat-users.xml delete mode 100644 base/tps/shared/conf/tomcat6.conf delete mode 100644 base/tps/shared/conf/uriworkermap.properties delete mode 100644 base/tps/shared/conf/vlv.ldif delete mode 100644 base/tps/shared/conf/vlvtasks.ldif delete mode 100644 base/tps/shared/conf/web.xml delete mode 100644 base/tps/shared/conf/workers.properties delete mode 100644 base/tps/shared/conf/workers.properties.minimal delete mode 100644 base/tps/shared/conf/workers2.properties delete mode 100644 base/tps/shared/conf/workers2.properties.minimal delete mode 100755 base/tps/shared/etc/init.d/pki-tpsd delete mode 100644 base/tps/shared/lib/systemd/system/pki-tpsd.target delete mode 100644 base/tps/shared/lib/systemd/system/pki-tpsd@.service delete mode 100755 base/tps/shared/webapps/tps/404.html delete mode 100755 base/tps/shared/webapps/tps/500.html delete mode 100644 base/tps/shared/webapps/tps/GenUnexpectedError.template delete mode 100644 base/tps/shared/webapps/tps/META-INF/context.xml delete mode 100644 base/tps/shared/webapps/tps/WEB-INF/auth.properties delete mode 100644 base/tps/shared/webapps/tps/WEB-INF/velocity.properties delete mode 100644 base/tps/shared/webapps/tps/WEB-INF/web.xml delete mode 100644 base/tps/shared/webapps/tps/index.html delete mode 100644 base/tps/shared/webapps/tps/services.template diff --git a/.classpath b/.classpath index 0cc81a118..bee1aacbf 100644 --- a/.classpath +++ b/.classpath @@ -16,7 +16,7 @@ - + diff --git a/base/CMakeLists.txt b/base/CMakeLists.txt index 0a8e51647..0dc513666 100644 --- a/base/CMakeLists.txt +++ b/base/CMakeLists.txt @@ -17,6 +17,7 @@ if (APPLICATION_FLAVOR_PKI_CORE) add_subdirectory(kra) add_subdirectory(ocsp) add_subdirectory(tks) + add_subdirectory(tps) add_subdirectory(silent) if(WITH_JAVADOC) diff --git a/base/ra/CMakeLists.txt b/base/ra/CMakeLists.txt index e3e2c1eba..ece6713c6 100644 --- a/base/ra/CMakeLists.txt +++ b/base/ra/CMakeLists.txt @@ -1,7 +1,7 @@ project(ra) +add_subdirectory(doc) add_subdirectory(setup) -add_subdirectory(shared/conf) # install systemd scripts install( diff --git a/base/ra/doc/CMakeLists.txt b/base/ra/doc/CMakeLists.txt new file mode 100644 index 000000000..419289d03 --- /dev/null +++ b/base/ra/doc/CMakeLists.txt @@ -0,0 +1,8 @@ +configure_file(${CMAKE_CURRENT_SOURCE_DIR}/CS.cfg.in ${CMAKE_CURRENT_BINARY_DIR}/CS.cfg @ONLY) + +install( + FILES + ${CMAKE_CURRENT_BINARY_DIR}/CS.cfg + DESTINATION + ${SHARE_INSTALL_PREFIX}/${APPLICATION_NAME}/${PROJECT_NAME}/conf +) diff --git a/base/ra/doc/CS.cfg.in b/base/ra/doc/CS.cfg.in new file mode 100644 index 000000000..227b117ce --- /dev/null +++ b/base/ra/doc/CS.cfg.in @@ -0,0 +1,242 @@ +_000=## +_001=## Registration Authority (RA) Configuration File +_002=## +pidDir=[PKI_PIDDIR] +pkicreate.pki_instance_root=[PKI_INSTANCE_ROOT] +pkicreate.pki_instance_name=[PKI_INSTANCE_NAME] +pkicreate.subsystem_type=[PKI_SUBSYSTEM_TYPE] +pkicreate.secure_port=[PKI_SECURE_PORT] +pkicreate.non_clientauth_secure_port=[NON_CLIENTAUTH_SECURE_PORT] +pkicreate.unsecure_port=[PKI_UNSECURE_PORT] +pkicreate.user=[PKI_USER] +pkicreate.group=[PKI_GROUP] +pkiremove.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] +request._000=######################################### +request._001=# Request Queue Parameters +request._002=######################################### +agent.authorized_groups=administrators,agents +admin.authorized_groups=administrators +database.dbfile=[PKI_INSTANCE_PATH]/conf/dbfile +database.lockfile=[PKI_INSTANCE_PATH]/conf/dblock +request.renewal.approve_request.0.ca=ca1 +request.renewal.approve_request.0.plugin=PKI::Request::Plugin::RequestToCA +request.renewal.approve_request.0.profileId=caDualRAuserCert +request.renewal.approve_request.0.reqType=crmf +request.renewal.approve_request.1.mailTo=$created_by +request.renewal.approve_request.1.plugin=PKI::Request::Plugin::EmailNotification +request.renewal.approve_request.1.templateDir=/usr/share/pki/ra/conf +request.renewal.approve_request.1.templateFile=mail_approve_request.vm +request.renewal.approve_request.num_plugins=2 +request.renewal.reject_request.num_plugins=0 +request.renewal.create_request.0.assignTo=agents +request.renewal.create_request.0.plugin=PKI::Request::Plugin::AutoAssign +request.renewal.create_request.1.mailTo=$created_by +request.renewal.create_request.1.plugin=PKI::Request::Plugin::EmailNotification +request.renewal.create_request.1.templateDir=/usr/share/pki/ra/conf +request.renewal.create_request.1.templateFile=mail_create_request.vm +request.renewal.create_request.num_plugins=2 +request.scep.profileId=caRARouterCert +request.scep.reqType=pkcs10 +request.scep.create_request.num_plugins=2 +request.scep.create_request.0.plugin=PKI::Request::Plugin::AutoAssign +request.scep.create_request.0.assignTo=agents +request.scep.create_request.1.plugin=PKI::Request::Plugin::EmailNotification +request.scep.create_request.1.mailTo= +request.scep.create_request.1.templateDir=/usr/share/pki/ra/conf +request.scep.create_request.1.templateFile=mail_create_request.vm +request.scep.approve_request.num_plugins=1 +request.scep.approve_request.0.plugin=PKI::Request::Plugin::CreatePin +request.scep.approve_request.0.pinFormat=$site_id +request.scep.reject_request.num_plugins=0 +request.agent.profileId=caRAagentCert +request.agent.reqType=crmf +request.agent.create_request.num_plugins=2 +request.agent.create_request.0.plugin=PKI::Request::Plugin::AutoAssign +request.agent.create_request.0.assignTo=agents +request.agent.create_request.1.plugin=PKI::Request::Plugin::EmailNotification +request.agent.create_request.1.mailTo= +request.agent.create_request.1.templateDir=/usr/share/pki/ra/conf +request.agent.create_request.1.templateFile=mail_create_request.vm +request.agent.approve_request.num_plugins=1 +request.agent.approve_request.0.plugin=PKI::Request::Plugin::CreatePin +request.agent.approve_request.0.pinFormat=$uid +request.agent.reject_request.num_plugins=0 +request.user.create_request.num_plugins=2 +request.user.create_request.0.plugin=PKI::Request::Plugin::AutoAssign +request.user.create_request.0.assignTo=agents +request.user.create_request.1.plugin=PKI::Request::Plugin::EmailNotification +request.user.create_request.1.templateDir=/usr/share/pki/ra/conf +request.user.create_request.1.templateFile=mail_create_request.vm +request.user.create_request.1.mailTo= +request.user.approve_request.num_plugins=2 +request.user.approve_request.0.plugin=PKI::Request::Plugin::RequestToCA +request.user.approve_request.0.ca=ca1 +request.user.approve_request.0.profileId=caDualRAuserCert +request.user.approve_request.0.reqType=crmf +request.user.approve_request.1.plugin=PKI::Request::Plugin::EmailNotification +request.user.approve_request.1.mailTo=$created_by +request.user.approve_request.1.templateDir=/usr/share/pki/ra/conf +request.user.approve_request.1.templateFile=mail_approve_request.vm +request.user.reject_request.num_plugins=0 +request.server.create_request.num_plugins=2 +request.server.create_request.0.plugin=PKI::Request::Plugin::AutoAssign +request.server.create_request.0.assignTo=agents +request.server.create_request.1.plugin=PKI::Request::Plugin::EmailNotification +request.server.create_request.1.mailTo= +request.server.create_request.1.templateDir=/usr/share/pki/ra/conf +request.server.create_request.1.templateFile=mail_create_request.vm +request.server.approve_request.num_plugins=2 +request.server.approve_request.0.plugin=PKI::Request::Plugin::RequestToCA +request.server.approve_request.0.ca=ca1 +request.server.approve_request.0.profileId=caRAserverCert +request.server.approve_request.0.reqType=pkcs10 +request.server.approve_request.1.plugin=PKI::Request::Plugin::EmailNotification +request.server.approve_request.1.mailTo=$created_by +request.server.approve_request.1.templateDir=/usr/share/pki/ra/conf +request.server.approve_request.1.templateFile=mail_approve_request.vm +request.server.reject_request.num_plugins=0 +cs.type=RA +service.machineName=[PKI_HOSTNAME] +service.instanceDir=[PKI_INSTANCE_PATH] +service.securePort=[PKI_SECURE_PORT] +service.non_clientauth_securePort=[NON_CLIENTAUTH_SECURE_PORT] +service.unsecurePort=[PKI_UNSECURE_PORT] +service.instanceID=[PKI_INSTANCE_NAME] +logging._000=######################################### +logging._001=# RA configuration File +logging._002=# +logging._003=# All <...> must be replaced with +logging._004=# appropriate values. +logging._005=######################################### +logging._006=######################################## +logging._007=# logging +logging._008=# +logging._009=# logging.debug.enable: +logging._010=# logging.audit.enable: +logging._011=# logging.error.enable: +logging._012=# - enable or disable the corresponding logging +logging._013=# logging.debug.filename: +logging._014=# logging.audit.filename: +logging._015=# logging.error.filename: +logging._016=# - name of the log file +logging._017=# logging.debug.level: +logging._018=# logging.audit.level: +logging._019=# logging.error.level: +logging._020=# - level of logging. (0-10) +logging._021=# 0 - no logging, +logging._022=# 4 - LL_PER_SERVER these messages will occur only once +logging._023=# during the entire invocation of the +logging._024=# server, e. g. at startup or shutdown +logging._025=# time., reading the conf parameters. +logging._026=# Perhaps other infrequent events +logging._027=# relating to failing over of CA, TKS, +logging._028=# too +logging._029=# 6 - LL_PER_CONNECTION these messages happen once per +logging._030=# connection - most of the log events +logging._031=# will be at this level +logging._032=# 8 - LL_PER_PDU these messages relate to PDU +logging._033=# processing. If you have something that +logging._034=# is done for every PDU, such as +logging._035=# applying the MAC, it should be logged +logging._036=# at this level +logging._037=# 9 - LL_ALL_DATA_IN_PDU dump all the data in the PDU - a more +logging._038=# chatty version of the above +logging._039=# 10 - all logging +logging._040=######################################### +logging.debug.enable=true +logging.debug.filename=[PKI_INSTANCE_PATH]/logs/ra-debug.log +logging.debug.level=7 +logging.audit.enable=true +logging.audit.filename=[PKI_INSTANCE_PATH]/logs/ra-audit.log +logging.audit.level=10 +logging.error.enable=true +logging.error.filename=[PKI_INSTANCE_PATH]/logs/ra-error.log +logging.error.level=10 +conn.ca1._000=######################################### +conn.ca1._001=# CA connection +conn.ca1._002=# +conn.ca1._003=# conn.ca.hostport: +conn.ca1._004=# - host name and port number of your CA, format is host:port +conn.ca1._005=# conn.ca.clientNickname: +conn.ca1._006=# - nickname of the client certificate for +conn.ca1._007=# authentication +conn.ca1._008=# conn.ca.servlet.enrollment: +conn.ca1._009=# - servlet to contact in CA +conn.ca1._010=# - must be '/ca/ee/ca/profileSubmitSSLClient' +conn.ca1._008=# conn.ca.servlet.addagent: +conn.ca1._009=# - servlet to add ra agent on CA +conn.ca1._010=# - must be '/ca/admin/ca/registerRaUser +conn.ca1._011=# conn.ca.retryConnect: +conn.ca1._012=# - number of reconnection attempts on failure +conn.ca1._013=# conn.ca.timeout: +conn.ca1._014=# - connection timeout +conn.ca1._015=# conn.ca.SSLOn: +conn.ca1._016=# - enable SSL or not +conn.ca1._017=# conn.ca.keepAlive: +conn.ca1._018=# - enable keep alive or not +conn.ca1._019=# +conn.ca1._020=# where +conn.ca1._021=# - CA connection ID +conn.ca1._022=######################################### +failover.pod.enable=false +conn.ca1.hostport=[PKI_CA_HOSTNAME]:[PKI_CA_PORT] +conn.ca1.clientNickname=[HSM_LABEL][NICKNAME] +conn.ca1.servlet.enrollment=/ca/ee/ca/profileSubmitSSLClient +conn.ca1.servlet.addagent=/ca/admin/ca/registerRaUser +conn.ca1.servlet.revoke=/ca/subsystem/ca/doRevoke +conn.ca1.servlet.unrevoke=/ca/subsystem/ca/doUnrevoke +conn.ca1.retryConnect=3 +conn.ca1.timeout=100 +conn.ca1.SSLOn=true +conn.ca1.keepAlive=true +preop.pin=[PKI_RANDOM_NUMBER] +cms.product.version=@APPLICATION_VERSION@ +preop.cert._000=######################################### +preop.cert._001=# Installation configuration "preop" certs parameters +preop.cert._002=######################################### +preop.cert.list=sslserver,subsystem +preop.cert.sslserver.enable=true +preop.cert.subsystem.enable=true +preop.cert.sslserver.defaultSigningAlgorithm=SHA256withRSA +preop.cert.sslserver.dn=CN=[PKI_HOSTNAME], OU=[PKI_INSTANCE_NAME] +preop.cert.sslserver.keysize.customsize=2048 +preop.cert.sslserver.keysize.size=2048 +preop.cert.sslserver.keysize.select=custom +preop.cert.sslserver.nickname=Server-Cert cert-[PKI_INSTANCE_NAME] +preop.cert.sslserver.profile=caInternalAuthServerCert +preop.cert.sslserver.subsystem=ra +preop.cert._003=#preop.cert.sslserver.type=local +preop.cert.sslserver.userfriendlyname=SSL Server Certificate +preop.cert._004=#preop.cert.sslserver.cncomponent.override=false +preop.cert.subsystem.defaultSigningAlgorithm=SHA256withRSA +preop.cert.subsystem.dn=CN=RA Subsystem Certificate, OU=[PKI_INSTANCE_NAME] +preop.cert.subsystem.keysize.customsize=2048 +preop.cert.subsystem.keysize.size=2048 +preop.cert.subsystem.keysize.select=custom +preop.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] +preop.cert.subsystem.profile=caInternalAuthSubsystemCert +preop.cert.subsystem.subsystem=ra +preop.cert._005=#preop.cert.subsystem.type=local +preop.cert.subsystem.userfriendlyname=Subsystem Certificate +preop.cert._006=#preop.cert.subsystem.cncomponent.override=true +preop.configModules._000=######################################### +preop.configModules._001=# Installation configuration "preop" module parameters +preop.configModules._002=######################################### +preop.configModules.count=3 +preop.configModules.module0.commonName=NSS Internal PKCS #11 Module +preop.configModules.module0.imagePath=/pki/images/clearpixel.gif +preop.configModules.module0.userFriendlyName=NSS Internal PKCS #11 Module +preop.configModules.module1.commonName=nfast +preop.configModules.module1.imagePath=/pki/images/clearpixel.gif +preop.configModules.module1.userFriendlyName=nCipher's nFast Token Hardware Module +preop.configModules.module2.commonName=lunasa +preop.configModules.module2.imagePath=/pki/images/clearpixel.gif +preop.configModules.module2.userFriendlyName=SafeNet's LunaSA Token Hardware Module +preop.module.token=NSS Certificate DB +preop.keysize._000=######################################### +preop.keysize._001=# Installation configuration "preop" keysize parameters +preop.keysize._002=######################################### +preop.keysize.customsize=2048 +preop.keysize.select=default +preop.keysize.size=2048 +preop.keysize.ecc.size=256 diff --git a/base/ra/shared/conf/CMakeLists.txt b/base/ra/shared/conf/CMakeLists.txt deleted file mode 100644 index 419289d03..000000000 --- a/base/ra/shared/conf/CMakeLists.txt +++ /dev/null @@ -1,8 +0,0 @@ -configure_file(${CMAKE_CURRENT_SOURCE_DIR}/CS.cfg.in ${CMAKE_CURRENT_BINARY_DIR}/CS.cfg @ONLY) - -install( - FILES - ${CMAKE_CURRENT_BINARY_DIR}/CS.cfg - DESTINATION - ${SHARE_INSTALL_PREFIX}/${APPLICATION_NAME}/${PROJECT_NAME}/conf -) diff --git a/base/ra/shared/conf/CS.cfg.in b/base/ra/shared/conf/CS.cfg.in deleted file mode 100644 index 227b117ce..000000000 --- a/base/ra/shared/conf/CS.cfg.in +++ /dev/null @@ -1,242 +0,0 @@ -_000=## -_001=## Registration Authority (RA) Configuration File -_002=## -pidDir=[PKI_PIDDIR] -pkicreate.pki_instance_root=[PKI_INSTANCE_ROOT] -pkicreate.pki_instance_name=[PKI_INSTANCE_NAME] -pkicreate.subsystem_type=[PKI_SUBSYSTEM_TYPE] -pkicreate.secure_port=[PKI_SECURE_PORT] -pkicreate.non_clientauth_secure_port=[NON_CLIENTAUTH_SECURE_PORT] -pkicreate.unsecure_port=[PKI_UNSECURE_PORT] -pkicreate.user=[PKI_USER] -pkicreate.group=[PKI_GROUP] -pkiremove.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] -request._000=######################################### -request._001=# Request Queue Parameters -request._002=######################################### -agent.authorized_groups=administrators,agents -admin.authorized_groups=administrators -database.dbfile=[PKI_INSTANCE_PATH]/conf/dbfile -database.lockfile=[PKI_INSTANCE_PATH]/conf/dblock -request.renewal.approve_request.0.ca=ca1 -request.renewal.approve_request.0.plugin=PKI::Request::Plugin::RequestToCA -request.renewal.approve_request.0.profileId=caDualRAuserCert -request.renewal.approve_request.0.reqType=crmf -request.renewal.approve_request.1.mailTo=$created_by -request.renewal.approve_request.1.plugin=PKI::Request::Plugin::EmailNotification -request.renewal.approve_request.1.templateDir=/usr/share/pki/ra/conf -request.renewal.approve_request.1.templateFile=mail_approve_request.vm -request.renewal.approve_request.num_plugins=2 -request.renewal.reject_request.num_plugins=0 -request.renewal.create_request.0.assignTo=agents -request.renewal.create_request.0.plugin=PKI::Request::Plugin::AutoAssign -request.renewal.create_request.1.mailTo=$created_by -request.renewal.create_request.1.plugin=PKI::Request::Plugin::EmailNotification -request.renewal.create_request.1.templateDir=/usr/share/pki/ra/conf -request.renewal.create_request.1.templateFile=mail_create_request.vm -request.renewal.create_request.num_plugins=2 -request.scep.profileId=caRARouterCert -request.scep.reqType=pkcs10 -request.scep.create_request.num_plugins=2 -request.scep.create_request.0.plugin=PKI::Request::Plugin::AutoAssign -request.scep.create_request.0.assignTo=agents -request.scep.create_request.1.plugin=PKI::Request::Plugin::EmailNotification -request.scep.create_request.1.mailTo= -request.scep.create_request.1.templateDir=/usr/share/pki/ra/conf -request.scep.create_request.1.templateFile=mail_create_request.vm -request.scep.approve_request.num_plugins=1 -request.scep.approve_request.0.plugin=PKI::Request::Plugin::CreatePin -request.scep.approve_request.0.pinFormat=$site_id -request.scep.reject_request.num_plugins=0 -request.agent.profileId=caRAagentCert -request.agent.reqType=crmf -request.agent.create_request.num_plugins=2 -request.agent.create_request.0.plugin=PKI::Request::Plugin::AutoAssign -request.agent.create_request.0.assignTo=agents -request.agent.create_request.1.plugin=PKI::Request::Plugin::EmailNotification -request.agent.create_request.1.mailTo= -request.agent.create_request.1.templateDir=/usr/share/pki/ra/conf -request.agent.create_request.1.templateFile=mail_create_request.vm -request.agent.approve_request.num_plugins=1 -request.agent.approve_request.0.plugin=PKI::Request::Plugin::CreatePin -request.agent.approve_request.0.pinFormat=$uid -request.agent.reject_request.num_plugins=0 -request.user.create_request.num_plugins=2 -request.user.create_request.0.plugin=PKI::Request::Plugin::AutoAssign -request.user.create_request.0.assignTo=agents -request.user.create_request.1.plugin=PKI::Request::Plugin::EmailNotification -request.user.create_request.1.templateDir=/usr/share/pki/ra/conf -request.user.create_request.1.templateFile=mail_create_request.vm -request.user.create_request.1.mailTo= -request.user.approve_request.num_plugins=2 -request.user.approve_request.0.plugin=PKI::Request::Plugin::RequestToCA -request.user.approve_request.0.ca=ca1 -request.user.approve_request.0.profileId=caDualRAuserCert -request.user.approve_request.0.reqType=crmf -request.user.approve_request.1.plugin=PKI::Request::Plugin::EmailNotification -request.user.approve_request.1.mailTo=$created_by -request.user.approve_request.1.templateDir=/usr/share/pki/ra/conf -request.user.approve_request.1.templateFile=mail_approve_request.vm -request.user.reject_request.num_plugins=0 -request.server.create_request.num_plugins=2 -request.server.create_request.0.plugin=PKI::Request::Plugin::AutoAssign -request.server.create_request.0.assignTo=agents -request.server.create_request.1.plugin=PKI::Request::Plugin::EmailNotification -request.server.create_request.1.mailTo= -request.server.create_request.1.templateDir=/usr/share/pki/ra/conf -request.server.create_request.1.templateFile=mail_create_request.vm -request.server.approve_request.num_plugins=2 -request.server.approve_request.0.plugin=PKI::Request::Plugin::RequestToCA -request.server.approve_request.0.ca=ca1 -request.server.approve_request.0.profileId=caRAserverCert -request.server.approve_request.0.reqType=pkcs10 -request.server.approve_request.1.plugin=PKI::Request::Plugin::EmailNotification -request.server.approve_request.1.mailTo=$created_by -request.server.approve_request.1.templateDir=/usr/share/pki/ra/conf -request.server.approve_request.1.templateFile=mail_approve_request.vm -request.server.reject_request.num_plugins=0 -cs.type=RA -service.machineName=[PKI_HOSTNAME] -service.instanceDir=[PKI_INSTANCE_PATH] -service.securePort=[PKI_SECURE_PORT] -service.non_clientauth_securePort=[NON_CLIENTAUTH_SECURE_PORT] -service.unsecurePort=[PKI_UNSECURE_PORT] -service.instanceID=[PKI_INSTANCE_NAME] -logging._000=######################################### -logging._001=# RA configuration File -logging._002=# -logging._003=# All <...> must be replaced with -logging._004=# appropriate values. -logging._005=######################################### -logging._006=######################################## -logging._007=# logging -logging._008=# -logging._009=# logging.debug.enable: -logging._010=# logging.audit.enable: -logging._011=# logging.error.enable: -logging._012=# - enable or disable the corresponding logging -logging._013=# logging.debug.filename: -logging._014=# logging.audit.filename: -logging._015=# logging.error.filename: -logging._016=# - name of the log file -logging._017=# logging.debug.level: -logging._018=# logging.audit.level: -logging._019=# logging.error.level: -logging._020=# - level of logging. (0-10) -logging._021=# 0 - no logging, -logging._022=# 4 - LL_PER_SERVER these messages will occur only once -logging._023=# during the entire invocation of the -logging._024=# server, e. g. at startup or shutdown -logging._025=# time., reading the conf parameters. -logging._026=# Perhaps other infrequent events -logging._027=# relating to failing over of CA, TKS, -logging._028=# too -logging._029=# 6 - LL_PER_CONNECTION these messages happen once per -logging._030=# connection - most of the log events -logging._031=# will be at this level -logging._032=# 8 - LL_PER_PDU these messages relate to PDU -logging._033=# processing. If you have something that -logging._034=# is done for every PDU, such as -logging._035=# applying the MAC, it should be logged -logging._036=# at this level -logging._037=# 9 - LL_ALL_DATA_IN_PDU dump all the data in the PDU - a more -logging._038=# chatty version of the above -logging._039=# 10 - all logging -logging._040=######################################### -logging.debug.enable=true -logging.debug.filename=[PKI_INSTANCE_PATH]/logs/ra-debug.log -logging.debug.level=7 -logging.audit.enable=true -logging.audit.filename=[PKI_INSTANCE_PATH]/logs/ra-audit.log -logging.audit.level=10 -logging.error.enable=true -logging.error.filename=[PKI_INSTANCE_PATH]/logs/ra-error.log -logging.error.level=10 -conn.ca1._000=######################################### -conn.ca1._001=# CA connection -conn.ca1._002=# -conn.ca1._003=# conn.ca.hostport: -conn.ca1._004=# - host name and port number of your CA, format is host:port -conn.ca1._005=# conn.ca.clientNickname: -conn.ca1._006=# - nickname of the client certificate for -conn.ca1._007=# authentication -conn.ca1._008=# conn.ca.servlet.enrollment: -conn.ca1._009=# - servlet to contact in CA -conn.ca1._010=# - must be '/ca/ee/ca/profileSubmitSSLClient' -conn.ca1._008=# conn.ca.servlet.addagent: -conn.ca1._009=# - servlet to add ra agent on CA -conn.ca1._010=# - must be '/ca/admin/ca/registerRaUser -conn.ca1._011=# conn.ca.retryConnect: -conn.ca1._012=# - number of reconnection attempts on failure -conn.ca1._013=# conn.ca.timeout: -conn.ca1._014=# - connection timeout -conn.ca1._015=# conn.ca.SSLOn: -conn.ca1._016=# - enable SSL or not -conn.ca1._017=# conn.ca.keepAlive: -conn.ca1._018=# - enable keep alive or not -conn.ca1._019=# -conn.ca1._020=# where -conn.ca1._021=# - CA connection ID -conn.ca1._022=######################################### -failover.pod.enable=false -conn.ca1.hostport=[PKI_CA_HOSTNAME]:[PKI_CA_PORT] -conn.ca1.clientNickname=[HSM_LABEL][NICKNAME] -conn.ca1.servlet.enrollment=/ca/ee/ca/profileSubmitSSLClient -conn.ca1.servlet.addagent=/ca/admin/ca/registerRaUser -conn.ca1.servlet.revoke=/ca/subsystem/ca/doRevoke -conn.ca1.servlet.unrevoke=/ca/subsystem/ca/doUnrevoke -conn.ca1.retryConnect=3 -conn.ca1.timeout=100 -conn.ca1.SSLOn=true -conn.ca1.keepAlive=true -preop.pin=[PKI_RANDOM_NUMBER] -cms.product.version=@APPLICATION_VERSION@ -preop.cert._000=######################################### -preop.cert._001=# Installation configuration "preop" certs parameters -preop.cert._002=######################################### -preop.cert.list=sslserver,subsystem -preop.cert.sslserver.enable=true -preop.cert.subsystem.enable=true -preop.cert.sslserver.defaultSigningAlgorithm=SHA256withRSA -preop.cert.sslserver.dn=CN=[PKI_HOSTNAME], OU=[PKI_INSTANCE_NAME] -preop.cert.sslserver.keysize.customsize=2048 -preop.cert.sslserver.keysize.size=2048 -preop.cert.sslserver.keysize.select=custom -preop.cert.sslserver.nickname=Server-Cert cert-[PKI_INSTANCE_NAME] -preop.cert.sslserver.profile=caInternalAuthServerCert -preop.cert.sslserver.subsystem=ra -preop.cert._003=#preop.cert.sslserver.type=local -preop.cert.sslserver.userfriendlyname=SSL Server Certificate -preop.cert._004=#preop.cert.sslserver.cncomponent.override=false -preop.cert.subsystem.defaultSigningAlgorithm=SHA256withRSA -preop.cert.subsystem.dn=CN=RA Subsystem Certificate, OU=[PKI_INSTANCE_NAME] -preop.cert.subsystem.keysize.customsize=2048 -preop.cert.subsystem.keysize.size=2048 -preop.cert.subsystem.keysize.select=custom -preop.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] -preop.cert.subsystem.profile=caInternalAuthSubsystemCert -preop.cert.subsystem.subsystem=ra -preop.cert._005=#preop.cert.subsystem.type=local -preop.cert.subsystem.userfriendlyname=Subsystem Certificate -preop.cert._006=#preop.cert.subsystem.cncomponent.override=true -preop.configModules._000=######################################### -preop.configModules._001=# Installation configuration "preop" module parameters -preop.configModules._002=######################################### -preop.configModules.count=3 -preop.configModules.module0.commonName=NSS Internal PKCS #11 Module -preop.configModules.module0.imagePath=/pki/images/clearpixel.gif -preop.configModules.module0.userFriendlyName=NSS Internal PKCS #11 Module -preop.configModules.module1.commonName=nfast -preop.configModules.module1.imagePath=/pki/images/clearpixel.gif -preop.configModules.module1.userFriendlyName=nCipher's nFast Token Hardware Module -preop.configModules.module2.commonName=lunasa -preop.configModules.module2.imagePath=/pki/images/clearpixel.gif -preop.configModules.module2.userFriendlyName=SafeNet's LunaSA Token Hardware Module -preop.module.token=NSS Certificate DB -preop.keysize._000=######################################### -preop.keysize._001=# Installation configuration "preop" keysize parameters -preop.keysize._002=######################################### -preop.keysize.customsize=2048 -preop.keysize.select=default -preop.keysize.size=2048 -preop.keysize.ecc.size=256 diff --git a/base/tps-tomcat/CMakeLists.txt b/base/tps-tomcat/CMakeLists.txt new file mode 100644 index 000000000..58304db06 --- /dev/null +++ b/base/tps-tomcat/CMakeLists.txt @@ -0,0 +1,67 @@ +project(tps Java) + +add_subdirectory(src) + +# install files +add_subdirectory(setup) +add_subdirectory(shared/conf) + +# install systemd scripts +install( + FILES + shared/lib/systemd/system/pki-tpsd.target + shared/lib/systemd/system/pki-tpsd@.service + DESTINATION + ${SYSTEMD_LIB_INSTALL_DIR} + PERMISSIONS + OWNER_EXECUTE OWNER_WRITE OWNER_READ + GROUP_EXECUTE GROUP_READ + WORLD_EXECUTE WORLD_READ +) + +# install init script +install( + FILES + shared/etc/init.d/pki-tpsd + DESTINATION + ${SYSCONF_INSTALL_DIR}/rc.d/init.d + PERMISSIONS + OWNER_EXECUTE OWNER_WRITE OWNER_READ + GROUP_EXECUTE GROUP_READ + WORLD_EXECUTE WORLD_READ +) + +# install directories +install( + DIRECTORY + shared/ + DESTINATION + ${SHARE_INSTALL_PREFIX}/${APPLICATION_NAME}/${PROJECT_NAME} + PATTERN + "CMakeLists.txt" EXCLUDE + PATTERN + "etc/*" EXCLUDE + PATTERN + "conf/CS.cfg.in" EXCLUDE + PATTERN + "lib/*" EXCLUDE +) + +# install empty directories +install( + DIRECTORY + DESTINATION + ${VAR_INSTALL_DIR}/lock/pki/tps +) + +install( + DIRECTORY + DESTINATION + ${VAR_INSTALL_DIR}/run/pki/tps +) + +install( + DIRECTORY + DESTINATION + ${SYSTEMD_ETC_INSTALL_DIR}/pki-tpsd.target.wants +) diff --git a/base/tps-tomcat/LICENSE b/base/tps-tomcat/LICENSE new file mode 100644 index 000000000..af64f0781 --- /dev/null +++ b/base/tps-tomcat/LICENSE @@ -0,0 +1,469 @@ +This Program is free software; you can redistribute it and/or modify it +under the terms of the GNU Lesser General Public License as published by +the Free Software Foundation; version 2.1 of the License. + +This Program is distributed in the hope that it will be useful, but +WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY +or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License +for more details. + +You should have received a copy of the GNU Lesser General Public License along +with this Program; if not, write to the Free Software Foundation, Inc., +59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. + + GNU LESSER GENERAL PUBLIC LICENSE + Version 2.1, February 1999 + + Copyright (C) 1991, 1999 Free Software Foundation, Inc. + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + +[This is the first released version of the Lesser GPL. It also counts + as the successor of the GNU Library Public License, version 2, hence + the version number 2.1.] + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +Licenses are intended to guarantee your freedom to share and change +free software--to make sure the software is free for all its users. + + This license, the Lesser General Public License, applies to some +specially designated software packages--typically libraries--of the +Free Software Foundation and other authors who decide to use it. You +can use it too, but we suggest you first think carefully about whether +this license or the ordinary General Public License is the better +strategy to use in any particular case, based on the explanations below. + + When we speak of free software, we are referring to freedom of use, +not price. Our General Public Licenses are designed to make sure that +you have the freedom to distribute copies of free software (and charge +for this service if you wish); that you receive source code or can get +it if you want it; that you can change the software and use pieces of +it in new free programs; and that you are informed that you can do +these things. + + To protect your rights, we need to make restrictions that forbid +distributors to deny you these rights or to ask you to surrender these +rights. These restrictions translate to certain responsibilities for +you if you distribute copies of the library or if you modify it. + + For example, if you distribute copies of the library, whether gratis +or for a fee, you must give the recipients all the rights that we gave +you. You must make sure that they, too, receive or can get the source +code. If you link other code with the library, you must provide +complete object files to the recipients, so that they can relink them +with the library after making changes to the library and recompiling +it. And you must show them these terms so they know their rights. + + We protect your rights with a two-step method: (1) we copyright the +library, and (2) we offer you this license, which gives you legal +permission to copy, distribute and/or modify the library. + + To protect each distributor, we want to make it very clear that +there is no warranty for the free library. Also, if the library is +modified by someone else and passed on, the recipients should know +that what they have is not the original version, so that the original +author's reputation will not be affected by problems that might be +introduced by others. + + Finally, software patents pose a constant threat to the existence of +any free program. We wish to make sure that a company cannot +effectively restrict the users of a free program by obtaining a +restrictive license from a patent holder. Therefore, we insist that +any patent license obtained for a version of the library must be +consistent with the full freedom of use specified in this license. + + Most GNU software, including some libraries, is covered by the +ordinary GNU General Public License. This license, the GNU Lesser +General Public License, applies to certain designated libraries, and +is quite different from the ordinary General Public License. We use +this license for certain libraries in order to permit linking those +libraries into non-free programs. + + When a program is linked with a library, whether statically or using +a shared library, the combination of the two is legally speaking a +combined work, a derivative of the original library. The ordinary +General Public License therefore permits such linking only if the +entire combination fits its criteria of freedom. The Lesser General +Public License permits more lax criteria for linking other code with +the library. + + We call this license the "Lesser" General Public License because it +does Less to protect the user's freedom than the ordinary General +Public License. It also provides other free software developers Less +of an advantage over competing non-free programs. These disadvantages +are the reason we use the ordinary General Public License for many +libraries. However, the Lesser license provides advantages in certain +special circumstances. + + For example, on rare occasions, there may be a special need to +encourage the widest possible use of a certain library, so that it becomes +a de-facto standard. To achieve this, non-free programs must be +allowed to use the library. A more frequent case is that a free +library does the same job as widely used non-free libraries. In this +case, there is little to gain by limiting the free library to free +software only, so we use the Lesser General Public License. + + In other cases, permission to use a particular library in non-free +programs enables a greater number of people to use a large body of +free software. For example, permission to use the GNU C Library in +non-free programs enables many more people to use the whole GNU +operating system, as well as its variant, the GNU/Linux operating +system. + + Although the Lesser General Public License is Less protective of the +users' freedom, it does ensure that the user of a program that is +linked with the Library has the freedom and the wherewithal to run +that program using a modified version of the Library. + + The precise terms and conditions for copying, distribution and +modification follow. Pay close attention to the difference between a +"work based on the library" and a "work that uses the library". The +former contains code derived from the library, whereas the latter must +be combined with the library in order to run. + + GNU LESSER GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License Agreement applies to any software library or other +program which contains a notice placed by the copyright holder or +other authorized party saying it may be distributed under the terms of +this Lesser General Public License (also called "this License"). +Each licensee is addressed as "you". + + A "library" means a collection of software functions and/or data +prepared so as to be conveniently linked with application programs +(which use some of those functions and data) to form executables. + + The "Library", below, refers to any such software library or work +which has been distributed under these terms. A "work based on the +Library" means either the Library or any derivative work under +copyright law: that is to say, a work containing the Library or a +portion of it, either verbatim or with modifications and/or translated +straightforwardly into another language. (Hereinafter, translation is +included without limitation in the term "modification".) + + "Source code" for a work means the preferred form of the work for +making modifications to it. For a library, complete source code means +all the source code for all modules it contains, plus any associated +interface definition files, plus the scripts used to control compilation +and installation of the library. + + Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running a program using the Library is not restricted, and output from +such a program is covered only if its contents constitute a work based +on the Library (independent of the use of the Library in a tool for +writing it). Whether that is true depends on what the Library does +and what the program that uses the Library does. + + 1. You may copy and distribute verbatim copies of the Library's +complete source code as you receive it, in any medium, provided that +you conspicuously and appropriately publish on each copy an +appropriate copyright notice and disclaimer of warranty; keep intact +all the notices that refer to this License and to the absence of any +warranty; and distribute a copy of this License along with the +Library. + + You may charge a fee for the physical act of transferring a copy, +and you may at your option offer warranty protection in exchange for a +fee. + + 2. You may modify your copy or copies of the Library or any portion +of it, thus forming a work based on the Library, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) The modified work must itself be a software library. + + b) You must cause the files modified to carry prominent notices + stating that you changed the files and the date of any change. + + c) You must cause the whole of the work to be licensed at no + charge to all third parties under the terms of this License. + + d) If a facility in the modified Library refers to a function or a + table of data to be supplied by an application program that uses + the facility, other than as an argument passed when the facility + is invoked, then you must make a good faith effort to ensure that, + in the event an application does not supply such function or + table, the facility still operates, and performs whatever part of + its purpose remains meaningful. + + (For example, a function in a library to compute square roots has + a purpose that is entirely well-defined independent of the + application. Therefore, Subsection 2d requires that any + application-supplied function or table used by this function must + be optional: if the application does not supply it, the square + root function must still compute square roots.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Library, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Library, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote +it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Library. + +In addition, mere aggregation of another work not based on the Library +with the Library (or with a work based on the Library) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may opt to apply the terms of the ordinary GNU General Public +License instead of this License to a given copy of the Library. To do +this, you must alter all the notices that refer to this License, so +that they refer to the ordinary GNU General Public License, version 2, +instead of to this License. (If a newer version than version 2 of the +ordinary GNU General Public License has appeared, then you can specify +that version instead if you wish.) Do not make any other change in +these notices. + + Once this change is made in a given copy, it is irreversible for +that copy, so the ordinary GNU General Public License applies to all +subsequent copies and derivative works made from that copy. + + This option is useful when you wish to copy part of the code of +the Library into a program that is not a library. + + 4. You may copy and distribute the Library (or a portion or +derivative of it, under Section 2) in object code or executable form +under the terms of Sections 1 and 2 above provided that you accompany +it with the complete corresponding machine-readable source code, which +must be distributed under the terms of Sections 1 and 2 above on a +medium customarily used for software interchange. + + If distribution of object code is made by offering access to copy +from a designated place, then offering equivalent access to copy the +source code from the same place satisfies the requirement to +distribute the source code, even though third parties are not +compelled to copy the source along with the object code. + + 5. A program that contains no derivative of any portion of the +Library, but is designed to work with the Library by being compiled or +linked with it, is called a "work that uses the Library". Such a +work, in isolation, is not a derivative work of the Library, and +therefore falls outside the scope of this License. + + However, linking a "work that uses the Library" with the Library +creates an executable that is a derivative of the Library (because it +contains portions of the Library), rather than a "work that uses the +library". The executable is therefore covered by this License. +Section 6 states terms for distribution of such executables. + + When a "work that uses the Library" uses material from a header file +that is part of the Library, the object code for the work may be a +derivative work of the Library even though the source code is not. +Whether this is true is especially significant if the work can be +linked without the Library, or if the work is itself a library. The +threshold for this to be true is not precisely defined by law. + + If such an object file uses only numerical parameters, data +structure layouts and accessors, and small macros and small inline +functions (ten lines or less in length), then the use of the object +file is unrestricted, regardless of whether it is legally a derivative +work. (Executables containing this object code plus portions of the +Library will still fall under Section 6.) + + Otherwise, if the work is a derivative of the Library, you may +distribute the object code for the work under the terms of Section 6. +Any executables containing that work also fall under Section 6, +whether or not they are linked directly with the Library itself. + + 6. As an exception to the Sections above, you may also combine or +link a "work that uses the Library" with the Library to produce a +work containing portions of the Library, and distribute that work +under terms of your choice, provided that the terms permit +modification of the work for the customer's own use and reverse +engineering for debugging such modifications. + + You must give prominent notice with each copy of the work that the +Library is used in it and that the Library and its use are covered by +this License. You must supply a copy of this License. If the work +during execution displays copyright notices, you must include the +copyright notice for the Library among them, as well as a reference +directing the user to the copy of this License. Also, you must do one +of these things: + + a) Accompany the work with the complete corresponding + machine-readable source code for the Library including whatever + changes were used in the work (which must be distributed under + Sections 1 and 2 above); and, if the work is an executable linked + with the Library, with the complete machine-readable "work that + uses the Library", as object code and/or source code, so that the + user can modify the Library and then relink to produce a modified + executable containing the modified Library. (It is understood + that the user who changes the contents of definitions files in the + Library will not necessarily be able to recompile the application + to use the modified definitions.) + + b) Use a suitable shared library mechanism for linking with the + Library. A suitable mechanism is one that (1) uses at run time a + copy of the library already present on the user's computer system, + rather than copying library functions into the executable, and (2) + will operate properly with a modified version of the library, if + the user installs one, as long as the modified version is + interface-compatible with the version that the work was made with. + + c) Accompany the work with a written offer, valid for at + least three years, to give the same user the materials + specified in Subsection 6a, above, for a charge no more + than the cost of performing this distribution. + + d) If distribution of the work is made by offering access to copy + from a designated place, offer equivalent access to copy the above + specified materials from the same place. + + e) Verify that the user has already received a copy of these + materials or that you have already sent this user a copy. + + For an executable, the required form of the "work that uses the +Library" must include any data and utility programs needed for +reproducing the executable from it. However, as a special exception, +the materials to be distributed need not include anything that is +normally distributed (in either source or binary form) with the major +components (compiler, kernel, and so on) of the operating system on +which the executable runs, unless that component itself accompanies +the executable. + + It may happen that this requirement contradicts the license +restrictions of other proprietary libraries that do not normally +accompany the operating system. Such a contradiction means you cannot +use both them and the Library together in an executable that you +distribute. + + 7. You may place library facilities that are a work based on the +Library side-by-side in a single library together with other library +facilities not covered by this License, and distribute such a combined +library, provided that the separate distribution of the work based on +the Library and of the other library facilities is otherwise +permitted, and provided that you do these two things: + + a) Accompany the combined library with a copy of the same work + based on the Library, uncombined with any other library + facilities. This must be distributed under the terms of the + Sections above. + + b) Give prominent notice with the combined library of the fact + that part of it is a work based on the Library, and explaining + where to find the accompanying uncombined form of the same work. + + 8. You may not copy, modify, sublicense, link with, or distribute +the Library except as expressly provided under this License. Any +attempt otherwise to copy, modify, sublicense, link with, or +distribute the Library is void, and will automatically terminate your +rights under this License. However, parties who have received copies, +or rights, from you under this License will not have their licenses +terminated so long as such parties remain in full compliance. + + 9. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Library or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Library (or any work based on the +Library), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Library or works based on it. + + 10. Each time you redistribute the Library (or any work based on the +Library), the recipient automatically receives a license from the +original licensor to copy, distribute, link with or modify the Library +subject to these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties with +this License. + + 11. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Library at all. For example, if a patent +license would not permit royalty-free redistribution of the Library by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Library. + +If any portion of this section is held invalid or unenforceable under any +particular circumstance, the balance of the section is intended to apply, +and the section as a whole is intended to apply in other circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 12. If the distribution and/or use of the Library is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Library under this License may add +an explicit geographical distribution limitation excluding those countries, +so that distribution is permitted only in or among countries not thus +excluded. In such case, this License incorporates the limitation as if +written in the body of this License. + + 13. The Free Software Foundation may publish revised and/or new +versions of the Lesser General Public License from time to time. +Such new versions will be similar in spirit to the present version, +but may differ in detail to address new problems or concerns. + +Each version is given a distinguishing version number. If the Library +specifies a version number of this License which applies to it and +"any later version", you have the option of following the terms and +conditions either of that version or of any later version published by +the Free Software Foundation. If the Library does not specify a +license version number, you may choose any version ever published by +the Free Software Foundation. + + 14. If you wish to incorporate parts of the Library into other free +programs whose distribution conditions are incompatible with these, +write to the author to ask for permission. For software which is +copyrighted by the Free Software Foundation, write to the Free +Software Foundation; we sometimes make exceptions for this. Our +decision will be guided by the two goals of preserving the free status +of all derivatives of our free software and of promoting the sharing +and reuse of software generally. + + NO WARRANTY + + 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO +WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. +EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR +OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY +KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE +LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME +THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN +WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY +AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU +FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR +CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE +LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING +RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A +FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF +SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH +DAMAGES. diff --git a/base/tps-tomcat/setup/CMakeLists.txt b/base/tps-tomcat/setup/CMakeLists.txt new file mode 100644 index 000000000..d2a1399e6 --- /dev/null +++ b/base/tps-tomcat/setup/CMakeLists.txt @@ -0,0 +1,6 @@ +install( + FILES + registry_instance + DESTINATION + ${SHARE_INSTALL_PREFIX}/${APPLICATION_NAME}/${PROJECT_NAME}/setup +) diff --git a/base/tps-tomcat/setup/registry_instance b/base/tps-tomcat/setup/registry_instance new file mode 100644 index 000000000..6365ecb9e --- /dev/null +++ b/base/tps-tomcat/setup/registry_instance @@ -0,0 +1,60 @@ +# Establish PKI Variable "Slot" Substitutions + +PKI_SUBSYSTEM_TYPE=[PKI_SUBSYSTEM_TYPE] +export PKI_SUBSYSTEM_TYPE + +PKI_USER=[PKI_USER] +export PKI_USER + +PKI_GROUP=[PKI_GROUP] +export PKI_GROUP + +PKI_INSTANCE_NAME=[PKI_INSTANCE_NAME] +export PKI_INSTANCE_NAME + +PKI_INSTANCE_PATH=[PKI_INSTANCE_PATH] +export PKI_INSTANCE_PATH + +PKI_INSTANCE_INITSCRIPT=[PKI_INSTANCE_INITSCRIPT] +export PKI_INSTANCE_INITSCRIPT + +PKI_SERVER_XML_CONF=[PKI_SERVER_XML_CONF] +export PKI_SERVER_XML_CONF + +# Use CATALINA_BASE + +CATALINA_BASE=$PKI_INSTANCE_PATH +export CATALINA_BASE + +TOMCAT_PROG=$PKI_INSTANCE_NAME +export TOMCAT_PROG + +TOMCAT_USER=$PKI_USER +export TOMCAT_USER + +TOMCAT_GROUP=$PKI_GROUP +export TOMCAT_GROUP + +PKI_LOCKDIR="/var/lock/pki/${PKI_SUBSYSTEM_TYPE}" +export PKI_LOCKDIR + +PKI_LOCKFILE="${PKI_LOCKDIR}/${PKI_INSTANCE_NAME}" +export PKI_LOCKFILE + +PKI_PIDDIR="/var/run/pki/${PKI_SUBSYSTEM_TYPE}" +export PKI_PIDDIR + +PKI_PIDFILE="${PKI_PIDDIR}/${PKI_INSTANCE_NAME}.pid" +export PKI_PIDFILE + +TOMCAT_LOCKFILE=/var/lock/subsys/${PKI_INSTANCE_NAME} +export TOMCAT_LOCKFILE + +TOMCAT_PIDFILE=[TOMCAT_PIDFILE] +export TOMCAT_PIDFILE + +pki_instance_configuration_file=${PKI_INSTANCE_PATH}/conf/CS.cfg +export pki_instance_configuration_file + +RESTART_SERVER=${PKI_INSTANCE_PATH}/conf/restart_server_after_configuration +export RESTART_SERVER diff --git a/base/tps-tomcat/shared/conf/CMakeLists.txt b/base/tps-tomcat/shared/conf/CMakeLists.txt new file mode 100644 index 000000000..419289d03 --- /dev/null +++ b/base/tps-tomcat/shared/conf/CMakeLists.txt @@ -0,0 +1,8 @@ +configure_file(${CMAKE_CURRENT_SOURCE_DIR}/CS.cfg.in ${CMAKE_CURRENT_BINARY_DIR}/CS.cfg @ONLY) + +install( + FILES + ${CMAKE_CURRENT_BINARY_DIR}/CS.cfg + DESTINATION + ${SHARE_INSTALL_PREFIX}/${APPLICATION_NAME}/${PROJECT_NAME}/conf +) diff --git a/base/tps-tomcat/shared/conf/CS.cfg.in b/base/tps-tomcat/shared/conf/CS.cfg.in new file mode 100644 index 000000000..1a392a119 --- /dev/null +++ b/base/tps-tomcat/shared/conf/CS.cfg.in @@ -0,0 +1,1603 @@ +_000=## +_001=## Token Processing System (TPS) Configuration File +_002=## +accessEvaluator.impl.group.class=com.netscape.cms.evaluators.GroupAccessEvaluator +accessEvaluator.impl.ipaddress.class=com.netscape.cms.evaluators.IPAddressAccessEvaluator +accessEvaluator.impl.user.class=com.netscape.cms.evaluators.UserAccessEvaluator +applet._000=######################################### +applet._001=# applet information +applet._002=# SAF Key: +applet._003=# applet.aid.cardmgr_instance=A0000001510000 +applet._004=######################################### +applet.aid.cardmgr_instance=A0000000030000 +applet.aid.netkey_file=627601FF0000 +applet.aid.netkey_instance=627601FF000000 +applet.aid.netkey_old_file=A000000001 +applet.aid.netkey_old_instance=A00000000101 +applet.delete_old=true +applet.so_pin=000000000000 +auths._000=## +auths._001=## new authentication +auths._002=## +auths.impl._000=## +auths.impl._001=## authentication manager implementations +auths.impl._002=## +auths.impl.AgentCertAuth.class=com.netscape.cms.authentication.AgentCertAuthentication +auths.impl.CMCAuth.class=com.netscape.cms.authentication.CMCAuth +auths.impl.NISAuth.class=com.netscape.cms.authentication.NISAuth +auths.impl.PortalEnroll.class=com.netscape.cms.authentication.PortalEnroll +auths.impl.SSLclientCertAuth.class=com.netscape.cms.authentication.SSLclientCertAuthentication +auths.impl.TokenAuth.class=com.netscape.cms.authentication.TokenAuthentication +auths.impl.UdnPwdDirAuth.class=com.netscape.cms.authentication.UdnPwdDirAuthentication +auths.impl.UidPwdDirAuth.class=com.netscape.cms.authentication.UidPwdDirAuthentication +auths.impl.UidPwdPinDirAuth.class=com.netscape.cms.authentication.UidPwdPinDirAuthentication +auths.instance.AgentCertAuth.agentGroup=Certificate Manager Agents +auths.instance.AgentCertAuth.pluginName=AgentCertAuth +auths.instance.TokenAuth.pluginName=TokenAuth +auths.instance.ldap1.dnpattern= +auths.instance.ldap1.ldapByteAttributes= +auths.instance.ldap1.ldapStringAttributes=mail,cn,uid +auths.instance.ldap1.ldap.basedn=[LDAP_ROOT] +auths.instance.ldap1.ldap.maxConns=15 +auths.instance.ldap1.ldap.minConns=3 +auths.instance.ldap1.ldap.ldapauth.authtype=BasicAuth +auths.instance.ldap1.ldap.ldapauth.bindDN= +auths.instance.ldap1.ldap.ldapauth.bindPWPrompt=ldap1 +auths.instance.ldap1.ldap.ldapauth.clientCertNickname= +auths.instance.ldap1.ldap.ldapconn.host=[LDAP_HOST] +auths.instance.ldap1.ldap.ldapconn.port=[LDAP_PORT] +auths.instance.ldap1.ldap.ldapconn.secureConn=false +auths.instance.ldap1.ldap.ldapconn.version=3 +auths.instance.ldap1.pluginName=UidPwdDirAuth +auths.instance.SSLclientCertAuth.pluginName=SSLclientCertAuth +auths.revocationChecking.bufferSize=50 +authType=pwd +authz._000=## +authz._001=## new authorizatioin +authz._002=## +authz.evaluateOrder=deny,allow +authz.impl._000=## +authz.impl._001=## authorization manager implementations +authz.impl._002=## +authz.impl.BasicAclAuthz.class=com.netscape.cms.authorization.BasicAclAuthz +authz.impl.DirAclAuthz.class=com.netscape.cms.authorization.DirAclAuthz +authz.instance.BasicAclAuthz.pluginName=BasicAclAuthz +authz.instance.DirAclAuthz.ldap._000=## +authz.instance.DirAclAuthz.ldap._001=## Internal Database +authz.instance.DirAclAuthz.ldap._002=## +authz.instance.DirAclAuthz.ldap=internaldb +authz.instance.DirAclAuthz.pluginName=DirAclAuthz +authz.sourceType=ldap +channel._000=######################################### +channel._001=# channel.encryption: +channel._002=# +channel._003=# - enable encryption for all operation commands to token +channel._004=# - default is true +channel._005=# channel.blocksize=242 +channel._006=# channel.defKeyVersion=0 +channel._007=# channel.defKeyIndex=0 +channel._008=# +channel._009=# Config the size of memory managed memory in the applet +channel._010=# Default is 5000, try not go get close to the instanceSize +channel._011=# which defaults to 18000: +channel._012=# +channel._013=# * channel.instanceSize=18000 +channel._014=# * channel.appletMemorySize=5000 +channel._015=######################################### +channel.encryption=true +channel.blocksize=248 +channel.defKeyVersion=0 +channel.defKeyIndex=0 +cms.product.version=@APPLICATION_VERSION@ +cms.version=@APPLICATION_VERSION_MAJOR@.@APPLICATION_VERSION_MINOR@ +config.Generals.General.state=Enabled +config.Generals.General.timestamp=1280283607424406 +configurationRoot=/[PKI_SUBSYSTEM_TYPE]/conf/ +conn.ca1._000=######################################### +conn.ca1._001=# CA connection +conn.ca1._002=# +conn.ca1._003=# conn.ca.hostport: +conn.ca1._004=# - host name and port number of your CA, format is host:port +conn.ca1._005=# conn.ca.clientNickname: +conn.ca1._006=# - nickname of the client certificate for +conn.ca1._007=# authentication +conn.ca1._008=# conn.ca.servlet.enrollment: +conn.ca1._009=# - servlet to contact in CA +conn.ca1._010=# - must be '/ca/profileSubmitSSLClient' +conn.ca1._011=# conn.ca.retryConnect: +conn.ca1._012=# - number of reconnection attempts on failure +conn.ca1._013=# conn.ca.timeout: +conn.ca1._014=# - connection timeout +conn.ca1._015=# conn.ca.SSLOn: +conn.ca1._016=# - enable SSL or not +conn.ca1._017=# conn.ca.keepAlive: +conn.ca1._018=# - enable keep alive or not +conn.ca1._019=# conn.ca.caNickname: +conn.ca1._020=# - nickname of the ca certificate +conn.ca1._021=# conn.ca.caSKI: +conn.ca1._022=# - Subject Key Identifier (in Base64) of the ca certificate +conn.ca1._023=# (automatically calculated by the system) +conn.ca1._024=# +conn.ca1._025=# conn.ca.list=ca1,ca2...ca +conn.ca1._026=# - list of ca connection IDs for revocation routing +conn.ca1._027=# +conn.ca1._028=# where +conn.ca1._029=# - CA connection ID +conn.ca1._030=######################################### +conn.ca1.clientNickname=[HSM_LABEL][NICKNAME] +conn.ca1.hostport=[PKI_CA_HOSTNAME]:[PKI_CA_PORT] +conn.ca1.keepAlive=true +conn.ca1.retryConnect=3 +conn.ca1.servlet.enrollment=/ca/ee/ca/profileSubmitSSLClient +conn.ca1.servlet.renewal=/ca/ee/ca/profileSubmitSSLClient +conn.ca1.servlet.revoke=/ca/ee/subsystem/ca/doRevoke +conn.ca1.servlet.unrevoke=/ca/ee/subsystem/ca/doUnrevoke +conn.ca1.SSLOn=true +conn.ca1.timeout=100 +conn.drm1._000=######################################### +conn.drm1._001=# DRM connection +conn.drm1._002=# +conn.drm1._003=#conn.drm.totalConns +conn.drm1._004=# - # of DRM connections +conn.drm1._005=#conn.drm.hostport +conn.drm1._006=# - host name and port number of your DRM, the format is host:port +conn.drm1._007=#conn.drm.clientNickname +conn.drm1._008=# - nickname of the client certificate for +conn.drm1._009=# authentication +conn.drm1._010=#conn.drm.servlet.GenerateKeyPair +conn.drm1._011=# - servlet to generate key pairs and archive keys on DRM +conn.drm1._012=# - must be '/kra/GenerateKeyPair' +conn.drm1._013=#conn.drm.servlet.TokenKeyRecovery=/kra/TokenKeyRecovery +conn.drm1._014=# - servlet to handle key recovery +conn.drm1._015=# - must be '/kra/TokenKeyRecovery' +conn.drm1._016=#conn.drm.retryConnect=3 +conn.drm1._017=# - number of reconnection attempts on failure +conn.drm1._018=#conn.drm.SSLOn=true +conn.drm1._019=# - enable SSL or not +conn.drm1._020=#conn.drm.keepAlive=false +conn.drm1._021=# - enable keep alive or not +conn.drm1._022=# +conn.drm1._023=# where +conn.drm1._024=# - DRM connection ID +conn.drm1._025=######################################### +conn.drm1.clientNickname=[HSM_LABEL][NICKNAME] +conn.drm1.hostport=[DRM_HOST]:[DRM_PORT] +conn.drm1.keepAlive=false +conn.drm1.retryConnect=3 +conn.drm1.servlet.GenerateKeyPair=/kra/agent/kra/GenerateKeyPair +conn.drm1.servlet.TokenKeyRecovery=/kra/agent/kra/TokenKeyRecovery +conn.drm1.SSLOn=true +conn.drm1.timeout=100 +conn.drm.totalConns=1 +conn.tks1._000=######################################### +conn.tks1._001=# TKS connection +conn.tks1._002=# +conn.tks1._003=# conn.tks.hostport: +conn.tks1._004=# - host name and port number of your TKS, the format is host:port +conn.tks1._005=# conn.tks.clientNickname: +conn.tks1._006=# - nickname of the client certificate for +conn.tks1._007=# authentication +conn.tks1._008=# conn.tks.servlet.computeSessionKey: +conn.tks1._009=# - servlet to compute session key +conn.tks1._010=# - must be '/tks/computeSessionKey' +conn.tks1._011=# conn.tks.servlet.encryptData: +conn.tks1._012=# - servlet to encrypt data +conn.tks1._013=# - must be '/tks/encryptData' +conn.tks1._014=# conn.tks.servlet.createKeySetData: +conn.tks1._015=# - servlet to create key set data +conn.tks1._016=# - must be '/tks/createKeySetData' +conn.tks1._017=# conn.tks.retryConnect: +conn.tks1._018=# - number of reconnection attempts on failure +conn.tks1._019=# conn.tks.SSLOn +conn.tks1._020=# - enable SSL or not +conn.tks1._021=# conn.tks.keepAlive: +conn.tks1._022=# - enable keep alive or not +conn.tks1._023=# +conn.tks1._024=# where +conn.tks1._025=# - TKS connection ID +conn.tks1._026=# conn.tks.tksSharedSymKeyName: +conn.tks1._027=# - set shared secret key name +conn.tks1._028=######################################### +conn.tks1.clientNickname=[HSM_LABEL][NICKNAME] +conn.tks1.generateHostChallenge=true +conn.tks1.hostport=[TKS_HOST]:[TKS_PORT] +conn.tks1.keepAlive=false +conn.tks1.keySet=defKeySet +conn.tks1.retryConnect=3 +conn.tks1.serverKeygen=[SERVER_KEYGEN] +conn.tks1.servlet.computeRandomData=/tks/agent/tks/computeRandomData +conn.tks1.servlet.computeSessionKey=/tks/agent/tks/computeSessionKey +conn.tks1.servlet.createKeySetData=/tks/agent/tks/createKeySetData +conn.tks1.servlet.encryptData=/tks/agent/tks/encryptData +conn.tks1.SSLOn=true +conn.tks1.timeout=100 +conn.tks1.tksSharedSymKeyName=sharedSecret +cs.state=0 +cs.type=TPS +dbs.ldap=internaldb +dbs.newSchemaEntryAdded=true +debug.append=true +debug.enabled=true +debug.filename=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/debug +debug.hashkeytypes= +debug.level=0 +debug.showcaller=false +failover.pod.enable=false +general.applet_ext=ijc +general.pwlength.min=16 +general.search.sizelimit.default=100 +general.search.sizelimit.max=2000 +general.search.timelimit.default=10 +general.search.timelimit.max=10 +general.verifyProof=1 +installDate=[INSTALL_TIME] +instanceId=[PKI_INSTANCE_NAME] +instanceRoot=[PKI_INSTANCE_PATH] +internaldb._000=## +internaldb._001=## Internal Database +internaldb._002=## +internaldb.ldapauth.authtype=BasicAuth +internaldb.ldapauth.bindDN=cn=Directory Manager +internaldb.ldapauth.bindPWPrompt=Internal LDAP Database +internaldb.ldapauth.clientCertNickname= +internaldb.ldapconn.host= +internaldb.ldapconn.port= +internaldb.ldapconn.secureConn=false +internaldb.maxConns=15 +internaldb.minConns=3 +internaldb.multipleSuffix.enable=false +jss._000=## +jss._001=## JSS +jss._002=## +jss.configDir=[PKI_INSTANCE_PATH]/alias/ +jss.enable=true +jss.ocspcheck.enable=false +jss.secmodName=secmod.db +jss.ssl.cipherfortezza=true +jss.ssl.cipherpref= +jss.ssl.cipherversion=cipherdomestic +keys.ecc.curve.default=nistp256 +keys.ecc.curve.display.list=nistp256 (secp256r1),nistp384 (secp384r1),nistp521 (secp521r1),nistk163 (sect163k1),sect163r1,nistb163 (sect163r2),sect193r1,sect193r2,nistk233 (sect233k1),nistb233 (sect233r1),sect239k1,nistk283 (sect283k1),nistb283 (sect283r1),nistk409 (sect409k1),nistb409 (sect409r1),nistk571 (sect571k1),nistb571 (sect571r1),secp160k1,secp160r1,secp160r2,secp192k1,nistp192 (secp192r1, prime192v1),secp224k1,nistp224 (secp224r1),secp256k1,prime192v2,prime192v3,prime239v1,prime239v2,prime239v3,c2pnb163v1,c2pnb163v2,c2pnb163v3,c2pnb176v1,c2tnb191v1,c2tnb191v2,c2tnb191v3,c2pnb208w1,c2tnb239v1,c2tnb239v2,c2tnb239v3,c2pnb272w1,c2pnb304w1,c2tnb359w1,c2pnb368w1,c2tnb431r1,secp112r1,secp112r2,secp128r1,secp128r2,sect113r1,sect113r2,sect131r1,sect131r2 +keys.ecc.curve.list=nistp256,nistp384,nistp521,sect163k1,nistk163,sect163r1,sect163r2,nistb163,sect193r1,sect193r2,sect233k1,nistk233,sect233r1,nistb233,sect239k1,sect283k1,nistk283,sect283r1,nistb283,sect409k1,nistk409,sect409r1,nistb409,sect571k1,nistk571,sect571r1,nistb571,secp160k1,secp160r1,secp160r2,secp192k1,secp192r1,nistp192,secp224k1,secp224r1,nistp224,secp256k1,secp256r1,secp384r1,secp521r1,prime192v1,prime192v2,prime192v3,prime239v1,prime239v2,prime239v3,c2pnb163v1,c2pnb163v2,c2pnb163v3,c2pnb176v1,c2tnb191v1,c2tnb191v2,c2tnb191v3,c2pnb208w1,c2tnb239v1,c2tnb239v2,c2tnb239v3,c2pnb272w1,c2pnb304w1,c2tnb359w1,c2pnb368w1,c2tnb431r1,secp112r1,secp112r2,secp128r1,secp128r2,sect113r1,sect113r2,sect131r1,sect131r2 +keys.rsa.keysize.default=2048 +log._000=## +log._001=## Logging +log._002=## +logAudit.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/access +logError.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/error +log.impl.file.class=com.netscape.cms.logging.RollingLogFile +log.instance.SignedAudit._000=## +log.instance.SignedAudit._001=## Signed Audit Logging +log.instance.SignedAudit._002=## +log.instance.SignedAudit._003=## +log.instance.SignedAudit._004=## Available Audit events: +log.instance.SignedAudit._005=## AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE,OCSP_ADD_CA_REQUEST,OCSP_ADD_CA_REQUEST_PROCESSED,OCSP_REMOVE_CA_REQUEST,OCSP_REMOVE_CA_REQUEST_PROCESSED_SUCCESS,OCSP_REMOVE_CA_REQUEST_PROCESSED_FAILURE,COMPUTE_RANDOM_DATA_REQUEST,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE,CIMC_CERT_VERIFICATION +log.instance.SignedAudit._006=## +log.instance.SignedAudit.bufferSize=512 +log.instance.SignedAudit.enable=true +log.instance.SignedAudit.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE,OCSP_ADD_CA_REQUEST,OCSP_ADD_CA_REQUEST_PROCESSED,OCSP_REMOVE_CA_REQUEST,OCSP_REMOVE_CA_REQUEST_PROCESSED_SUCCESS,OCSP_REMOVE_CA_REQUEST_PROCESSED_FAILURE,COMPUTE_RANDOM_DATA_REQUEST,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE,CIMC_CERT_VERIFICATION,LOGGING_SIGNED_AUDIT_SIGNING,ENROLLMENT,PIN_RESET,FORMAT,CONFIG,CONFIG_TOKEN,CONFIG_PROFILE,APPLET_UPGRADE,KEY_CHANGEOVER,RENEWAL,CIMC_CERT_VERIFICATION +log.instance.SignedAudit.expirationTime=0 +log.instance.SignedAudit.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/signedAudit/tps_cert-tps_audit +log.instance.SignedAudit.flushInterval=5 +log.instance.SignedAudit.level=1 +log.instance.SignedAudit.logSigning=false +log.instance.SignedAudit.maxFileSize=2000 +log.instance.SignedAudit.pluginName=file +log.instance.SignedAudit.rolloverInterval=2592000 +log.instance.SignedAudit.signedAudit:_000=## +log.instance.SignedAudit.signedAudit:_001=## Fill in the nickname of a trusted signing certificate to allow TPS audit logs to be signed +log.instance.SignedAudit.signedAudit:_002=## +log.instance.SignedAudit.signedAuditCertNickname=auditSigningCert cert-[PKI_INSTANCE_NAME] +log.instance.SignedAudit.type=signedAudit +log.instance.System._000=## +log.instance.System._001=## System Logging +log.instance.System._002=## +log.instance.System.bufferSize=512 +log.instance.System.enable=true +log.instance.System.expirationTime=0 +log.instance.System.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/system +log.instance.System.flushInterval=5 +log.instance.System.level=3 +log.instance.System.maxFileSize=2000 +log.instance.System.pluginName=file +log.instance.System.rolloverInterval=2592000 +log.instance.System.type=system +log.instance.Transactions._000=## +log.instance.Transactions._001=## Transaction Logging +log.instance.Transactions._002=## +log.instance.Transactions.bufferSize=512 +log.instance.Transactions.enable=true +log.instance.Transactions.expirationTime=0 +log.instance.Transactions.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/transactions +log.instance.Transactions.flushInterval=5 +log.instance.Transactions.level=1 +log.instance.Transactions.maxFileSize=2000 +log.instance.Transactions.pluginName=file +log.instance.Transactions.rolloverInterval=2592000 +log.instance.Transactions.type=transaction +machineName=[PKI_HOSTNAME] +multiroles._000=## +multiroles._001=## multiroles +multiroles._002=## +multiroles.enable=true +multiroles.false.groupEnforceList=Administrators,Auditors,Trusted Managers,Certificate Manager Agents,Registration Manager Agents,Data Recovery Manager Agents,Online Certificate Status Manager Agents,Token Key Service Manager Agents,Enterprise CA Administrators,Enterprise KRA Administrators,Enterprise OCSP Administrators,Enterprise RA Administrators,Enterprise TKS Administrators,Enterprise TPS Administrators,Security Domain Administrators,Subsystem Group,ClonedSubsystems +multiroles.false.groupEnforceList=Administrators,Auditors,Trusted Managers,Certificate Manager Agents,Registration Manager Agents,Data Recovery Manager Agents,Online Certificate Status Manager Agents,Token Key Service Manager Agents,Enterprise CA Administrators,Enterprise KRA Adminstrators,Enterprise OCSP Administrators,Enterprise RA Administrators,Enterprise TKS Administrators,Enterprise TPS Administrators,Security Domain Administrators,Subsystem Group +multiroles=true +op.enroll._000=######################################### +op.enroll._001=# Default Operations +op.enroll._002=# +op.enroll._003=# op..mapping.order=,, +op.enroll._004=# - contains at least one value or a series +op.enroll._005=# of comma-separated mapping values which +op.enroll._006=# are checked in sequential order +op.enroll._007=# op..mapping..filter.tokenType=userKey +op.enroll._008=# - can be either empty or token type +op.enroll._009=# specified by the client +op.enroll._010=# op..mapping..filter.tokenATR= +op.enroll._011=# - can be either empty or token ATR +op.enroll._012=# specified by the client +op.enroll._013=# op..mapping..filter.appletMajorVersion=1 +op.enroll._014=# - can be either empty or applet major version +op.enroll._015=# specified by the client +op.enroll._016=# op..mapping..filter.appletMinorVersion= +op.enroll._017=# - can be either empty or applet minor version +op.enroll._018=# specified by the client +op.enroll._019=# - if major and minor versions are both zero, this +op.enroll._020=# indicate there is no applet on the token. +op.enroll._021=# op..mapping..target.tokenType=userKey +op.enroll._022=# - if tokenType, tokenATR, appletMajorVersion, +op.enroll._023=# and appletMinorVersion are matched, value in +op.enroll._024=# targetTokenType will be used to locate +op.enroll._025=# the corresponding token profile to +op.enroll._026=# process the request. +op.enroll._027=# +op.enroll._028=# where +op.enroll._029=# - operation; enroll,pinReset,format +op.enroll._030=# - mapping ID; order is specifiable +op.enroll._031=# +op.enroll._032=# Token ATR: +op.enroll._033=# Web Store - 3B759400006202020201 +op.enroll._034=######################################### +op.enroll.allowUnknownToken=true +op.enroll.mapping.0.filter.appletMajorVersion=1 +op.enroll.mapping.0.filter.appletMinorVersion= +op.enroll.mapping.0.filter.tokenATR= +op.enroll.mapping.0.filter.tokenCUID.end= +op.enroll.mapping.0.filter.tokenCUID.start= +op.enroll.mapping.0.filter.tokenType=userKey +op.enroll.mapping.0.target.tokenType=userKey +op.enroll.mapping.1.filter.appletMajorVersion= +op.enroll.mapping.1.filter.appletMinorVersion= +op.enroll.mapping.1.filter.tokenATR= +op.enroll.mapping.1.filter.tokenCUID.end= +op.enroll.mapping.1.filter.tokenCUID.start= +op.enroll.mapping.1.filter.tokenType=soKey +op.enroll.mapping.1.target.tokenType=soKey +op.enroll.mapping.2.filter.appletMajorVersion= +op.enroll.mapping.2.filter.appletMinorVersion= +op.enroll.mapping.2.filter.tokenATR= +op.enroll.mapping.2.filter.tokenCUID.end= +op.enroll.mapping.2.filter.tokenCUID.start= +op.enroll.mapping.2.filter.tokenType= +op.enroll.mapping.2.target.tokenType=userKey +op.enroll.mapping.order=0,1,2 +op.enroll.soKey._079=#op.enroll.userKey.keyGen.signing.publisherId=fileBasedPublisher +op.enroll.soKey.auth.enable=true +op.enroll.soKey.auth.id=ldap2 +op.enroll.soKey.cardmgr_instance=A0000000030000 +op.enroll.soKey.issuerinfo.enable=true +op.enroll.soKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/so/index.cgi +op.enroll.soKey.keyGen.encryption.ca.conn=ca1 +op.enroll.soKey.keyGen.encryption.ca.profileId=caTokenUserEncryptionKeyEnrollment +op.enroll.soKey.keyGen.encryption.certAttrId=c2 +op.enroll.soKey.keyGen.encryption.certId=C2 +op.enroll.soKey.keyGen.encryption.cuid_label=$cuid$ +op.enroll.soKey.keyGen.encryption.keySize=1024 +op.enroll.soKey.keyGen.encryption.keyUsage=0 +op.enroll.soKey.keyGen.encryption.keyUser=0 +op.enroll.soKey.keyGen.encryption.label=encryption key for $userid$ +op.enroll.soKey.keyGen.encryption.overwrite=true +op.enroll.soKey.keyGen.encryption.privateKeyAttrId=k4 +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.decrypt=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.derive=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.encrypt=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.private=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.sensitive=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.sign=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.signRecover=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.token=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.unwrap=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.verify=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.verifyRecover=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.wrap=false +op.enroll.soKey.keyGen.encryption.privateKeyNumber=4 +op.enroll.soKey.keyGen.encryption.publicKeyAttrId=k5 +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.decrypt=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.derive=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.encrypt=true +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.private=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.sensitive=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.sign=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.signRecover=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.token=true +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.unwrap=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.verify=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.verifyRecover=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.wrap=true +op.enroll.soKey.keyGen.encryption.publicKeyNumber=5 +op.enroll.soKey.keyGen.encryption.recovery.destroyed.revokeCert=false +op.enroll.soKey.keyGen.encryption.recovery.destroyed.revokeCert.reason=0 +op.enroll.soKey.keyGen.encryption.recovery.destroyed.scheme=RecoverLast +op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.revokeCert.reason=1 +op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.revokeCert=true +op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.scheme=GenerateNewKey +op.enroll.soKey.keyGen.encryption.recovery.onHold.revokeCert.reason=6 +op.enroll.soKey.keyGen.encryption.recovery.onHold.revokeCert=true +op.enroll.soKey.keyGen.encryption.recovery.onHold.scheme=GenerateNewKey +op.enroll.soKey.keyGen.encryption.serverKeygen.archive=true +op.enroll.soKey.keyGen.encryption.serverKeygen.drm.conn=drm1 +op.enroll.soKey.keyGen.encryption.serverKeygen.enable=[SERVER_KEYGEN] +op.enroll.soKey.keyGen.keyType.num=2 +op.enroll.soKey.keyGen.keyType.value.0=signing +op.enroll.soKey.keyGen.keyType.value.1=encryption +op.enroll.soKey.keyGen.recovery.destroyed.keyType.num=2 +op.enroll.soKey.keyGen.recovery.destroyed.keyType.value.0=signing +op.enroll.soKey.keyGen.recovery.destroyed.keyType.value.1=encryption +op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.num=2 +op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.value.0=signing +op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.value.1=encryption +op.enroll.soKey.keyGen.recovery.onHold.keyType.num=2 +op.enroll.soKey.keyGen.recovery.onHold.keyType.value.0=signing +op.enroll.soKey.keyGen.recovery.onHold.keyType.value.1=encryption +op.enroll.soKey.keyGen.signing.ca.conn=ca1 +op.enroll.soKey.keyGen.signing.ca.profileId=caTokenUserSigningKeyEnrollment +op.enroll.soKey.keyGen.signing.certAttrId=c1 +op.enroll.soKey.keyGen.signing.certId=C1 +op.enroll.soKey.keyGen.signing.cuid_label=$cuid$ +op.enroll.soKey.keyGen.signing.keySize=1024 +op.enroll.soKey.keyGen.signing.keyUsage=0 +op.enroll.soKey.keyGen.signing.keyUser=0 +op.enroll.soKey.keyGen.signing.label=signing key for $userid$ +op.enroll.soKey.keyGen.signing.overwrite=true +op.enroll.soKey.keyGen.signing.privateKeyAttrId=k2 +op.enroll.soKey.keyGen.signing.private.keyCapabilities.decrypt=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.derive=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.encrypt=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.private=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.sensitive=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.signRecover=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.sign=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.token=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.unwrap=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.verify=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.verifyRecover=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.wrap=false +op.enroll.soKey.keyGen.signing.privateKeyNumber=2 +op.enroll.soKey.keyGen.signing.publicKeyAttrId=k3 +op.enroll.soKey.keyGen.signing.public.keyCapabilities.decrypt=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.derive=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.encrypt=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.private=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.sensitive=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.sign=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.signRecover=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.token=true +op.enroll.soKey.keyGen.signing.public.keyCapabilities.unwrap=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.verifyRecover=true +op.enroll.soKey.keyGen.signing.public.keyCapabilities.verify=true +op.enroll.soKey.keyGen.signing.public.keyCapabilities.wrap=false +op.enroll.soKey.keyGen.signing.publicKeyNumber=3 +op.enroll.soKey.keyGen.signing.recovery.destroyed.revokeCert.reason=0 +op.enroll.soKey.keyGen.signing.recovery.destroyed.revokeCert=true +op.enroll.soKey.keyGen.signing.recovery.destroyed.scheme=GenerateNewKey +op.enroll.soKey.keyGen.signing.recovery.keyCompromise.revokeCert.reason=1 +op.enroll.soKey.keyGen.signing.recovery.keyCompromise.revokeCert=true +op.enroll.soKey.keyGen.signing.recovery.keyCompromise.scheme=GenerateNewKey +op.enroll.soKey.keyGen.signing.recovery.onHold.revokeCert.reason=6 +op.enroll.soKey.keyGen.signing.recovery.onHold.revokeCert=true +op.enroll.soKey.keyGen.signing.recovery.onHold.scheme=GenerateNewKey +op.enroll.soKey.keyGen.tokenName=$auth.cn$ +op.enroll.soKey.loginRequest.enable=true +op.enroll.soKey.pinReset.enable=true +op.enroll.soKey.pinReset.pin.maxLen=10 +op.enroll.soKey.pinReset.pin.maxRetries=127 +op.enroll.soKey.pinReset.pin.minLen=4 +op.enroll.soKey.pkcs11obj.compress.enable=true +op.enroll.soKey.pkcs11obj.enable=true +op.enroll.soKeyTemporary.auth.enable=true +op.enroll.soKeyTemporary.auth.id=ldap2 +op.enroll.soKeyTemporary.cardmgr_instance=A0000000030000 +op.enroll.soKeyTemporary.keyGen.auth.ca.conn=ca1 +op.enroll.soKeyTemporary.keyGen.auth.ca.profileId=caTempTokenDeviceKeyEnrollment +op.enroll.soKeyTemporary.keyGen.auth.certAttrId=c0 +op.enroll.soKeyTemporary.keyGen.auth.certId=C0 +op.enroll.soKeyTemporary.keyGen.auth.cuid_label=$cuid$ +op.enroll.soKeyTemporary.keyGen.auth.keySize=1024 +op.enroll.soKeyTemporary.keyGen.auth.keyUsage=0 +op.enroll.soKeyTemporary.keyGen.auth.keyUser=15 +op.enroll.soKeyTemporary.keyGen.auth.label=Temporary Key for $userid$ +op.enroll.soKeyTemporary.keyGen.auth.overwrite=false +op.enroll.soKeyTemporary.keyGen.auth.privateKeyAttrId=k0 +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.private=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.sensitive=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.signRecover=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.sign=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.verifyRecover=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.verify=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.auth.privateKeyNumber=0 +op.enroll.soKeyTemporary.keyGen.auth.publicKeyAttrId=k1 +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.private=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.sensitive=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.signRecover=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.sign=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.verifyRecover=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.verify=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.auth.publicKeyNumber=1 +op.enroll.soKeyTemporary.keyGen.encryption.ca.conn=ca1 +op.enroll.soKeyTemporary.keyGen.encryption.ca.profileId=caTempTokenUserEncryptionKeyEnrollment +op.enroll.soKeyTemporary.keyGen.encryption.certAttrId=c2 +op.enroll.soKeyTemporary.keyGen.encryption.certId=C2 +op.enroll.soKeyTemporary.keyGen.encryption.cuid_label=$cuid$ +op.enroll.soKeyTemporary.keyGen.encryption.keySize=1024 +op.enroll.soKeyTemporary.keyGen.encryption.keyUsage=0 +op.enroll.soKeyTemporary.keyGen.encryption.keyUser=0 +op.enroll.soKeyTemporary.keyGen.encryption.label=encryption key for $userid$ +op.enroll.soKeyTemporary.keyGen.encryption.overwrite=true +op.enroll.soKeyTemporary.keyGen.encryption.privateKeyAttrId=k4 +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.decrypt=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.private=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.sensitive=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.sign=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.signRecover=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.unwrap=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.verify=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.verifyRecover=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.encryption.privateKeyNumber=4 +op.enroll.soKeyTemporary.keyGen.encryption.publicKeyAttrId=k5 +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.encrypt=true +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.private=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.sensitive=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.sign=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.signRecover=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.verify=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.verifyRecover=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.wrap=true +op.enroll.soKeyTemporary.keyGen.encryption.publicKeyNumber=5 +op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert.reason=0 +op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert=true +op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.scheme=RecoverLast +op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.archive=true +op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.drm.conn=drm1 +op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.enable=true +op.enroll.soKeyTemporary.keyGen.keyType.num=3 +op.enroll.soKeyTemporary.keyGen.keyType.value.0=auth +op.enroll.soKeyTemporary.keyGen.keyType.value.1=signing +op.enroll.soKeyTemporary.keyGen.keyType.value.2=encryption +op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.num=2 +op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.value.0=signing +op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.value.1=encryption +op.enroll.soKeyTemporary.keyGen.signing.ca.conn=ca1 +op.enroll.soKeyTemporary.keyGen.signing.ca.profileId=caTempTokenUserSigningKeyEnrollment +op.enroll.soKeyTemporary.keyGen.signing.certAttrId=c1 +op.enroll.soKeyTemporary.keyGen.signing.certId=C1 +op.enroll.soKeyTemporary.keyGen.signing.cuid_label=$cuid$ +op.enroll.soKeyTemporary.keyGen.signing.keySize=1024 +op.enroll.soKeyTemporary.keyGen.signing.keyUsage=0 +op.enroll.soKeyTemporary.keyGen.signing.keyUser=0 +op.enroll.soKeyTemporary.keyGen.signing.label=signing key for $userid$ +op.enroll.soKeyTemporary.keyGen.signing.overwrite=true +op.enroll.soKeyTemporary.keyGen.signing.privateKeyAttrId=k2 +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.private=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.sensitive=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.signRecover=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.sign=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.verify=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.verifyRecover=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.signing.privateKeyNumber=2 +op.enroll.soKeyTemporary.keyGen.signing.publicKeyAttrId=k3 +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.private=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.sensitive=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.sign=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.signRecover=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.verifyRecover=true +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.verify=true +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.signing.publicKeyNumber=3 +op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.revokeCert.reason=0 +op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.revokeCert=true +op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.scheme=GenerateNewKey +op.enroll.soKeyTemporary.keyGen.tokenName=$auth.cn$ (Temporary) +op.enroll.soKeyTemporary.loginRequest.enable=true +op.enroll.soKeyTemporary.pinReset.enable=true +op.enroll.soKeyTemporary.pinReset.pin.maxLen=10 +op.enroll.soKeyTemporary.pinReset.pin.maxRetries=127 +op.enroll.soKeyTemporary.pinReset.pin.minLen=4 +op.enroll.soKeyTemporary.pkcs11obj.compress.enable=true +op.enroll.soKeyTemporary.pkcs11obj.enable=true +op.enroll.soKeyTemporary.tks.conn=tks1 +op.enroll.soKeyTemporary.tks.keySet=defKeyset +op.enroll.soKey.temporaryToken.tokenType=soKeyTemporary +op.enroll.soKeyTemporary.update.applet.directory=[TPS_DIR]/applets +op.enroll.soKeyTemporary.update.applet.emptyToken.enable=true +op.enroll.soKeyTemporary.update.applet.enable=true +op.enroll.soKeyTemporary.update.applet.encryption=true +op.enroll.soKeyTemporary.update.applet.requiredVersion=1.4.4d40a449 +op.enroll.soKeyTemporary.update.symmetricKeys.enable=false +op.enroll.soKeyTemporary.update.symmetricKeys.requiredVersion=1 +op.enroll.soKey.tks.conn=tks1 +op.enroll.soKey.update.applet.directory=[TPS_DIR]/applets +op.enroll.soKey.update.applet.emptyToken.enable=true +op.enroll.soKey.update.applet.enable=true +op.enroll.soKey.update.applet.encryption=true +op.enroll.soKey.update.applet.requiredVersion=1.4.4d40a449 +op.enroll.soKey.update.symmetricKeys.enable=false +op.enroll.soKey.update.symmetricKeys.requiredVersion=1 +op.enroll.userKey._000=######################################### +op.enroll.userKey._001=# Enrollment Operation For CoolKey +op.enroll.userKey._002=# +op.enroll.userKey._003=# op.enroll..keyGen..keySize=1024 +op.enroll.userKey._004=# - size of the key the token should generate +op.enroll.userKey._005=# - max value: 1024 +op.enroll.userKey._006=# +op.enroll.userKey._007=# op.enroll..keyGen..keyCapabilities.encrypt=false +op.enroll.userKey._008=# op.enroll..keyGen..keyCapabilities.sign=true +op.enroll.userKey._009=# op.enroll..keyGen..keyCapabilities.signRecover=true +op.enroll.userKey._010=# op.enroll..keyGen..keyCapabilities.decrypt=false +op.enroll.userKey._011=# op.enroll..keyGen..keyCapabilities.derive=false +op.enroll.userKey._012=# op.enroll..keyGen..keyCapabilities.unwrap=false +op.enroll.userKey._013=# op.enroll..keyGen..keyCapabilities.wrap=false +op.enroll.userKey._014=# op.enroll..keyGen..keyCapabilities.verifyRecover=true +op.enroll.userKey._015=# op.enroll..keyGen..keyCapabilities.verify=true +op.enroll.userKey._016=# op.enroll..keyGen..keyCapabilities.sensitive=true +op.enroll.userKey._017=# op.enroll..keyGen..keyCapabilities.private=true +op.enroll.userKey._018=# op.enroll..keyGen..keyCapabilities.token=true +op.enroll.userKey._019=# - specify the PKCS11 attributes to set on the token +op.enroll.userKey._020=# +op.enroll.userKey._021=# op.enroll.userKey.keyGen.signing.cuid_label +op.enroll.userKey._022=# - specify the CUID shown in the certificate +op.enroll.userKey._023=# +op.enroll.userKey._024=# op.enroll.userKey.keyGen.signing.label +op.enroll.userKey._025=# - specify the token name. all resulting labels for co-existing keys +op.enroll.userKey._026=# on the same token must be unique +op.enroll.userKey._027=# - $pretty_cuid$ - Pretty Print CUID (i.e. 4090-0062-FF02-0000-0B9C) +op.enroll.userKey._028=# - $cuid$ - CUID (i.e. 40900062FF0200000B9C) +op.enroll.userKey._029=# - $msn$ - MSN +op.enroll.userKey._030=# - $userid$ - User ID +op.enroll.userKey._031=# - $profileId$ - Profile ID +op.enroll.userKey._032=# +op.enroll.userKey._033=# op.enroll..keyGen..overwrite=true|false +op.enroll.userKey._034=# - if key and certificate exist, should RA overwrite them +op.enroll.userKey._035=# +op.enroll.userKey._036=# op.enroll..keyGen..certId=C1 +op.enroll.userKey._037=# op.enroll..keyGen..certAttrId=c1 +op.enroll.userKey._038=# op.enroll..keyGen..privateKeyAttrId=k2 +op.enroll.userKey._039=# op.enroll..keyGen..publicKeyAttrId=k3 +op.enroll.userKey._040=# op.enroll..keyGen..privateKeyNumber=2 +op.enroll.userKey._041=# op.enroll..keyGen..publicKeyNumber=3 +op.enroll.userKey._042=# - specify name PKCS11 object IDs +op.enroll.userKey._043=# - Lower case letters signify objects containing PKCS11 object attributes, +op.enroll.userKey._044=# in the format described below. +op.enroll.userKey._045=# 'c' An object containing PKCS11 attributes for a certificate. +op.enroll.userKey._046=# 'k' An object containing PKCS11 attributes for a public or private key +op.enroll.userKey._047=# 'r' An object containing PKCS11 attributes for an "reader". +op.enroll.userKey._048=# - Upper case letters signify objects containing raw data corresponding to +op.enroll.userKey._049=# the lower case letters described above. For example, object "C0" +op.enroll.userKey._050=# contains raw data corresponding to object "c0". +op.enroll.userKey._051=# 'C' This object contains an entire DER cert, and nothing else. +op.enroll.userKey._052=# 'K' This object contains a MUSCLE "key blob". TPS does not use this. +op.enroll.userKey._053=# +op.enroll.userKey._054=# op.enroll..keyGen..keyUsage=0 +op.enroll.userKey._055=# op.enroll..keyGen..keyUser=0 +op.enroll.userKey._056=# - user specifies which PIN user should be granted +op.enroll.userKey._057=# use privilege of the generated private key, or +op.enroll.userKey._058=# 15 if all users have use privilege for the private key +op.enroll.userKey._059=# - Valid uage: (only specifies the usage for the private key) +op.enroll.userKey._060=# 0 - default usage (Signing only for this APDU) +op.enroll.userKey._061=# 1 - signing only +op.enroll.userKey._062=# 2 - decryption only +op.enroll.userKey._063=# 3 - signing and decryption +op.enroll.userKey._064=# +op.enroll.userKey._065=# op.enroll..pkcs11obj.enable=true|false +op.enroll.userKey._066=# - enable writing of PKCS11 cache object to the token +op.enroll.userKey._067=# +op.enroll.userKey._068=# op.enroll..pkcs11obj.compress.enable=true|false +op.enroll.userKey._069=# - enable compression for writing of PKCS11 cache object to the token +op.enroll.userKey._070=# +op.enroll.userKey._071=# op.enroll..pinReset.pin.maxRetries=127 +op.enroll.userKey._072=# - max number of retries before blocking the token +op.enroll.userKey._073=# - max value: 127 +op.enroll.userKey._074=# +op.enroll.userKey._075=# There is a special case of tokenType userKeyTemporary. +op.enroll.userKey._076=# Make sure the profile specified by the profileId to have +op.enroll.userKey._077=# short validity period (eg, 7 days) for the certificate. +op.enroll.userKey._078=# +op.enroll.userKey._079=#op.enroll.userKey.keyGen.signing.publisherId=fileBasedPublisher +op.enroll.userKey._079=# The three recovery schemes supported are: +op.enroll.userKey._080=# +op.enroll.userKey._080=#op.enroll.userKeyTemporary.keyGen.signing.publisherId=fileBasedPublisher +op.enroll.userKey._081=# * GenerateNewKey - Generate a new +op.enroll.userKey._082=# cert for the +op.enroll.userKey._083=# encryption cert. +op.enroll.userKey._084=# * RecoverLast - Recover the most +op.enroll.userKey._085=# recent cert for the +op.enroll.userKey._086=# encryption cert. +op.enroll.userKey._087=# * GenerateNewKeyandRecoverLast - Generate new cert AND +op.enroll.userKey._088=# recover last for +op.enroll.userKey._089=# encryption cert. +op.enroll.userKey._090=######################################### +op.enroll.userKey.auth.enable=true +op.enroll.userKey.auth.id=ldap1 +op.enroll.userKey.cardmgr_instance=A0000000030000 +op.enroll.userKey.issuerinfo.enable=true +op.enroll.userKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi +op.enroll.userKey.keyGen.encryption.ca.conn=ca1 +op.enroll.userKey.keyGen.encryption.ca.profileId=caTokenUserEncryptionKeyEnrollment +op.enroll.userKey.keyGen.encryption.certAttrId=c2 +op.enroll.userKey.keyGen.encryption.certId=C2 +op.enroll.userKey.keyGen.encryption.cuid_label=$cuid$ +op.enroll.userKey.keyGen.encryption.keySize=1024 +op.enroll.userKey.keyGen.encryption.keyUsage=0 +op.enroll.userKey.keyGen.encryption.keyUser=0 +op.enroll.userKey.keyGen.encryption.label=encryption key for $userid$ +op.enroll.userKey.keyGen.encryption.overwrite=true +op.enroll.userKey.keyGen.encryption.privateKeyAttrId=k4 +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.decrypt=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.derive=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.encrypt=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.private=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.sensitive=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.sign=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.signRecover=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.token=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.unwrap=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.verify=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.verifyRecover=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.wrap=false +op.enroll.userKey.keyGen.encryption.privateKeyNumber=4 +op.enroll.userKey.keyGen.encryption.publicKeyAttrId=k5 +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.decrypt=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.derive=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.encrypt=true +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.private=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.sensitive=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.sign=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.signRecover=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.token=true +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.unwrap=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.verify=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.verifyRecover=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.wrap=true +op.enroll.userKey.keyGen.encryption.publicKeyNumber=5 +op.enroll.userKey.keyGen.encryption.recovery.destroyed.revokeCert=false +op.enroll.userKey.keyGen.encryption.recovery.destroyed.revokeCert.reason=0 +op.enroll.userKey.keyGen.encryption.recovery.destroyed.scheme=RecoverLast +op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.revokeCert.reason=1 +op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.revokeCert=true +op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.scheme=GenerateNewKey +op.enroll.userKey.keyGen.encryption.recovery.onHold.revokeCert.reason=6 +op.enroll.userKey.keyGen.encryption.recovery.onHold.revokeCert=true +op.enroll.userKey.keyGen.encryption.recovery.onHold.scheme=GenerateNewKey +op.enroll.userKey.keyGen.encryption.serverKeygen.archive=true +op.enroll.userKey.keyGen.encryption.serverKeygen.drm.conn=drm1 +op.enroll.userKey.keyGen.encryption.serverKeygen.enable=[SERVER_KEYGEN] +op.enroll.userKey.keyGen.keyType.num=2 +op.enroll.userKey.keyGen.keyType.value.0=signing +op.enroll.userKey.keyGen.keyType.value.1=encryption +op.enroll.userKey.keyGen.recovery.destroyed.keyType.num=2 +op.enroll.userKey.keyGen.recovery.destroyed.keyType.value.0=signing +op.enroll.userKey.keyGen.recovery.destroyed.keyType.value.1=encryption +op.enroll.userKey.keyGen.recovery.keyCompromise.keyType.num=2 +op.enroll.userKey.keyGen.recovery.keyCompromise.keyType.value.0=signing +op.enroll.userKey.keyGen.recovery.keyCompromise.keyType.value.1=encryption +op.enroll.userKey.keyGen.recovery.onHold.keyType.num=2 +op.enroll.userKey.keyGen.recovery.onHold.keyType.value.0=signing +op.enroll.userKey.keyGen.recovery.onHold.keyType.value.1=encryption +op.enroll.userKey.keyGen.signing.ca.conn=ca1 +op.enroll.userKey.keyGen.signing.ca.profileId=caTokenUserSigningKeyEnrollment +op.enroll.userKey.keyGen.signing.certAttrId=c1 +op.enroll.userKey.keyGen.signing.certId=C1 +op.enroll.userKey.keyGen.signing.cuid_label=$cuid$ +op.enroll.userKey.keyGen.signing.keySize=1024 +op.enroll.userKey.keyGen.signing.keyUsage=0 +op.enroll.userKey.keyGen.signing.keyUser=0 +op.enroll.userKey.keyGen.signing.label=signing key for $userid$ +op.enroll.userKey.keyGen.signing.overwrite=true +op.enroll.userKey.keyGen.signing.privateKeyAttrId=k2 +op.enroll.userKey.keyGen.signing.private.keyCapabilities.decrypt=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.derive=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.encrypt=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.private=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.sensitive=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.signRecover=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.sign=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.token=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.unwrap=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.verify=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.verifyRecover=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.wrap=false +op.enroll.userKey.keyGen.signing.privateKeyNumber=2 +op.enroll.userKey.keyGen.signing.publicKeyAttrId=k3 +op.enroll.userKey.keyGen.signing.public.keyCapabilities.decrypt=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.derive=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.encrypt=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.private=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.sensitive=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.sign=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.signRecover=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.token=true +op.enroll.userKey.keyGen.signing.public.keyCapabilities.unwrap=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.verifyRecover=true +op.enroll.userKey.keyGen.signing.public.keyCapabilities.verify=true +op.enroll.userKey.keyGen.signing.public.keyCapabilities.wrap=false +op.enroll.userKey.keyGen.signing.publicKeyNumber=3 +op.enroll.userKey.keyGen.signing.recovery.destroyed.revokeCert.reason=0 +op.enroll.userKey.keyGen.signing.recovery.destroyed.revokeCert=true +op.enroll.userKey.keyGen.signing.recovery.destroyed.scheme=GenerateNewKey +op.enroll.userKey.keyGen.signing.recovery.keyCompromise.revokeCert.reason=1 +op.enroll.userKey.keyGen.signing.recovery.keyCompromise.revokeCert=true +op.enroll.userKey.keyGen.signing.recovery.keyCompromise.scheme=GenerateNewKey +op.enroll.userKey.keyGen.signing.recovery.onHold.revokeCert.reason=6 +op.enroll.userKey.keyGen.signing.recovery.onHold.revokeCert=true +op.enroll.userKey.keyGen.signing.recovery.onHold.scheme=GenerateNewKey +op.enroll.userKey.keyGen.tokenName=$auth.cn$ +op.enroll.userKey.loginRequest.enable=true +op.enroll.userKey.pinReset.enable=true +op.enroll.userKey.pinReset.pin.maxLen=10 +op.enroll.userKey.pinReset.pin.maxRetries=127 +op.enroll.userKey.pinReset.pin.minLen=4 +op.enroll.userKey.pkcs11obj.compress.enable=true +op.enroll.userKey.pkcs11obj.enable=true +op.enroll.userKey.renewal._000=######################################### +op.enroll.userKey.renewal._001=# Token Renewal. +op.enroll.userKey.renewal._002=# +op.enroll.userKey.renewal._003=# For each token in TPS UI, set the +op.enroll.userKey.renewal._004=# following to trigger renewal +op.enroll.userKey.renewal._005=# operations: +op.enroll.userKey.renewal._006=# +op.enroll.userKey.renewal._007=# RENEW=YES +op.enroll.userKey.renewal._008=# +op.enroll.userKey.renewal._009=# Optional grace period enforcement +op.enroll.userKey.renewal._010=# must coincide exactly with what +op.enroll.userKey.renewal._011=# the CA enforces. +op.enroll.userKey.renewal._012=# +op.enroll.userKey.renewal._013=# In case of renewal, encryption certId +op.enroll.userKey.renewal._014=# values are for completeness only, server +op.enroll.userKey.renewal._015=# code calculates actual values used. +op.enroll.userKey.renewal._016=# +op.enroll.userKey.renewal._017=######################################### +op.enroll.userKey.renewal.encryption.ca.conn=ca1 +op.enroll.userKey.renewal.encryption.ca.profileId=caTokenUserEncryptionKeyRenewal +op.enroll.userKey.renewal.encryption.certAttrId=c2 +op.enroll.userKey.renewal.encryption.certId=C2 +op.enroll.userKey.renewal.encryption.enable=true +op.enroll.userKey.renewal.encryption.gracePeriod.after=30 +op.enroll.userKey.renewal.encryption.gracePeriod.before=30 +op.enroll.userKey.renewal.encryption.gracePeriod.enable=false +op.enroll.userKey.renewal.keyType.num=2 +op.enroll.userKey.renewal.keyType.value.0=signing +op.enroll.userKey.renewal.keyType.value.1=encryption +op.enroll.userKey.renewal.signing.ca.conn=ca1 +op.enroll.userKey.renewal.signing.ca.profileId=caTokenUserSigningKeyRenewal +op.enroll.userKey.renewal.signing.certAttrId=c1 +op.enroll.userKey.renewal.signing.certId=C1 +op.enroll.userKey.renewal.signing.enable=true +op.enroll.userKey.renewal.signing.gracePeriod.after=30 +op.enroll.userKey.renewal.signing.gracePeriod.before=30 +op.enroll.userKey.renewal.signing.gracePeriod.enable=false +op.enroll.userKeyTemporary.auth.enable=true +op.enroll.userKeyTemporary.auth.id=ldap1 +op.enroll.userKeyTemporary.cardmgr_instance=A0000000030000 +op.enroll.userKeyTemporary.keyGen.auth.ca.conn=ca1 +op.enroll.userKeyTemporary.keyGen.auth.ca.profileId=caTempTokenDeviceKeyEnrollment +op.enroll.userKeyTemporary.keyGen.auth.certAttrId=c0 +op.enroll.userKeyTemporary.keyGen.auth.certId=C0 +op.enroll.userKeyTemporary.keyGen.auth.cuid_label=$cuid$ +op.enroll.userKeyTemporary.keyGen.auth.keySize=1024 +op.enroll.userKeyTemporary.keyGen.auth.keyUsage=0 +op.enroll.userKeyTemporary.keyGen.auth.keyUser=15 +op.enroll.userKeyTemporary.keyGen.auth.label=Temporary Key for $userid$ +op.enroll.userKeyTemporary.keyGen.auth.overwrite=false +op.enroll.userKeyTemporary.keyGen.auth.privateKeyAttrId=k0 +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.private=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.sensitive=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.signRecover=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.sign=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.verifyRecover=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.verify=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.auth.privateKeyNumber=0 +op.enroll.userKeyTemporary.keyGen.auth.publicKeyAttrId=k1 +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.private=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.sensitive=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.signRecover=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.sign=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.verifyRecover=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.verify=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.auth.publicKeyNumber=1 +op.enroll.userKeyTemporary.keyGen.encryption.ca.conn=ca1 +op.enroll.userKeyTemporary.keyGen.encryption.ca.profileId=caTempTokenUserEncryptionKeyEnrollment +op.enroll.userKeyTemporary.keyGen.encryption.certAttrId=c2 +op.enroll.userKeyTemporary.keyGen.encryption.certId=C2 +op.enroll.userKeyTemporary.keyGen.encryption.cuid_label=$cuid$ +op.enroll.userKeyTemporary.keyGen.encryption.keySize=1024 +op.enroll.userKeyTemporary.keyGen.encryption.keyUsage=0 +op.enroll.userKeyTemporary.keyGen.encryption.keyUser=0 +op.enroll.userKeyTemporary.keyGen.encryption.label=encryption key for $userid$ +op.enroll.userKeyTemporary.keyGen.encryption.overwrite=true +op.enroll.userKeyTemporary.keyGen.encryption.privateKeyAttrId=k4 +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.decrypt=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.private=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.sensitive=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.sign=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.signRecover=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.unwrap=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.verify=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.verifyRecover=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.encryption.privateKeyNumber=4 +op.enroll.userKeyTemporary.keyGen.encryption.publicKeyAttrId=k5 +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.encrypt=true +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.private=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.sensitive=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.sign=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.signRecover=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.verify=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.verifyRecover=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.wrap=true +op.enroll.userKeyTemporary.keyGen.encryption.publicKeyNumber=5 +op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert.reason=0 +op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert=true +op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.scheme=RecoverLast +op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.archive=true +op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.drm.conn=drm1 +op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.enable=true +op.enroll.userKeyTemporary.keyGen.keyType.num=3 +op.enroll.userKeyTemporary.keyGen.keyType.value.0=auth +op.enroll.userKeyTemporary.keyGen.keyType.value.1=signing +op.enroll.userKeyTemporary.keyGen.keyType.value.2=encryption +op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.num=2 +op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.value.0=signing +op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.value.1=encryption +op.enroll.userKeyTemporary.keyGen.signing.ca.conn=ca1 +op.enroll.userKeyTemporary.keyGen.signing.ca.profileId=caTempTokenUserSigningKeyEnrollment +op.enroll.userKeyTemporary.keyGen.signing.certAttrId=c1 +op.enroll.userKeyTemporary.keyGen.signing.certId=C1 +op.enroll.userKeyTemporary.keyGen.signing.cuid_label=$cuid$ +op.enroll.userKeyTemporary.keyGen.signing.keySize=1024 +op.enroll.userKeyTemporary.keyGen.signing.keyUsage=0 +op.enroll.userKeyTemporary.keyGen.signing.keyUser=0 +op.enroll.userKeyTemporary.keyGen.signing.label=signing key for $userid$ +op.enroll.userKeyTemporary.keyGen.signing.overwrite=true +op.enroll.userKeyTemporary.keyGen.signing.privateKeyAttrId=k2 +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.private=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.sensitive=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.signRecover=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.sign=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.verify=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.verifyRecover=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.signing.privateKeyNumber=2 +op.enroll.userKeyTemporary.keyGen.signing.publicKeyAttrId=k3 +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.private=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.sensitive=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.sign=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.signRecover=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.verifyRecover=true +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.verify=true +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.signing.publicKeyNumber=3 +op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.revokeCert.reason=0 +op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.revokeCert=true +op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.scheme=GenerateNewKey +op.enroll.userKeyTemporary.keyGen.tokenName=$auth.cn$ (Temporary) +op.enroll.userKeyTemporary.loginRequest.enable=true +op.enroll.userKeyTemporary.pinReset.enable=true +op.enroll.userKeyTemporary.pinReset.pin.maxLen=10 +op.enroll.userKeyTemporary.pinReset.pin.maxRetries=127 +op.enroll.userKeyTemporary.pinReset.pin.minLen=4 +op.enroll.userKeyTemporary.pkcs11obj.compress.enable=true +op.enroll.userKeyTemporary.pkcs11obj.enable=true +op.enroll.userKeyTemporary.tks.conn=tks1 +op.enroll.userKey.temporaryToken.tokenType=userKeyTemporary +op.enroll.userKeyTemporary.update.applet.directory=[TPS_DIR]/applets +op.enroll.userKeyTemporary.update.applet.emptyToken.enable=true +op.enroll.userKeyTemporary.update.applet.enable=true +op.enroll.userKeyTemporary.update.applet.encryption=true +op.enroll.userKeyTemporary.update.applet.requiredVersion=1.4.4d40a449 +op.enroll.userKeyTemporary.update.symmetricKeys.enable=false +op.enroll.userKeyTemporary.update.symmetricKeys.requiredVersion=1 +op.enroll.userKey.tks.conn=tks1 +op.enroll.userKey.update.applet.directory=[TPS_DIR]/applets +op.enroll.userKey.update.applet.emptyToken.enable=true +op.enroll.userKey.update.applet.enable=true +op.enroll.userKey.update.applet.encryption=true +op.enroll.userKey.update.applet.requiredVersion=1.4.4d40a449 +op.enroll.userKey.update.symmetricKeys.enable=false +op.enroll.userKey.update.symmetricKeys.requiredVersion=1 +op.format._000=######################################### +op.format._001=# Format Operation For tokenKey +op.format._002=# +op.format._003=# op.format.tokenKey.update.applet.emptyToken.enable=false +op.format._004=# - update applet or not if token is empty +op.format._005=# +op.format._006=# - applicable to CoolKey +op.format._007=# - applicable to HouseKey +op.format._008=# - applicable to HouseKey with Legacy Applet +op.format._009=######################################### +op.format.allowUnknownToken=true +op.format.cleanToken.auth.enable=false +op.format.cleanToken.auth.id=ldap1 +op.format.cleanToken.ca.conn=ca1 +op.format.cleanToken.cardmgr_instance=A0000000030000 +op.format.cleanToken.issuerinfo.enable=true +op.format.cleanToken.issuerinfo.value= +op.format.cleanToken.loginRequest.enable=true +op.format.cleanToken.revokeCert=true +op.format.cleanToken.tks.conn=tks1 +op.format.cleanToken.update.applet.directory=[TPS_DIR]/applets +op.format.cleanToken.update.applet.emptyToken.enable=true +op.format.cleanToken.update.applet.encryption=true +op.format.cleanToken.update.applet.requiredVersion=1.4.4d40a449 +op.format.cleanToken.update.symmetricKeys.enable=false +op.format.cleanToken.update.symmetricKeys.requiredVersion=1 +op.format.mapping.0.filter.appletMajorVersion= +op.format.mapping.0.filter.appletMinorVersion= +op.format.mapping.0.filter.tokenATR= +op.format.mapping.0.filter.tokenCUID.end= +op.format.mapping.0.filter.tokenCUID.start= +op.format.mapping.0.filter.tokenType=soCleanUserToken +op.format.mapping.0.target.tokenType=soCleanUserToken +op.format.mapping.1.filter.appletMajorVersion= +op.format.mapping.1.filter.appletMinorVersion= +op.format.mapping.1.filter.tokenATR= +op.format.mapping.1.filter.tokenCUID.end= +op.format.mapping.1.filter.tokenCUID.start= +op.format.mapping.1.filter.tokenType=soUserKey +op.format.mapping.1.target.tokenType=soUserKey +op.format.mapping.2.filter.appletMajorVersion= +op.format.mapping.2.filter.appletMinorVersion= +op.format.mapping.2.filter.tokenATR= +op.format.mapping.2.filter.tokenCUID.end= +op.format.mapping.2.filter.tokenCUID.start= +op.format.mapping.2.filter.tokenType=soKey +op.format.mapping.2.target.tokenType=soKey +op.format.mapping.3.filter.appletMajorVersion= +op.format.mapping.3.filter.appletMinorVersion= +op.format.mapping.3.filter.tokenATR= +op.format.mapping.3.filter.tokenCUID.end= +op.format.mapping.3.filter.tokenCUID.start= +op.format.mapping.3.filter.tokenType=userKey +op.format.mapping.3.target.tokenType=userKey +op.format.mapping.4.filter.appletMajorVersion= +op.format.mapping.4.filter.appletMinorVersion= +op.format.mapping.4.filter.tokenATR= +op.format.mapping.4.filter.tokenCUID.end= +op.format.mapping.4.filter.tokenCUID.start= +op.format.mapping.4.filter.tokenType=soCleanSOToken +op.format.mapping.4.target.tokenType=soCleanSOToken +op.format.mapping.5.filter.appletMajorVersion= +op.format.mapping.5.filter.appletMinorVersion= +op.format.mapping.5.filter.tokenATR= +op.format.mapping.5.filter.tokenCUID.end= +op.format.mapping.5.filter.tokenCUID.start= +op.format.mapping.5.filter.tokenType=cleanToken +op.format.mapping.5.target.tokenType=cleanToken +op.format.mapping.6.filter.appletMajorVersion= +op.format.mapping.6.filter.appletMinorVersion= +op.format.mapping.6.filter.tokenATR= +op.format.mapping.6.filter.tokenCUID.end= +op.format.mapping.6.filter.tokenCUID.start= +op.format.mapping.6.target.tokenType=tokenKey +op.format.mapping.order=0,1,2,3,4,5,6 +op.format.soCleanSOToken.auth.enable=false +op.format.soCleanSOToken.auth.id=ldap1 +op.format.soCleanSOToken.ca.conn=ca1 +op.format.soCleanSOToken.cardmgr_instance=A0000000030000 +op.format.soCleanSOToken.issuerinfo.enable=true +op.format.soCleanSOToken.issuerinfo.value= +op.format.soCleanSOToken.loginRequest.enable=false +op.format.soCleanSOToken.revokeCert=true +op.format.soCleanSOToken.tks.conn=tks1 +op.format.soCleanSOToken.update.applet.directory=[TPS_DIR]/applets +op.format.soCleanSOToken.update.applet.emptyToken.enable=true +op.format.soCleanSOToken.update.applet.encryption=true +op.format.soCleanSOToken.update.applet.requiredVersion=1.4.4d40a449 +op.format.soCleanSOToken.update.symmetricKeys.enable=false +op.format.soCleanSOToken.update.symmetricKeys.requiredVersion=1 +op.format.soCleanUserToken.auth.enable=false +op.format.soCleanUserToken.auth.id=ldap1 +op.format.soCleanUserToken.ca.conn=ca1 +op.format.soCleanUserToken.cardmgr_instance=A0000000030000 +op.format.soCleanUserToken.issuerinfo.enable=true +op.format.soCleanUserToken.issuerinfo.value= +op.format.soCleanUserToken.loginRequest.enable=false +op.format.soCleanUserToken.revokeCert=true +op.format.soCleanUserToken.tks.conn=tks1 +op.format.soCleanUserToken.update.applet.directory=[TPS_DIR]/applets +op.format.soCleanUserToken.update.applet.emptyToken.enable=true +op.format.soCleanUserToken.update.applet.encryption=true +op.format.soCleanUserToken.update.applet.requiredVersion=1.4.4d40a449 +op.format.soCleanUserToken.update.symmetricKeys.enable=false +op.format.soCleanUserToken.update.symmetricKeys.requiredVersion=1 +op.format.soKey.auth.enable=true +op.format.soKey.auth.id=ldap2 +op.format.soKey.ca.conn=ca1 +op.format.soKey.cardmgr_instance=A0000000030000 +op.format.soKey.issuerinfo.enable=true +op.format.soKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/so/index.cgi +op.format.soKey.loginRequest.enable=true +op.format.soKey.revokeCert=true +op.format.soKey.tks.conn=tks1 +op.format.soKey.update.applet.directory=[TPS_DIR]/applets +op.format.soKey.update.applet.emptyToken.enable=true +op.format.soKey.update.applet.encryption=true +op.format.soKey.update.applet.requiredVersion=1.4.4d40a449 +op.format.soKey.update.symmetricKeys.enable=false +op.format.soKey.update.symmetricKeys.requiredVersion=1 +op.format.soUserKey.auth.enable=false +op.format.soUserKey.auth.id=ldap1 +op.format.soUserKey.ca.conn=ca1 +op.format.soUserKey.cardmgr_instance=A0000000030000 +op.format.soUserKey.issuerinfo.enable=true +op.format.soUserKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi +op.format.soUserKey.loginRequest.enable=false +op.format.soUserKey.revokeCert=true +op.format.soUserKey.tks.conn=tks1 +op.format.soUserKey.update.applet.directory=[TPS_DIR]/applets +op.format.soUserKey.update.applet.emptyToken.enable=true +op.format.soUserKey.update.applet.encryption=true +op.format.soUserKey.update.applet.requiredVersion=1.4.4d40a449 +op.format.soUserKey.update.symmetricKeys.enable=false +op.format.soUserKey.update.symmetricKeys.requiredVersion=1 +op.format.tokenKey.auth.enable=true +op.format.tokenKey.auth.id=ldap1 +op.format.tokenKey.ca.conn=ca1 +op.format.tokenKey.cardmgr_instance=A0000000030000 +op.format.tokenKey.issuerinfo.enable=true +op.format.tokenKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi +op.format.tokenKey.loginRequest.enable=true +op.format.tokenKey.revokeCert=true +op.format.tokenKey.tks.conn=tks1 +op.format.tokenKey.update.applet.directory=[TPS_DIR]/applets +op.format.tokenKey.update.applet.emptyToken.enable=true +op.format.tokenKey.update.applet.encryption=true +op.format.tokenKey.update.applet.requiredVersion=1.4.4d40a449 +op.format.tokenKey.update.symmetricKeys.enable=false +op.format.tokenKey.update.symmetricKeys.requiredVersion=1 +op.format.userKey.auth.enable=true +op.format.userKey.auth.id=ldap1 +op.format.userKey.ca.conn=ca1 +op.format.userKey.cardmgr_instance=A0000000030000 +op.format.userKey.issuerinfo.enable=true +op.format.userKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi +op.format.userKey.loginRequest.enable=true +op.format.userKey.revokeCert=true +op.format.userKey.tks.conn=tks1 +op.format.userKey.update.applet.directory=[TPS_DIR]/applets +op.format.userKey.update.applet.emptyToken.enable=true +op.format.userKey.update.applet.encryption=true +op.format.userKey.update.applet.requiredVersion=1.4.4d40a449 +op.format.userKey.update.symmetricKeys.enable=false +op.format.userKey.update.symmetricKeys.requiredVersion=1 +op.pinReset._000=######################################### +op.pinReset._001=# Certificate Chain Imports +op.pinReset._002=# +op.pinReset._003=# op.enroll.certificates.num=1 +op.pinReset._004=# op.enroll.certificates.value.0=caCert +op.pinReset._005=# op.enroll.certificates.caCert.nickName=caCert0 pki-tps +op.pinReset._006=# op.enroll.certificates.caCert.certId=C5 +op.pinReset._007=# op.enroll.certificates.caCert.certAttrId=c5 +op.pinReset._008=# op.enroll.certificates.caCert.label=caCert Label +op.pinReset._009=######################################### +op.pinReset._010=######################################### +op.pinReset._011=# Pin Reset Operation For CoolKey +op.pinReset._012=# +op.pinReset._013=# op.pinReset.userKey.update.applet.emptyToken.enable=false +op.pinReset._014=# - update applet or not if token is empty +op.pinReset._015=# +op.pinReset._016=# - N/A for HouseKey +op.pinReset._017=# - N/A for HouseKey with Legacy Applet +op.pinReset._018=######################################### +op.pinReset.mapping.0.filter.appletMajorVersion= +op.pinReset.mapping.0.filter.appletMinorVersion= +op.pinReset.mapping.0.filter.tokenATR= +op.pinReset.mapping.0.filter.tokenCUID.end= +op.pinReset.mapping.0.filter.tokenCUID.start= +op.pinReset.mapping.0.filter.tokenType= +op.pinReset.mapping.0.target.tokenType=userKey +op.pinReset.mapping.order=0 +op.pinReset.userKey.auth.enable=true +op.pinReset.userKey.auth.id=ldap1 +op.pinReset.userKey.cardmgr_instance=A0000000030000 +op.pinReset.userKey.loginRequest.enable=true +op.pinReset.userKey.pinReset.pin.maxLen=10 +op.pinReset.userKey.pinReset.pin.minLen=4 +op.pinReset.userKey.tks.conn=tks1 +op.pinReset.userKey.update.applet.directory=[TPS_DIR]/applets +op.pinReset.userKey.update.applet.emptyToken.enable=true +op.pinReset.userKey.update.applet.enable=false +op.pinReset.userKey.update.applet.encryption=true +op.pinReset.userKey.update.applet.requiredVersion=1.4.4d40a449 +op.pinReset.userKey.update.symmetricKeys.enable=false +op.pinReset.userKey.update.symmetricKeys.requiredVersion=1 +os.serverName=cert-[PKI_INSTANCE_NAME] +os.userid=nobody +passwordClass=com.netscape.cmsutil.password.PlainPasswordFile +passwordFile=[PKI_INSTANCE_PATH]/conf/password.conf +pidDir=[PKI_PIDDIR] +pkicreate.admin_secure_port=[PKI_ADMIN_SECURE_PORT] +pkicreate.agent_secure_port=[PKI_AGENT_SECURE_PORT] +pkicreate.ee_secure_port=[PKI_EE_SECURE_PORT] +pkicreate.group=[PKI_GROUP] +pkicreate.pki_instance_name=[PKI_INSTANCE_NAME] +pkicreate.pki_instance_root=[PKI_INSTANCE_ROOT] +pkicreate.secure_port=[PKI_SECURE_PORT] +pkicreate.subsystem_type=[PKI_SUBSYSTEM_TYPE] +pkicreate.systemd.servicename=[PKI_SYSTEMD_SERVICENAME] +pkicreate.tomcat_server_port=[TOMCAT_SERVER_PORT] +pkicreate.unsecure_port=[PKI_UNSECURE_PORT] +pkicreate.user=[PKI_USER] +pkiremove.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] +preop.admincert.profile=caAdminCert +preop.admin.group=TUS Agents,TUS Operators,TUS Administrators,TUS Officers +preop.admin.name=Token Processing Service Manager Administrator +preop.cert.admin.defaultSigningAlgorithm=SHA256withRSA +preop.cert.admin.dn=uid=admin,cn=admin +preop.cert.admin.keysize.custom_size=2048 +preop.cert.admin.keysize.size=2048 +preop.cert.admin.profile=adminCert.profile +preop.cert.audit_signing.cncomponent.override=true +preop.cert.audit_signing.defaultSigningAlgorithm=SHA256withRSA +preop.cert.audit_signing.dn=CN=TPS Audit Signing Certificate +preop.cert.audit_signing.enable=true +preop.cert.audit_signing.keysize.custom_size=2048 +preop.cert.audit_signing.keysize.size=2048 +preop.cert.audit_signing.nickname=auditSigningCert cert-[PKI_INSTANCE_NAME] +preop.cert.audit_signing.profile=caInternalAuthAuditSigningCert +preop.cert.audit_signing.signing.required=false +preop.cert.audit_signing.subsystem=tps +preop.cert.audit_signing.type=remote +preop.cert.audit_signing.userfriendlyname=TPS Audit Signing Certificate +preop.cert.list=sslserver,subsystem,audit_signing +preop.cert.rsalist=audit_signing +preop.cert.sslserver.cncomponent.override=false +preop.cert.sslserver.defaultSigningAlgorithm=SHA256withRSA +preop.cert.sslserver.dn=CN=[PKI_HOSTNAME] +preop.cert.sslserver.enable=true +preop.cert.sslserver.keysize.custom_size=2048 +preop.cert.sslserver.keysize.size=2048 +preop.cert.sslserver.nickname=[PKI_SSL_SERVER_NICKNAME] +preop.cert.sslserver.profile=caInternalAuthServerCert +preop.cert.sslserver.signing.required=false +preop.cert.sslserver.subsystem=tps +preop.cert.sslserver.type=remote +preop.cert.sslserver.userfriendlyname=SSL Server Certificate +preop.cert.subsystem.cncomponent.override=true +preop.cert.subsystem.defaultSigningAlgorithm=SHA256withRSA +preop.cert.subsystem.dn=CN=TPS Subsystem Certificate +preop.cert.subsystem.enable=true +preop.cert.subsystem.keysize.custom_size=2048 +preop.cert.subsystem.keysize.size=2048 +preop.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] +preop.cert.subsystem.profile=caInternalAuthSubsystemCert +preop.cert.subsystem.signing.required=false +preop.cert.subsystem.subsystem=tps +preop.cert.subsystem.type=remote +preop.cert.subsystem.userfriendlyname=Subsystem Certificate +preop.configModules.count=3 +preop.configModules.module0.commonName=NSS Internal PKCS #11 Module +preop.configModules.module0.imagePath=/pki/images/clearpixel.gif +preop.configModules.module0.userFriendlyName=NSS Internal PKCS #11 Module +preop.configModules.module1.commonName=nfast +preop.configModules.module1.imagePath=/pki/images/clearpixel.gif +preop.configModules.module1.userFriendlyName=nCipher's nFast Token Hardware Module +preop.configModules.module2.commonName=lunasa +preop.configModules.module2.imagePath=/pki/images/clearpixel.gif +preop.configModules.module2.userFriendlyName=SafeNet's LunaSA Token Hardware Module +preop.hierarchy.profile=caCert.profile +preop.internaldb.data_ldif=/usr/share/pki/tps/conf/db.ldif +preop.internaldb.index_ldif=/usr/share/pki/tps/conf/index.ldif +preop.internaldb.ldif=/usr/share/pki/tps/conf/database.ldif +preop.internaldb.manager_ldif=/usr/share/pki/tps/conf/manager.ldif +preop.internaldb.post_ldif=/usr/share/pki/tps/conf/vlv.ldif,/usr/share/pki/tps/conf/vlvtasks.ldif +preop.internaldb.schema.ldif=/usr/share/pki/tps/conf/schema.ldif +preop.internaldb.wait_dn=cn=index1160528734, cn=index, cn=tasks, cn=config +preop.module.token=Internal Key Storage Token +preop.pin=[PKI_RANDOM_NUMBER] +preop.product.name=CS +preop.securitydomain.admin_url=https://[PKI_HOSTNAME]:8443 +preop.system.fullname=Token Key Service +preop.system.name=TPS +preop.wizard.name=TPS Setup Wizard +proxy.securePort=[PKI_PROXY_SECURE_PORT] +proxy.unsecurePort=[PKI_PROXY_UNSECURE_PORT] +registry.file=[PKI_INSTANCE_PATH]/conf/registry.cfg +selftests._000=## +selftests._001=## Self Tests +selftests._002=## +selftests._003=## The Self-Test plugin TPSSystemCertsVerification uses the +selftests._004=## following parameters (where certusage is optional): +selftests._005=## tps.cert.list = +selftests._006=## tps.cert..nickname +selftests._007=## tps.cert..certusage +selftests._008=## +selftests.container.instance.SystemCertsVerification=com.netscape.cms.selftests.common.SystemCertsVerification +selftests.container.logger.bufferSize=512 +selftests.container.logger.class=com.netscape.cms.logging.RollingLogFile +selftests.container.logger.enable=true +selftests.container.logger.expirationTime=0 +selftests.container.logger.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/selftests.log +selftests.container.logger.flushInterval=5 +selftests.container.logger.level=1 +selftests.container.logger.maxFileSize=2000 +selftests.container.logger.register=false +selftests.container.logger.rolloverInterval=2592000 +selftests.container.logger.type=transaction +selftests.container.order.onDemand=SystemCertsVerification:critical +selftests.container.order.startup=SystemCertsVerification:critical +selftests.plugin.SystemCertsVerification.SubId=tps +service.instanceDir=[PKI_INSTANCE_ROOT] +service.instanceID=[PKI_INSTANCE_NAME] +service.machineName=[PKI_HOSTNAME] +service.non_clientauth_securePort=[PKI_EE_SECURE_PORT] +service.securePort=[PKI_AGENT_SECURE_PORT] +service.unsecurePort=[PKI_UNSECURE_PORT] +smtp.host=localhost +smtp.port=25 +subsystem.0.class=org.dogtagpki.tps.server.TPSSubsystem +subsystem.0.id=tps +subsystem.1.class=com.netscape.cmscore.selftests.SelfTestSubsystem +subsystem.1.id=selftests +subsystem.2.class=com.netscape.cmscore.util.StatsSubsystem +subsystem.2.id=stats +target._000=######################################### +target._001=# entries to enable configuration of parameter sets through the TPS UI agent and admin tabs +target._002=# +target._003=# target.configure.list = comma separated lists of all parameter sets that can be configured by the admin. +target._004=# Each entry will show up (with underscore replaced by space) under Advanced Configuration on the admin tab. +target._005=# +target._006=# target.agent_approve.list = comma separated subset of above list. Parameter sets in this list +target._007=# will show up in the agent tab (under advanced configuration) and will require agent involvement +target._008=# (enable/ disable) to be edited. +target._009=# +target._010=# For the wording to display correctly, the values in the above list should be plurals. +target._011=# +target._012=# Each parameter set in the lists above requires three parameters: +target._013=# target..list : list of choices of this parameter set type (will display in the drop down box) +target._014=# target..pattern : the regular expression to select parameters in CS.cfg for this parameter set. +target._015=# target..displayname: used in the UI display text. This should be the singular form of . +target._016=# +target._017=# The exception is the parameter set Generals, which has only a pattern and displayname defined. +target._018=# +target._019=######################################## +target.agent_approve.list=Profiles +target.Authentication_Sources.displayname=Authentication Source +target.Authentication_Sources.list=0,1 +target.Authentication_Sources.pattern=auth\.instance\.$name\..* +target.configure.list=Profiles,Subsystem_Connections,Profile_Mappings,Authentication_Sources +target.Generals.displayname=General +target.Generals.pattern=^applet\..*\|^general\..*\|^failover.pod.enable\|^channel\..* +target.Profile_Mappings.displayname=Profile Mapping +target.Profile_Mappings.list=enroll,format,pinReset +target.Profile_Mappings.pattern=op\.$name\.mapping\..* +target.Profiles.displayname=Profile +target.Profiles.list=userKey,soKey,soCleanUserToken,soUserKey,cleanToken,soCleanSoToken,tokenKey +target.Profiles.pattern=op\..*\.$name\..* +target.Subsystem_Connections.displayname=Subsystem Connection +target.Subsystem_Connections.list=ca1,drm1,tks1 +target.Subsystem_Connections.pattern=conn\.$name\..* +tokendb._000=######################################### +tokendb._001=# tokendb.auditLog: +tokendb._002=# - audit log path +tokendb._003=# tokendb.host: +tokendb._004=# - tokendb host name +tokendb._005=# tokendb.port: +tokendb._006=# - tokendb port number +tokendb._007=# tokendb.bindDN: +tokendb._008=# - tokendb administration DN (i.e. cn=Directory Manager) +tokendb._009=# tokendb.bindPassPath: +tokendb._010=# - tokendb administration password file path +tokendb._011=# tokendb.templateDir +tokendb._012=# - directory where all the tokendb templates are located +tokendb._013=# tokendb.userBaseDN: +tokendb._014=# - directory base DN for users and groups +tokendb._015=# tokendb.baseDN: +tokendb._016=# - directory base DN for tokens +tokendb._017=# tokendb.activityBaseDN: +tokendb._018=# - directory base DN for activities +tokendb._019=# tokendb.indexTemplate=index.template +tokendb._020=# - index template +tokendb._021=# tokendb.newTemplate=new.template +tokendb._022=# - add template +tokendb._023=# tokendb.showTemplate=show.template +tokendb._024=# - show template +tokendb._025=# tokendb.errorTemplate=error.template +tokendb._026=# - error template +tokendb._027=# tokendb.searchTemplate=search.template +tokendb._028=# - search template +tokendb._029=# tokendb.searchResultTemplate=searchResults.template +tokendb._030=# - search result template +tokendb._031=# tokendb.editTemplate=edit.template +tokendb._032=# - edit template +tokendb._033=# tokendb.editResultTemplate=editResults.template +tokendb._034=# - edit result template +tokendb._035=# tokendb.addResultTemplate=addResults.template +tokendb._036=# - add result template +tokendb._037=# tokendb.deleteResultTemplate=deleteResults.template +tokendb._038=# - delete result template +tokendb._039=# tokendb.searchActivityTemplate=searchActivity.template +tokendb._040=# - search activity template +tokendb._041=# tokendb.searchActivityResultTemplate=searchActivityResults.template +tokendb._042=# - search activity result template +tokendb._043=# tokendb.showAdminTemplate=showAdmin.template +tokendb._044=# - show admin template +tokendb._045=# tokendb.editAdminTemplate=editAdmin.template +tokendb._046=# - edit admin template +tokendb._047=# tokendb.editAdminResultTemplate=editAdminResults.template +tokendb._048=# - edit admin result template +tokendb._049=# tokendb.searchAdminTemplate=searchAdmin.template +tokendb._050=# - search admin template +tokendb._051=# tokendb.searchAdminResultTemplate=searchAdminResults.template +tokendb._052=# - search admin result template +tokendb._053=# tokendb.defaultPolicy: +tokendb._054=# Supported Policy (Separated by ; [Semicolon]): +tokendb._055=# For example, PIN_RESET=YES|NO;RE_ENROLL=YES|NO +tokendb._056=# PIN_RESET=YES|NO +tokendb._057=# - If not present, pin reset by user is allowed. +tokendb._058=# - If present and agent change PIN_RESET from NO +tokendb._059=# to YES, user is allowed to do pin reset. This +tokendb._060=# policy will be changed back to NO after pin reset. +tokendb._061=# RE_ENROLL=YES|NO +tokendb._062=# - If not present, re-enrollment is allowed. +tokendb._063=# - If present, re-enrollment is allowed when RE_ENROLL +tokendb._064=# is set to YES. Otherwise, re-enrollment is not +tokendb._065=# allowed. +tokendb._066=# tokendb.allowedTransitions: +tokendb._067=# - has transitions between the following states +tokendb._068=# TOKEN_UNINITIALIZED = 0, +tokendb._069=# TOKEN_DAMAGED =1, +tokendb._070=# TOKEN_PERM_LOST=2, +tokendb._071=# TOKEN_TEMP_LOST=3, +tokendb._072=# TOKEN_FOUND =4, +tokendb._073=# TOKEN_TEMP_LOST_PERM_LOST =5, +tokendb._074=# TOKEN_TERMINATED = 6 +tokendb._075=######################################### +tokendb.activityBaseDN=ou=Activities,[TOKENDB_ROOT] +tokendb.addConfigTemplate=addConfig.template +tokendb.addResultTemplate=addResults.template +tokendb.agentSelectConfigTemplate=agentSelectConfig.template +tokendb.agentViewConfigTemplate=agentViewConfig.template +tokendb.allowedTransitions=0:1,0:2,0:3,0:4,0:5,0:6,3:4,3:5,3:6,4:1,4:2,4:3,4:6 +tokendb.auditAdminTemplate=auditAdmin.template +tokendb.auditLog=[PKI_INSTANCE_PATH]/logs/tokendb-audit.log +tokendb.baseDN=ou=Tokens,[TOKENDB_ROOT] +tokendb.bindDN=cn=Directory Manager +tokendb.bindPassPath=[PKI_INSTANCE_PATH]/conf/password.conf +tokendb.certBaseDN=ou=Certificates,[TOKENDB_ROOT] +tokendb.confirmConfigChangesTemplate=confirmConfigChanges.template +tokendb.confirmDeleteConfigTemplate=confirmDeleteConfig.template +tokendb.defaultPolicy=RE_ENROLL=YES +tokendb.deleteResultTemplate=deleteResults.template +tokendb.deleteTemplate=delete.template +tokendb.doTokenConfirmTemplate=doTokenConfirm.template +tokendb.doTokenTemplate=doToken.template +tokendb.editConfigTemplate=editConfig.template +tokendb.editResultTemplate=editResults.template +tokendb.editTemplate=edit.template +tokendb.editUserTemplate=editUser.template +tokendb.errorTemplate=error.template +tokendb.hostport=[TOKENDB_HOST]:[TOKENDB_PORT] +tokendb.indexAdminTemplate=indexAdmin.template +tokendb.indexOperatorTemplate=indexOperator.template +tokendb.indexTemplate=index.template +tokendb.newTemplate=new.template +tokendb.newUserTemplate=newUser.template +tokendb.revokeTemplate=revoke.template +tokendb.searchActivityAdminResultTemplate=searchActivityAdminResults.template +tokendb.searchActivityAdminTemplate=searchActivityAdmin.template +tokendb.searchActivityResultTemplate=searchActivityResults.template +tokendb.searchActivityTemplate=searchActivity.template +tokendb.searchAdminResultTemplate=searchAdminResults.template +tokendb.searchAdminTemplate=searchAdmin.template +tokendb.searchCertificateResultTemplate=searchCertificateResults.template +tokendb.searchCertificateTemplate=searchCertificate.template +tokendb.searchResultTemplate=searchResults.template +tokendb.searchTemplate=search.template +tokendb.searchUserResultTemplate=searchUserResults.template +tokendb.searchUserTemplate=searchUser.template +tokendb.selectConfigTemplate=selectConfig.template +tokendb.selfTestResultsTemplate=selfTestResults.template +tokendb.selfTestTemplate=selfTest.template +tokendb.showAdminTemplate=showAdmin.template +tokendb.showCertTemplate=showCert.template +tokendb.showTemplate=show.template +tokendb.ssl=false +tokendb.templateDir=[PKI_INSTANCE_PATH]/docroot/tus +tokendb.userBaseDN=[TOKENDB_ROOT] +tokendb.userDeleteTemplate=userDelete.template +tps._000=######################################## +tps._001=# For verifying system certificates +tps._002=# tps.cert.list=sslserver,subsystem,audit_signing +tps._003=# tps.cert.sslserver.nickname=xxx +tps._005=# tps.cert.subsystem.nickname=xxx +tps._007=# tps.cert.audit_signing.nickname=xxx +tps._008=# operations.allowedTransitions: +tps._009=# - token operations, like formatting and enrollment have transitions between the following states +tps._010=# TOKEN_UNINITIALIZED = 0, +tps._011=# TOKEN_DAMAGED =1, +tps._012=# TOKEN_PERM_LOST=2, +tps._013=# TOKEN_TEMP_LOST=3, +tps._014=# TOKEN_FOUND =4, +tps._015=# TOKEN_TEMP_LOST_PERM_LOST =5, +tps._016=# TOKEN_TERMINATED = 6 +tps._017=# Sample: tps.operations.allowedTransitions=0:0,0:4,4:6,6:0 +tps._018=######################################## +tps.cert.audit_signing.certusage=ObjectSigner +tps.cert.audit_signing.nickname=[HSM_LABEL][NICKNAME] +tps.cert.list=sslserver,subsystem,audit_signing +tps.cert.sslserver.certusage=SSLServer +tps.cert.subsystem.certusage=SSLClient +tps.operations.allowedTransitions=0:0,0:4,4:0 +usrgrp._000=## +usrgrp._001=## User/Group +usrgrp._002=## +usrgrp.ldap=internaldb diff --git a/base/tps-tomcat/shared/conf/acl.ldif b/base/tps-tomcat/shared/conf/acl.ldif new file mode 100644 index 000000000..fb63122d1 --- /dev/null +++ b/base/tps-tomcat/shared/conf/acl.ldif @@ -0,0 +1,22 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# Copyright (C) 2006 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +dn: cn=aclResources,{rootSuffix} +objectClass: top +objectClass: CertACLS +cn: aclResources +resourceACLS: certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete +resourceACLS: certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify +resourceACLS: certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify +resourceACLS: certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter +#resourceACLS: certServer.log.configuration.signedAudit.expirationTime:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";deny (modify) user=anybody:Nobody is allowed to modify an expirationTime parameter +resourceACLS: certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log +resourceACLS: certServer.log.content.system:read:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents":Administrators, auditors, and agents are allowed to read the log content +resourceACLS: certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents":Administrators, auditors, and agents are allowed to read the log content +resourceACLS: certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify +resourceACLS: certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify) group="Administrators":this acl is shared by all admin servlets +resourceACLS: certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate +resourceACLS: certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody":Anybody may submit an enrollment request +resourceACLS: certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to clone the configuration. diff --git a/base/tps-tomcat/shared/conf/catalina.policy b/base/tps-tomcat/shared/conf/catalina.policy new file mode 100644 index 000000000..5ccc7959e --- /dev/null +++ b/base/tps-tomcat/shared/conf/catalina.policy @@ -0,0 +1,182 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// Copyright (C) 2006-2010 Red Hat, Inc. +// All rights reserved. +// Modifications: configuration parameters +// --- END COPYRIGHT BLOCK --- + +// Licensed to the Apache Software Foundation (ASF) under one or more +// contributor license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright ownership. +// The ASF licenses this file to You under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance with +// the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +// ============================================================================ +// catalina.corepolicy - Security Policy Permissions for Tomcat 6 +// +// This file contains a default set of security policies to be enforced (by the +// JVM) when Catalina is executed with the "-security" option. In addition +// to the permissions granted here, the following additional permissions are +// granted to the codebase specific to each web application: +// +// * Read access to the document root directory +// +// $Id$ +// ============================================================================ + + +// ========== SYSTEM CODE PERMISSIONS ========================================= + + +// These permissions apply to javac +grant codeBase "file:${java.home}/lib/-" { + permission java.security.AllPermission; +}; + +// These permissions apply to all shared system extensions +grant codeBase "file:${java.home}/jre/lib/ext/-" { + permission java.security.AllPermission; +}; + +// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre +grant codeBase "file:${java.home}/../lib/-" { + permission java.security.AllPermission; +}; + +// These permissions apply to all shared system extensions when +// ${java.home} points at $JAVA_HOME/jre +grant codeBase "file:${java.home}/lib/ext/-" { + permission java.security.AllPermission; +}; + + +// ========== CATALINA CODE PERMISSIONS ======================================= + + +// These permissions apply to the daemon code +grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" { + permission java.security.AllPermission; +}; + +// These permissions apply to the logging API +grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" { + permission java.util.PropertyPermission "java.util.logging.config.class", "read"; + permission java.util.PropertyPermission "java.util.logging.config.file", "read"; + permission java.io.FilePermission "${java.home}${file.separator}lib${file.separator}logging.properties", "read"; + permission java.lang.RuntimePermission "shutdownHooks"; + permission java.io.FilePermission "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read"; + permission java.util.PropertyPermission "catalina.base", "read"; + permission java.util.logging.LoggingPermission "control"; + permission java.io.FilePermission "${catalina.base}${file.separator}logs", "read, write"; + permission java.io.FilePermission "${catalina.base}${file.separator}logs${file.separator}*", "read, write"; + permission java.lang.RuntimePermission "getClassLoader"; + // To enable per context logging configuration, permit read access to the appropriate file. + // Be sure that the logging configuration is secure before enabling such access + // eg for the examples web application: + // permission java.io.FilePermission "${catalina.base}${file.separator}webapps${file.separator}examples${file.separator}WEB-INF${file.separator}classes${file.separator}logging.properties", "read"; +}; + +// These permissions apply to the server startup code +grant codeBase "file:${catalina.home}/bin/bootstrap.jar" { + permission java.security.AllPermission; +}; + +// These permissions apply to the servlet API classes +// and those that are shared across all class loaders +// located in the "lib" directory +grant codeBase "file:${catalina.home}/lib/-" { + permission java.security.AllPermission; +}; + + +// ========== WEB APPLICATION PERMISSIONS ===================================== + + +// These permissions are granted by default to all web applications +// In addition, a web application will be given a read FilePermission +// and JndiPermission for all files and directories in its document root. +grant { + // Required for JNDI lookup of named JDBC DataSource's and + // javamail named MimePart DataSource used to send mail + permission java.util.PropertyPermission "java.home", "read"; + permission java.util.PropertyPermission "java.naming.*", "read"; + permission java.util.PropertyPermission "javax.sql.*", "read"; + + // OS Specific properties to allow read access + permission java.util.PropertyPermission "os.name", "read"; + permission java.util.PropertyPermission "os.version", "read"; + permission java.util.PropertyPermission "os.arch", "read"; + permission java.util.PropertyPermission "file.separator", "read"; + permission java.util.PropertyPermission "path.separator", "read"; + permission java.util.PropertyPermission "line.separator", "read"; + + // JVM properties to allow read access + permission java.util.PropertyPermission "java.version", "read"; + permission java.util.PropertyPermission "java.vendor", "read"; + permission java.util.PropertyPermission "java.vendor.url", "read"; + permission java.util.PropertyPermission "java.class.version", "read"; + permission java.util.PropertyPermission "java.specification.version", "read"; + permission java.util.PropertyPermission "java.specification.vendor", "read"; + permission java.util.PropertyPermission "java.specification.name", "read"; + + permission java.util.PropertyPermission "java.vm.specification.version", "read"; + permission java.util.PropertyPermission "java.vm.specification.vendor", "read"; + permission java.util.PropertyPermission "java.vm.specification.name", "read"; + permission java.util.PropertyPermission "java.vm.version", "read"; + permission java.util.PropertyPermission "java.vm.vendor", "read"; + permission java.util.PropertyPermission "java.vm.name", "read"; + + // Required for OpenJMX + permission java.lang.RuntimePermission "getAttribute"; + + // Allow read of JAXP compliant XML parser debug + permission java.util.PropertyPermission "jaxp.debug", "read"; + + // Precompiled JSPs need access to this package. + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime"; + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*"; + + // Precompiled JSPs need access to this system property. + permission java.util.PropertyPermission "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read"; +}; + + +// You can assign additional permissions to particular web applications by +// adding additional "grant" entries here, based on the code base for that +// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files. +// +// Different permissions can be granted to JSP pages, classes loaded from +// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/ +// directory, or even to individual jar files in the /WEB-INF/lib/ directory. +// +// For instance, assume that the standard "examples" application +// included a JDBC driver that needed to establish a network connection to the +// corresponding database and used the scrape taglib to get the weather from +// the NOAA web server. You might create a "grant" entries like this: +// +// The permissions granted to the context root directory apply to JSP pages. +// grant codeBase "file:${catalina.home}/webapps/examples/-" { +// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; +// permission java.net.SocketPermission "*.noaa.gov:80", "connect"; +// }; +// +// The permissions granted to the context WEB-INF/classes directory +// grant codeBase "file:${catalina.home}/webapps/examples/WEB-INF/classes/-" { +// }; +// +// The permission granted to your JDBC driver +// grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/driver.jar!/-" { +// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; +// }; +// The permission granted to the scrape taglib +// grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/scrape.jar!/-" { +// permission java.net.SocketPermission "*.noaa.gov:80", "connect"; +// }; diff --git a/base/tps-tomcat/shared/conf/catalina.properties b/base/tps-tomcat/shared/conf/catalina.properties new file mode 100644 index 000000000..f6d1d1415 --- /dev/null +++ b/base/tps-tomcat/shared/conf/catalina.properties @@ -0,0 +1,87 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# Copyright (C) 2006-2010 Red Hat, Inc. +# All rights reserved. +# Modifications: configuration parameters +# --- END COPYRIGHT BLOCK --- + +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# +# List of comma-separated packages that start with or equal this string +# will cause a security exception to be thrown when +# passed to checkPackageAccess unless the +# corresponding RuntimePermission ("accessClassInPackage."+package) has +# been granted. +package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,org.apache.jasper.,sun.beans. +# +# List of comma-separated packages that start with or equal this string +# will cause a security exception to be thrown when +# passed to checkPackageDefinition unless the +# corresponding RuntimePermission ("defineClassInPackage."+package) has +# been granted. +# +# by default, no packages are restricted for definition, and none of +# the class loaders supplied with the JDK call checkPackageDefinition. +# +package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,org.apache.jasper. + +# +# +# List of comma-separated paths defining the contents of the "common" +# classloader. Prefixes should be used to define what is the repository type. +# Path may be relative to the CATALINA_HOME or CATALINA_BASE path or absolute. +# If left as blank,the JVM system loader will be used as Catalina's "common" +# loader. +# Examples: +# "foo": Add this folder as a class repository +# "foo/*.jar": Add all the JARs of the specified folder as class +# repositories +# "foo/bar.jar": Add bar.jar as a class repository +common.loader=${catalina.home}/lib,${catalina.home}/lib/*.jar,[TOMCAT_INSTANCE_COMMON_LIB] + +# +# List of comma-separated paths defining the contents of the "server" +# classloader. Prefixes should be used to define what is the repository type. +# Path may be relative to the CATALINA_HOME or CATALINA_BASE path or absolute. +# If left as blank, the "common" loader will be used as Catalina's "server" +# loader. +# Examples: +# "foo": Add this folder as a class repository +# "foo/*.jar": Add all the JARs of the specified folder as class +# repositories +# "foo/bar.jar": Add bar.jar as a class repository +server.loader= + +# +# List of comma-separated paths defining the contents of the "shared" +# classloader. Prefixes should be used to define what is the repository type. +# Path may be relative to the CATALINA_BASE path or absolute. If left as blank, +# the "common" loader will be used as Catalina's "shared" loader. +# Examples: +# "foo": Add this folder as a class repository +# "foo/*.jar": Add all the JARs of the specified folder as class +# repositories +# "foo/bar.jar": Add bar.jar as a class repository +# Please note that for single jars, e.g. bar.jar, you need the URL form +# starting with file:. +shared.loader= + +# +# String cache configuration. +tomcat.util.buf.StringCache.byte.enabled=true +#tomcat.util.buf.StringCache.char.enabled=true +#tomcat.util.buf.StringCache.trainThreshold=500000 +#tomcat.util.buf.StringCache.cacheSize=5000 diff --git a/base/tps-tomcat/shared/conf/context.xml b/base/tps-tomcat/shared/conf/context.xml new file mode 100644 index 000000000..ba139add2 --- /dev/null +++ b/base/tps-tomcat/shared/conf/context.xml @@ -0,0 +1,40 @@ + + + + + + + + WEB-INF/web.xml + + + + + + + + diff --git a/base/tps-tomcat/shared/conf/database.ldif b/base/tps-tomcat/shared/conf/database.ldif new file mode 100644 index 000000000..d3c5f9e68 --- /dev/null +++ b/base/tps-tomcat/shared/conf/database.ldif @@ -0,0 +1,9 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# Copyright (C) 2006 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +dn: cn=config +changetype: modify +replace: nsslapd-maxbersize +nsslapd-maxbersize: 209715200 diff --git a/base/tps-tomcat/shared/conf/db.ldif b/base/tps-tomcat/shared/conf/db.ldif new file mode 100644 index 000000000..1dada984a --- /dev/null +++ b/base/tps-tomcat/shared/conf/db.ldif @@ -0,0 +1,54 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# Copyright (C) 2006 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +dn: ou=Tokens,{rootSuffix} +objectclass: top +objectclass: organizationalunit +ou: Tokens + +dn: ou=Activities,{rootSuffix} +objectclass: top +objectclass: organizationalunit +ou: Activities + +dn: ou=Certificates,{rootSuffix} +objectclass: top +objectclass: organizationalunit +ou: Certificates + +dn: ou=People,{rootSuffix} +objectclass: top +objectclass: organizationalunit +ou: People +aci: (targetattr!="userPassword")(version 3.0; acl "Enable anonymous access"; allow (read, search, compare)userdn="ldap:///anyone";) + +dn: ou=Groups,{rootSuffix} +objectclass: top +objectclass: organizationalunit +ou: Groups + +dn: cn=TUS Agents,ou=Groups,{rootSuffix} +objectClass: top +objectClass: groupOfUniqueNames +cn: TUS Agents +description: Agents for TUS + +dn: cn=TUS Officers,ou=Groups,{rootSuffix} +objectClass: top +objectClass: groupOfUniqueNames +cn: TUS Officers +description: Security Officers for TUS + +dn: cn=TUS Administrators,ou=Groups,{rootSuffix} +objectClass: top +objectClass: groupOfUniqueNames +cn: TUS Administrators +description: Administrators for TUS + +dn: cn=TUS Operators,ou=Groups,{rootSuffix} +objectClass: top +objectClass: groupOfUniqueNames +cn: TUS Operators +description: Operators for TUS diff --git a/base/tps-tomcat/shared/conf/etc/init.d/pki-tpsd b/base/tps-tomcat/shared/conf/etc/init.d/pki-tpsd new file mode 100755 index 000000000..7b991f39c --- /dev/null +++ b/base/tps-tomcat/shared/conf/etc/init.d/pki-tpsd @@ -0,0 +1,86 @@ +#!/bin/bash +# +# --- BEGIN COPYRIGHT BLOCK --- +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# +# Copyright (C) 2007-2010 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +# pki-tpsd Startup script for pki-tps with tomcat7 +# +# chkconfig: - 84 16 +# description: Token Processing Service (Tomcat 7.0) +# processname: pki-tpsd +# piddir: /var/run/pki/tps +# + +PROG_NAME=`basename $0` +SERVICE_NAME="pki-tpsd" +SERVICE_PROG="/sbin/service" +PKI_PATH="/usr/share/pki/tps" +PKI_REGISTRY="/etc/sysconfig/pki/tps" +PKI_TYPE="pki-tps" +PKI_TOTAL_PORTS=6 + +# Avoid using 'systemctl' for now +SYSTEMCTL_SKIP_REDIRECT=1 +export SYSTEMCTL_SKIP_REDIRECT + +# Disallow 'others' the ability to 'write' to new files +umask 00002 + +command="$1" +pki_instance="$2" + +# Source function library. +. /etc/init.d/functions + +# Source the PKI function library +. /usr/share/pki/scripts/functions + +# See how we were called. +case $command in + status) + registry_status + exit $? + ;; + start) + start + exit $? + ;; + restart) + restart + exit $? + ;; + stop) + stop + exit $? + ;; + condrestart|force-restart|try-restart) + [ ! -f ${lockfile} ] || restart + exit $? + ;; + reload) + echo "The 'reload' action is an unimplemented feature." + exit ${default_error} + ;; + *) + echo "unknown action ($command)" + usage + echo "where valid instance names include:" + list_instances + exit ${default_error} + ;; +esac diff --git a/base/tps-tomcat/shared/conf/index.ldif b/base/tps-tomcat/shared/conf/index.ldif new file mode 100644 index 000000000..d896de394 --- /dev/null +++ b/base/tps-tomcat/shared/conf/index.ldif @@ -0,0 +1,76 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; +# version 2.1 of the License. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301 USA +# +# Copyright (C) 2007 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +dn: cn=tokenUserID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config +objectclass: top +objectclass: nsIndex +cn: tokenUserID +nsindextype: eq +nsindextype: pres +nsindextype: sub +nssystemindex: false + +dn: cn=tokenID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config +objectclass: top +objectclass: nsIndex +cn: tokenID +nsindextype: eq +nsindextype: pres +nsindextype: sub +nssystemindex: false + +dn: cn=dateOfCreate,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config +objectclass: top +objectclass: nsIndex +cn: dateOfCreate +nsindextype: eq +nsindextype: pres +nsindextype: sub +nssystemindex: false + +dn: cn=dateOfModify,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config +objectclass: top +objectclass: nsIndex +cn: dateOfModify +nsindextype: eq +nsindextype: pres +nsindextype: sub +nssystemindex: false + +dn: cn=userCertificate,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config +objectclass: top +objectclass: nsIndex +cn: userCertificate +nsindextype: eq +nssystemindex: false + +dn: cn=tokenSerial,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config +objectclass: top +objectclass: nsIndex +cn: tokenSerial +nsindextype: eq +nssystemindex: false + +dn: cn=tokenKeyType,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config +objectclass: top +objectclass: nsIndex +cn: tokenKeyType +nsindextype: eq +nssystemindex: false diff --git a/base/tps-tomcat/shared/conf/jk2.manifest b/base/tps-tomcat/shared/conf/jk2.manifest new file mode 100644 index 000000000..986d7b874 --- /dev/null +++ b/base/tps-tomcat/shared/conf/jk2.manifest @@ -0,0 +1,2 @@ +Main-Class: org.apache.jk.apr.TomcatStarter +Class-Path: ../lib/tomcat.jar log4j.jar log4j-core.jar ../lib/common/log4j.jar ../lib/common/log4j-core.jar ../lib/common/classes ../lib/common/commons-logging.jar bootstrap.jar ../server/lib/commons-logging.jar ../server/lib/jmx.jar jmx.jar commons-logging-api.jar diff --git a/base/tps-tomcat/shared/conf/jk2.properties b/base/tps-tomcat/shared/conf/jk2.properties new file mode 100644 index 000000000..934d6ed54 --- /dev/null +++ b/base/tps-tomcat/shared/conf/jk2.properties @@ -0,0 +1,31 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# Copyright (C) 2006 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +## THIS FILE MAY BE OVERRIDEN AT RUNTIME. MAKE SURE TOMCAT IS STOPED +## WHEN YOU EDIT THE FILE. + +## COMMENTS WILL BE _LOST_ + +## DOCUMENTATION OF THE FORMAT IN JkMain javadoc. + +# Set the desired handler list +# handler.list=apr,request,channelJni +# +# Override the default port for the socketChannel +# channelSocket.port=8019 +# Default: +# channelUnix.file=${jkHome}/work/jk2.socket +# Just to check if the the config is working +# shm.file=${jkHome}/work/jk2.shm + +# In order to enable jni use any channelJni directive +# channelJni.disabled = 0 +# And one of the following directives: + +# apr.jniModeSo=/opt/apache2/modules/mod_jk2.so + +# If set to inprocess the mod_jk2 will Register natives itself +# This will enable the starting of the Tomcat from mod_jk2 +# apr.jniModeSo=inprocess diff --git a/base/tps-tomcat/shared/conf/jkconf.ant.xml b/base/tps-tomcat/shared/conf/jkconf.ant.xml new file mode 100644 index 000000000..48396f1b7 --- /dev/null +++ b/base/tps-tomcat/shared/conf/jkconf.ant.xml @@ -0,0 +1,55 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/base/tps-tomcat/shared/conf/jkconfig.manifest b/base/tps-tomcat/shared/conf/jkconfig.manifest new file mode 100644 index 000000000..3ba1f2e3e --- /dev/null +++ b/base/tps-tomcat/shared/conf/jkconfig.manifest @@ -0,0 +1,2 @@ +Main-Class: org.apache.jk.config.WebXml2Jk +Class-Path: tomcat-jk2.jar commons-logging.jar crimson.jar xercesImpl.jar xmlApis.jar tomcat-util.jar log4j.jar log4j-core.jar diff --git a/base/tps-tomcat/shared/conf/logging.properties b/base/tps-tomcat/shared/conf/logging.properties new file mode 100644 index 000000000..796cfc071 --- /dev/null +++ b/base/tps-tomcat/shared/conf/logging.properties @@ -0,0 +1,70 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# Copyright (C) 2006-2010 Red Hat, Inc. +# All rights reserved. +# Modifications: configuration parameters +# --- END COPYRIGHT BLOCK --- + +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler + +.handlers = 1catalina.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler + +############################################################ +# Handler specific properties. +# Describes specific configuration info for Handlers. +############################################################ + +1catalina.org.apache.juli.FileHandler.level = FINE +1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs +1catalina.org.apache.juli.FileHandler.prefix = catalina. + +2localhost.org.apache.juli.FileHandler.level = FINE +2localhost.org.apache.juli.FileHandler.directory = ${catalina.base}/logs +2localhost.org.apache.juli.FileHandler.prefix = localhost. + +3manager.org.apache.juli.FileHandler.level = FINE +3manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs +3manager.org.apache.juli.FileHandler.prefix = manager. + +4host-manager.org.apache.juli.FileHandler.level = FINE +4host-manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs +4host-manager.org.apache.juli.FileHandler.prefix = host-manager. + +java.util.logging.ConsoleHandler.level = FINE +java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter + + +############################################################ +# Facility specific properties. +# Provides extra control for each logger. +############################################################ + +org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = INFO +org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = 2localhost.org.apache.juli.FileHandler + +org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = INFO +org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = 3manager.org.apache.juli.FileHandler + +org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].level = INFO +org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = 4host-manager.org.apache.juli.FileHandler + +# For example, set the com.xyz.foo logger to only log SEVERE +# messages: +#org.apache.catalina.startup.ContextConfig.level = FINE +#org.apache.catalina.startup.HostConfig.level = FINE +#org.apache.catalina.session.ManagerBase.level = FINE +#org.apache.catalina.core.AprLifecycleListener.level=FINE diff --git a/base/tps-tomcat/shared/conf/manager.ldif b/base/tps-tomcat/shared/conf/manager.ldif new file mode 100644 index 000000000..18700dd4b --- /dev/null +++ b/base/tps-tomcat/shared/conf/manager.ldif @@ -0,0 +1,46 @@ +# acis for cert manager + +dn: ou=csusers,cn=config +objectClass: top +objectClass: organizationalUnit +ou: csusers + +dn: {rootSuffix} +changetype: modify +add: aci +aci: (targetattr=*)(version 3.0; acl "cert manager access v2"; allow (all) userdn = "ldap:///{dbuser}";) + +dn: cn=ldbm database,cn=plugins,cn=config +changetype: modify +add: aci +aci: (targetattr=*)(version 3.0; acl "Cert Manager access for VLV searches"; allow (read) userdn="ldap:///{dbuser}";) + +dn: cn=config +changetype: modify +add: aci +aci: (targetattr != aci)(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///{dbuser}";) + +dn: ou=csusers,cn=config +changetype: modify +add: aci +aci: (targetattr != aci)(version 3.0; aci "cert manager manage replication users"; allow (all) userdn = "ldap:///{dbuser}";) + +dn: cn="{rootSuffix}",cn=mapping tree,cn=config +changetype: modify +add: aci +aci: (targetattr=*)(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///{dbuser}";) + +dn: cn="{rootSuffix}",cn=mapping tree,cn=config +changetype: modify +add: aci +aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///{dbuser}";) + +dn: cn="{rootSuffix}",cn=mapping tree,cn=config +changetype: modify +add: aci +aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///{dbuser}";) + +dn: cn=tasks,cn=config +changetype: modify +add: aci +aci: (targetattr=*)(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///{dbuser}";) diff --git a/base/tps-tomcat/shared/conf/schema.ldif b/base/tps-tomcat/shared/conf/schema.ldif new file mode 100644 index 000000000..bde045630 --- /dev/null +++ b/base/tps-tomcat/shared/conf/schema.ldif @@ -0,0 +1,58 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; +# version 2.1 of the License. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301 USA +# +# Copyright (C) 2007 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +dn: cn=schema +changetype: modify +add: attributeTypes +attributeTypes: ( dateOfCreate-oid NAME 'dateOfCreate' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( dateOfModify-oid NAME 'dateOfModify' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( modified-oid NAME 'modified' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenUserID-oid NAME 'tokenUserID' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenStatus-oid NAME 'tokenStatus' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenAppletID-oid NAME 'tokenAppletID' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( keyInfo-oid NAME 'keyInfo' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( numberOfResets-oid NAME 'numberOfResets' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) +attributeTypes: ( numberOfEnrollments-oid NAME 'numberOfEnrollments' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) +attributeTypes: ( numberOfRenewals-oid NAME 'numberOfRenewals' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) +attributeTypes: ( numberOfRecoveries-oid NAME 'numberOfRecoveries' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) +attributeTypes: ( allowPinReset-oid NAME 'allowPinReset' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( extensions-oid NAME 'extensions' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenOp-oid NAME 'tokenOp' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenID-oid NAME 'tokenID' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenMsg-oid NAME 'tokenMsg' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenResult-oid NAME 'tokenResult' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenIP-oid NAME 'tokenIP' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenPolicy-oid NAME 'tokenPolicy' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenIssuer-oid NAME 'tokenIssuer' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenSubject-oid NAME 'tokenSubject' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenSerial-oid NAME 'tokenSerial' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenOrigin-oid NAME 'tokenOrigin' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenType-oid NAME 'tokenType' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenKeyType-oid NAME 'tokenKeyType' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenReason-oid NAME 'tokenReason' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenNotBefore-oid NAME 'tokenNotBefore' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( tokenNotAfter-oid NAME 'tokenNotAfter' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +attributeTypes: ( profileID-oid NAME 'profileID' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) +- +add: objectClasses +objectClasses: ( tokenRecord-oid NAME 'tokenRecord' DESC 'CMS defined class' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ modified $ tokenReason $ tokenUserID $ tokenStatus $ tokenAppletID $ keyInfo $ tokenPolicy $ extensions $ numberOfResets $ numberOfEnrollments $ numberOfRenewals $ numberOfRecoveries $ userCertificate $ tokenType ) X-ORIGIN 'user defined' ) +objectClasses: ( tokenActivity-oid NAME 'tokenActivity' DESC 'CMS defined class' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ tokenOp $ tokenIP $ tokenResult $ tokenID $ tokenUserID $ tokenMsg $ extensions $ tokenType ) X-ORIGIN 'user defined' ) +objectClasses: ( tokenCert-oid NAME 'tokenCert' DESC 'CMS defined class' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ userCertificate $ tokenUserID $ tokenID $ tokenIssuer $ tokenOrigin $ tokenSubject $ tokenSerial $ tokenStatus $ tokenType $ tokenKeyType $ tokenNotBefore $ tokenNotAfter $ extensions ) X-ORIGIN 'user defined' ) +objectClasses: ( tpsProfileID-oid NAME 'tpsProfileID' DESC 'CMS defined class' SUP top AUXILIARY MAY ( profileID ) X-ORIGIN 'user-defined' ) diff --git a/base/tps-tomcat/shared/conf/server-minimal.xml b/base/tps-tomcat/shared/conf/server-minimal.xml new file mode 100644 index 000000000..fc855c6e3 --- /dev/null +++ b/base/tps-tomcat/shared/conf/server-minimal.xml @@ -0,0 +1,29 @@ + + + + + + + + + + + + + + + + + + + + + diff --git a/base/tps-tomcat/shared/conf/server.xml b/base/tps-tomcat/shared/conf/server.xml new file mode 100644 index 000000000..b66cb51ae --- /dev/null +++ b/base/tps-tomcat/shared/conf/server.xml @@ -0,0 +1,258 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + [PKI_UNSECURE_PORT_SERVER_COMMENT] + + + + [PKI_SECURE_PORT_SERVER_COMMENT] + + + + + [PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_ADMIN_SECURE_PORT_SERVER_COMMENT] + + [PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT] + + [PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_EE_SECURE_PORT_SERVER_COMMENT] + + [PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT] + + + + + + + +[PKI_OPEN_AJP_PORT_COMMENT] + +[PKI_CLOSE_AJP_PORT_COMMENT] + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/base/tps-tomcat/shared/conf/shm.manifest b/base/tps-tomcat/shared/conf/shm.manifest new file mode 100644 index 000000000..0505c085b --- /dev/null +++ b/base/tps-tomcat/shared/conf/shm.manifest @@ -0,0 +1,2 @@ +Main-Class: org.apache.jk.common.Shm +Class-Path: tomcat-jk2.jar commons-logging.jar tomcat-util.jar log4j.jar log4j-core.jar diff --git a/base/tps-tomcat/shared/conf/tomcat-jk2.manifest b/base/tps-tomcat/shared/conf/tomcat-jk2.manifest new file mode 100644 index 000000000..acfef4a90 --- /dev/null +++ b/base/tps-tomcat/shared/conf/tomcat-jk2.manifest @@ -0,0 +1,7 @@ +Manifest-version: 1.0 +Extension-Name: org.apache.jk +Specification-Vendor: Apache Software Foundation +Specification-Version: 2.0 +Implementation-Vendor-Id: org.apache +Implementation-Vendor: Apache Software Foundation +Implementation-Version: 2.1 diff --git a/base/tps-tomcat/shared/conf/tomcat-users.xml b/base/tps-tomcat/shared/conf/tomcat-users.xml new file mode 100644 index 000000000..daa9260cc --- /dev/null +++ b/base/tps-tomcat/shared/conf/tomcat-users.xml @@ -0,0 +1,45 @@ + + + + + + + + + + + + + + + + + + + + diff --git a/base/tps-tomcat/shared/conf/tomcat6.conf b/base/tps-tomcat/shared/conf/tomcat6.conf new file mode 100644 index 000000000..2d7def5ec --- /dev/null +++ b/base/tps-tomcat/shared/conf/tomcat6.conf @@ -0,0 +1,58 @@ +# Service-specific configuration file for tomcat6. This will be sourced by +# the SysV init script after the global configuration file +# /etc/tomcat6/tomcat6.conf, thus allowing values to be overridden in +# a per-service manner. +# +# NEVER change the init script itself. To change values for all services make +# your changes in /etc/tomcat6/tomcat6.conf +# +# To change values for a specific service make your edits here. +# To create a new service create a link from /etc/init.d/ to +# /etc/init.d/tomcat6 (do not copy the init script) and make a copy of the +# /etc/sysconfig/tomcat6 file to /etc/sysconfig/ and change +# the property values so the two services won't conflict. Register the new +# service in the system as usual (see chkconfig and similars). +# + +# Where your java installation lives +#JAVA_HOME="/usr/lib/jvm/java" + +# Where your tomcat installation lives +CATALINA_BASE="[PKI_INSTANCE_PATH]" +#CATALINA_HOME="/usr/share/tomcat6" +#JASPER_HOME="/usr/share/tomcat6" +#CATALINA_TMPDIR="/var/cache/tomcat6/temp" + +# You can pass some parameters to java here if you wish to +#JAVA_OPTS="-Xminf0.1 -Xmaxf0.3" + +# Use JAVA_OPTS to set java.library.path for libtcnative.so +#JAVA_OPTS="-Djava.library.path=/usr/lib64" + +# What user should run tomcat +TOMCAT_USER="[PKI_USER]" + +# You can change your tomcat locale here +#LANG="en_US" + +# Run tomcat under the Java Security Manager +#SECURITY_MANAGER="false" + +# Time to wait in seconds, before killing process +#SHUTDOWN_WAIT="30" + +# Whether to annoy the user with "attempting to shut down" messages or not +#SHUTDOWN_VERBOSE="false" + +# Set the TOMCAT_PID location +CATALINA_PID="[TOMCAT_PIDFILE]" + +# Set the tomcat log file +TOMCAT_LOG="[TOMCAT_LOG_DIR]/tomcat-initd.log" + +# Connector port is 8080 for this tomcat6 instance +#CONNECTOR_PORT="8080" + +# If you wish to further customize your tomcat environment, +# put your own definitions here +# (i.e. LD_LIBRARY_PATH for some jdbc drivers) diff --git a/base/tps-tomcat/shared/conf/uriworkermap.properties b/base/tps-tomcat/shared/conf/uriworkermap.properties new file mode 100644 index 000000000..c89dd82a6 --- /dev/null +++ b/base/tps-tomcat/shared/conf/uriworkermap.properties @@ -0,0 +1,18 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# Copyright (C) 2006 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +# uriworkermap.properties - IIS +# +# This file provides sample mappings for example ajp13w +# worker defined in workermap.properties.minimal +# The general sytax for this file is: +# [URL]=[Worker name] + +/servlet-examples/*=ajp13w + +# Optionally filter out all .jpeg files inside that context +# For no mapping the url has to start with exclamation (!) + +!/servlet-examples/*.jpeg=ajp13w diff --git a/base/tps-tomcat/shared/conf/vlv.ldif b/base/tps-tomcat/shared/conf/vlv.ldif new file mode 100644 index 000000000..db7988e36 --- /dev/null +++ b/base/tps-tomcat/shared/conf/vlv.ldif @@ -0,0 +1,51 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; +# version 2.1 of the License. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301 USA +# +# Copyright (C) 2007 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +dn: cn=tus-listTokens-vlv,cn=userRoot,cn=ldbm database,cn=plugins,cn=config +cn: tus-listtokens-vlv +objectClass: top +objectClass: vlvsearch +vlvBase: ou=Tokens,{rootSuffix} +vlvFilter: (&(cn=*)(tokenUserID=*)) +vlvScope: 2 + +dn: cn=tus-listActivities-vlv,cn=userRoot,cn=ldbm database,cn=plugins,cn=config +cn: tus-listActivities-vlv +objectClass: top +objectClass: vlvsearch +vlvBase: ou=Activities,{rootSuffix} +vlvFilter: (&(tokenID=*)(tokenUserID=*)) +vlvScope: 2 + +dn: cn=listTokensIndex,cn=tus-listTokens-vlv,cn=userRoot,cn=ldbm database,cn=plugins,cn=config +cn: listTokensIndex +objectClass: top +objectClass: vlvindex +vlvSort: -dateOfModify +vlvEnabled: 1 +vlvUses: 0 + +dn: cn=listActivitiesIndex,cn=tus-listActivities-vlv,cn=userRoot,cn=ldbm database,cn=plugins,cn=config +cn: listActivitiesIndex +objectClass: top +objectClass: vlvindex +vlvSort: -dateOfCreate +vlvEnabled: 1 +vlvUses: 0 diff --git a/base/tps-tomcat/shared/conf/vlvtasks.ldif b/base/tps-tomcat/shared/conf/vlvtasks.ldif new file mode 100644 index 000000000..b6b4bb762 --- /dev/null +++ b/base/tps-tomcat/shared/conf/vlvtasks.ldif @@ -0,0 +1,28 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; +# version 2.1 of the License. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301 USA +# +# Copyright (C) 2007 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +dn: cn=index1160528734, cn=index, cn=tasks, cn=config +objectclass: top +objectclass: extensibleObject +cn: index1160528734 +ttl: 4 +nsInstance: userRoot +nsIndexVLVAttribute: listTokensIndex +nsIndexVLVAttribute: listActivitiesIndex diff --git a/base/tps-tomcat/shared/conf/web.xml b/base/tps-tomcat/shared/conf/web.xml new file mode 100644 index 000000000..8330ecca8 --- /dev/null +++ b/base/tps-tomcat/shared/conf/web.xml @@ -0,0 +1,993 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + default + org.apache.catalina.servlets.DefaultServlet + + debug + 0 + + + listings + false + + 1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + jsp + org.apache.jasper.servlet.JspServlet + + fork + false + + + xpoweredBy + false + + 3 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + default + / + + + + + + + + jsp + *.jsp + + + + jsp + *.jspx + + + + + + + + + + + + + + + + 30 + + + + + + + + + + + + abs + audio/x-mpeg + + + ai + application/postscript + + + aif + audio/x-aiff + + + aifc + audio/x-aiff + + + aiff + audio/x-aiff + + + aim + application/x-aim + + + art + image/x-jg + + + asf + video/x-ms-asf + + + asx + video/x-ms-asf + + + au + audio/basic + + + avi + video/x-msvideo + + + avx + video/x-rad-screenplay + + + bcpio + application/x-bcpio + + + bin + application/octet-stream + + + bmp + image/bmp + + + body + text/html + + + cdf + application/x-cdf + + + cer + application/x-x509-ca-cert + + + class + application/java + + + cpio + application/x-cpio + + + csh + application/x-csh + + + css + text/css + + + dib + image/bmp + + + doc + application/msword + + + dtd + application/xml-dtd + + + dv + video/x-dv + + + dvi + application/x-dvi + + + eps + application/postscript + + + etx + text/x-setext + + + exe + application/octet-stream + + + gif + image/gif + + + gtar + application/x-gtar + + + gz + application/x-gzip + + + hdf + application/x-hdf + + + hqx + application/mac-binhex40 + + + htc + text/x-component + + + htm + text/html + + + html + text/html + + + hqx + application/mac-binhex40 + + + ief + image/ief + + + jad + text/vnd.sun.j2me.app-descriptor + + + jar + application/java-archive + + + java + text/plain + + + jnlp + application/x-java-jnlp-file + + + jpe + image/jpeg + + + jpeg + image/jpeg + + + jpg + image/jpeg + + + js + text/javascript + + + jsf + text/plain + + + jspf + text/plain + + + kar + audio/x-midi + + + latex + application/x-latex + + + m3u + audio/x-mpegurl + + + mac + image/x-macpaint + + + man + application/x-troff-man + + + mathml + application/mathml+xml + + + me + application/x-troff-me + + + mid + audio/x-midi + + + midi + audio/x-midi + + + mif + application/x-mif + + + mov + video/quicktime + + + movie + video/x-sgi-movie + + + mp1 + audio/x-mpeg + + + mp2 + audio/x-mpeg + + + mp3 + audio/x-mpeg + + + mpa + audio/x-mpeg + + + mpe + video/mpeg + + + mpeg + video/mpeg + + + mpega + audio/x-mpeg + + + mpg + video/mpeg + + + mpv2 + video/mpeg2 + + + ms + application/x-wais-source + + + nc + application/x-netcdf + + + oda + application/oda + + + ogg + application/ogg + + + pbm + image/x-portable-bitmap + + + pct + image/pict + + + pdf + application/pdf + + + pgm + image/x-portable-graymap + + + pic + image/pict + + + pict + image/pict + + + pls + audio/x-scpls + + + png + image/png + + + pnm + image/x-portable-anymap + + + pnt + image/x-macpaint + + + ppm + image/x-portable-pixmap + + + ppt + application/powerpoint + + + ps + application/postscript + + + psd + image/x-photoshop + + + qt + video/quicktime + + + qti + image/x-quicktime + + + qtif + image/x-quicktime + + + ras + image/x-cmu-raster + + + rdf + application/rdf+xml + + + rgb + image/x-rgb + + + rm + application/vnd.rn-realmedia + + + roff + application/x-troff + + + rtf + application/rtf + + + rtx + text/richtext + + + sh + application/x-sh + + + shar + application/x-shar + + + smf + audio/x-midi + + + sit + application/x-stuffit + + + snd + audio/basic + + + src + application/x-wais-source + + + sv4cpio + application/x-sv4cpio + + + sv4crc + application/x-sv4crc + + + svg + image/svg+xml + + + swf + application/x-shockwave-flash + + + t + application/x-troff + + + tar + application/x-tar + + + tcl + application/x-tcl + + + tex + application/x-tex + + + texi + application/x-texinfo + + + texinfo + application/x-texinfo + + + tif + image/tiff + + + tiff + image/tiff + + + tr + application/x-troff + + + tsv + text/tab-separated-values + + + txt + text/plain + + + ulw + audio/basic + + + ustar + application/x-ustar + + + vxml + application/voicexml+xml + + + xbm + image/x-xbitmap + + + xht + application/xhtml+xml + + + xhtml + application/xhtml+xml + + + xml + application/xml + + + xpm + image/x-xpixmap + + + xsl + application/xml + + + xslt + application/xslt+xml + + + xul + application/vnd.mozilla.xul+xml + + + xwd + image/x-xwindowdump + + + wav + audio/x-wav + + + svg + image/svg + + + svgz + image/svg + + + vsd + application/x-visio + + + + wbmp + image/vnd.wap.wbmp + + + + wml + text/vnd.wap.wml + + + + wmlc + application/vnd.wap.wmlc + + + + wmls + text/vnd.wap.wmlscript + + + + wmlscriptc + application/vnd.wap.wmlscriptc + + + wrl + x-world/x-vrml + + + Z + application/x-compress + + + z + application/x-compress + + + zip + application/zip + + + + + + + + + + + + + + + + + index.html + index.htm + index.jsp + + + + 404 + /404.html + + + + 500 + /500.html + + + diff --git a/base/tps-tomcat/shared/conf/workers.properties b/base/tps-tomcat/shared/conf/workers.properties new file mode 100644 index 000000000..ae26a983c --- /dev/null +++ b/base/tps-tomcat/shared/conf/workers.properties @@ -0,0 +1,209 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# Copyright (C) 2006 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +# workers.properties - +# +# This file provides jk derived plugins with the needed information to +# connect to the different tomcat workers. Note that the distributed +# version of this file requires modification before it is usable by a +# plugin. +# +# As a general note, the characters $( and ) are used internally to define +# macros. Do not use them in your own configuration!!! +# +# Whenever you see a set of lines such as: +# x=value +# y=$(x)\something +# +# the final value for y will be value\something +# +# Normaly all you will need to do is un-comment and modify the first three +# properties, i.e. workers.tomcat_home, workers.java_home and ps. +# Most of the configuration is derived from these. +# +# When you are done updating workers.tomcat_home, workers.java_home and ps +# you should have 3 workers configured: +# +# - An ajp12 worker that connects to localhost:8007 +# - An ajp13 worker that connects to localhost:8009 +# - A jni inprocess worker. +# - A load balancer worker +# +# However by default the plugins will only use the ajp12 worker. To have +# the plugins use other workers you should modify the worker.list property. +# +# + +# OPTIONS ( very important for jni mode ) + +# +# workers.tomcat_home should point to the location where you +# installed tomcat. This is where you have your conf, webapps and lib +# directories. +# +workers.tomcat_home=/var/tomcat3 + +# +# workers.java_home should point to your Java installation. Normally +# you should have a bin and lib directories beneath it. +# +workers.java_home=/opt/IBMJava2-13 + +# +# You should configure your environment slash... ps=\ on NT and / on UNIX +# and maybe something different elsewhere. +# +ps=/ + +# +#------ ADVANCED MODE ------------------------------------------------ +#--------------------------------------------------------------------- +# + +# +#------ DEFAULT worket list ------------------------------------------ +#--------------------------------------------------------------------- +# +# +# The workers that your plugins should create and work with +# +# Add 'inprocess' if you want JNI connector +worker.list=ajp12, ajp13 +# , inprocess + + +# +#------ DEFAULT ajp12 WORKER DEFINITION ------------------------------ +#--------------------------------------------------------------------- +# + +# +# Defining a worker named ajp12 and of type ajp12 +# Note that the name and the type do not have to match. +# +worker.ajp12.port=8007 +worker.ajp12.host=localhost +worker.ajp12.type=ajp12 +# +# Specifies the load balance factor when used with +# a load balancing worker. +# Note: +# ----> lbfactor must be > 0 +# ----> Low lbfactor means less work done by the worker. +worker.ajp12.lbfactor=1 + +# +#------ DEFAULT ajp13 WORKER DEFINITION ------------------------------ +#--------------------------------------------------------------------- +# + +# +# Defining a worker named ajp13 and of type ajp13 +# Note that the name and the type do not have to match. +# +worker.ajp13.port=8009 +worker.ajp13.host=localhost +worker.ajp13.type=ajp13 +# +# Specifies the load balance factor when used with +# a load balancing worker. +# Note: +# ----> lbfactor must be > 0 +# ----> Low lbfactor means less work done by the worker. +worker.ajp13.lbfactor=1 + +# +# Specify the size of the open connection cache. +#worker.ajp13.cachesize + +# +#------ DEFAULT LOAD BALANCER WORKER DEFINITION ---------------------- +#--------------------------------------------------------------------- +# + +# +# The loadbalancer (type lb) workers perform wighted round-robin +# load balancing with sticky sessions. +# Note: +# ----> If a worker dies, the load balancer will check its state +# once in a while. Until then all work is redirected to peer +# workers. +worker.loadbalancer.type=lb +worker.loadbalancer.balanced_workers=ajp12, ajp13 + + +# +#------ DEFAULT JNI WORKER DEFINITION--------------------------------- +#--------------------------------------------------------------------- +# + +# +# Defining a worker named inprocess and of type jni +# Note that the name and the type do not have to match. +# +worker.inprocess.type=jni + +# +#------ CLASSPATH DEFINITION ----------------------------------------- +#--------------------------------------------------------------------- +# + +# +# Additional class path components. +# +worker.inprocess.class_path=$(workers.tomcat_home)$(ps)lib$(ps)tomcat.jar + +# +# Setting the command line for tomcat. +# Note: The cmd_line string may not contain spaces. +# +worker.inprocess.cmd_line=start + +# Not needed, but can be customized. +#worker.inprocess.cmd_line=-config +#worker.inprocess.cmd_line=$(workers.tomcat_home)$(ps)conf$(ps)server.xml +#worker.inprocess.cmd_line=-home +#worker.inprocess.cmd_line=$(workers.tomcat_home) + +# +# The JVM that we are about to use +# +# This is for Java2 +# +# Windows +worker.inprocess.jvm_lib=$(workers.java_home)$(ps)jre$(ps)bin$(ps)classic$(ps)jvm.dll +# IBM JDK1.3 +#worker.inprocess.jvm_lib=$(workers.java_home)$(ps)jre$(ps)bin$(ps)classic$(ps)libjvm.so +# Unix - Sun VM or blackdown +#worker.inprocess.jvm_lib=$(workers.java_home)$(ps)jre$(ps)lib$(ps)i386$(ps)classic$(ps)libjvm.so + +# +# And this is for jdk1.1.X +# +#worker.inprocess.jvm_lib=$(workers.java_home)$(ps)bin$(ps)javai.dll + + +# +# Setting the place for the stdout and stderr of tomcat +# +worker.inprocess.stdout=$(workers.tomcat_home)$(ps)logs$(ps)inprocess.stdout +worker.inprocess.stderr=$(workers.tomcat_home)$(ps)logs$(ps)inprocess.stderr + +# +# Setting the tomcat.home Java property +# +#worker.inprocess.sysprops=tomcat.home=$(workers.tomcat_home) + +# +# Java system properties +# +# worker.inprocess.sysprops=java.compiler=NONE +# worker.inprocess.sysprops=myprop=mypropvalue + +# +# Additional path components. +# +# worker.inprocess.ld_path=d:$(ps)SQLLIB$(ps)bin +# diff --git a/base/tps-tomcat/shared/conf/workers.properties.minimal b/base/tps-tomcat/shared/conf/workers.properties.minimal new file mode 100644 index 000000000..51980ac49 --- /dev/null +++ b/base/tps-tomcat/shared/conf/workers.properties.minimal @@ -0,0 +1,22 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# Copyright (C) 2006 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +# workers.properties.minimal - +# +# This file provides minimal jk configuration properties needed to +# connect to Tomcat. +# +# The workers that jk should create and work with +# +worker.list=ajp13w + + +# +# Defining a worker named ajp13w and of type ajp13 +# Note that the name and the type do not have to match. +# +worker.ajp13w.type=ajp13 +worker.ajp13w.host=localhost +worker.ajp13w.port=8009 diff --git a/base/tps-tomcat/shared/conf/workers2.properties b/base/tps-tomcat/shared/conf/workers2.properties new file mode 100644 index 000000000..3c8e0f4a5 --- /dev/null +++ b/base/tps-tomcat/shared/conf/workers2.properties @@ -0,0 +1,136 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# Copyright (C) 2006 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +[logger] +level=DEBUG + +[config:] +file=${serverRoot}/conf/workers2.properties +debug=0 +debugEnv=0 + +[uriMap:] +info=Maps the requests. Options: debug +debug=0 + +# Alternate file logger +#[logger.file:0] +#level=DEBUG +#file=${serverRoot}/logs/jk2.log + +[shm:] +info=Scoreboard. Required for reconfiguration and status with multiprocess servers +file=${serverRoot}/logs/jk2.shm +size=1000000 +debug=0 +disabled=0 + +[workerEnv:] +info=Global server options +timing=1 +debug=0 +# Default Native Logger (apache2 or win32 ) +# can be overriden to a file logger, useful +# when tracing win32 related issues +#logger=logger.file:0 + +[lb:lb] +info=Default load balancer. +debug=0 + +[lb:lb_1] +info=A second load balancer. +debug=0 + +[channel.socket:localhost:8009] +info=Ajp13 forwarding over socket +debug=0 +tomcatId=localhost:8009 + +[channel.socket:localhost:8019] +info=A second tomcat instance. +debug=0 +tomcatId=localhost:8019 +lb_factor=1 +#group=lb +group:lb:lb +#group=lb_1 +group:lb:lb_1 +disabled=0 + +[channel.un:/opt/33/work/jk2.socket] +info=A second channel connecting to localhost:8019 via unix socket +tomcatId=localhost:8019 +lb_factor=1 +debug=0 + +[channel.jni:jni] +info=The jni channel, used if tomcat is started inprocess + +[status:] +info=Status worker, displays runtime informations + +[vm:] +info=Parameters used to load a JVM in the server process +#JVM=C:\jdk\jre\bin\hotspot\jvm.dll +classpath=${TOMCAT_HOME}/bin/tomcat-jni.jar +classpath=${TOMCAT_HOME}/server/lib/commons-logging.jar +OPT=-Dtomcat.home=${TOMCAT_HOME} +OPT=-Dcatalina.home=${TOMCAT_HOME} +OPT=-Xmx128M +#OPT=-Djava.compiler=NONE +disabled=1 + +[worker.jni:onStartup] +info=Command to be executed by the VM on startup. This one will start tomcat. +class=org/apache/jk/apr/TomcatStarter +ARG=start +# For Tomcat 5 use the 'stard' for startup argument +# ARG=stard +disabled=1 +stdout=${serverRoot}/logs/stdout.log +stderr=${serverRoot}/logs/stderr.log + +[worker.jni:onShutdown] +info=Command to be executed by the VM on shutdown. This one will stop tomcat. +class=org/apache/jk/apr/TomcatStarter +ARG=stop +disabled=1 + +[uri:/jkstatus/*] +info=Display status information and checks the config file for changes. +group=status: + +[uri:127.0.0.1:8003] +info=Example virtual host. Make sure myVirtualHost is in /etc/hosts to test it +alias=myVirtualHost:8003 + +[uri:127.0.0.1:8003/ex] +info=Example webapp in the virtual host. It'll go to lb_1 ( i.e. localhost:8019 ) +context=/ex +group=lb_1 + +[uri:/examples] +info=Example webapp in the default context. +context=/examples +debug=0 + +[uri:/examples1/*] +info=A second webapp, this time going to the second tomcat only. +group=lb_1 +debug=0 + +[uri:/examples/servlet/*] +info=Prefix mapping + +[uri:/examples/*.jsp] +info=Extension mapping + +[uri:/examples/*] +info=Map the whole webapp + +[uri:/examples/servlet/HelloW] +info=Example with debug enabled. +debug=10 diff --git a/base/tps-tomcat/shared/conf/workers2.properties.minimal b/base/tps-tomcat/shared/conf/workers2.properties.minimal new file mode 100644 index 000000000..0e88d14c7 --- /dev/null +++ b/base/tps-tomcat/shared/conf/workers2.properties.minimal @@ -0,0 +1,60 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# Copyright (C) 2006 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +# +# This is the minimal JK2 connector configuration file. +# + +[logger] +info=Native logger +level=ERROR + +[config:] +file=${serverRoot}/conf/workers2.properties +debug=0 +debugEnv=0 + +[uriMap:] +info=Maps the requests. +debug=0 + +[shm:] +info=Scoreboard. Required for reconfiguration and status with multiprocess servers +file=anonymous +debug=0 + +[workerEnv:] +info=Global server options +timing=0 +debug=0 + +[lb:lb] +info=Default load balancer. +debug=0 + +[channel.socket:localhost:8009] +info=Ajp13 forwarding over socket +debug=0 +tomcatId=localhost:8009 + +[uri:/admin] +info=Tomcat HTML based administration web application. +debug=0 + +[uri:/manager] +info=A scriptable management web application for the Tomcat Web Server. +debug=0 + +[uri:/jsp-examples] +info=JSP 2.0 Examples. +debug=0 + +[uri:/servlets-examples] +info=Servlet 2.4 Examples. +debug=0 + +[uri:/*.jsp] +info=JSP Extension mapping. +debug=0 diff --git a/base/tps-tomcat/shared/etc/init.d/pki-tpsd b/base/tps-tomcat/shared/etc/init.d/pki-tpsd new file mode 100755 index 000000000..7b991f39c --- /dev/null +++ b/base/tps-tomcat/shared/etc/init.d/pki-tpsd @@ -0,0 +1,86 @@ +#!/bin/bash +# +# --- BEGIN COPYRIGHT BLOCK --- +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# +# Copyright (C) 2007-2010 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +# pki-tpsd Startup script for pki-tps with tomcat7 +# +# chkconfig: - 84 16 +# description: Token Processing Service (Tomcat 7.0) +# processname: pki-tpsd +# piddir: /var/run/pki/tps +# + +PROG_NAME=`basename $0` +SERVICE_NAME="pki-tpsd" +SERVICE_PROG="/sbin/service" +PKI_PATH="/usr/share/pki/tps" +PKI_REGISTRY="/etc/sysconfig/pki/tps" +PKI_TYPE="pki-tps" +PKI_TOTAL_PORTS=6 + +# Avoid using 'systemctl' for now +SYSTEMCTL_SKIP_REDIRECT=1 +export SYSTEMCTL_SKIP_REDIRECT + +# Disallow 'others' the ability to 'write' to new files +umask 00002 + +command="$1" +pki_instance="$2" + +# Source function library. +. /etc/init.d/functions + +# Source the PKI function library +. /usr/share/pki/scripts/functions + +# See how we were called. +case $command in + status) + registry_status + exit $? + ;; + start) + start + exit $? + ;; + restart) + restart + exit $? + ;; + stop) + stop + exit $? + ;; + condrestart|force-restart|try-restart) + [ ! -f ${lockfile} ] || restart + exit $? + ;; + reload) + echo "The 'reload' action is an unimplemented feature." + exit ${default_error} + ;; + *) + echo "unknown action ($command)" + usage + echo "where valid instance names include:" + list_instances + exit ${default_error} + ;; +esac diff --git a/base/tps-tomcat/shared/lib/systemd/system/pki-tpsd.target b/base/tps-tomcat/shared/lib/systemd/system/pki-tpsd.target new file mode 100644 index 000000000..443c2adad --- /dev/null +++ b/base/tps-tomcat/shared/lib/systemd/system/pki-tpsd.target @@ -0,0 +1,6 @@ +[Unit] +Description=PKI Token Processing Service +After=syslog.target network.target + +[Install] +WantedBy=multi-user.target diff --git a/base/tps-tomcat/shared/lib/systemd/system/pki-tpsd@.service b/base/tps-tomcat/shared/lib/systemd/system/pki-tpsd@.service new file mode 100644 index 000000000..4703b3fe8 --- /dev/null +++ b/base/tps-tomcat/shared/lib/systemd/system/pki-tpsd@.service @@ -0,0 +1,12 @@ +[Unit] +Description=PKI Token Processing Service %i +After=pki-tpsd.target +BindTo=pki-tpsd.target + +[Service] +Type=forking +ExecStart=/usr/bin/pkicontrol start tps %i +ExecStop=/usr/bin/pkicontrol stop tps %i + +[Install] +WantedBy=multi-user.target diff --git a/base/tps-tomcat/shared/webapps/tps/404.html b/base/tps-tomcat/shared/webapps/tps/404.html new file mode 100755 index 000000000..0bf93578c --- /dev/null +++ b/base/tps-tomcat/shared/webapps/tps/404.html @@ -0,0 +1,145 @@ + + + + + + +TPS 404 Error! + + + + + + + + + +
+ +
+
+ +
+ - +
+ + +
+
+ +
+ +Certificate System TPS Error Page +
+

+ +

+ +

+ + + diff --git a/base/tps-tomcat/shared/webapps/tps/500.html b/base/tps-tomcat/shared/webapps/tps/500.html new file mode 100755 index 000000000..3e1e8bb66 --- /dev/null +++ b/base/tps-tomcat/shared/webapps/tps/500.html @@ -0,0 +1,138 @@ + + + + + + +TPS 500 Error! + + + + + + + + + +
+ +
+
+ +
+ - +
+ + +
+
+ +
+ +Certificate System TPS Error Page +
+

+ +

+ +

+ + + diff --git a/base/tps-tomcat/shared/webapps/tps/GenUnexpectedError.template b/base/tps-tomcat/shared/webapps/tps/GenUnexpectedError.template new file mode 100644 index 000000000..ea545c145 --- /dev/null +++ b/base/tps-tomcat/shared/webapps/tps/GenUnexpectedError.template @@ -0,0 +1,67 @@ + + + + + +TPS Processing Error! + + + + +Problem Processing Your Request + + + + + + +
 
+ + + + + + + + diff --git a/base/tps-tomcat/shared/webapps/tps/META-INF/context.xml b/base/tps-tomcat/shared/webapps/tps/META-INF/context.xml new file mode 100644 index 000000000..e838503a6 --- /dev/null +++ b/base/tps-tomcat/shared/webapps/tps/META-INF/context.xml @@ -0,0 +1,37 @@ + + + + + + + + + + + + + diff --git a/base/tps-tomcat/shared/webapps/tps/WEB-INF/auth.properties b/base/tps-tomcat/shared/webapps/tps/WEB-INF/auth.properties new file mode 100644 index 000000000..8ed17dbe0 --- /dev/null +++ b/base/tps-tomcat/shared/webapps/tps/WEB-INF/auth.properties @@ -0,0 +1,10 @@ +# Restful API authorization mapping info +# +# Format: +# = , +# ex: admin.users = certServer.ca.users,read + +account.login = certServer.tps.account,login +account.logout = certServer.tps.account,logout +admin.users = certServer.tps.users,execute +admin.groups = certServer.tps.groups,execute diff --git a/base/tps-tomcat/shared/webapps/tps/WEB-INF/velocity.properties b/base/tps-tomcat/shared/webapps/tps/WEB-INF/velocity.properties new file mode 100644 index 000000000..5cd0454cc --- /dev/null +++ b/base/tps-tomcat/shared/webapps/tps/WEB-INF/velocity.properties @@ -0,0 +1,13 @@ +# --- BEGIN COPYRIGHT BLOCK --- +# Copyright (C) 2006 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +resource.loader = file +file.resource.loader.class = org.apache.velocity.runtime.resource.loader.FileResourceLoader +file.resource.loader.path = [PKI_INSTANCE_PATH]/[PKI_WEBAPPS_NAME]/[PKI_SUBSYSTEM_TYPE] +file.resource.loader.cache = true +file.resource.loader.modificationCheckInterval = 2 +input.encoding=UTF-8 +output.encoding=UTF-8 +runtime.log.logsystem.class=org.apache.velocity.runtime.log.NullLogSystem diff --git a/base/tps-tomcat/shared/webapps/tps/WEB-INF/web.xml b/base/tps-tomcat/shared/webapps/tps/WEB-INF/web.xml new file mode 100644 index 000000000..9a6c87462 --- /dev/null +++ b/base/tps-tomcat/shared/webapps/tps/WEB-INF/web.xml @@ -0,0 +1,188 @@ + + + + + + Token Processing Service + + + csadmin-login + com.netscape.cms.servlet.csadmin.LoginServlet + + properties + /WEB-INF/velocity.properties + + + + + tpsstart + com.netscape.cms.servlet.base.CMSStartServlet + + AuthzMgr + BasicAclAuthz + + + cfgPath + [PKI_INSTANCE_PATH]/conf/[PKI_SUBSYSTEM_TYPE]/CS.cfg + + + ID + tpsstart + + 1 + + + + tpsug + com.netscape.cms.servlet.admin.UsrGrpAdminServlet + + ID + tpsug + + + AuthzMgr + BasicAclAuthz + + + + + tpslog + com.netscape.cms.servlet.admin.LogAdminServlet + + ID + tpslog + + AuthzMgr + BasicAclAuthz + + + + + tpsGetStatus + com.netscape.cms.servlet.csadmin.GetStatus + + GetClientCert + false + + + authority + tps + + + ID + tpsGetStatus + + + + + tps + org.dogtagpki.tps.server.TPSServlet + + + + org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap + + + + resteasy.servlet.mapping.prefix + /rest + + + + resteasy.resource.method-interceptors + org.jboss.resteasy.core.ResourceMethodSecurityInterceptor + + + + Resteasy + org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher + + javax.ws.rs.Application + org.dogtagpki.tps.server.TPSApplication + + + + + Resteasy + /rest/* + + + + tpsstart + /start + + + + tpsug + /ug + + + + tpslog + /log + + + + csadmin-login + /admin/console/config/login + + + + tpsGetStatus + /admin/tps/getStatus + + + + tps + /tps + + + + + + + + + + 30 + + + + + Account Services + /rest/account/* + + + * + + + CONFIDENTIAL + + + + + + Admin Services + /rest/admin/* + + + * + + + CONFIDENTIAL + + + + + Token Processing Service + + + + * + + + diff --git a/base/tps-tomcat/shared/webapps/tps/index.html b/base/tps-tomcat/shared/webapps/tps/index.html new file mode 100644 index 000000000..30662d47a --- /dev/null +++ b/base/tps-tomcat/shared/webapps/tps/index.html @@ -0,0 +1,23 @@ + + + + diff --git a/base/tps-tomcat/shared/webapps/tps/services.template b/base/tps-tomcat/shared/webapps/tps/services.template new file mode 100644 index 000000000..c6792fea1 --- /dev/null +++ b/base/tps-tomcat/shared/webapps/tps/services.template @@ -0,0 +1,106 @@ + + + + +TKS Services + + + + + + + + + + + + +
+ +
+
+ +
+ - +
+ + +
+
+ +
+ + + +Certificate System TKS Services Page +
+

+ +

+

+ + + + + + + + + + +
  
  
+
+ + + diff --git a/base/tps-tomcat/src/CMakeLists.txt b/base/tps-tomcat/src/CMakeLists.txt new file mode 100644 index 000000000..2c9af352a --- /dev/null +++ b/base/tps-tomcat/src/CMakeLists.txt @@ -0,0 +1,138 @@ +project(pki-tps_java NONE) + +find_file(LDAPJDK_JAR + NAMES + ldapjdk.jar + PATHS + /usr/share/java +) + +find_file(JAXRS_API_JAR + NAMES + jaxrs-api.jar + PATHS + ${RESTEASY_LIB} +) + +find_file(JSS_JAR + NAMES + jss4.jar + PATHS + ${JAVA_LIB_INSTALL_DIR} +) + +find_file(COMMONS_CODEC_JAR + NAMES + commons-codec.jar + PATHS + /usr/share/java +) + +find_file(JAXRS_API_JAR + NAMES + jaxrs-api.jar + PATHS + ${RESTEASY_LIB} +) + +find_file(PKI_CERTSRV_JAR + NAMES + pki-certsrv.jar + PATHS + /usr/share/java/pki +) + +find_file(PKI_CMS_JAR + NAMES + pki-cms.jar + PATHS + /usr/share/java/pki +) + +find_file(PKI_CMSCORE_JAR + NAMES + pki-cmscore.jar + PATHS + /usr/share/java/pki +) + +find_file(PKI_CMSUTIL_JAR + NAMES + pki-cmsutil.jar + PATHS + /usr/share/java/pki +) + +find_file(PKI_NSUTIL_JAR + NAMES + pki-nsutil.jar + PATHS + /usr/share/java/pki +) + +find_file(RESTEASY_ATOM_PROVIDER_JAR + NAMES + resteasy-atom-provider.jar + PATHS + ${RESTEASY_LIB} +) + +find_file(SERVLET_JAR + NAMES + servlet.jar + PATHS + ${JAVA_LIB_INSTALL_DIR} + /usr/share/java +) + +find_file(SYMKEY_JAR + NAMES + symkey.jar + PATHS + ${JAVA_LIB_INSTALL_DIR} + /usr/share/java +) + +# build pki-tps +javac(pki-tps-classes + SOURCES + org/dogtagpki/tps/*.java + CLASSPATH + ${PKI_CERTSRV_JAR} ${PKI_CMS_JAR} ${PKI_CMSCORE_JAR} + ${PKI_CMSUTIL_JAR} ${PKI_NSUTIL_JAR} + ${LDAPJDK_JAR} ${JAXRS_API_JAR} ${RESTEASY_ATOM_PROVIDER_JAR} + ${JSS_JAR} ${COMMONS_CODEC_JAR} ${SYMKEY_JAR} ${SERVLET_JAR} + OUTPUT_DIR + ${CMAKE_BINARY_DIR}/classes + DEPENDS + pki-nsutil-jar pki-cmsutil-jar pki-certsrv-jar pki-cms-jar pki-cmscore-jar +) + +configure_file( + ${CMAKE_CURRENT_SOURCE_DIR}/pki-tps.mf + ${CMAKE_CURRENT_BINARY_DIR}/pki-tps.mf +) + +jar(pki-tps-jar + CREATE + ${CMAKE_BINARY_DIR}/dist/pki-tps.jar + OPTIONS + m + PARAMS + ${CMAKE_CURRENT_BINARY_DIR}/pki-tps.mf + INPUT_DIR + ${CMAKE_BINARY_DIR}/classes + FILES + org/dogtagpki/tps/*.class + DEPENDS + pki-tps-classes +) + +install( + FILES + ${CMAKE_BINARY_DIR}/dist/pki-tps.jar + DESTINATION + ${JAVA_JAR_INSTALL_DIR}/pki +) + +set(PKI_TPS_JAR ${CMAKE_BINARY_DIR}/dist/pki-tps.jar CACHE INTERNAL "pki-tps jar file") diff --git a/base/tps-tomcat/src/org/dogtagpki/tps/TPSConnection.java b/base/tps-tomcat/src/org/dogtagpki/tps/TPSConnection.java new file mode 100644 index 000000000..cd62ff530 --- /dev/null +++ b/base/tps-tomcat/src/org/dogtagpki/tps/TPSConnection.java @@ -0,0 +1,98 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2013 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package org.dogtagpki.tps; + +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +import java.io.PrintStream; + +/** + * @author Endi S. Dewata + */ +public class TPSConnection { + + public InputStream in; + public PrintStream out; + public boolean chunked; + + public TPSConnection(InputStream in, OutputStream out) { + this(in, out, false); + } + + public TPSConnection(InputStream in, OutputStream out, boolean chunked) { + this.in = in; + this.out = new PrintStream(out); + this.chunked = chunked; + } + + public TPSMessage read() throws IOException { + + StringBuilder sb = new StringBuilder(); + int b; + + // read the first parameter + while ((b = in.read()) >= 0) { + char c = (char)b; + if (c == '&') break; + sb.append(c); + } + + if (b < 0) throw new IOException("Unexpected end of stream"); + + // parse message size + String nvp = sb.toString(); + String[] s = nvp.split("="); + int size = Integer.parseInt(s[1]); + + sb.append('&'); + + // read the rest of message + for (int i=0; i + */ +public class TPSMessage { + + Map map = new LinkedHashMap(); + + public TPSMessage() { + } + + public TPSMessage(String message) { + decode(message); + } + + public TPSMessage(Map map) { + this.map.putAll(map); + } + + public void put(String key, String value) { + map.put(key, value); + } + + public void put(String key, Integer value) { + map.put(key, value.toString()); + } + + public void put(String key, byte[] bytes) { + StringBuilder sb = new StringBuilder(); + + for (byte b : bytes) { + sb.append("%"); + sb.append(String.format("%02X", b)); + } + + map.put(key, sb.toString()); + } + + public void decode(String message) { + + for (String nvp : message.split("&")) { + String[] s = nvp.split("="); + + String key = s[0]; + String value = s[1]; + + // skip message size + if (key.equals("s")) continue; + + map.put(key, value); + } + } + + public String encode() { + + StringBuilder sb = new StringBuilder(); + + // encode message type + String type = map.get("msg_type"); + sb.append("msg_type=" + type); + + // encode other parameters + for (String key : map.keySet()) { + + if (key.equals("msg_type")) continue; + + String value = map.get(key); + sb.append("&" + key + "=" + value); + } + + String message = sb.toString(); + + // encode message_size + return "s=" + message.length() + "&" + message; + } + + public String toString() { + return map.toString(); + } +} diff --git a/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSApplication.java b/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSApplication.java new file mode 100644 index 000000000..2f2b2a63a --- /dev/null +++ b/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSApplication.java @@ -0,0 +1,84 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2013 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package org.dogtagpki.tps.server; + +import java.util.HashSet; +import java.util.Set; + +import javax.ws.rs.core.Application; + +import org.dogtagpki.tps.token.TokenService; + +import com.netscape.certsrv.acls.ACLInterceptor; +import com.netscape.certsrv.authentication.AuthMethodInterceptor; +import com.netscape.certsrv.base.PKIException; +import com.netscape.cms.servlet.account.AccountService; +import com.netscape.cms.servlet.admin.GroupMemberService; +import com.netscape.cms.servlet.admin.GroupService; +import com.netscape.cms.servlet.admin.SystemCertService; +import com.netscape.cms.servlet.admin.UserCertService; +import com.netscape.cms.servlet.admin.UserMembershipService; +import com.netscape.cms.servlet.admin.UserService; +import com.netscape.cms.servlet.csadmin.SystemConfigService; + +/** + * @author Endi S. Dewata + */ +public class TPSApplication extends Application { + + private Set singletons = new HashSet(); + private Set> classes = new HashSet>(); + + public TPSApplication() { + + // account + classes.add(AccountService.class); + + // installer + classes.add(SystemConfigService.class); + + // user and group management + classes.add(GroupMemberService.class); + classes.add(GroupService.class); + classes.add(UserCertService.class); + classes.add(UserMembershipService.class); + classes.add(UserService.class); + + // system certs + classes.add(SystemCertService.class); + + // tokens + classes.add(TokenService.class); + + // exception mapper + classes.add(PKIException.Mapper.class); + + // interceptors + singletons.add(new AuthMethodInterceptor()); + singletons.add(new ACLInterceptor()); + } + + public Set> getClasses() { + return classes; + } + + public Set getSingletons() { + return singletons; + } + +} diff --git a/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSServlet.java b/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSServlet.java new file mode 100644 index 000000000..78e6df4f8 --- /dev/null +++ b/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSServlet.java @@ -0,0 +1,61 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2013 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package org.dogtagpki.tps.server; + +import java.io.IOException; + +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +import org.dogtagpki.tps.TPSConnection; +import org.dogtagpki.tps.TPSMessage; + +/** + * @author Endi S. Dewata + */ +public class TPSServlet extends HttpServlet { + + private static final long serialVersionUID = -1092227495262381074L; + + public void service(HttpServletRequest request, HttpServletResponse response) throws IOException { + + response.setHeader("Transfer-Encoding", "chunked"); + + TPSConnection con = new TPSConnection( + request.getInputStream(), response.getOutputStream(), true); + + TPSMessage message = con.read(); + System.out.println("Receive: " + message); + + message = new TPSMessage(); + message.put("msg_type", 9); + message.put("pdu_size", 12); + message.put("pdu_data", new byte[] { + (byte)0x00, (byte)0xA4, (byte)0x04, (byte)0x00, + (byte)0x07, (byte)0xA0, (byte)0x00, (byte)0x00, + (byte)0x00, (byte)0x03, (byte)0x00, (byte)0x00 + }); + + System.out.println("Send: " + message); + con.write(message); + + message = con.read(); + System.out.println("Receive: " + message); + } +} diff --git a/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSSubsystem.java b/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSSubsystem.java new file mode 100644 index 000000000..92017812c --- /dev/null +++ b/base/tps-tomcat/src/org/dogtagpki/tps/server/TPSSubsystem.java @@ -0,0 +1,115 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2013 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package org.dogtagpki.tps.server; + +import org.dogtagpki.tps.token.TokenDatabase; + +import com.netscape.certsrv.apps.CMS; +import com.netscape.certsrv.authority.IAuthority; +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.IConfigStore; +import com.netscape.certsrv.base.ISubsystem; +import com.netscape.certsrv.logging.ILogger; +import com.netscape.certsrv.request.IRequestListener; +import com.netscape.certsrv.request.IRequestQueue; + +/** + * @author Endi S. Dewata + */ +public class TPSSubsystem implements IAuthority, ISubsystem { + + public final static TPSSubsystem INSTANCE = new TPSSubsystem(); + + public ILogger logger = CMS.getLogger(); + + public String id; + public String nickname; + public ISubsystem owner; + public IConfigStore config; + + public TokenDatabase tokenDatabase = new TokenDatabase(); + + public static TPSSubsystem getInstance() { + return INSTANCE; + } + + @Override + public String getId() { + return id; + } + + @Override + public void setId(String id) throws EBaseException { + this.id = id; + } + + @Override + public void init(ISubsystem owner, IConfigStore config) throws EBaseException { + this.owner = owner; + this.config = config; + } + + @Override + public void startup() throws EBaseException { + } + + @Override + public void shutdown() { + } + + @Override + public IConfigStore getConfigStore() { + return config; + } + + @Override + public IRequestQueue getRequestQueue() { + return null; + } + + @Override + public void registerRequestListener(IRequestListener listener) { + } + + @Override + public void registerPendingListener(IRequestListener listener) { + } + + @Override + public void log(int level, String msg) { + logger.log(ILogger.EV_SYSTEM, ILogger.S_TPS, level, msg); + } + + @Override + public String getNickname() { + return nickname; + } + + public void setNickname(String nickname) { + this.nickname = nickname; + } + + @Override + public String getOfficialName() { + return "tps"; + } + + public TokenDatabase getTokenDatabase() { + return tokenDatabase; + } +} diff --git a/base/tps-tomcat/src/org/dogtagpki/tps/token/TokenDatabase.java b/base/tps-tomcat/src/org/dogtagpki/tps/token/TokenDatabase.java new file mode 100644 index 000000000..3db76649f --- /dev/null +++ b/base/tps-tomcat/src/org/dogtagpki/tps/token/TokenDatabase.java @@ -0,0 +1,76 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2013 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- + +package org.dogtagpki.tps.token; + +import java.util.Collection; +import java.util.Date; +import java.util.LinkedHashMap; +import java.util.Map; + +/** + * This class implements in-memory token database. In the future this + * will be replaced with LDAP database. + * + * @author Endi S. Dewata + */ +public class TokenDatabase { + + public final static int DEFAULT_SIZE = 20; + + Map tokens = new LinkedHashMap(); + + public Collection getTokens() throws Exception { + return tokens.values(); + } + + public TokenRecord getToken(String tokenID) throws Exception { + if (!tokens.containsKey(tokenID)) { + throw new Exception("Token "+ tokenID + " does not exist."); + } + return tokens.get(tokenID); + } + + public void addToken(TokenRecord tokenRecord) throws Exception { + if (tokens.containsKey(tokenRecord.getID())) { + throw new Exception("Token "+ tokenRecord.getID() + " already exists."); + } + + tokenRecord.setStatus("ENABLED"); + tokenRecord.setCreateTimestamp(new Date()); + + tokens.put(tokenRecord.getID(), tokenRecord); + } + + public void updateToken(String tokenID, TokenRecord tokenRecord) throws Exception { + if (!tokens.containsKey(tokenRecord.getID())) { + throw new Exception("Token "+ tokenRecord.getID() + " does not exist."); + } + + tokenRecord.setModifyTimestamp(new Date()); + + tokens.put(tokenRecord.getID(), tokenRecord); + } + + public void removeToken(String tokenID) throws Exception { + if (!tokens.containsKey(tokenID)) { + throw new Exception("Token "+ tokenID + " does not exist."); + } + tokens.remove(tokenID); + } +} diff --git a/base/tps-tomcat/src/org/dogtagpki/tps/token/TokenRecord.java b/base/tps-tomcat/src/org/dogtagpki/tps/token/TokenRecord.java new file mode 100644 index 000000000..1f9d9caf5 --- /dev/null +++ b/base/tps-tomcat/src/org/dogtagpki/tps/token/TokenRecord.java @@ -0,0 +1,188 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2013 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- + +package org.dogtagpki.tps.token; + +import java.util.Date; + +import com.netscape.certsrv.token.TokenData; + +/** + * @author Endi S. Dewata + */ +public class TokenRecord { + + String id; + String userID; + String status; + String reason; + String appletID; + String keyInfo; + Date createTimestamp; + Date modifyTimestamp; + + public String getID() { + return id; + } + + public void setID(String id) { + this.id = id; + } + + public String getUserID() { + return userID; + } + + public void setUserID(String userID) { + this.userID = userID; + } + + public String getStatus() { + return status; + } + + public void setStatus(String status) { + this.status = status; + } + + public String getReason() { + return reason; + } + + public void setReason(String reason) { + this.reason = reason; + } + + public String getAppletID() { + return appletID; + } + + public void setAppletID(String appletID) { + this.appletID = appletID; + } + + public String getKeyInfo() { + return keyInfo; + } + + public void setKeyInfo(String keyInfo) { + this.keyInfo = keyInfo; + } + + public Date getCreateTimestamp() { + return createTimestamp; + } + + public void setCreateTimestamp(Date createTimestamp) { + this.createTimestamp = createTimestamp; + } + + public Date getModifyTimestamp() { + return modifyTimestamp; + } + + public void setModifyTimestamp(Date modifyTimestamp) { + this.modifyTimestamp = modifyTimestamp; + } + + @Override + public int hashCode() { + final int prime = 31; + int result = 1; + result = prime * result + ((appletID == null) ? 0 : appletID.hashCode()); + result = prime * result + ((createTimestamp == null) ? 0 : createTimestamp.hashCode()); + result = prime * result + ((id == null) ? 0 : id.hashCode()); + result = prime * result + ((keyInfo == null) ? 0 : keyInfo.hashCode()); + result = prime * result + ((modifyTimestamp == null) ? 0 : modifyTimestamp.hashCode()); + result = prime * result + ((reason == null) ? 0 : reason.hashCode()); + result = prime * result + ((status == null) ? 0 : status.hashCode()); + result = prime * result + ((userID == null) ? 0 : userID.hashCode()); + return result; + } + + @Override + public boolean equals(Object obj) { + if (this == obj) + return true; + if (obj == null) + return false; + if (getClass() != obj.getClass()) + return false; + TokenRecord other = (TokenRecord) obj; + if (appletID == null) { + if (other.appletID != null) + return false; + } else if (!appletID.equals(other.appletID)) + return false; + if (createTimestamp == null) { + if (other.createTimestamp != null) + return false; + } else if (!createTimestamp.equals(other.createTimestamp)) + return false; + if (id == null) { + if (other.id != null) + return false; + } else if (!id.equals(other.id)) + return false; + if (keyInfo == null) { + if (other.keyInfo != null) + return false; + } else if (!keyInfo.equals(other.keyInfo)) + return false; + if (modifyTimestamp == null) { + if (other.modifyTimestamp != null) + return false; + } else if (!modifyTimestamp.equals(other.modifyTimestamp)) + return false; + if (reason == null) { + if (other.reason != null) + return false; + } else if (!reason.equals(other.reason)) + return false; + if (status == null) { + if (other.status != null) + return false; + } else if (!status.equals(other.status)) + return false; + if (userID == null) { + if (other.userID != null) + return false; + } else if (!userID.equals(other.userID)) + return false; + return true; + } + + public static void main(String args[]) throws Exception { + + TokenData before = new TokenData(); + before.setID("token1"); + before.setUserID("user1"); + before.setStatus("revoked"); + before.setReason("lost"); + before.setAppletID("APPLET1234"); + before.setKeyInfo("key info"); + before.setCreateTimestamp(new Date()); + before.setModifyTimestamp(new Date()); + + String string = before.toString(); + System.out.println(string); + + TokenData after = TokenData.valueOf(string); + System.out.println(before.equals(after)); + } +} diff --git a/base/tps-tomcat/src/org/dogtagpki/tps/token/TokenService.java b/base/tps-tomcat/src/org/dogtagpki/tps/token/TokenService.java new file mode 100644 index 000000000..bc8b35d59 --- /dev/null +++ b/base/tps-tomcat/src/org/dogtagpki/tps/token/TokenService.java @@ -0,0 +1,245 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2013 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- + +package org.dogtagpki.tps.token; + +import java.io.UnsupportedEncodingException; +import java.net.URI; +import java.net.URLEncoder; +import java.util.Iterator; + +import javax.ws.rs.core.MediaType; +import javax.ws.rs.core.Response; + +import org.dogtagpki.tps.server.TPSSubsystem; +import org.jboss.resteasy.plugins.providers.atom.Link; + +import com.netscape.certsrv.base.PKIException; +import com.netscape.certsrv.token.TokenCollection; +import com.netscape.certsrv.token.TokenData; +import com.netscape.certsrv.token.TokenModifyRequest; +import com.netscape.certsrv.token.TokenResource; +import com.netscape.cms.servlet.base.PKIService; + +/** + * @author Endi S. Dewata + */ +public class TokenService extends PKIService implements TokenResource { + + public final static int DEFAULT_SIZE = 20; + + public TokenService() { + System.out.println("TokenService.()"); + } + + public TokenData createTokenData(TokenRecord tokenRecord) { + + TokenData tokenData = new TokenData(); + tokenData.setID(tokenRecord.getID()); + tokenData.setUserID(tokenRecord.getUserID()); + tokenData.setStatus(tokenRecord.getStatus()); + tokenData.setReason(tokenRecord.getReason()); + tokenData.setAppletID(tokenRecord.getAppletID()); + tokenData.setKeyInfo(tokenRecord.getKeyInfo()); + tokenData.setCreateTimestamp(tokenRecord.getCreateTimestamp()); + tokenData.setModifyTimestamp(tokenRecord.getModifyTimestamp()); + + String tokenID = tokenRecord.getID(); + try { + tokenID = URLEncoder.encode(tokenID, "UTF-8"); + } catch (UnsupportedEncodingException e) { + e.printStackTrace(); + throw new PKIException(e.getMessage()); + } + + URI uri = uriInfo.getBaseUriBuilder().path(TokenResource.class).path("{tokenID}").build(tokenID); + tokenData.setLink(new Link("self", uri)); + + return tokenData; + } + + public TokenRecord createTokenRecord(TokenData tokenData) { + + TokenRecord tokenRecord = new TokenRecord(); + tokenRecord.setID(tokenData.getID()); + tokenRecord.setUserID(tokenData.getUserID()); + tokenRecord.setStatus(tokenData.getStatus()); + tokenRecord.setReason(tokenData.getReason()); + tokenRecord.setAppletID(tokenData.getAppletID()); + tokenRecord.setKeyInfo(tokenData.getKeyInfo()); + tokenRecord.setCreateTimestamp(tokenData.getCreateTimestamp()); + tokenRecord.setModifyTimestamp(tokenData.getModifyTimestamp()); + + return tokenRecord; + } + + @Override + public TokenCollection findTokens(Integer start, Integer size) { + + System.out.println("TokenService.findTokens()"); + + try { + start = start == null ? 0 : start; + size = size == null ? DEFAULT_SIZE : size; + + TPSSubsystem subsystem = TPSSubsystem.getInstance(); + TokenDatabase database = subsystem.getTokenDatabase(); + + Iterator tokens = database.getTokens().iterator(); + + TokenCollection response = new TokenCollection(); + + int i = 0; + + // skip to the start of the page + for ( ; i 0) { + URI uri = uriInfo.getRequestUriBuilder().replaceQueryParam("start", Math.max(start-size, 0)).build(); + response.addLink(new Link("prev", uri)); + } + + if (start+size < i) { + URI uri = uriInfo.getRequestUriBuilder().replaceQueryParam("start", start+size).build(); + response.addLink(new Link("next", uri)); + } + + return response; + + } catch (Exception e) { + e.printStackTrace(); + throw new PKIException(e.getMessage()); + } + } + + @Override + public TokenData getToken(String tokenID) { + + System.out.println("TokenService.getToken(\"" + tokenID + "\")"); + + try { + TPSSubsystem subsystem = TPSSubsystem.getInstance(); + TokenDatabase database = subsystem.getTokenDatabase(); + + return createTokenData(database.getToken(tokenID)); + + } catch (Exception e) { + e.printStackTrace(); + throw new PKIException(e.getMessage()); + } + } + + @Override + public Response addToken(TokenData tokenData) { + + System.out.println("TokenService.addToken(\"" + tokenData.getID() + "\")"); + + try { + TPSSubsystem subsystem = TPSSubsystem.getInstance(); + TokenDatabase database = subsystem.getTokenDatabase(); + + database.addToken(createTokenRecord(tokenData)); + tokenData = createTokenData(database.getToken(tokenData.getID())); + + return Response + .created(tokenData.getLink().getHref()) + .entity(tokenData) + .type(MediaType.APPLICATION_XML) + .build(); + + } catch (Exception e) { + e.printStackTrace(); + throw new PKIException(e.getMessage()); + } + } + + @Override + public Response updateToken(String tokenID, TokenData tokenData) { + + System.out.println("TokenService.updateToken(\"" + tokenID + "\")"); + + try { + TPSSubsystem subsystem = TPSSubsystem.getInstance(); + TokenDatabase database = subsystem.getTokenDatabase(); + + TokenRecord tokenRecord = database.getToken(tokenID); + tokenRecord.setUserID(tokenData.getUserID()); + database.updateToken(tokenData.getID(), tokenRecord); + + tokenData = createTokenData(database.getToken(tokenID)); + + return Response + .ok(tokenData) + .type(MediaType.APPLICATION_XML) + .build(); + + } catch (Exception e) { + e.printStackTrace(); + throw new PKIException(e.getMessage()); + } + } + + @Override + public Response modifyToken(String tokenID, TokenModifyRequest request) { + + System.out.println("TokenService.modifyToken(\"" + tokenID + "\", request"); + + try { + TPSSubsystem subsystem = TPSSubsystem.getInstance(); + TokenDatabase database = subsystem.getTokenDatabase(); + + TokenRecord tokenRecord = database.getToken(tokenID); + // TODO: perform modification + + TokenData tokenData = createTokenData(tokenRecord); + + return Response + .ok(tokenData) + .type(MediaType.APPLICATION_XML) + .build(); + + } catch (Exception e) { + e.printStackTrace(); + throw new PKIException(e.getMessage()); + } + } + + @Override + public void removeToken(String tokenID) { + + System.out.println("TokenService.removeToken(\"" + tokenID + "\")"); + + try { + TPSSubsystem subsystem = TPSSubsystem.getInstance(); + TokenDatabase database = subsystem.getTokenDatabase(); + database.removeToken(tokenID); + + } catch (Exception e) { + e.printStackTrace(); + throw new PKIException(e.getMessage()); + } + } +} diff --git a/base/tps-tomcat/src/pki-tps.mf b/base/tps-tomcat/src/pki-tps.mf new file mode 100644 index 000000000..d77fe8fa9 --- /dev/null +++ b/base/tps-tomcat/src/pki-tps.mf @@ -0,0 +1,3 @@ +Name: pki-tps +Specification-Version: ${APPLICATION_VERSION} +Implementation-Version: ${VERSION} diff --git a/base/tps/CMakeLists.txt b/base/tps/CMakeLists.txt index aa6ac8cb1..954146cb4 100644 --- a/base/tps/CMakeLists.txt +++ b/base/tps/CMakeLists.txt @@ -36,13 +36,12 @@ SET(CMAKE_INSTALL_RPATH "${LIB_INSTALL_DIR}/tps") # which point to directories outside the build tree to the install RPATH SET(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE) -add_subdirectory(java) add_subdirectory(src) add_subdirectory(tools) # install files +add_subdirectory(doc) add_subdirectory(setup) -add_subdirectory(shared/conf) # install systemd scripts install( @@ -214,19 +213,3 @@ install( DESTINATION ${SYSTEMD_ETC_INSTALL_DIR}/pki-tpsd.target.wants ) - -# install directories -install( - DIRECTORY - shared/ - DESTINATION - ${SHARE_INSTALL_PREFIX}/${APPLICATION_NAME}/${PROJECT_NAME} - PATTERN - "CMakeLists.txt" EXCLUDE - PATTERN - "etc/*" EXCLUDE - PATTERN - "conf/CS.cfg.in" EXCLUDE - PATTERN - "lib/*" EXCLUDE -) diff --git a/base/tps/doc/CMakeLists.txt b/base/tps/doc/CMakeLists.txt new file mode 100644 index 000000000..419289d03 --- /dev/null +++ b/base/tps/doc/CMakeLists.txt @@ -0,0 +1,8 @@ +configure_file(${CMAKE_CURRENT_SOURCE_DIR}/CS.cfg.in ${CMAKE_CURRENT_BINARY_DIR}/CS.cfg @ONLY) + +install( + FILES + ${CMAKE_CURRENT_BINARY_DIR}/CS.cfg + DESTINATION + ${SHARE_INSTALL_PREFIX}/${APPLICATION_NAME}/${PROJECT_NAME}/conf +) diff --git a/base/tps/doc/CS.cfg.in b/base/tps/doc/CS.cfg.in new file mode 100644 index 000000000..d5c0f312e --- /dev/null +++ b/base/tps/doc/CS.cfg.in @@ -0,0 +1,1608 @@ +_000=## +_001=## Token Processing System (TPS) Configuration File +_002=## +pidDir=[PKI_PIDDIR] +pkicreate.pki_instance_root=[PKI_INSTANCE_ROOT] +pkicreate.pki_instance_name=[PKI_INSTANCE_NAME] +pkicreate.subsystem_type=[PKI_SUBSYSTEM_TYPE] +pkicreate.secure_port=[PKI_SECURE_PORT] +pkicreate.non_clientauth_secure_port=[NON_CLIENTAUTH_SECURE_PORT] +pkicreate.unsecure_port=[PKI_UNSECURE_PORT] +pkicreate.user=[PKI_USER] +pkicreate.group=[PKI_GROUP] +pkiremove.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] +cs.type=TPS +selftests._000=## +selftests._001=## Self Tests +selftests._002=## +selftests._003=## The Self-Test plugin TPSSystemCertsVerification uses the +selftests._004=## following parameters (where certusage is optional): +selftests._005=## tps.cert.list = +selftests._006=## tps.cert..nickname +selftests._007=## tps.cert..certusage +selftests._008=## +selftests.container.logger.enable=true +selftests.container.logger.expirationTime=0 +selftests.container.logger.file.type=RollingLogFile +selftests.container.logger.fileName=[PKI_INSTANCE_PATH]/logs/selftests.log +selftests.container.logger.level=10 +selftests.container.logger.maxFileSize=2000 +selftests.container.logger.rolloverInterval=2592000 +selftests.container.order.startup=TPSPresence:critical, TPSSystemCertsVerification:critical +selftests.container.order.onDemand=TPSPresence:critical, TPSValidity:critical, TPSSystemCertsVerification:critical +selftests.plugin.TPSPresence.nickname=[HSM_LABEL][NICKNAME] +selftests.plugin.TPSValidity.nickname=[HSM_LABEL][NICKNAME] +service.machineName=[PKI_HOSTNAME] +service.instanceDir=[PKI_INSTANCE_PATH] +service.securePort=[PKI_SECURE_PORT] +service.non_clientauth_securePort=[NON_CLIENTAUTH_SECURE_PORT] +service.unsecurePort=[PKI_UNSECURE_PORT] +service.instanceID=[PKI_INSTANCE_NAME] +logging._000=######################################### +logging._001=# RA configuration File +logging._002=# +logging._003=# All <...> must be replaced with +logging._004=# appropriate values. +logging._005=######################################### +logging._006=######################################## +logging._007=# logging +logging._008=# +logging._009=# logging.debug.enable: +logging._010=# logging.audit.enable: +logging._011=# logging.error.enable: +logging._012=# - enable or disable the corresponding logging +logging._013=# logging.debug.filename: +logging._014=# logging.audit.filename: +logging._015=# logging.error.filename: +logging._016=# - name of the log file +logging._017=# logging.debug.level: +logging._018=# logging.audit.level: +logging._019=# logging.error.level: +logging._020=# - level of logging. (0-10) +logging._021=# 0 - no logging, +logging._022=# 4 - LL_PER_SERVER these messages will occur only once +logging._023=# during the entire invocation of the +logging._024=# server, e. g. at startup or shutdown +logging._025=# time., reading the conf parameters. +logging._026=# Perhaps other infrequent events +logging._027=# relating to failing over of CA, TKS, +logging._028=# too +logging._029=# 6 - LL_PER_CONNECTION these messages happen once per +logging._030=# connection - most of the log events +logging._031=# will be at this level +logging._032=# 8 - LL_PER_PDU these messages relate to PDU +logging._033=# processing. If you have something that +logging._034=# is done for every PDU, such as +logging._035=# applying the MAC, it should be logged +logging._036=# at this level +logging._037=# 9 - LL_ALL_DATA_IN_PDU dump all the data in the PDU - a more +logging._038=# chatty version of the above +logging._039=# 10 - all logging +logging._040=# logging.audit.buffer.size: # in bytes +logging._041=# logging.audit.flush.interval: # in seconds, 0 disables flush thread +logging._042=# logging.*.file.type: +logging._043=# - file type: RollingLogFile or LogFile +logging._044=# logging.*.rolloverInterval: +logging._045=# - interval to roll over logs (seconds), 0 to disable rollover +logging._046=# logging.*.maxFileSize: +logging._047=# - size at which file rollover occurs, in kB +logging._048=# logging.*.expirationTime: +logging._049=# - maximum age of log, older unmodified logs are deleted( in seconds, 0 to disable) +logging._050=######################################### +logging.debug.enable=true +logging.debug.filename=[PKI_INSTANCE_PATH]/logs/tps-debug.log +logging.debug.level=10 +logging.debug.file.type=RollingLogFile +logging.debug.maxFileSize=2000 +logging.debug.rolloverInterval=2592000 +logging.debug.expirationTime=0 +logging.audit.enable=true +logging.audit.filename=[PKI_INSTANCE_PATH]/logs/tps-audit.log +logging.audit.signedAuditFilename=[PKI_INSTANCE_PATH]/logs/signedAudit/tps_audit +logging.audit.level=10 +logging.audit.logSigning=false +logging.audit.signedAuditCertNickname=auditSigningCert cert-[PKI_INSTANCE_NAME] +logging.audit.selected.events=AUTHZ_SUCCESS,AUTHZ_FAIL,AUTH_FAIL,AUTH_SUCCESS,ROLE_ASSUME,ENROLLMENT,PIN_RESET,FORMAT,CONFIG,CONFIG_ROLE,CONFIG_TOKEN,CONFIG_PROFILE,CONFIG_AUDIT,APPLET_UPGRADE,KEY_CHANGEOVER,RENEWAL,CIMC_CERT_VERIFICATION +logging.audit.selectable.events=AUTHZ_SUCCESS,AUTHZ_FAIL,AUTH_FAIL,AUTH_SUCCESS,ROLE_ASSUME,ENROLLMENT,PIN_RESET,FORMAT,CONFIG,CONFIG_ROLE,CONFIG_TOKEN,CONFIG_PROFILE,CONFIG_AUDIT,APPLET_UPGRADE,KEY_CHANGEOVER,RENEWAL,CIMC_CERT_VERIFICATION +logging.audit.nonselectable.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,LOGGING_SIGNED_AUDIT_SIGNING +logging.audit.buffer.size=512 +logging.audit.flush.interval=5 +logging.audit.file.type=RollingLogFile +logging.audit.maxFileSize=2000 +logging.audit.rolloverInterval=2592000 +logging.audit.expirationTime=0 +logging.error.enable=true +logging.error.filename=[PKI_INSTANCE_PATH]/logs/tps-error.log +logging.error.level=10 +logging.error.file.type=RollingLogFile +logging.error.maxFileSize=2000 +logging.error.rolloverInterval=2592000 +logging.error.expirationTime=0 +conn.ca1._000=######################################### +conn.ca1._001=# CA connection +conn.ca1._002=# +conn.ca1._003=# conn.ca.hostport: +conn.ca1._004=# - host name and port number of your CA, format is host:port +conn.ca1._005=# conn.ca.clientNickname: +conn.ca1._006=# - nickname of the client certificate for +conn.ca1._007=# authentication +conn.ca1._008=# conn.ca.servlet.enrollment: +conn.ca1._009=# - servlet to contact in CA +conn.ca1._010=# - must be '/ca/profileSubmitSSLClient' +conn.ca1._011=# conn.ca.retryConnect: +conn.ca1._012=# - number of reconnection attempts on failure +conn.ca1._013=# conn.ca.timeout: +conn.ca1._014=# - connection timeout +conn.ca1._015=# conn.ca.SSLOn: +conn.ca1._016=# - enable SSL or not +conn.ca1._017=# conn.ca.keepAlive: +conn.ca1._018=# - enable keep alive or not +conn.ca1._019=# conn.ca.caNickname: +conn.ca1._020=# - nickname of the ca certificate +conn.ca1._021=# conn.ca.caSKI: +conn.ca1._022=# - Subject Key Identifier (in Base64) of the ca certificate +conn.ca1._023=# (automatically calculated by the system) +conn.ca1._024=# +conn.ca1._025=# conn.ca.list=ca1,ca2...ca +conn.ca1._026=# - list of ca connection IDs for revocation routing +conn.ca1._027=# +conn.ca1._028=# where +conn.ca1._029=# - CA connection ID +conn.ca1._030=######################################### +failover.pod.enable=false +conn.ca1.hostport=[PKI_CA_HOSTNAME]:[PKI_CA_PORT] +conn.ca1.clientNickname=[HSM_LABEL][NICKNAME] +conn.ca1.servlet.enrollment=/ca/ee/ca/profileSubmitSSLClient +conn.ca1.servlet.renewal=/ca/ee/ca/profileSubmitSSLClient +conn.ca1.servlet.revoke=/ca/ee/subsystem/ca/doRevoke +conn.ca1.servlet.unrevoke=/ca/ee/subsystem/ca/doUnrevoke +conn.ca1.retryConnect=3 +conn.ca1.timeout=100 +conn.ca1.SSLOn=true +conn.ca1.keepAlive=true +conn.tks1._000=######################################### +conn.tks1._001=# TKS connection +conn.tks1._002=# +conn.tks1._003=# conn.tks.hostport: +conn.tks1._004=# - host name and port number of your TKS, the format is host:port +conn.tks1._005=# conn.tks.clientNickname: +conn.tks1._006=# - nickname of the client certificate for +conn.tks1._007=# authentication +conn.tks1._008=# conn.tks.servlet.computeSessionKey: +conn.tks1._009=# - servlet to compute session key +conn.tks1._010=# - must be '/tks/computeSessionKey' +conn.tks1._011=# conn.tks.servlet.encryptData: +conn.tks1._012=# - servlet to encrypt data +conn.tks1._013=# - must be '/tks/encryptData' +conn.tks1._014=# conn.tks.servlet.createKeySetData: +conn.tks1._015=# - servlet to create key set data +conn.tks1._016=# - must be '/tks/createKeySetData' +conn.tks1._017=# conn.tks.retryConnect: +conn.tks1._018=# - number of reconnection attempts on failure +conn.tks1._019=# conn.tks.SSLOn +conn.tks1._020=# - enable SSL or not +conn.tks1._021=# conn.tks.keepAlive: +conn.tks1._022=# - enable keep alive or not +conn.tks1._023=# +conn.tks1._024=# where +conn.tks1._025=# - TKS connection ID +conn.tks1._026=# conn.tks.tksSharedSymKeyName: +conn.tks1._027=# - set shared secret key name +conn.tks1._028=######################################### +conn.tks1.hostport=[TKS_HOST]:[TKS_PORT] +conn.tks1.clientNickname=[HSM_LABEL][NICKNAME] +conn.tks1.servlet.computeSessionKey=/tks/agent/tks/computeSessionKey +conn.tks1.servlet.encryptData=/tks/agent/tks/encryptData +conn.tks1.servlet.createKeySetData=/tks/agent/tks/createKeySetData +conn.tks1.servlet.computeRandomData=/tks/agent/tks/computeRandomData +conn.tks1.retryConnect=3 +conn.tks1.timeout=100 +conn.tks1.generateHostChallenge=true +conn.tks1.SSLOn=true +conn.tks1.keepAlive=false +conn.tks1.keySet=defKeySet +conn.tks1.serverKeygen=[SERVER_KEYGEN] +conn.tks1.tksSharedSymKeyName=sharedSecret +conn.drm1._000=######################################### +conn.drm1._001=# DRM connection +conn.drm1._002=# +conn.drm1._003=#conn.drm.totalConns +conn.drm1._004=# - # of DRM connections +conn.drm1._005=#conn.drm.hostport +conn.drm1._006=# - host name and port number of your DRM, the format is host:port +conn.drm1._007=#conn.drm.clientNickname +conn.drm1._008=# - nickname of the client certificate for +conn.drm1._009=# authentication +conn.drm1._010=#conn.drm.servlet.GenerateKeyPair +conn.drm1._011=# - servlet to generate key pairs and archive keys on DRM +conn.drm1._012=# - must be '/kra/GenerateKeyPair' +conn.drm1._013=#conn.drm.servlet.TokenKeyRecovery=/kra/TokenKeyRecovery +conn.drm1._014=# - servlet to handle key recovery +conn.drm1._015=# - must be '/kra/TokenKeyRecovery' +conn.drm1._016=#conn.drm.retryConnect=3 +conn.drm1._017=# - number of reconnection attempts on failure +conn.drm1._018=#conn.drm.SSLOn=true +conn.drm1._019=# - enable SSL or not +conn.drm1._020=#conn.drm.keepAlive=false +conn.drm1._021=# - enable keep alive or not +conn.drm1._022=# +conn.drm1._023=# where +conn.drm1._024=# - DRM connection ID +conn.drm1._025=######################################### +conn.drm.totalConns=1 +conn.drm1.hostport=[DRM_HOST]:[DRM_PORT] +conn.drm1.clientNickname=[HSM_LABEL][NICKNAME] +conn.drm1.servlet.GenerateKeyPair=/kra/agent/kra/GenerateKeyPair +conn.drm1.servlet.TokenKeyRecovery=/kra/agent/kra/TokenKeyRecovery +conn.drm1.retryConnect=3 +conn.drm1.timeout=100 +conn.drm1.SSLOn=true +conn.drm1.keepAlive=false +auth.instance._000=######################################## +auth.instance._001=# publishing +auth.instance._002=# +auth.instance._003=# publisher.instance..libraryName: +auth.instance._004=# - name of the library specified with a fully qualified path name +auth.instance._005=# publisher.instance..libraryFactory: +auth.instance._006=# - the name of the function which instantiates the publisher +auth.instance._007=# publisher.instance..publisherId: +auth.instance._008=# - the publisher ID +auth.instance._009=# +auth.instance._010=# where +auth.instance._011=# - publisher connection ID +auth.instance._012=######################################## +auth.instance._013=######################################### +auth.instance._014=# authentication +auth.instance._015=# +auth.instance._016=# auth.instance..libraryName: +auth.instance._017=# - name of the library specified with a fully qualified path name +auth.instance._018=# auth.instance..libraryFactory: +auth.instance._019=# - the name of the function which instantiates the authentication +auth.instance._020=# auth.instance..authId +auth.instance._021=# - the authentication ID +auth.instance._022=# auth.instance..hostport +auth.instance._023=# - parameter specific to the given authentication, +auth.instance._024=# i. e., LDAPAuthentication (id=ldap1) +auth.instance._025=# - host name and port number, host:port +auth.instance._026=# - for failover, provide multiple host:port designations +auth.instance._027=# separated by " " +auth.instance._028=# auth.instance..SSLOn: +auth.instance._029=# - parameter specific to the given authentication, +auth.instance._030=# i. e., LDAPAuthentication (id=ldap1) +auth.instance._031=# - use SSL or not for LDAP service +auth.instance._032=# auth.instance..retries: +auth.instance._033=# - parameter specific to the given authentication, +auth.instance._034=# i. e., LDAPAuthentication (id=ldap1) +auth.instance._035=# - number of authentication re-attempts when authentication failed +auth.instance._036=# auth.instance..retryConnect: +auth.instance._037=# - parameter specific to the given authentication, +auth.instance._038=# i. e., LDAPAuthentication (id=ldap1) +auth.instance._039=# - number of connection re-attempts when connection failed +auth.instance._040=# +auth.instance._041=# where +auth.instance._042=# - authentication connection ID +auth.instance._043=######################################### +auth.instance.0.type=LDAP_Authentication +auth.instance.0.libraryName=[SYSTEM_USER_LIBRARIES]/tps/[LIB_PREFIX]ldapauth[OBJ_EXT] +auth.instance.0.libraryFactory=GetAuthentication +auth.instance.0.authId=ldap1 +auth.instance.0.hostport=[LDAP_HOST]:[LDAP_PORT] +auth.instance.0.SSLOn=false +auth.instance.0.retries=1 +auth.instance.0.retryConnect=3 +auth.instance.0.baseDN=[LDAP_ROOT] +auth.instance.0.ssl=false +auth.instance.0.attributes._001=############################################## +auth.instance.0.attributes._002=# attributes will be available +auth.instance.0.attributes._003=# as $auth.$ +auth.instance.0.attributes._004=############################################## +auth.instance.0.attributes=mail,cn,uid +auth.instance.0.ui.title.en=LDAP Authentication +auth.instance.0.ui.description.en=This authenticates user against the LDAP directory. +auth.instance.0.ui.id.UID.name.en=LDAP User ID +auth.instance.0.ui.id.PASSWORD.name.en=LDAP Password +auth.instance.0.ui.id.UID.description.en=LDAP User ID +auth.instance.0.ui.id.PASSWORD.description.en=LDAP Password +auth.instance.1.type=LDAP_Authentication +auth.instance.1.libraryName=[SYSTEM_USER_LIBRARIES]/tps/[LIB_PREFIX]ldapauth[OBJ_EXT] +auth.instance.1.libraryFactory=GetAuthentication +auth.instance.1.authId=ldap2 +auth.instance.1.bindDN=cn=Directory Manager +auth.instance.1.bindPWD=[PKI_INSTANCE_PATH]/conf/password.conf +auth.instance.1.hostport=[TOKENDB_HOST]:[TOKENDB_PORT] +auth.instance.1.SSLOn=false +auth.instance.1.retries=1 +auth.instance.1.retryConnect=3 +auth.instance.1.baseDN=[TOKENDB_ROOT] +auth.instance.1.ssl=false +auth.instance.1.attributes._001=############################################## +auth.instance.1.attributes._002=# attributes will be available +auth.instance.1.attributes._003=# as $auth.$ +auth.instance.1.attributes._004=############################################## +auth.instance.1.attributes=mail,cn,uid +auth.instance.1.ui.title.en=LDAP Authentication +auth.instance.1.ui.description.en=This authenticates user against the LDAP directory. +auth.instance.1.ui.id.UID.name.en=LDAP User ID +auth.instance.1.ui.id.PASSWORD.name.en=LDAP Password +auth.instance.1.ui.id.UID.description.en=LDAP User ID +auth.instance.1.ui.id.PASSWORD.description.en=LDAP Password +applet._000=######################################### +applet._001=# applet information +applet._002=# SAF Key: +applet._003=# applet.aid.cardmgr_instance=A0000001510000 +applet._004=######################################### +applet.aid.cardmgr_instance=A0000000030000 +applet.aid.netkey_instance=627601FF000000 +applet.aid.netkey_file=627601FF0000 +applet.aid.netkey_old_instance=A00000000101 +applet.aid.netkey_old_file=A000000001 +applet.so_pin=000000000000 +applet.delete_old=true +general.verifyProof=1 +general.applet_ext=ijc +general.search.sizelimit.max=2000 +general.search.sizelimit.default=100 +general.search.timelimit.max=10 +general.search.timelimit.default=10 +general.pwlength.min=16 +channel._000=######################################### +channel._001=# channel.encryption: +channel._002=# +channel._003=# - enable encryption for all operation commands to token +channel._004=# - default is true +channel._005=# channel.blocksize=242 +channel._006=# channel.defKeyVersion=0 +channel._007=# channel.defKeyIndex=0 +channel._008=######################################### +channel.encryption=true +channel.blocksize=248 +channel.defKeyVersion=0 +channel.defKeyIndex=0 +# NOTE: Since the following comments will be 'scrubbed' from any TPS +# instance's configuration file, they will ONLY be viewable in +# the '/usr/share/pki/tps/conf/CS.cfg' TPS subsystem template! +# +# Config the size of memory managed memory in the applet +# Default is 5000, try not go get close to the instanceSize +# which defaults to 18000: +# +# * channel.instanceSize=18000 +# * channel.appletMemorySize=5000 +# +preop.pin=[PKI_RANDOM_NUMBER] +cms.product.version=@APPLICATION_VERSION@ +preop.cert._000=######################################### +preop.cert._001=# Installation configuration "preop" certs parameters +preop.cert._002=######################################### +preop.cert.list=sslserver,subsystem,audit_signing +tps.cert.audit_signing.certusage=ObjectSigner +tps.cert.sslserver.certusage=SSLServer +tps.cert.subsystem.certusage=SSLClient +preop.cert.sslserver.enable=true +preop.cert.subsystem.enable=true +preop.cert.audit_signing.enable=false +preop.cert.sslserver.defaultSigningAlgorithm=SHA256withRSA +preop.cert.sslserver.dn=CN=[PKI_HOSTNAME], OU=[PKI_INSTANCE_NAME] +preop.cert.sslserver.keysize.customsize=2048 +preop.cert.sslserver.keysize.size=2048 +preop.cert.sslserver.keysize.select=default +preop.cert.sslserver.nickname=Server-Cert cert-[PKI_INSTANCE_NAME] +preop.cert.sslserver.profile=caInternalAuthServerCert +preop.cert.sslserver.subsystem=tps +preop.cert._003=#preop.cert.sslserver.type=local +preop.cert.sslserver.userfriendlyname=SSL Server Certificate +preop.cert._004=#preop.cert.sslserver.cncomponent.override=false +preop.cert.subsystem.defaultSigningAlgorithm=SHA256withRSA +preop.cert.subsystem.dn=CN=TPS Subsystem Certificate, OU=[PKI_INSTANCE_NAME] +preop.cert.subsystem.keysize.customsize=2048 +preop.cert.subsystem.keysize.size=2048 +preop.cert.subsystem.keysize.select=default +preop.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] +preop.cert.subsystem.profile=caInternalAuthSubsystemCert +preop.cert.subsystem.subsystem=tps +preop.cert._005=#preop.cert.subsystem.type=local +preop.cert.subsystem.userfriendlyname=Subsystem Certificate +preop.cert._006=#preop.cert.subsystem.cncomponent.override=true +preop.cert.audit_signing.defaultSigningAlgorithm=SHA256withRSA +preop.cert.audit_signing.dn=CN=TPS Audit Signing Certificate, OU=[PKI_INSTANCE_NAME] +preop.cert.audit_signing.keysize.customsize=2048 +preop.cert.audit_signing.keysize.size=2048 +preop.cert.audit_signing.keysize.select=default +preop.cert.audit_signing.nickname=auditSigningCert cert-[PKI_INSTANCE_NAME] +preop.cert.audit_signing.profile=caInternalAuthAuditSigningCert +preop.cert.audit_signing.subsystem=tps +preop.cert._005=#preop.cert.audit_signing.type=local +preop.cert.audit_signing.userfriendlyname=Audit Log Signing Certificate +preop.cert._006=#preop.cert.audit_signing.cncomponent.override=true +preop.configModules._000=######################################### +preop.configModules._001=# Installation configuration "preop" module parameters +preop.configModules._002=######################################### +preop.configModules.count=3 +preop.configModules.module0.commonName=NSS Internal PKCS #11 Module +preop.configModules.module0.imagePath=/pki/images/clearpixel.gif +preop.configModules.module0.userFriendlyName=NSS Internal PKCS #11 Module +preop.configModules.module1.commonName=nfast +preop.configModules.module1.imagePath=/pki/images/clearpixel.gif +preop.configModules.module1.userFriendlyName=nCipher's nFast Token Hardware Module +preop.configModules.module2.commonName=lunasa +preop.configModules.module2.imagePath=/pki/images/clearpixel.gif +preop.configModules.module2.userFriendlyName=SafeNet's LunaSA Token Hardware Module +preop.module.token=NSS Certificate DB +preop.keysize._000=######################################### +preop.keysize._001=# Installation configuration "preop" keysize parameters +preop.keysize._002=######################################### +preop.keysize.customsize=2048 +preop.keysize.select=default +preop.keysize.size=2048 +preop.keysize.ecc.size=256 +preop.adminauth.done=false +preop.adminpanel.done=false +preop.agentauth.done=false +preop.authdb.done=false +preop.cainfo.done=false +preop.certprettyprint.done=false +preop.certrequest.done=false +preop.confighsmlogin.done=false +preop.confighsm.done=false +preop.database.done=false +preop.displaycertchain2.done=false +preop.displaycertchain.done=false +preop.donepanel.done=false +preop.drminfo.done=false +preop.importadmincert.done=false +preop.loginpanel.done=false +preop.ModulePanel.done=false +preop.namepanel.done=false +preop.securitydomain.done=false +preop.SizePanel.done=false +preop.subsystemtype.done=false +preop.tksinfo.done=false +preop.welcome.done=false +op.enroll._000=######################################### +op.enroll._001=# Default Operations +op.enroll._002=# +op.enroll._003=# op..mapping.order=,, +op.enroll._004=# - contains at least one value or a series +op.enroll._005=# of comma-separated mapping values which +op.enroll._006=# are checked in sequential order +op.enroll._007=# op..mapping..filter.tokenType=userKey +op.enroll._008=# - can be either empty or token type +op.enroll._009=# specified by the client +op.enroll._010=# op..mapping..filter.tokenATR= +op.enroll._011=# - can be either empty or token ATR +op.enroll._012=# specified by the client +op.enroll._013=# op..mapping..filter.appletMajorVersion=1 +op.enroll._014=# - can be either empty or applet major version +op.enroll._015=# specified by the client +op.enroll._016=# op..mapping..filter.appletMinorVersion= +op.enroll._017=# - can be either empty or applet minor version +op.enroll._018=# specified by the client +op.enroll._019=# - if major and minor versions are both zero, this +op.enroll._020=# indicate there is no applet on the token. +op.enroll._021=# op..mapping..target.tokenType=userKey +op.enroll._022=# - if tokenType, tokenATR, appletMajorVersion, +op.enroll._023=# and appletMinorVersion are matched, value in +op.enroll._024=# targetTokenType will be used to locate +op.enroll._025=# the corresponding token profile to +op.enroll._026=# process the request. +op.enroll._027=# +op.enroll._028=# where +op.enroll._029=# - operation; enroll,pinReset,format +op.enroll._030=# - mapping ID; order is specifiable +op.enroll._031=# +op.enroll._032=# Token ATR: +op.enroll._033=# Web Store - 3B759400006202020201 +op.enroll._034=######################################### +op.enroll.mapping.order=0,1,2 +op.enroll.mapping.0.filter.tokenType=userKey +op.enroll.mapping.0.filter.tokenATR= +op.enroll.mapping.0.filter.tokenCUID.start= +op.enroll.mapping.0.filter.tokenCUID.end= +op.enroll.mapping.0.filter.appletMajorVersion=1 +op.enroll.mapping.0.filter.appletMinorVersion= +op.enroll.mapping.0.target.tokenType=userKey +op.enroll.mapping.1.filter.tokenType=soKey +op.enroll.mapping.1.filter.tokenATR= +op.enroll.mapping.1.filter.tokenCUID.start= +op.enroll.mapping.1.filter.tokenCUID.end= +op.enroll.mapping.1.filter.appletMajorVersion= +op.enroll.mapping.1.filter.appletMinorVersion= +op.enroll.mapping.1.target.tokenType=soKey +op.enroll.mapping.2.filter.tokenType= +op.enroll.mapping.2.filter.tokenATR= +op.enroll.mapping.2.filter.tokenCUID.start= +op.enroll.mapping.2.filter.tokenCUID.end= +op.enroll.mapping.2.filter.appletMajorVersion= +op.enroll.mapping.2.filter.appletMinorVersion= +op.enroll.mapping.2.target.tokenType=userKey +op.pinReset.mapping.order=0 +op.pinReset.mapping.0.filter.tokenType= +op.pinReset.mapping.0.filter.tokenATR= +op.pinReset.mapping.0.filter.tokenCUID.start= +op.pinReset.mapping.0.filter.tokenCUID.end= +op.pinReset.mapping.0.filter.appletMajorVersion= +op.pinReset.mapping.0.filter.appletMinorVersion= +op.pinReset.mapping.0.target.tokenType=userKey +op.format.mapping.order=0,1,2,3,4,5,6 +op.format.mapping.0.filter.tokenType=soCleanUserToken +op.format.mapping.0.filter.tokenATR= +op.format.mapping.0.filter.tokenCUID.start= +op.format.mapping.0.filter.tokenCUID.end= +op.format.mapping.0.filter.appletMajorVersion= +op.format.mapping.0.filter.appletMinorVersion= +op.format.mapping.0.target.tokenType=soCleanUserToken +op.format.mapping.1.filter.tokenType=soUserKey +op.format.mapping.1.filter.tokenATR= +op.format.mapping.1.filter.tokenCUID.start= +op.format.mapping.1.filter.tokenCUID.end= +op.format.mapping.1.filter.appletMajorVersion= +op.format.mapping.1.filter.appletMinorVersion= +op.format.mapping.1.target.tokenType=soUserKey +op.format.mapping.2.filter.tokenType=soKey +op.format.mapping.2.filter.tokenATR= +op.format.mapping.2.filter.tokenCUID.start= +op.format.mapping.2.filter.tokenCUID.end= +op.format.mapping.2.filter.appletMajorVersion= +op.format.mapping.2.filter.appletMinorVersion= +op.format.mapping.2.target.tokenType=soKey +op.format.mapping.3.filter.tokenType=userKey +op.format.mapping.3.filter.tokenATR= +op.format.mapping.3.filter.tokenCUID.start= +op.format.mapping.3.filter.tokenCUID.end= +op.format.mapping.3.filter.appletMajorVersion= +op.format.mapping.3.filter.appletMinorVersion= +op.format.mapping.3.target.tokenType=userKey +op.format.mapping.4.filter.tokenType=soCleanSOToken +op.format.mapping.4.filter.tokenATR= +op.format.mapping.4.filter.tokenCUID.start= +op.format.mapping.4.filter.tokenCUID.end= +op.format.mapping.4.filter.appletMajorVersion= +op.format.mapping.4.filter.appletMinorVersion= +op.format.mapping.5.filter.tokenType=cleanToken +op.format.mapping.5.filter.tokenATR= +op.format.mapping.5.filter.tokenCUID.start= +op.format.mapping.5.filter.tokenCUID.end= +op.format.mapping.5.filter.appletMajorVersion= +op.format.mapping.5.filter.appletMinorVersion= +op.format.mapping.5.target.tokenType=cleanToken +op.format.mapping.4.target.tokenType=soCleanSOToken +op.format.mapping.6.filter.tokenATR= +op.format.mapping.6.filter.tokenCUID.start= +op.format.mapping.6.filter.tokenCUID.end= +op.format.mapping.6.filter.appletMajorVersion= +op.format.mapping.6.filter.appletMinorVersion= +op.format.mapping.6.target.tokenType=tokenKey +op.enroll.userKey._000=######################################### +op.enroll.userKey._001=# Enrollment Operation For CoolKey +op.enroll.userKey._002=# +op.enroll.userKey._003=# op.enroll..keyGen..keySize=1024 +op.enroll.userKey._004=# - size of the key the token should generate +op.enroll.userKey._005=# - max value: 1024 +op.enroll.userKey._006=# +op.enroll.userKey._007=# op.enroll..keyGen..keyCapabilities.encrypt=false +op.enroll.userKey._008=# op.enroll..keyGen..keyCapabilities.sign=true +op.enroll.userKey._009=# op.enroll..keyGen..keyCapabilities.signRecover=true +op.enroll.userKey._010=# op.enroll..keyGen..keyCapabilities.decrypt=false +op.enroll.userKey._011=# op.enroll..keyGen..keyCapabilities.derive=false +op.enroll.userKey._012=# op.enroll..keyGen..keyCapabilities.unwrap=false +op.enroll.userKey._013=# op.enroll..keyGen..keyCapabilities.wrap=false +op.enroll.userKey._014=# op.enroll..keyGen..keyCapabilities.verifyRecover=true +op.enroll.userKey._015=# op.enroll..keyGen..keyCapabilities.verify=true +op.enroll.userKey._016=# op.enroll..keyGen..keyCapabilities.sensitive=true +op.enroll.userKey._017=# op.enroll..keyGen..keyCapabilities.private=true +op.enroll.userKey._018=# op.enroll..keyGen..keyCapabilities.token=true +op.enroll.userKey._019=# - specify the PKCS11 attributes to set on the token +op.enroll.userKey._020=# +op.enroll.userKey._021=# op.enroll.userKey.keyGen.signing.cuid_label +op.enroll.userKey._022=# - specify the CUID shown in the certificate +op.enroll.userKey._023=# +op.enroll.userKey._024=# op.enroll.userKey.keyGen.signing.label +op.enroll.userKey._025=# - specify the token name. all resulting labels for co-existing keys +op.enroll.userKey._026=# on the same token must be unique +op.enroll.userKey._027=# - $pretty_cuid$ - Pretty Print CUID (i.e. 4090-0062-FF02-0000-0B9C) +op.enroll.userKey._028=# - $cuid$ - CUID (i.e. 40900062FF0200000B9C) +op.enroll.userKey._029=# - $msn$ - MSN +op.enroll.userKey._030=# - $userid$ - User ID +op.enroll.userKey._031=# - $profileId$ - Profile ID +op.enroll.userKey._032=# +op.enroll.userKey._033=# op.enroll..keyGen..overwrite=true|false +op.enroll.userKey._034=# - if key and certificate exist, should RA overwrite them +op.enroll.userKey._035=# +op.enroll.userKey._036=# op.enroll..keyGen..certId=C1 +op.enroll.userKey._037=# op.enroll..keyGen..certAttrId=c1 +op.enroll.userKey._038=# op.enroll..keyGen..privateKeyAttrId=k2 +op.enroll.userKey._039=# op.enroll..keyGen..publicKeyAttrId=k3 +op.enroll.userKey._040=# op.enroll..keyGen..privateKeyNumber=2 +op.enroll.userKey._041=# op.enroll..keyGen..publicKeyNumber=3 +op.enroll.userKey._042=# - specify name PKCS11 object IDs +op.enroll.userKey._043=# - Lower case letters signify objects containing PKCS11 object attributes, +op.enroll.userKey._044=# in the format described below. +op.enroll.userKey._045=# 'c' An object containing PKCS11 attributes for a certificate. +op.enroll.userKey._046=# 'k' An object containing PKCS11 attributes for a public or private key +op.enroll.userKey._047=# 'r' An object containing PKCS11 attributes for an "reader". +op.enroll.userKey._048=# - Upper case letters signify objects containing raw data corresponding to +op.enroll.userKey._049=# the lower case letters described above. For example, object "C0" +op.enroll.userKey._050=# contains raw data corresponding to object "c0". +op.enroll.userKey._051=# 'C' This object contains an entire DER cert, and nothing else. +op.enroll.userKey._052=# 'K' This object contains a MUSCLE "key blob". TPS does not use this. +op.enroll.userKey._053=# +op.enroll.userKey._054=# op.enroll..keyGen..keyUsage=0 +op.enroll.userKey._055=# op.enroll..keyGen..keyUser=0 +op.enroll.userKey._056=# - user specifies which PIN user should be granted +op.enroll.userKey._057=# use privilege of the generated private key, or +op.enroll.userKey._058=# 15 if all users have use privilege for the private key +op.enroll.userKey._059=# - Valid uage: (only specifies the usage for the private key) +op.enroll.userKey._060=# 0 - default usage (Signing only for this APDU) +op.enroll.userKey._061=# 1 - signing only +op.enroll.userKey._062=# 2 - decryption only +op.enroll.userKey._063=# 3 - signing and decryption +op.enroll.userKey._064=# +op.enroll.userKey._065=# op.enroll..pkcs11obj.enable=true|false +op.enroll.userKey._066=# - enable writing of PKCS11 cache object to the token +op.enroll.userKey._067=# +op.enroll.userKey._068=# op.enroll..pkcs11obj.compress.enable=true|false +op.enroll.userKey._069=# - enable compression for writing of PKCS11 cache object to the token +op.enroll.userKey._070=# +op.enroll.userKey._071=# op.enroll..pinReset.pin.maxRetries=127 +op.enroll.userKey._072=# - max number of retries before blocking the token +op.enroll.userKey._073=# - max value: 127 +op.enroll.userKey._074=# +op.enroll.userKey._075=# There is a special case of tokenType userKeyTemporary. +op.enroll.userKey._076=# Make sure the profile specified by the profileId to have +op.enroll.userKey._077=# short validity period (eg, 7 days) for the certificate. +op.enroll.userKey._078=# +op.enroll.userKey._079=# The three recovery schemes supported are: +op.enroll.userKey._080=# +op.enroll.userKey._081=# * GenerateNewKey - Generate a new +op.enroll.userKey._082=# cert for the +op.enroll.userKey._083=# encryption cert. +op.enroll.userKey._084=# * RecoverLast - Recover the most +op.enroll.userKey._085=# recent cert for the +op.enroll.userKey._086=# encryption cert. +op.enroll.userKey._087=# * GenerateNewKeyandRecoverLast - Generate new cert AND +op.enroll.userKey._088=# recover last for +op.enroll.userKey._089=# encryption cert. +op.enroll.userKey._090=######################################### +op.enroll.allowUnknownToken=true +op.enroll.userKey.temporaryToken.tokenType=userKeyTemporary +op.enroll.userKey.keyGen.recovery.destroyed.keyType.num=2 +op.enroll.userKey.keyGen.recovery.destroyed.keyType.value.0=signing +op.enroll.userKey.keyGen.recovery.destroyed.keyType.value.1=encryption +op.enroll.userKey.keyGen.signing.recovery.destroyed.scheme=GenerateNewKey +op.enroll.userKey.keyGen.signing.recovery.destroyed.revokeCert=true +op.enroll.userKey.keyGen.signing.recovery.destroyed.revokeCert.reason=0 +op.enroll.userKey.keyGen.encryption.recovery.destroyed.scheme=RecoverLast +op.enroll.userKey.keyGen.encryption.recovery.destroyed.revokeCert=false +op.enroll.userKey.keyGen.encryption.recovery.destroyed.revokeCert.reason=0 +op.enroll.userKey.keyGen.recovery.keyCompromise.keyType.num=2 +op.enroll.userKey.keyGen.recovery.keyCompromise.keyType.value.0=signing +op.enroll.userKey.keyGen.recovery.keyCompromise.keyType.value.1=encryption +op.enroll.userKey.keyGen.signing.recovery.keyCompromise.scheme=GenerateNewKey +op.enroll.userKey.keyGen.signing.recovery.keyCompromise.revokeCert=true +op.enroll.userKey.keyGen.signing.recovery.keyCompromise.revokeCert.reason=1 +op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.scheme=GenerateNewKey +op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.revokeCert=true +op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.revokeCert.reason=1 +op.enroll.userKey.keyGen.recovery.onHold.keyType.num=2 +op.enroll.userKey.keyGen.recovery.onHold.keyType.value.0=signing +op.enroll.userKey.keyGen.recovery.onHold.keyType.value.1=encryption +op.enroll.userKey.keyGen.signing.recovery.onHold.scheme=GenerateNewKey +op.enroll.userKey.keyGen.signing.recovery.onHold.revokeCert=true +op.enroll.userKey.keyGen.signing.recovery.onHold.revokeCert.reason=6 +op.enroll.userKey.keyGen.encryption.recovery.onHold.scheme=GenerateNewKey +op.enroll.userKey.keyGen.encryption.recovery.onHold.revokeCert=true +op.enroll.userKey.keyGen.encryption.recovery.onHold.revokeCert.reason=6 +op.enroll.userKey.keyGen.tokenName=$auth.cn$ +op.enroll.userKey.keyGen.keyType.num=2 +op.enroll.userKey.keyGen.keyType.value.0=signing +op.enroll.userKey.keyGen.keyType.value.1=encryption +op.enroll.userKey.keyGen.signing.keySize=1024 +op.enroll.userKey.keyGen.signing.public.keyCapabilities.encrypt=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.sign=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.signRecover=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.decrypt=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.derive=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.unwrap=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.wrap=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.verifyRecover=true +op.enroll.userKey.keyGen.signing.public.keyCapabilities.verify=true +op.enroll.userKey.keyGen.signing.public.keyCapabilities.sensitive=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.private=false +op.enroll.userKey.keyGen.signing.public.keyCapabilities.token=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.encrypt=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.sign=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.signRecover=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.decrypt=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.derive=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.unwrap=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.wrap=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.verifyRecover=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.verify=false +op.enroll.userKey.keyGen.signing.private.keyCapabilities.sensitive=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.private=true +op.enroll.userKey.keyGen.signing.private.keyCapabilities.token=true +op.enroll.userKey.keyGen.signing.label=signing key for $userid$ +op.enroll.userKey.keyGen.signing.cuid_label=$cuid$ +op.enroll.userKey.keyGen.signing.overwrite=true +op.enroll.userKey.keyGen.signing.certId=C1 +op.enroll.userKey.keyGen.signing.certAttrId=c1 +op.enroll.userKey.keyGen.signing.privateKeyAttrId=k2 +op.enroll.userKey.keyGen.signing.publicKeyAttrId=k3 +op.enroll.userKey.keyGen.signing.keyUsage=0 +op.enroll.userKey.keyGen.signing.keyUser=0 +op.enroll.userKey.keyGen.signing.privateKeyNumber=2 +op.enroll.userKey.keyGen.signing.publicKeyNumber=3 +op.enroll.userKey.keyGen.signing.ca.profileId=caTokenUserSigningKeyEnrollment +op.enroll.userKey.keyGen.signing.ca.conn=ca1 +op.enroll.userKey._079=#op.enroll.userKey.keyGen.signing.publisherId=fileBasedPublisher +op.enroll.userKey.keyGen.encryption.keySize=1024 +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.encrypt=true +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.sign=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.signRecover=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.decrypt=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.derive=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.unwrap=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.wrap=true +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.verifyRecover=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.verify=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.sensitive=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.private=false +op.enroll.userKey.keyGen.encryption.public.keyCapabilities.token=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.encrypt=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.sign=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.signRecover=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.decrypt=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.derive=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.unwrap=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.wrap=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.verifyRecover=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.verify=false +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.sensitive=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.private=true +op.enroll.userKey.keyGen.encryption.private.keyCapabilities.token=true +op.enroll.userKey.keyGen.encryption.label=encryption key for $userid$ +op.enroll.userKey.keyGen.encryption.cuid_label=$cuid$ +op.enroll.userKey.keyGen.encryption.overwrite=true +op.enroll.userKey.keyGen.encryption.certId=C2 +op.enroll.userKey.keyGen.encryption.certAttrId=c2 +op.enroll.userKey.keyGen.encryption.privateKeyAttrId=k4 +op.enroll.userKey.keyGen.encryption.publicKeyAttrId=k5 +op.enroll.userKey.keyGen.encryption.keyUsage=0 +op.enroll.userKey.keyGen.encryption.keyUser=0 +op.enroll.userKey.keyGen.encryption.privateKeyNumber=4 +op.enroll.userKey.keyGen.encryption.publicKeyNumber=5 +op.enroll.userKey.keyGen.encryption.ca.profileId=caTokenUserEncryptionKeyEnrollment +op.enroll.userKey.keyGen.encryption.ca.conn=ca1 +op.enroll.userKey.pkcs11obj.enable=true +op.enroll.userKey.pkcs11obj.compress.enable=true +op.enroll.userKey.update.applet.emptyToken.enable=true +op.enroll.userKey.update.applet.enable=true +op.enroll.userKey.update.applet.requiredVersion=1.4.4d40a449 +op.enroll.userKey.update.applet.directory=[TPS_DIR]/applets +op.enroll.userKey.update.applet.encryption=true +op.enroll.userKey.update.symmetricKeys.enable=false +op.enroll.userKey.update.symmetricKeys.requiredVersion=1 +op.enroll.userKey.loginRequest.enable=true +op.enroll.userKey.pinReset.enable=true +op.enroll.userKey.pinReset.pin.maxRetries=127 +op.enroll.userKey.pinReset.pin.minLen=4 +op.enroll.userKey.pinReset.pin.maxLen=10 +op.enroll.userKey.cardmgr_instance=A0000000030000 +op.enroll.userKey.tks.conn=tks1 +op.enroll.userKey.auth.id=ldap1 +op.enroll.userKey.auth.enable=true +op.enroll.userKey.issuerinfo.enable=true +op.enroll.userKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi +op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.num=2 +op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.value.0=signing +op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.value.1=encryption +op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.scheme=GenerateNewKey +op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.revokeCert=true +op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.revokeCert.reason=0 +op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.scheme=RecoverLast +op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert=true +op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert.reason=0 +op.enroll.userKey.keyGen.encryption.serverKeygen.enable=[SERVER_KEYGEN] +op.enroll.userKey.keyGen.encryption.serverKeygen.drm.conn=drm1 +op.enroll.userKey.keyGen.encryption.serverKeygen.archive=true +op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.enable=true +op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.drm.conn=drm1 +op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.archive=true +op.enroll.userKeyTemporary.keyGen.tokenName=$auth.cn$ (Temporary) +op.enroll.userKeyTemporary.keyGen.keyType.num=3 +op.enroll.userKeyTemporary.keyGen.keyType.value.0=auth +op.enroll.userKeyTemporary.keyGen.keyType.value.1=signing +op.enroll.userKeyTemporary.keyGen.keyType.value.2=encryption +op.enroll.userKeyTemporary.keyGen.auth.keySize=1024 +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.sign=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.signRecover=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.verifyRecover=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.verify=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.sensitive=true +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.private=false +op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.sign=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.signRecover=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.verifyRecover=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.verify=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.sensitive=true +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.private=false +op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.auth.label=Temporary Key for $userid$ +op.enroll.userKeyTemporary.keyGen.auth.cuid_label=$cuid$ +op.enroll.userKeyTemporary.keyGen.auth.overwrite=false +op.enroll.userKeyTemporary.keyGen.auth.certId=C0 +op.enroll.userKeyTemporary.keyGen.auth.certAttrId=c0 +op.enroll.userKeyTemporary.keyGen.auth.privateKeyAttrId=k0 +op.enroll.userKeyTemporary.keyGen.auth.publicKeyAttrId=k1 +op.enroll.userKeyTemporary.keyGen.auth.keyUsage=0 +op.enroll.userKeyTemporary.keyGen.auth.keyUser=15 +op.enroll.userKeyTemporary.keyGen.auth.privateKeyNumber=0 +op.enroll.userKeyTemporary.keyGen.auth.publicKeyNumber=1 +op.enroll.userKeyTemporary.keyGen.auth.ca.profileId=caTempTokenDeviceKeyEnrollment +op.enroll.userKeyTemporary.keyGen.auth.ca.conn=ca1 +op.enroll.userKeyTemporary.keyGen.signing.keySize=1024 +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.sign=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.signRecover=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.verifyRecover=true +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.verify=true +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.sensitive=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.private=false +op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.sign=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.signRecover=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.verifyRecover=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.verify=false +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.sensitive=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.private=true +op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.signing.label=signing key for $userid$ +op.enroll.userKeyTemporary.keyGen.signing.cuid_label=$cuid$ +op.enroll.userKeyTemporary.keyGen.signing.overwrite=true +op.enroll.userKeyTemporary.keyGen.signing.certId=C1 +op.enroll.userKeyTemporary.keyGen.signing.certAttrId=c1 +op.enroll.userKeyTemporary.keyGen.signing.privateKeyAttrId=k2 +op.enroll.userKeyTemporary.keyGen.signing.publicKeyAttrId=k3 +op.enroll.userKeyTemporary.keyGen.signing.keyUsage=0 +op.enroll.userKeyTemporary.keyGen.signing.keyUser=0 +op.enroll.userKeyTemporary.keyGen.signing.privateKeyNumber=2 +op.enroll.userKeyTemporary.keyGen.signing.publicKeyNumber=3 +op.enroll.userKeyTemporary.keyGen.signing.ca.profileId=caTempTokenUserSigningKeyEnrollment +op.enroll.userKeyTemporary.keyGen.signing.ca.conn=ca1 +op.enroll.userKey._080=#op.enroll.userKeyTemporary.keyGen.signing.publisherId=fileBasedPublisher +op.enroll.userKeyTemporary.keyGen.encryption.keySize=1024 +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.encrypt=true +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.sign=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.signRecover=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.decrypt=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.unwrap=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.wrap=true +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.verifyRecover=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.verify=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.sensitive=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.private=false +op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.encrypt=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.sign=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.signRecover=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.decrypt=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.derive=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.unwrap=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.wrap=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.verifyRecover=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.verify=false +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.sensitive=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.private=true +op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.token=true +op.enroll.userKeyTemporary.keyGen.encryption.label=encryption key for $userid$ +op.enroll.userKeyTemporary.keyGen.encryption.cuid_label=$cuid$ +op.enroll.userKeyTemporary.keyGen.encryption.overwrite=true +op.enroll.userKeyTemporary.keyGen.encryption.certId=C2 +op.enroll.userKeyTemporary.keyGen.encryption.certAttrId=c2 +op.enroll.userKeyTemporary.keyGen.encryption.privateKeyAttrId=k4 +op.enroll.userKeyTemporary.keyGen.encryption.publicKeyAttrId=k5 +op.enroll.userKeyTemporary.keyGen.encryption.keyUsage=0 +op.enroll.userKeyTemporary.keyGen.encryption.keyUser=0 +op.enroll.userKeyTemporary.keyGen.encryption.privateKeyNumber=4 +op.enroll.userKeyTemporary.keyGen.encryption.publicKeyNumber=5 +op.enroll.userKeyTemporary.keyGen.encryption.ca.profileId=caTempTokenUserEncryptionKeyEnrollment +op.enroll.userKeyTemporary.keyGen.encryption.ca.conn=ca1 +op.enroll.userKeyTemporary.pkcs11obj.enable=true +op.enroll.userKeyTemporary.pkcs11obj.compress.enable=true +op.enroll.userKeyTemporary.update.applet.emptyToken.enable=true +op.enroll.userKeyTemporary.update.applet.enable=true +op.enroll.userKeyTemporary.update.applet.requiredVersion=1.4.4d40a449 +op.enroll.userKeyTemporary.update.applet.directory=[TPS_DIR]/applets +op.enroll.userKeyTemporary.update.applet.encryption=true +op.enroll.userKeyTemporary.update.symmetricKeys.enable=false +op.enroll.userKeyTemporary.update.symmetricKeys.requiredVersion=1 +op.enroll.userKeyTemporary.loginRequest.enable=true +op.enroll.userKeyTemporary.pinReset.enable=true +op.enroll.userKeyTemporary.pinReset.pin.maxRetries=127 +op.enroll.userKeyTemporary.pinReset.pin.minLen=4 +op.enroll.userKeyTemporary.pinReset.pin.maxLen=10 +op.enroll.userKeyTemporary.tks.conn=tks1 +op.enroll.userKeyTemporary.cardmgr_instance=A0000000030000 +op.enroll.userKeyTemporary.auth.id=ldap1 +op.enroll.userKeyTemporary.auth.enable=true +op.enroll.userKey.renewal._000=######################################### +op.enroll.userKey.renewal._001=# Token Renewal. +op.enroll.userKey.renewal._002=# +op.enroll.userKey.renewal._003=# For each token in TPS UI, set the +op.enroll.userKey.renewal._004=# following to trigger renewal +op.enroll.userKey.renewal._005=# operations: +op.enroll.userKey.renewal._006=# +op.enroll.userKey.renewal._007=# RENEW=YES +op.enroll.userKey.renewal._008=# +op.enroll.userKey.renewal._009=# Optional grace period enforcement +op.enroll.userKey.renewal._010=# must coincide exactly with what +op.enroll.userKey.renewal._011=# the CA enforces. +op.enroll.userKey.renewal._012=# +op.enroll.userKey.renewal._013=# In case of renewal, encryption certId +op.enroll.userKey.renewal._014=# values are for completeness only, server +op.enroll.userKey.renewal._015=# code calculates actual values used. +op.enroll.userKey.renewal._016=# +op.enroll.userKey.renewal._017=######################################### +op.enroll.userKey.renewal.keyType.num=2 +op.enroll.userKey.renewal.keyType.value.0=signing +op.enroll.userKey.renewal.keyType.value.1=encryption +op.enroll.userKey.renewal.signing.enable=true +op.enroll.userKey.renewal.signing.gracePeriod.enable=false +op.enroll.userKey.renewal.signing.gracePeriod.before=30 +op.enroll.userKey.renewal.signing.gracePeriod.after=30 +op.enroll.userKey.renewal.signing.certId=C1 +op.enroll.userKey.renewal.encryption.certId=C2 +op.enroll.userKey.renewal.signing.certAttrId=c1 +op.enroll.userKey.renewal.encryption.certAttrId=c2 +op.enroll.userKey.renewal.encryption.enable=true +op.enroll.userKey.renewal.encryption.gracePeriod.enable=false +op.enroll.userKey.renewal.encryption.gracePeriod.before=30 +op.enroll.userKey.renewal.encryption.gracePeriod.after=30 +op.enroll.userKey.renewal.signing.ca.conn=ca1 +op.enroll.userKey.renewal.encryption.ca.conn=ca1 +op.enroll.userKey.renewal.signing.ca.profileId=caTokenUserSigningKeyRenewal +op.enroll.userKey.renewal.encryption.ca.profileId=caTokenUserEncryptionKeyRenewal +op.enroll.soKey.temporaryToken.tokenType=soKeyTemporary +op.enroll.soKey.keyGen.recovery.destroyed.keyType.num=2 +op.enroll.soKey.keyGen.recovery.destroyed.keyType.value.0=signing +op.enroll.soKey.keyGen.recovery.destroyed.keyType.value.1=encryption +op.enroll.soKey.keyGen.signing.recovery.destroyed.scheme=GenerateNewKey +op.enroll.soKey.keyGen.signing.recovery.destroyed.revokeCert=true +op.enroll.soKey.keyGen.signing.recovery.destroyed.revokeCert.reason=0 +op.enroll.soKey.keyGen.encryption.recovery.destroyed.scheme=RecoverLast +op.enroll.soKey.keyGen.encryption.recovery.destroyed.revokeCert=false +op.enroll.soKey.keyGen.encryption.recovery.destroyed.revokeCert.reason=0 +op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.num=2 +op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.value.0=signing +op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.value.1=encryption +op.enroll.soKey.keyGen.signing.recovery.keyCompromise.scheme=GenerateNewKey +op.enroll.soKey.keyGen.signing.recovery.keyCompromise.revokeCert=true +op.enroll.soKey.keyGen.signing.recovery.keyCompromise.revokeCert.reason=1 +op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.scheme=GenerateNewKey +op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.revokeCert=true +op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.revokeCert.reason=1 +op.enroll.soKey.keyGen.recovery.onHold.keyType.num=2 +op.enroll.soKey.keyGen.recovery.onHold.keyType.value.0=signing +op.enroll.soKey.keyGen.recovery.onHold.keyType.value.1=encryption +op.enroll.soKey.keyGen.signing.recovery.onHold.scheme=GenerateNewKey +op.enroll.soKey.keyGen.signing.recovery.onHold.revokeCert=true +op.enroll.soKey.keyGen.signing.recovery.onHold.revokeCert.reason=6 +op.enroll.soKey.keyGen.encryption.recovery.onHold.scheme=GenerateNewKey +op.enroll.soKey.keyGen.encryption.recovery.onHold.revokeCert=true +op.enroll.soKey.keyGen.encryption.recovery.onHold.revokeCert.reason=6 +op.enroll.soKey.keyGen.tokenName=$auth.cn$ +op.enroll.soKey.keyGen.keyType.num=2 +op.enroll.soKey.keyGen.keyType.value.0=signing +op.enroll.soKey.keyGen.keyType.value.1=encryption +op.enroll.soKey.keyGen.signing.keySize=1024 +op.enroll.soKey.keyGen.signing.public.keyCapabilities.encrypt=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.sign=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.signRecover=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.decrypt=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.derive=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.unwrap=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.wrap=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.verifyRecover=true +op.enroll.soKey.keyGen.signing.public.keyCapabilities.verify=true +op.enroll.soKey.keyGen.signing.public.keyCapabilities.sensitive=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.private=false +op.enroll.soKey.keyGen.signing.public.keyCapabilities.token=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.encrypt=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.sign=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.signRecover=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.decrypt=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.derive=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.unwrap=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.wrap=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.verifyRecover=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.verify=false +op.enroll.soKey.keyGen.signing.private.keyCapabilities.sensitive=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.private=true +op.enroll.soKey.keyGen.signing.private.keyCapabilities.token=true +op.enroll.soKey.keyGen.signing.label=signing key for $userid$ +op.enroll.soKey.keyGen.signing.cuid_label=$cuid$ +op.enroll.soKey.keyGen.signing.overwrite=true +op.enroll.soKey.keyGen.signing.certId=C1 +op.enroll.soKey.keyGen.signing.certAttrId=c1 +op.enroll.soKey.keyGen.signing.privateKeyAttrId=k2 +op.enroll.soKey.keyGen.signing.publicKeyAttrId=k3 +op.enroll.soKey.keyGen.signing.keyUsage=0 +op.enroll.soKey.keyGen.signing.keyUser=0 +op.enroll.soKey.keyGen.signing.privateKeyNumber=2 +op.enroll.soKey.keyGen.signing.publicKeyNumber=3 +op.enroll.soKey.keyGen.signing.ca.profileId=caTokenUserSigningKeyEnrollment +op.enroll.soKey.keyGen.signing.ca.conn=ca1 +op.enroll.soKey._079=#op.enroll.userKey.keyGen.signing.publisherId=fileBasedPublisher +op.enroll.soKey.keyGen.encryption.keySize=1024 +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.encrypt=true +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.sign=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.signRecover=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.decrypt=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.derive=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.unwrap=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.wrap=true +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.verifyRecover=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.verify=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.sensitive=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.private=false +op.enroll.soKey.keyGen.encryption.public.keyCapabilities.token=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.encrypt=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.sign=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.signRecover=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.decrypt=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.derive=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.unwrap=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.wrap=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.verifyRecover=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.verify=false +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.sensitive=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.private=true +op.enroll.soKey.keyGen.encryption.private.keyCapabilities.token=true +op.enroll.soKey.keyGen.encryption.label=encryption key for $userid$ +op.enroll.soKey.keyGen.encryption.cuid_label=$cuid$ +op.enroll.soKey.keyGen.encryption.overwrite=true +op.enroll.soKey.keyGen.encryption.certId=C2 +op.enroll.soKey.keyGen.encryption.certAttrId=c2 +op.enroll.soKey.keyGen.encryption.privateKeyAttrId=k4 +op.enroll.soKey.keyGen.encryption.publicKeyAttrId=k5 +op.enroll.soKey.keyGen.encryption.keyUsage=0 +op.enroll.soKey.keyGen.encryption.keyUser=0 +op.enroll.soKey.keyGen.encryption.privateKeyNumber=4 +op.enroll.soKey.keyGen.encryption.publicKeyNumber=5 +op.enroll.soKey.keyGen.encryption.ca.profileId=caTokenUserEncryptionKeyEnrollment +op.enroll.soKey.keyGen.encryption.ca.conn=ca1 +op.enroll.soKey.pkcs11obj.enable=true +op.enroll.soKey.pkcs11obj.compress.enable=true +op.enroll.soKey.update.applet.emptyToken.enable=true +op.enroll.soKey.update.applet.enable=true +op.enroll.soKey.update.applet.requiredVersion=1.4.4d40a449 +op.enroll.soKey.update.applet.directory=[TPS_DIR]/applets +op.enroll.soKey.update.applet.encryption=true +op.enroll.soKey.update.symmetricKeys.enable=false +op.enroll.soKey.update.symmetricKeys.requiredVersion=1 +op.enroll.soKey.loginRequest.enable=true +op.enroll.soKey.pinReset.enable=true +op.enroll.soKey.pinReset.pin.maxRetries=127 +op.enroll.soKey.pinReset.pin.minLen=4 +op.enroll.soKey.pinReset.pin.maxLen=10 +op.enroll.soKey.cardmgr_instance=A0000000030000 +op.enroll.soKey.tks.conn=tks1 +op.enroll.soKey.auth.id=ldap2 +op.enroll.soKey.auth.enable=true +op.enroll.soKey.issuerinfo.enable=true +op.enroll.soKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/so/index.cgi +op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.num=2 +op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.value.0=signing +op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.value.1=encryption +op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.scheme=GenerateNewKey +op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.revokeCert=true +op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.revokeCert.reason=0 +op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.scheme=RecoverLast +op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert=true +op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert.reason=0 +op.enroll.soKey.keyGen.encryption.serverKeygen.enable=[SERVER_KEYGEN] +op.enroll.soKey.keyGen.encryption.serverKeygen.drm.conn=drm1 +op.enroll.soKey.keyGen.encryption.serverKeygen.archive=true +op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.enable=true +op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.drm.conn=drm1 +op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.archive=true +op.enroll.soKeyTemporary.keyGen.tokenName=$auth.cn$ (Temporary) +op.enroll.soKeyTemporary.keyGen.keyType.num=3 +op.enroll.soKeyTemporary.keyGen.keyType.value.0=auth +op.enroll.soKeyTemporary.keyGen.keyType.value.1=signing +op.enroll.soKeyTemporary.keyGen.keyType.value.2=encryption +op.enroll.soKeyTemporary.keyGen.auth.keySize=1024 +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.sign=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.signRecover=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.verifyRecover=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.verify=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.sensitive=true +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.private=false +op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.sign=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.signRecover=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.verifyRecover=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.verify=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.sensitive=true +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.private=false +op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.auth.label=Temporary Key for $userid$ +op.enroll.soKeyTemporary.keyGen.auth.cuid_label=$cuid$ +op.enroll.soKeyTemporary.keyGen.auth.overwrite=false +op.enroll.soKeyTemporary.keyGen.auth.certId=C0 +op.enroll.soKeyTemporary.keyGen.auth.certAttrId=c0 +op.enroll.soKeyTemporary.keyGen.auth.privateKeyAttrId=k0 +op.enroll.soKeyTemporary.keyGen.auth.publicKeyAttrId=k1 +op.enroll.soKeyTemporary.keyGen.auth.keyUsage=0 +op.enroll.soKeyTemporary.keyGen.auth.keyUser=15 +op.enroll.soKeyTemporary.keyGen.auth.privateKeyNumber=0 +op.enroll.soKeyTemporary.keyGen.auth.publicKeyNumber=1 +op.enroll.soKeyTemporary.keyGen.auth.ca.profileId=caTempTokenDeviceKeyEnrollment +op.enroll.soKeyTemporary.keyGen.auth.ca.conn=ca1 +op.enroll.soKeyTemporary.keyGen.signing.keySize=1024 +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.sign=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.signRecover=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.verifyRecover=true +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.verify=true +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.sensitive=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.private=false +op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.sign=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.signRecover=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.verifyRecover=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.verify=false +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.sensitive=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.private=true +op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.signing.label=signing key for $userid$ +op.enroll.soKeyTemporary.keyGen.signing.cuid_label=$cuid$ +op.enroll.soKeyTemporary.keyGen.signing.overwrite=true +op.enroll.soKeyTemporary.keyGen.signing.certId=C1 +op.enroll.soKeyTemporary.keyGen.signing.certAttrId=c1 +op.enroll.soKeyTemporary.keyGen.signing.privateKeyAttrId=k2 +op.enroll.soKeyTemporary.keyGen.signing.publicKeyAttrId=k3 +op.enroll.soKeyTemporary.keyGen.signing.keyUsage=0 +op.enroll.soKeyTemporary.keyGen.signing.keyUser=0 +op.enroll.soKeyTemporary.keyGen.signing.privateKeyNumber=2 +op.enroll.soKeyTemporary.keyGen.signing.publicKeyNumber=3 +op.enroll.soKeyTemporary.keyGen.signing.ca.profileId=caTempTokenUserSigningKeyEnrollment +op.enroll.soKeyTemporary.keyGen.signing.ca.conn=ca1 +op.enroll.soKeyTemporary.keyGen.encryption.keySize=1024 +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.encrypt=true +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.sign=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.signRecover=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.decrypt=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.unwrap=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.wrap=true +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.verifyRecover=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.verify=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.sensitive=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.private=false +op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.encrypt=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.sign=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.signRecover=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.decrypt=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.derive=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.unwrap=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.wrap=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.verifyRecover=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.verify=false +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.sensitive=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.private=true +op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.token=true +op.enroll.soKeyTemporary.keyGen.encryption.label=encryption key for $userid$ +op.enroll.soKeyTemporary.keyGen.encryption.cuid_label=$cuid$ +op.enroll.soKeyTemporary.keyGen.encryption.overwrite=true +op.enroll.soKeyTemporary.keyGen.encryption.certId=C2 +op.enroll.soKeyTemporary.keyGen.encryption.certAttrId=c2 +op.enroll.soKeyTemporary.keyGen.encryption.privateKeyAttrId=k4 +op.enroll.soKeyTemporary.keyGen.encryption.publicKeyAttrId=k5 +op.enroll.soKeyTemporary.keyGen.encryption.keyUsage=0 +op.enroll.soKeyTemporary.keyGen.encryption.keyUser=0 +op.enroll.soKeyTemporary.keyGen.encryption.privateKeyNumber=4 +op.enroll.soKeyTemporary.keyGen.encryption.publicKeyNumber=5 +op.enroll.soKeyTemporary.keyGen.encryption.ca.profileId=caTempTokenUserEncryptionKeyEnrollment +op.enroll.soKeyTemporary.keyGen.encryption.ca.conn=ca1 +op.enroll.soKeyTemporary.pkcs11obj.enable=true +op.enroll.soKeyTemporary.pkcs11obj.compress.enable=true +op.enroll.soKeyTemporary.update.applet.emptyToken.enable=true +op.enroll.soKeyTemporary.update.applet.enable=true +op.enroll.soKeyTemporary.update.applet.requiredVersion=1.4.4d40a449 +op.enroll.soKeyTemporary.update.applet.directory=[TPS_DIR]/applets +op.enroll.soKeyTemporary.update.applet.encryption=true +op.enroll.soKeyTemporary.update.symmetricKeys.enable=false +op.enroll.soKeyTemporary.update.symmetricKeys.requiredVersion=1 +op.enroll.soKeyTemporary.loginRequest.enable=true +op.enroll.soKeyTemporary.pinReset.enable=true +op.enroll.soKeyTemporary.pinReset.pin.maxRetries=127 +op.enroll.soKeyTemporary.pinReset.pin.minLen=4 +op.enroll.soKeyTemporary.pinReset.pin.maxLen=10 +op.enroll.soKeyTemporary.cardmgr_instance=A0000000030000 +op.enroll.soKeyTemporary.tks.conn=tks1 +op.enroll.soKeyTemporary.tks.keySet=defKeyset +op.enroll.soKeyTemporary.auth.id=ldap2 +op.enroll.soKeyTemporary.auth.enable=true +op.pinReset._000=######################################### +op.pinReset._001=# Certificate Chain Imports +op.pinReset._002=# +op.pinReset._003=# op.enroll.certificates.num=1 +op.pinReset._004=# op.enroll.certificates.value.0=caCert +op.pinReset._005=# op.enroll.certificates.caCert.nickName=caCert0 pki-tps +op.pinReset._006=# op.enroll.certificates.caCert.certId=C5 +op.pinReset._007=# op.enroll.certificates.caCert.certAttrId=c5 +op.pinReset._008=# op.enroll.certificates.caCert.label=caCert Label +op.pinReset._009=######################################### +op.pinReset._010=######################################### +op.pinReset._011=# Pin Reset Operation For CoolKey +op.pinReset._012=# +op.pinReset._013=# op.pinReset.userKey.update.applet.emptyToken.enable=false +op.pinReset._014=# - update applet or not if token is empty +op.pinReset._015=# +op.pinReset._016=# - N/A for HouseKey +op.pinReset._017=# - N/A for HouseKey with Legacy Applet +op.pinReset._018=######################################### +op.pinReset.userKey.update.applet.emptyToken.enable=true +op.pinReset.userKey.update.applet.enable=false +op.pinReset.userKey.update.applet.requiredVersion=1.4.4d40a449 +op.pinReset.userKey.update.applet.directory=[TPS_DIR]/applets +op.pinReset.userKey.update.applet.encryption=true +op.pinReset.userKey.update.symmetricKeys.enable=false +op.pinReset.userKey.update.symmetricKeys.requiredVersion=1 +op.pinReset.userKey.loginRequest.enable=true +op.pinReset.userKey.pinReset.pin.minLen=4 +op.pinReset.userKey.pinReset.pin.maxLen=10 +op.pinReset.userKey.tks.conn=tks1 +op.pinReset.userKey.cardmgr_instance=A0000000030000 +op.pinReset.userKey.auth.id=ldap1 +op.pinReset.userKey.auth.enable=true +op.format._000=######################################### +op.format._001=# Format Operation For tokenKey +op.format._002=# +op.format._003=# op.format.tokenKey.update.applet.emptyToken.enable=false +op.format._004=# - update applet or not if token is empty +op.format._005=# +op.format._006=# - applicable to CoolKey +op.format._007=# - applicable to HouseKey +op.format._008=# - applicable to HouseKey with Legacy Applet +op.format._009=######################################### +op.format.allowUnknownToken=true +op.format.soCleanUserToken.update.applet.emptyToken.enable=true +op.format.soCleanUserToken.update.applet.requiredVersion=1.4.4d40a449 +op.format.soCleanUserToken.update.applet.directory=[TPS_DIR]/applets +op.format.soCleanUserToken.update.applet.encryption=true +op.format.soCleanUserToken.update.symmetricKeys.enable=false +op.format.soCleanUserToken.update.symmetricKeys.requiredVersion=1 +op.format.soCleanUserToken.revokeCert=true +op.format.soCleanUserToken.ca.conn=ca1 +op.format.soCleanUserToken.loginRequest.enable=false +op.format.soCleanUserToken.cardmgr_instance=A0000000030000 +op.format.soCleanUserToken.tks.conn=tks1 +op.format.soCleanUserToken.auth.id=ldap1 +op.format.soCleanUserToken.auth.enable=false +op.format.soCleanUserToken.issuerinfo.enable=true +op.format.soCleanUserToken.issuerinfo.value= +op.format.soCleanSOToken.update.applet.emptyToken.enable=true +op.format.soCleanSOToken.update.applet.requiredVersion=1.4.4d40a449 +op.format.soCleanSOToken.update.applet.directory=[TPS_DIR]/applets +op.format.soCleanSOToken.update.applet.encryption=true +op.format.soCleanSOToken.update.symmetricKeys.enable=false +op.format.soCleanSOToken.update.symmetricKeys.requiredVersion=1 +op.format.soCleanSOToken.revokeCert=true +op.format.soCleanSOToken.ca.conn=ca1 +op.format.soCleanSOToken.loginRequest.enable=false +op.format.soCleanSOToken.cardmgr_instance=A0000000030000 +op.format.soCleanSOToken.tks.conn=tks1 +op.format.soCleanSOToken.auth.id=ldap1 +op.format.soCleanSOToken.auth.enable=false +op.format.soCleanSOToken.issuerinfo.enable=true +op.format.soCleanSOToken.issuerinfo.value= +op.format.cleanToken.update.applet.emptyToken.enable=true +op.format.cleanToken.update.applet.requiredVersion=1.4.4d40a449 +op.format.cleanToken.update.applet.directory=[TPS_DIR]/applets +op.format.cleanToken.update.applet.encryption=true +op.format.cleanToken.update.symmetricKeys.enable=false +op.format.cleanToken.update.symmetricKeys.requiredVersion=1 +op.format.cleanToken.revokeCert=true +op.format.cleanToken.ca.conn=ca1 +op.format.cleanToken.loginRequest.enable=true +op.format.cleanToken.cardmgr_instance=A0000000030000 +op.format.cleanToken.tks.conn=tks1 +op.format.cleanToken.auth.id=ldap1 +op.format.cleanToken.auth.enable=false +op.format.cleanToken.issuerinfo.enable=true +op.format.cleanToken.issuerinfo.value= +op.format.soUserKey.update.applet.emptyToken.enable=true +op.format.soUserKey.update.applet.requiredVersion=1.4.4d40a449 +op.format.soUserKey.update.applet.directory=[TPS_DIR]/applets +op.format.soUserKey.update.applet.encryption=true +op.format.soUserKey.update.symmetricKeys.enable=false +op.format.soUserKey.update.symmetricKeys.requiredVersion=1 +op.format.soUserKey.revokeCert=true +op.format.soUserKey.ca.conn=ca1 +op.format.soUserKey.loginRequest.enable=false +op.format.soUserKey.cardmgr_instance=A0000000030000 +op.format.soUserKey.tks.conn=tks1 +op.format.soUserKey.auth.id=ldap1 +op.format.soUserKey.auth.enable=false +op.format.soUserKey.issuerinfo.enable=true +op.format.soUserKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi +op.format.soKey.update.applet.emptyToken.enable=true +op.format.soKey.update.applet.requiredVersion=1.4.4d40a449 +op.format.soKey.update.applet.directory=[TPS_DIR]/applets +op.format.soKey.update.applet.encryption=true +op.format.soKey.update.symmetricKeys.enable=false +op.format.soKey.update.symmetricKeys.requiredVersion=1 +op.format.soKey.revokeCert=true +op.format.soKey.ca.conn=ca1 +op.format.soKey.loginRequest.enable=true +op.format.soKey.cardmgr_instance=A0000000030000 +op.format.soKey.tks.conn=tks1 +op.format.soKey.auth.id=ldap2 +op.format.soKey.auth.enable=true +op.format.soKey.issuerinfo.enable=true +op.format.soKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/so/index.cgi +op.format.userKey.update.applet.emptyToken.enable=true +op.format.userKey.update.applet.requiredVersion=1.4.4d40a449 +op.format.userKey.update.applet.directory=[TPS_DIR]/applets +op.format.userKey.update.applet.encryption=true +op.format.userKey.update.symmetricKeys.enable=false +op.format.userKey.update.symmetricKeys.requiredVersion=1 +op.format.userKey.revokeCert=true +op.format.userKey.ca.conn=ca1 +op.format.userKey.loginRequest.enable=true +op.format.userKey.cardmgr_instance=A0000000030000 +op.format.userKey.tks.conn=tks1 +op.format.userKey.auth.id=ldap1 +op.format.userKey.auth.enable=true +op.format.userKey.issuerinfo.enable=true +op.format.userKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi +op.format.tokenKey.update.applet.emptyToken.enable=true +op.format.tokenKey.update.applet.requiredVersion=1.4.4d40a449 +op.format.tokenKey.update.applet.directory=[TPS_DIR]/applets +op.format.tokenKey.update.applet.encryption=true +op.format.tokenKey.update.symmetricKeys.enable=false +op.format.tokenKey.update.symmetricKeys.requiredVersion=1 +op.format.tokenKey.revokeCert=true +op.format.tokenKey.ca.conn=ca1 +op.format.tokenKey.loginRequest.enable=true +op.format.tokenKey.cardmgr_instance=A0000000030000 +op.format.tokenKey.tks.conn=tks1 +op.format.tokenKey.auth.id=ldap1 +op.format.tokenKey.auth.enable=true +op.format.tokenKey.issuerinfo.enable=true +op.format.tokenKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi +tokendb._000=######################################### +tokendb._001=# tokendb.auditLog: +tokendb._002=# - audit log path +tokendb._003=# tokendb.host: +tokendb._004=# - tokendb host name +tokendb._005=# tokendb.port: +tokendb._006=# - tokendb port number +tokendb._007=# tokendb.bindDN: +tokendb._008=# - tokendb administration DN (i.e. cn=Directory Manager) +tokendb._009=# tokendb.bindPassPath: +tokendb._010=# - tokendb administration password file path +tokendb._011=# tokendb.templateDir +tokendb._012=# - directory where all the tokendb templates are located +tokendb._013=# tokendb.userBaseDN: +tokendb._014=# - directory base DN for users and groups +tokendb._015=# tokendb.baseDN: +tokendb._016=# - directory base DN for tokens +tokendb._017=# tokendb.activityBaseDN: +tokendb._018=# - directory base DN for activities +tokendb._019=# tokendb.indexTemplate=index.template +tokendb._020=# - index template +tokendb._021=# tokendb.newTemplate=new.template +tokendb._022=# - add template +tokendb._023=# tokendb.showTemplate=show.template +tokendb._024=# - show template +tokendb._025=# tokendb.errorTemplate=error.template +tokendb._026=# - error template +tokendb._027=# tokendb.searchTemplate=search.template +tokendb._028=# - search template +tokendb._029=# tokendb.searchResultTemplate=searchResults.template +tokendb._030=# - search result template +tokendb._031=# tokendb.editTemplate=edit.template +tokendb._032=# - edit template +tokendb._033=# tokendb.editResultTemplate=editResults.template +tokendb._034=# - edit result template +tokendb._035=# tokendb.addResultTemplate=addResults.template +tokendb._036=# - add result template +tokendb._037=# tokendb.deleteResultTemplate=deleteResults.template +tokendb._038=# - delete result template +tokendb._039=# tokendb.searchActivityTemplate=searchActivity.template +tokendb._040=# - search activity template +tokendb._041=# tokendb.searchActivityResultTemplate=searchActivityResults.template +tokendb._042=# - search activity result template +tokendb._043=# tokendb.showAdminTemplate=showAdmin.template +tokendb._044=# - show admin template +tokendb._045=# tokendb.editAdminTemplate=editAdmin.template +tokendb._046=# - edit admin template +tokendb._047=# tokendb.editAdminResultTemplate=editAdminResults.template +tokendb._048=# - edit admin result template +tokendb._049=# tokendb.searchAdminTemplate=searchAdmin.template +tokendb._050=# - search admin template +tokendb._051=# tokendb.searchAdminResultTemplate=searchAdminResults.template +tokendb._052=# - search admin result template +tokendb._053=# tokendb.defaultPolicy: +tokendb._054=# Supported Policy (Separated by ; [Semicolon]): +tokendb._055=# For example, PIN_RESET=YES|NO;RE_ENROLL=YES|NO +tokendb._056=# PIN_RESET=YES|NO +tokendb._057=# - If not present, pin reset by user is allowed. +tokendb._058=# - If present and agent change PIN_RESET from NO +tokendb._059=# to YES, user is allowed to do pin reset. This +tokendb._060=# policy will be changed back to NO after pin reset. +tokendb._061=# RE_ENROLL=YES|NO +tokendb._062=# - If not present, re-enrollment is allowed. +tokendb._063=# - If present, re-enrollment is allowed when RE_ENROLL +tokendb._064=# is set to YES. Otherwise, re-enrollment is not +tokendb._065=# allowed. +tokendb._066=# tokendb.allowedTransitions: +tokendb._067=# - has transitions between the following states +tokendb._068=# TOKEN_UNINITIALIZED = 0, +tokendb._069=# TOKEN_DAMAGED =1, +tokendb._070=# TOKEN_PERM_LOST=2, +tokendb._071=# TOKEN_TEMP_LOST=3, +tokendb._072=# TOKEN_FOUND =4, +tokendb._073=# TOKEN_TEMP_LOST_PERM_LOST =5, +tokendb._074=# TOKEN_TERMINATED = 6 +tokendb._075=######################################### +tokendb.auditLog=[PKI_INSTANCE_PATH]/logs/tokendb-audit.log +tokendb.hostport=[TOKENDB_HOST]:[TOKENDB_PORT] +tokendb.ssl=false +tokendb.bindDN=cn=Directory Manager +tokendb.bindPassPath=[PKI_INSTANCE_PATH]/conf/password.conf +tokendb.templateDir=[PKI_INSTANCE_PATH]/docroot/tus +tokendb.userBaseDN=[TOKENDB_ROOT] +tokendb.baseDN=ou=Tokens,[TOKENDB_ROOT] +tokendb.activityBaseDN=ou=Activities,[TOKENDB_ROOT] +tokendb.certBaseDN=ou=Certificates,[TOKENDB_ROOT] +tokendb.indexTemplate=index.template +tokendb.indexAdminTemplate=indexAdmin.template +tokendb.newTemplate=new.template +tokendb.showTemplate=show.template +tokendb.showCertTemplate=showCert.template +tokendb.errorTemplate=error.template +tokendb.searchTemplate=search.template +tokendb.searchResultTemplate=searchResults.template +tokendb.searchCertificateResultTemplate=searchCertificateResults.template +tokendb.editTemplate=edit.template +tokendb.editResultTemplate=editResults.template +tokendb.addResultTemplate=addResults.template +tokendb.deleteTemplate=delete.template +tokendb.deleteResultTemplate=deleteResults.template +tokendb.searchActivityTemplate=searchActivity.template +tokendb.searchCertificateTemplate=searchCertificate.template +tokendb.searchActivityResultTemplate=searchActivityResults.template +tokendb.searchActivityAdminTemplate=searchActivityAdmin.template +tokendb.searchActivityAdminResultTemplate=searchActivityAdminResults.template +tokendb.showAdminTemplate=showAdmin.template +tokendb.doTokenTemplate=doToken.template +tokendb.doTokenConfirmTemplate=doTokenConfirm.template +tokendb.revokeTemplate=revoke.template +tokendb.searchAdminTemplate=searchAdmin.template +tokendb.searchAdminResultTemplate=searchAdminResults.template +tokendb.defaultPolicy=RE_ENROLL=YES +tokendb.newUserTemplate=newUser.template +tokendb.userDeleteTemplate=userDelete.template +tokendb.searchUserResultTemplate=searchUserResults.template +tokendb.searchUserTemplate=searchUser.template +tokendb.editUserTemplate=editUser.template +tokendb.indexOperatorTemplate=indexOperator.template +tokendb.selfTestTemplate=selfTest.template +tokendb.selfTestResultsTemplate=selfTestResults.template +tokendb.auditAdminTemplate=auditAdmin.template +tokendb.selectConfigTemplate=selectConfig.template +tokendb.agentSelectConfigTemplate=agentSelectConfig.template +tokendb.editConfigTemplate=editConfig.template +tokendb.agentViewConfigTemplate=agentViewConfig.template +tokendb.addConfigTemplate=addConfig.template +tokendb.confirmConfigChangesTemplate=confirmConfigChanges.template +tokendb.confirmDeleteConfigTemplate=confirmDeleteConfig.template +log.instance.SignedAudit.selected.events=ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,CONFIG,CONFIG_ROLE,CONFIG_TOKEN,CONFIG_PROFILE,CONFIG_AUDIT,APPLET_UPGRADE,KEY_CHANGEOVER,RENEWAL +log.instance.SignedAudit.selectable.events=ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE,PRIVATE_KEY_ARCHIVE_PROCESSED,KEY_RECOVERY_REQUEST,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_PROCESSED,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,CONFIG,CONFIG_ROLE,CONFIG_TOKEN,CONFIG_PROFILE,CONFIG_AUDIT,APPLET_UPGRADE,KEY_CHANGEOVER,RENEWAL +log.instance.SignedAudit.nonselectable.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_PROCESSED,SERVER_SIDE_KEYGEN_REQUEST +tokendb.allowedTransitions=0:1,0:2,0:3,0:4,0:5,0:6,3:4,3:5,3:6,4:1,4:2,4:3,4:6 +target._000=######################################### +target._001=# entries to enable configuration of parameter sets through the TPS UI agent and admin tabs +target._002=# +target._003=# target.configure.list = comma separated lists of all parameter sets that can be configured by the admin. +target._004=# Each entry will show up (with underscore replaced by space) under Advanced Configuration on the admin tab. +target._005=# +target._006=# target.agent_approve.list = comma separated subset of above list. Parameter sets in this list +target._007=# will show up in the agent tab (under advanced configuration) and will require agent involvement +target._008=# (enable/ disable) to be edited. +target._009=# +target._010=# For the wording to display correctly, the values in the above list should be plurals. +target._011=# +target._012=# Each parameter set in the lists above requires three parameters: +target._013=# target..list : list of choices of this parameter set type (will display in the drop down box) +target._014=# target..pattern : the regular expression to select parameters in CS.cfg for this parameter set. +target._015=# target..displayname: used in the UI display text. This should be the singular form of . +target._016=# +target._017=# The exception is the parameter set Generals, which has only a pattern and displayname defined. +target._018=# +target._019=######################################## +target.configure.list=Profiles,Subsystem_Connections,Profile_Mappings,Authentication_Sources +target.agent_approve.list=Profiles +target.Profiles.list=userKey,soKey,soCleanUserToken,soUserKey,cleanToken,soCleanSoToken,tokenKey +target.Profiles.pattern=op\..*\.$name\..* +target.Profiles.displayname=Profile +target.Subsystem_Connections.list=ca1,drm1,tks1 +target.Subsystem_Connections.pattern=conn\.$name\..* +target.Subsystem_Connections.displayname=Subsystem Connection +target.Profile_Mappings.list=enroll,format,pinReset +target.Profile_Mappings.pattern=op\.$name\.mapping\..* +target.Profile_Mappings.displayname=Profile Mapping +target.Authentication_Sources.list=0,1 +target.Authentication_Sources.pattern=auth\.instance\.$name\..* +target.Authentication_Sources.displayname=Authentication Source +target.Generals.displayname=General +target.Generals.pattern=^applet\..*\|^general\..*\|^failover.pod.enable\|^channel\..* +config.Generals.General.state=Enabled +config.Generals.General.timestamp=1280283607424406 +tps._000=######################################## +tps._001=# For verifying system certificates +tps._002=# tps.cert.list=sslserver,subsystem,audit_signing +tps._003=# tps.cert.sslserver.nickname=xxx +tps._005=# tps.cert.subsystem.nickname=xxx +tps._007=# tps.cert.audit_signing.nickname=xxx +tps._008=# operations.allowedTransitions: +tps._009=# - token operations, like formatting and enrollment have transitions between the following states +tps._010=# TOKEN_UNINITIALIZED = 0, +tps._011=# TOKEN_DAMAGED =1, +tps._012=# TOKEN_PERM_LOST=2, +tps._013=# TOKEN_TEMP_LOST=3, +tps._014=# TOKEN_FOUND =4, +tps._015=# TOKEN_TEMP_LOST_PERM_LOST =5, +tps._016=# TOKEN_TERMINATED = 6 +tps._017=# Sample: tps.operations.allowedTransitions=0:0,0:4,4:6,6:0 +tps._018=######################################## +tps.operations.allowedTransitions=0:0,0:4,4:0 +tps.cert.list=sslserver,subsystem,audit_signing +tps.cert.sslserver.nickname=[HSM_LABEL][NICKNAME] +tps.cert.subsystem.nickname=[HSM_LABEL][NICKNAME] +tps.cert.audit_signing.nickname=[HSM_LABEL][NICKNAME] diff --git a/base/tps/java/CMakeLists.txt b/base/tps/java/CMakeLists.txt deleted file mode 100644 index c8f90e44e..000000000 --- a/base/tps/java/CMakeLists.txt +++ /dev/null @@ -1,136 +0,0 @@ -project(pki-tps_java NONE) - -find_file(LDAPJDK_JAR - NAMES - ldapjdk.jar - PATHS - /usr/share/java -) - -find_file(JAXRS_API_JAR - NAMES - jaxrs-api.jar - PATHS - ${RESTEASY_LIB} -) - -find_file(JSS_JAR - NAMES - jss4.jar - PATHS - ${JAVA_LIB_INSTALL_DIR} -) - -find_file(COMMONS_CODEC_JAR - NAMES - commons-codec.jar - PATHS - /usr/share/java -) - -find_file(JAXRS_API_JAR - NAMES - jaxrs-api.jar - PATHS - ${RESTEASY_LIB} -) - -find_file(PKI_CERTSRV_JAR - NAMES - pki-certsrv.jar - PATHS - /usr/share/java/pki -) - -find_file(PKI_CMS_JAR - NAMES - pki-cms.jar - PATHS - /usr/share/java/pki -) - -find_file(PKI_CMSCORE_JAR - NAMES - pki-cmscore.jar - PATHS - /usr/share/java/pki -) - -find_file(PKI_CMSUTIL_JAR - NAMES - pki-cmsutil.jar - PATHS - /usr/share/java/pki -) - -find_file(PKI_NSUTIL_JAR - NAMES - pki-nsutil.jar - PATHS - /usr/share/java/pki -) - -find_file(RESTEASY_ATOM_PROVIDER_JAR - NAMES - resteasy-atom-provider.jar - PATHS - ${RESTEASY_LIB} -) - -find_file(SERVLET_JAR - NAMES - servlet.jar - PATHS - ${JAVA_LIB_INSTALL_DIR} - /usr/share/java -) - -find_file(SYMKEY_JAR - NAMES - symkey.jar - PATHS - ${JAVA_LIB_INSTALL_DIR} - /usr/share/java -) - -# build pki-tps -javac(pki-tps-classes - SOURCES - org/dogtagpki/tps/*.java - CLASSPATH - ${PKI_CERTSRV_JAR} ${PKI_CMS_JAR} ${PKI_CMSCORE_JAR} - ${PKI_CMSUTIL_JAR} ${PKI_NSUTIL_JAR} - ${LDAPJDK_JAR} ${JAXRS_API_JAR} ${RESTEASY_ATOM_PROVIDER_JAR} - ${JSS_JAR} ${COMMONS_CODEC_JAR} ${SYMKEY_JAR} ${SERVLET_JAR} - OUTPUT_DIR - ${CMAKE_BINARY_DIR}/classes -) - -configure_file( - ${CMAKE_CURRENT_SOURCE_DIR}/pki-tps.mf - ${CMAKE_CURRENT_BINARY_DIR}/pki-tps.mf -) - -jar(pki-tps-jar - CREATE - ${CMAKE_BINARY_DIR}/dist/pki-tps.jar - OPTIONS - m - PARAMS - ${CMAKE_CURRENT_BINARY_DIR}/pki-tps.mf - INPUT_DIR - ${CMAKE_BINARY_DIR}/classes - FILES - org/dogtagpki/tps/*.class - DEPENDS - pki-tps-classes -) - -install( - FILES - ${CMAKE_BINARY_DIR}/dist/pki-tps.jar - DESTINATION - ${JAVA_JAR_INSTALL_DIR}/pki -) - -set(PKI_TPS_JAR ${CMAKE_BINARY_DIR}/dist/pki-tps.jar CACHE INTERNAL "pki-tps jar file") diff --git a/base/tps/java/org/dogtagpki/tps/TPSConnection.java b/base/tps/java/org/dogtagpki/tps/TPSConnection.java deleted file mode 100644 index cd62ff530..000000000 --- a/base/tps/java/org/dogtagpki/tps/TPSConnection.java +++ /dev/null @@ -1,98 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- -package org.dogtagpki.tps; - -import java.io.IOException; -import java.io.InputStream; -import java.io.OutputStream; -import java.io.PrintStream; - -/** - * @author Endi S. Dewata - */ -public class TPSConnection { - - public InputStream in; - public PrintStream out; - public boolean chunked; - - public TPSConnection(InputStream in, OutputStream out) { - this(in, out, false); - } - - public TPSConnection(InputStream in, OutputStream out, boolean chunked) { - this.in = in; - this.out = new PrintStream(out); - this.chunked = chunked; - } - - public TPSMessage read() throws IOException { - - StringBuilder sb = new StringBuilder(); - int b; - - // read the first parameter - while ((b = in.read()) >= 0) { - char c = (char)b; - if (c == '&') break; - sb.append(c); - } - - if (b < 0) throw new IOException("Unexpected end of stream"); - - // parse message size - String nvp = sb.toString(); - String[] s = nvp.split("="); - int size = Integer.parseInt(s[1]); - - sb.append('&'); - - // read the rest of message - for (int i=0; i - */ -public class TPSMessage { - - Map map = new LinkedHashMap(); - - public TPSMessage() { - } - - public TPSMessage(String message) { - decode(message); - } - - public TPSMessage(Map map) { - this.map.putAll(map); - } - - public void put(String key, String value) { - map.put(key, value); - } - - public void put(String key, Integer value) { - map.put(key, value.toString()); - } - - public void put(String key, byte[] bytes) { - StringBuilder sb = new StringBuilder(); - - for (byte b : bytes) { - sb.append("%"); - sb.append(String.format("%02X", b)); - } - - map.put(key, sb.toString()); - } - - public void decode(String message) { - - for (String nvp : message.split("&")) { - String[] s = nvp.split("="); - - String key = s[0]; - String value = s[1]; - - // skip message size - if (key.equals("s")) continue; - - map.put(key, value); - } - } - - public String encode() { - - StringBuilder sb = new StringBuilder(); - - // encode message type - String type = map.get("msg_type"); - sb.append("msg_type=" + type); - - // encode other parameters - for (String key : map.keySet()) { - - if (key.equals("msg_type")) continue; - - String value = map.get(key); - sb.append("&" + key + "=" + value); - } - - String message = sb.toString(); - - // encode message_size - return "s=" + message.length() + "&" + message; - } - - public String toString() { - return map.toString(); - } -} diff --git a/base/tps/java/org/dogtagpki/tps/server/TPSApplication.java b/base/tps/java/org/dogtagpki/tps/server/TPSApplication.java deleted file mode 100644 index 2f2b2a63a..000000000 --- a/base/tps/java/org/dogtagpki/tps/server/TPSApplication.java +++ /dev/null @@ -1,84 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- -package org.dogtagpki.tps.server; - -import java.util.HashSet; -import java.util.Set; - -import javax.ws.rs.core.Application; - -import org.dogtagpki.tps.token.TokenService; - -import com.netscape.certsrv.acls.ACLInterceptor; -import com.netscape.certsrv.authentication.AuthMethodInterceptor; -import com.netscape.certsrv.base.PKIException; -import com.netscape.cms.servlet.account.AccountService; -import com.netscape.cms.servlet.admin.GroupMemberService; -import com.netscape.cms.servlet.admin.GroupService; -import com.netscape.cms.servlet.admin.SystemCertService; -import com.netscape.cms.servlet.admin.UserCertService; -import com.netscape.cms.servlet.admin.UserMembershipService; -import com.netscape.cms.servlet.admin.UserService; -import com.netscape.cms.servlet.csadmin.SystemConfigService; - -/** - * @author Endi S. Dewata - */ -public class TPSApplication extends Application { - - private Set singletons = new HashSet(); - private Set> classes = new HashSet>(); - - public TPSApplication() { - - // account - classes.add(AccountService.class); - - // installer - classes.add(SystemConfigService.class); - - // user and group management - classes.add(GroupMemberService.class); - classes.add(GroupService.class); - classes.add(UserCertService.class); - classes.add(UserMembershipService.class); - classes.add(UserService.class); - - // system certs - classes.add(SystemCertService.class); - - // tokens - classes.add(TokenService.class); - - // exception mapper - classes.add(PKIException.Mapper.class); - - // interceptors - singletons.add(new AuthMethodInterceptor()); - singletons.add(new ACLInterceptor()); - } - - public Set> getClasses() { - return classes; - } - - public Set getSingletons() { - return singletons; - } - -} diff --git a/base/tps/java/org/dogtagpki/tps/server/TPSServlet.java b/base/tps/java/org/dogtagpki/tps/server/TPSServlet.java deleted file mode 100644 index 78e6df4f8..000000000 --- a/base/tps/java/org/dogtagpki/tps/server/TPSServlet.java +++ /dev/null @@ -1,61 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- -package org.dogtagpki.tps.server; - -import java.io.IOException; - -import javax.servlet.http.HttpServlet; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; - -import org.dogtagpki.tps.TPSConnection; -import org.dogtagpki.tps.TPSMessage; - -/** - * @author Endi S. Dewata - */ -public class TPSServlet extends HttpServlet { - - private static final long serialVersionUID = -1092227495262381074L; - - public void service(HttpServletRequest request, HttpServletResponse response) throws IOException { - - response.setHeader("Transfer-Encoding", "chunked"); - - TPSConnection con = new TPSConnection( - request.getInputStream(), response.getOutputStream(), true); - - TPSMessage message = con.read(); - System.out.println("Receive: " + message); - - message = new TPSMessage(); - message.put("msg_type", 9); - message.put("pdu_size", 12); - message.put("pdu_data", new byte[] { - (byte)0x00, (byte)0xA4, (byte)0x04, (byte)0x00, - (byte)0x07, (byte)0xA0, (byte)0x00, (byte)0x00, - (byte)0x00, (byte)0x03, (byte)0x00, (byte)0x00 - }); - - System.out.println("Send: " + message); - con.write(message); - - message = con.read(); - System.out.println("Receive: " + message); - } -} diff --git a/base/tps/java/org/dogtagpki/tps/server/TPSSubsystem.java b/base/tps/java/org/dogtagpki/tps/server/TPSSubsystem.java deleted file mode 100644 index 92017812c..000000000 --- a/base/tps/java/org/dogtagpki/tps/server/TPSSubsystem.java +++ /dev/null @@ -1,115 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- -package org.dogtagpki.tps.server; - -import org.dogtagpki.tps.token.TokenDatabase; - -import com.netscape.certsrv.apps.CMS; -import com.netscape.certsrv.authority.IAuthority; -import com.netscape.certsrv.base.EBaseException; -import com.netscape.certsrv.base.IConfigStore; -import com.netscape.certsrv.base.ISubsystem; -import com.netscape.certsrv.logging.ILogger; -import com.netscape.certsrv.request.IRequestListener; -import com.netscape.certsrv.request.IRequestQueue; - -/** - * @author Endi S. Dewata - */ -public class TPSSubsystem implements IAuthority, ISubsystem { - - public final static TPSSubsystem INSTANCE = new TPSSubsystem(); - - public ILogger logger = CMS.getLogger(); - - public String id; - public String nickname; - public ISubsystem owner; - public IConfigStore config; - - public TokenDatabase tokenDatabase = new TokenDatabase(); - - public static TPSSubsystem getInstance() { - return INSTANCE; - } - - @Override - public String getId() { - return id; - } - - @Override - public void setId(String id) throws EBaseException { - this.id = id; - } - - @Override - public void init(ISubsystem owner, IConfigStore config) throws EBaseException { - this.owner = owner; - this.config = config; - } - - @Override - public void startup() throws EBaseException { - } - - @Override - public void shutdown() { - } - - @Override - public IConfigStore getConfigStore() { - return config; - } - - @Override - public IRequestQueue getRequestQueue() { - return null; - } - - @Override - public void registerRequestListener(IRequestListener listener) { - } - - @Override - public void registerPendingListener(IRequestListener listener) { - } - - @Override - public void log(int level, String msg) { - logger.log(ILogger.EV_SYSTEM, ILogger.S_TPS, level, msg); - } - - @Override - public String getNickname() { - return nickname; - } - - public void setNickname(String nickname) { - this.nickname = nickname; - } - - @Override - public String getOfficialName() { - return "tps"; - } - - public TokenDatabase getTokenDatabase() { - return tokenDatabase; - } -} diff --git a/base/tps/java/org/dogtagpki/tps/token/TokenDatabase.java b/base/tps/java/org/dogtagpki/tps/token/TokenDatabase.java deleted file mode 100644 index 3db76649f..000000000 --- a/base/tps/java/org/dogtagpki/tps/token/TokenDatabase.java +++ /dev/null @@ -1,76 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- - -package org.dogtagpki.tps.token; - -import java.util.Collection; -import java.util.Date; -import java.util.LinkedHashMap; -import java.util.Map; - -/** - * This class implements in-memory token database. In the future this - * will be replaced with LDAP database. - * - * @author Endi S. Dewata - */ -public class TokenDatabase { - - public final static int DEFAULT_SIZE = 20; - - Map tokens = new LinkedHashMap(); - - public Collection getTokens() throws Exception { - return tokens.values(); - } - - public TokenRecord getToken(String tokenID) throws Exception { - if (!tokens.containsKey(tokenID)) { - throw new Exception("Token "+ tokenID + " does not exist."); - } - return tokens.get(tokenID); - } - - public void addToken(TokenRecord tokenRecord) throws Exception { - if (tokens.containsKey(tokenRecord.getID())) { - throw new Exception("Token "+ tokenRecord.getID() + " already exists."); - } - - tokenRecord.setStatus("ENABLED"); - tokenRecord.setCreateTimestamp(new Date()); - - tokens.put(tokenRecord.getID(), tokenRecord); - } - - public void updateToken(String tokenID, TokenRecord tokenRecord) throws Exception { - if (!tokens.containsKey(tokenRecord.getID())) { - throw new Exception("Token "+ tokenRecord.getID() + " does not exist."); - } - - tokenRecord.setModifyTimestamp(new Date()); - - tokens.put(tokenRecord.getID(), tokenRecord); - } - - public void removeToken(String tokenID) throws Exception { - if (!tokens.containsKey(tokenID)) { - throw new Exception("Token "+ tokenID + " does not exist."); - } - tokens.remove(tokenID); - } -} diff --git a/base/tps/java/org/dogtagpki/tps/token/TokenRecord.java b/base/tps/java/org/dogtagpki/tps/token/TokenRecord.java deleted file mode 100644 index 1f9d9caf5..000000000 --- a/base/tps/java/org/dogtagpki/tps/token/TokenRecord.java +++ /dev/null @@ -1,188 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- - -package org.dogtagpki.tps.token; - -import java.util.Date; - -import com.netscape.certsrv.token.TokenData; - -/** - * @author Endi S. Dewata - */ -public class TokenRecord { - - String id; - String userID; - String status; - String reason; - String appletID; - String keyInfo; - Date createTimestamp; - Date modifyTimestamp; - - public String getID() { - return id; - } - - public void setID(String id) { - this.id = id; - } - - public String getUserID() { - return userID; - } - - public void setUserID(String userID) { - this.userID = userID; - } - - public String getStatus() { - return status; - } - - public void setStatus(String status) { - this.status = status; - } - - public String getReason() { - return reason; - } - - public void setReason(String reason) { - this.reason = reason; - } - - public String getAppletID() { - return appletID; - } - - public void setAppletID(String appletID) { - this.appletID = appletID; - } - - public String getKeyInfo() { - return keyInfo; - } - - public void setKeyInfo(String keyInfo) { - this.keyInfo = keyInfo; - } - - public Date getCreateTimestamp() { - return createTimestamp; - } - - public void setCreateTimestamp(Date createTimestamp) { - this.createTimestamp = createTimestamp; - } - - public Date getModifyTimestamp() { - return modifyTimestamp; - } - - public void setModifyTimestamp(Date modifyTimestamp) { - this.modifyTimestamp = modifyTimestamp; - } - - @Override - public int hashCode() { - final int prime = 31; - int result = 1; - result = prime * result + ((appletID == null) ? 0 : appletID.hashCode()); - result = prime * result + ((createTimestamp == null) ? 0 : createTimestamp.hashCode()); - result = prime * result + ((id == null) ? 0 : id.hashCode()); - result = prime * result + ((keyInfo == null) ? 0 : keyInfo.hashCode()); - result = prime * result + ((modifyTimestamp == null) ? 0 : modifyTimestamp.hashCode()); - result = prime * result + ((reason == null) ? 0 : reason.hashCode()); - result = prime * result + ((status == null) ? 0 : status.hashCode()); - result = prime * result + ((userID == null) ? 0 : userID.hashCode()); - return result; - } - - @Override - public boolean equals(Object obj) { - if (this == obj) - return true; - if (obj == null) - return false; - if (getClass() != obj.getClass()) - return false; - TokenRecord other = (TokenRecord) obj; - if (appletID == null) { - if (other.appletID != null) - return false; - } else if (!appletID.equals(other.appletID)) - return false; - if (createTimestamp == null) { - if (other.createTimestamp != null) - return false; - } else if (!createTimestamp.equals(other.createTimestamp)) - return false; - if (id == null) { - if (other.id != null) - return false; - } else if (!id.equals(other.id)) - return false; - if (keyInfo == null) { - if (other.keyInfo != null) - return false; - } else if (!keyInfo.equals(other.keyInfo)) - return false; - if (modifyTimestamp == null) { - if (other.modifyTimestamp != null) - return false; - } else if (!modifyTimestamp.equals(other.modifyTimestamp)) - return false; - if (reason == null) { - if (other.reason != null) - return false; - } else if (!reason.equals(other.reason)) - return false; - if (status == null) { - if (other.status != null) - return false; - } else if (!status.equals(other.status)) - return false; - if (userID == null) { - if (other.userID != null) - return false; - } else if (!userID.equals(other.userID)) - return false; - return true; - } - - public static void main(String args[]) throws Exception { - - TokenData before = new TokenData(); - before.setID("token1"); - before.setUserID("user1"); - before.setStatus("revoked"); - before.setReason("lost"); - before.setAppletID("APPLET1234"); - before.setKeyInfo("key info"); - before.setCreateTimestamp(new Date()); - before.setModifyTimestamp(new Date()); - - String string = before.toString(); - System.out.println(string); - - TokenData after = TokenData.valueOf(string); - System.out.println(before.equals(after)); - } -} diff --git a/base/tps/java/org/dogtagpki/tps/token/TokenService.java b/base/tps/java/org/dogtagpki/tps/token/TokenService.java deleted file mode 100644 index bc8b35d59..000000000 --- a/base/tps/java/org/dogtagpki/tps/token/TokenService.java +++ /dev/null @@ -1,245 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// This program is free software; you can redistribute it and/or modify -// it under the terms of the GNU General Public License as published by -// the Free Software Foundation; version 2 of the License. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -// GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// (C) 2013 Red Hat, Inc. -// All rights reserved. -// --- END COPYRIGHT BLOCK --- - -package org.dogtagpki.tps.token; - -import java.io.UnsupportedEncodingException; -import java.net.URI; -import java.net.URLEncoder; -import java.util.Iterator; - -import javax.ws.rs.core.MediaType; -import javax.ws.rs.core.Response; - -import org.dogtagpki.tps.server.TPSSubsystem; -import org.jboss.resteasy.plugins.providers.atom.Link; - -import com.netscape.certsrv.base.PKIException; -import com.netscape.certsrv.token.TokenCollection; -import com.netscape.certsrv.token.TokenData; -import com.netscape.certsrv.token.TokenModifyRequest; -import com.netscape.certsrv.token.TokenResource; -import com.netscape.cms.servlet.base.PKIService; - -/** - * @author Endi S. Dewata - */ -public class TokenService extends PKIService implements TokenResource { - - public final static int DEFAULT_SIZE = 20; - - public TokenService() { - System.out.println("TokenService.()"); - } - - public TokenData createTokenData(TokenRecord tokenRecord) { - - TokenData tokenData = new TokenData(); - tokenData.setID(tokenRecord.getID()); - tokenData.setUserID(tokenRecord.getUserID()); - tokenData.setStatus(tokenRecord.getStatus()); - tokenData.setReason(tokenRecord.getReason()); - tokenData.setAppletID(tokenRecord.getAppletID()); - tokenData.setKeyInfo(tokenRecord.getKeyInfo()); - tokenData.setCreateTimestamp(tokenRecord.getCreateTimestamp()); - tokenData.setModifyTimestamp(tokenRecord.getModifyTimestamp()); - - String tokenID = tokenRecord.getID(); - try { - tokenID = URLEncoder.encode(tokenID, "UTF-8"); - } catch (UnsupportedEncodingException e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - - URI uri = uriInfo.getBaseUriBuilder().path(TokenResource.class).path("{tokenID}").build(tokenID); - tokenData.setLink(new Link("self", uri)); - - return tokenData; - } - - public TokenRecord createTokenRecord(TokenData tokenData) { - - TokenRecord tokenRecord = new TokenRecord(); - tokenRecord.setID(tokenData.getID()); - tokenRecord.setUserID(tokenData.getUserID()); - tokenRecord.setStatus(tokenData.getStatus()); - tokenRecord.setReason(tokenData.getReason()); - tokenRecord.setAppletID(tokenData.getAppletID()); - tokenRecord.setKeyInfo(tokenData.getKeyInfo()); - tokenRecord.setCreateTimestamp(tokenData.getCreateTimestamp()); - tokenRecord.setModifyTimestamp(tokenData.getModifyTimestamp()); - - return tokenRecord; - } - - @Override - public TokenCollection findTokens(Integer start, Integer size) { - - System.out.println("TokenService.findTokens()"); - - try { - start = start == null ? 0 : start; - size = size == null ? DEFAULT_SIZE : size; - - TPSSubsystem subsystem = TPSSubsystem.getInstance(); - TokenDatabase database = subsystem.getTokenDatabase(); - - Iterator tokens = database.getTokens().iterator(); - - TokenCollection response = new TokenCollection(); - - int i = 0; - - // skip to the start of the page - for ( ; i 0) { - URI uri = uriInfo.getRequestUriBuilder().replaceQueryParam("start", Math.max(start-size, 0)).build(); - response.addLink(new Link("prev", uri)); - } - - if (start+size < i) { - URI uri = uriInfo.getRequestUriBuilder().replaceQueryParam("start", start+size).build(); - response.addLink(new Link("next", uri)); - } - - return response; - - } catch (Exception e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - } - - @Override - public TokenData getToken(String tokenID) { - - System.out.println("TokenService.getToken(\"" + tokenID + "\")"); - - try { - TPSSubsystem subsystem = TPSSubsystem.getInstance(); - TokenDatabase database = subsystem.getTokenDatabase(); - - return createTokenData(database.getToken(tokenID)); - - } catch (Exception e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - } - - @Override - public Response addToken(TokenData tokenData) { - - System.out.println("TokenService.addToken(\"" + tokenData.getID() + "\")"); - - try { - TPSSubsystem subsystem = TPSSubsystem.getInstance(); - TokenDatabase database = subsystem.getTokenDatabase(); - - database.addToken(createTokenRecord(tokenData)); - tokenData = createTokenData(database.getToken(tokenData.getID())); - - return Response - .created(tokenData.getLink().getHref()) - .entity(tokenData) - .type(MediaType.APPLICATION_XML) - .build(); - - } catch (Exception e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - } - - @Override - public Response updateToken(String tokenID, TokenData tokenData) { - - System.out.println("TokenService.updateToken(\"" + tokenID + "\")"); - - try { - TPSSubsystem subsystem = TPSSubsystem.getInstance(); - TokenDatabase database = subsystem.getTokenDatabase(); - - TokenRecord tokenRecord = database.getToken(tokenID); - tokenRecord.setUserID(tokenData.getUserID()); - database.updateToken(tokenData.getID(), tokenRecord); - - tokenData = createTokenData(database.getToken(tokenID)); - - return Response - .ok(tokenData) - .type(MediaType.APPLICATION_XML) - .build(); - - } catch (Exception e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - } - - @Override - public Response modifyToken(String tokenID, TokenModifyRequest request) { - - System.out.println("TokenService.modifyToken(\"" + tokenID + "\", request"); - - try { - TPSSubsystem subsystem = TPSSubsystem.getInstance(); - TokenDatabase database = subsystem.getTokenDatabase(); - - TokenRecord tokenRecord = database.getToken(tokenID); - // TODO: perform modification - - TokenData tokenData = createTokenData(tokenRecord); - - return Response - .ok(tokenData) - .type(MediaType.APPLICATION_XML) - .build(); - - } catch (Exception e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - } - - @Override - public void removeToken(String tokenID) { - - System.out.println("TokenService.removeToken(\"" + tokenID + "\")"); - - try { - TPSSubsystem subsystem = TPSSubsystem.getInstance(); - TokenDatabase database = subsystem.getTokenDatabase(); - database.removeToken(tokenID); - - } catch (Exception e) { - e.printStackTrace(); - throw new PKIException(e.getMessage()); - } - } -} diff --git a/base/tps/java/pki-tps.mf b/base/tps/java/pki-tps.mf deleted file mode 100644 index d77fe8fa9..000000000 --- a/base/tps/java/pki-tps.mf +++ /dev/null @@ -1,3 +0,0 @@ -Name: pki-tps -Specification-Version: ${APPLICATION_VERSION} -Implementation-Version: ${VERSION} diff --git a/base/tps/shared/conf/CMakeLists.txt b/base/tps/shared/conf/CMakeLists.txt deleted file mode 100644 index 419289d03..000000000 --- a/base/tps/shared/conf/CMakeLists.txt +++ /dev/null @@ -1,8 +0,0 @@ -configure_file(${CMAKE_CURRENT_SOURCE_DIR}/CS.cfg.in ${CMAKE_CURRENT_BINARY_DIR}/CS.cfg @ONLY) - -install( - FILES - ${CMAKE_CURRENT_BINARY_DIR}/CS.cfg - DESTINATION - ${SHARE_INSTALL_PREFIX}/${APPLICATION_NAME}/${PROJECT_NAME}/conf -) diff --git a/base/tps/shared/conf/CS.cfg.in b/base/tps/shared/conf/CS.cfg.in deleted file mode 100644 index 1a392a119..000000000 --- a/base/tps/shared/conf/CS.cfg.in +++ /dev/null @@ -1,1603 +0,0 @@ -_000=## -_001=## Token Processing System (TPS) Configuration File -_002=## -accessEvaluator.impl.group.class=com.netscape.cms.evaluators.GroupAccessEvaluator -accessEvaluator.impl.ipaddress.class=com.netscape.cms.evaluators.IPAddressAccessEvaluator -accessEvaluator.impl.user.class=com.netscape.cms.evaluators.UserAccessEvaluator -applet._000=######################################### -applet._001=# applet information -applet._002=# SAF Key: -applet._003=# applet.aid.cardmgr_instance=A0000001510000 -applet._004=######################################### -applet.aid.cardmgr_instance=A0000000030000 -applet.aid.netkey_file=627601FF0000 -applet.aid.netkey_instance=627601FF000000 -applet.aid.netkey_old_file=A000000001 -applet.aid.netkey_old_instance=A00000000101 -applet.delete_old=true -applet.so_pin=000000000000 -auths._000=## -auths._001=## new authentication -auths._002=## -auths.impl._000=## -auths.impl._001=## authentication manager implementations -auths.impl._002=## -auths.impl.AgentCertAuth.class=com.netscape.cms.authentication.AgentCertAuthentication -auths.impl.CMCAuth.class=com.netscape.cms.authentication.CMCAuth -auths.impl.NISAuth.class=com.netscape.cms.authentication.NISAuth -auths.impl.PortalEnroll.class=com.netscape.cms.authentication.PortalEnroll -auths.impl.SSLclientCertAuth.class=com.netscape.cms.authentication.SSLclientCertAuthentication -auths.impl.TokenAuth.class=com.netscape.cms.authentication.TokenAuthentication -auths.impl.UdnPwdDirAuth.class=com.netscape.cms.authentication.UdnPwdDirAuthentication -auths.impl.UidPwdDirAuth.class=com.netscape.cms.authentication.UidPwdDirAuthentication -auths.impl.UidPwdPinDirAuth.class=com.netscape.cms.authentication.UidPwdPinDirAuthentication -auths.instance.AgentCertAuth.agentGroup=Certificate Manager Agents -auths.instance.AgentCertAuth.pluginName=AgentCertAuth -auths.instance.TokenAuth.pluginName=TokenAuth -auths.instance.ldap1.dnpattern= -auths.instance.ldap1.ldapByteAttributes= -auths.instance.ldap1.ldapStringAttributes=mail,cn,uid -auths.instance.ldap1.ldap.basedn=[LDAP_ROOT] -auths.instance.ldap1.ldap.maxConns=15 -auths.instance.ldap1.ldap.minConns=3 -auths.instance.ldap1.ldap.ldapauth.authtype=BasicAuth -auths.instance.ldap1.ldap.ldapauth.bindDN= -auths.instance.ldap1.ldap.ldapauth.bindPWPrompt=ldap1 -auths.instance.ldap1.ldap.ldapauth.clientCertNickname= -auths.instance.ldap1.ldap.ldapconn.host=[LDAP_HOST] -auths.instance.ldap1.ldap.ldapconn.port=[LDAP_PORT] -auths.instance.ldap1.ldap.ldapconn.secureConn=false -auths.instance.ldap1.ldap.ldapconn.version=3 -auths.instance.ldap1.pluginName=UidPwdDirAuth -auths.instance.SSLclientCertAuth.pluginName=SSLclientCertAuth -auths.revocationChecking.bufferSize=50 -authType=pwd -authz._000=## -authz._001=## new authorizatioin -authz._002=## -authz.evaluateOrder=deny,allow -authz.impl._000=## -authz.impl._001=## authorization manager implementations -authz.impl._002=## -authz.impl.BasicAclAuthz.class=com.netscape.cms.authorization.BasicAclAuthz -authz.impl.DirAclAuthz.class=com.netscape.cms.authorization.DirAclAuthz -authz.instance.BasicAclAuthz.pluginName=BasicAclAuthz -authz.instance.DirAclAuthz.ldap._000=## -authz.instance.DirAclAuthz.ldap._001=## Internal Database -authz.instance.DirAclAuthz.ldap._002=## -authz.instance.DirAclAuthz.ldap=internaldb -authz.instance.DirAclAuthz.pluginName=DirAclAuthz -authz.sourceType=ldap -channel._000=######################################### -channel._001=# channel.encryption: -channel._002=# -channel._003=# - enable encryption for all operation commands to token -channel._004=# - default is true -channel._005=# channel.blocksize=242 -channel._006=# channel.defKeyVersion=0 -channel._007=# channel.defKeyIndex=0 -channel._008=# -channel._009=# Config the size of memory managed memory in the applet -channel._010=# Default is 5000, try not go get close to the instanceSize -channel._011=# which defaults to 18000: -channel._012=# -channel._013=# * channel.instanceSize=18000 -channel._014=# * channel.appletMemorySize=5000 -channel._015=######################################### -channel.encryption=true -channel.blocksize=248 -channel.defKeyVersion=0 -channel.defKeyIndex=0 -cms.product.version=@APPLICATION_VERSION@ -cms.version=@APPLICATION_VERSION_MAJOR@.@APPLICATION_VERSION_MINOR@ -config.Generals.General.state=Enabled -config.Generals.General.timestamp=1280283607424406 -configurationRoot=/[PKI_SUBSYSTEM_TYPE]/conf/ -conn.ca1._000=######################################### -conn.ca1._001=# CA connection -conn.ca1._002=# -conn.ca1._003=# conn.ca.hostport: -conn.ca1._004=# - host name and port number of your CA, format is host:port -conn.ca1._005=# conn.ca.clientNickname: -conn.ca1._006=# - nickname of the client certificate for -conn.ca1._007=# authentication -conn.ca1._008=# conn.ca.servlet.enrollment: -conn.ca1._009=# - servlet to contact in CA -conn.ca1._010=# - must be '/ca/profileSubmitSSLClient' -conn.ca1._011=# conn.ca.retryConnect: -conn.ca1._012=# - number of reconnection attempts on failure -conn.ca1._013=# conn.ca.timeout: -conn.ca1._014=# - connection timeout -conn.ca1._015=# conn.ca.SSLOn: -conn.ca1._016=# - enable SSL or not -conn.ca1._017=# conn.ca.keepAlive: -conn.ca1._018=# - enable keep alive or not -conn.ca1._019=# conn.ca.caNickname: -conn.ca1._020=# - nickname of the ca certificate -conn.ca1._021=# conn.ca.caSKI: -conn.ca1._022=# - Subject Key Identifier (in Base64) of the ca certificate -conn.ca1._023=# (automatically calculated by the system) -conn.ca1._024=# -conn.ca1._025=# conn.ca.list=ca1,ca2...ca -conn.ca1._026=# - list of ca connection IDs for revocation routing -conn.ca1._027=# -conn.ca1._028=# where -conn.ca1._029=# - CA connection ID -conn.ca1._030=######################################### -conn.ca1.clientNickname=[HSM_LABEL][NICKNAME] -conn.ca1.hostport=[PKI_CA_HOSTNAME]:[PKI_CA_PORT] -conn.ca1.keepAlive=true -conn.ca1.retryConnect=3 -conn.ca1.servlet.enrollment=/ca/ee/ca/profileSubmitSSLClient -conn.ca1.servlet.renewal=/ca/ee/ca/profileSubmitSSLClient -conn.ca1.servlet.revoke=/ca/ee/subsystem/ca/doRevoke -conn.ca1.servlet.unrevoke=/ca/ee/subsystem/ca/doUnrevoke -conn.ca1.SSLOn=true -conn.ca1.timeout=100 -conn.drm1._000=######################################### -conn.drm1._001=# DRM connection -conn.drm1._002=# -conn.drm1._003=#conn.drm.totalConns -conn.drm1._004=# - # of DRM connections -conn.drm1._005=#conn.drm.hostport -conn.drm1._006=# - host name and port number of your DRM, the format is host:port -conn.drm1._007=#conn.drm.clientNickname -conn.drm1._008=# - nickname of the client certificate for -conn.drm1._009=# authentication -conn.drm1._010=#conn.drm.servlet.GenerateKeyPair -conn.drm1._011=# - servlet to generate key pairs and archive keys on DRM -conn.drm1._012=# - must be '/kra/GenerateKeyPair' -conn.drm1._013=#conn.drm.servlet.TokenKeyRecovery=/kra/TokenKeyRecovery -conn.drm1._014=# - servlet to handle key recovery -conn.drm1._015=# - must be '/kra/TokenKeyRecovery' -conn.drm1._016=#conn.drm.retryConnect=3 -conn.drm1._017=# - number of reconnection attempts on failure -conn.drm1._018=#conn.drm.SSLOn=true -conn.drm1._019=# - enable SSL or not -conn.drm1._020=#conn.drm.keepAlive=false -conn.drm1._021=# - enable keep alive or not -conn.drm1._022=# -conn.drm1._023=# where -conn.drm1._024=# - DRM connection ID -conn.drm1._025=######################################### -conn.drm1.clientNickname=[HSM_LABEL][NICKNAME] -conn.drm1.hostport=[DRM_HOST]:[DRM_PORT] -conn.drm1.keepAlive=false -conn.drm1.retryConnect=3 -conn.drm1.servlet.GenerateKeyPair=/kra/agent/kra/GenerateKeyPair -conn.drm1.servlet.TokenKeyRecovery=/kra/agent/kra/TokenKeyRecovery -conn.drm1.SSLOn=true -conn.drm1.timeout=100 -conn.drm.totalConns=1 -conn.tks1._000=######################################### -conn.tks1._001=# TKS connection -conn.tks1._002=# -conn.tks1._003=# conn.tks.hostport: -conn.tks1._004=# - host name and port number of your TKS, the format is host:port -conn.tks1._005=# conn.tks.clientNickname: -conn.tks1._006=# - nickname of the client certificate for -conn.tks1._007=# authentication -conn.tks1._008=# conn.tks.servlet.computeSessionKey: -conn.tks1._009=# - servlet to compute session key -conn.tks1._010=# - must be '/tks/computeSessionKey' -conn.tks1._011=# conn.tks.servlet.encryptData: -conn.tks1._012=# - servlet to encrypt data -conn.tks1._013=# - must be '/tks/encryptData' -conn.tks1._014=# conn.tks.servlet.createKeySetData: -conn.tks1._015=# - servlet to create key set data -conn.tks1._016=# - must be '/tks/createKeySetData' -conn.tks1._017=# conn.tks.retryConnect: -conn.tks1._018=# - number of reconnection attempts on failure -conn.tks1._019=# conn.tks.SSLOn -conn.tks1._020=# - enable SSL or not -conn.tks1._021=# conn.tks.keepAlive: -conn.tks1._022=# - enable keep alive or not -conn.tks1._023=# -conn.tks1._024=# where -conn.tks1._025=# - TKS connection ID -conn.tks1._026=# conn.tks.tksSharedSymKeyName: -conn.tks1._027=# - set shared secret key name -conn.tks1._028=######################################### -conn.tks1.clientNickname=[HSM_LABEL][NICKNAME] -conn.tks1.generateHostChallenge=true -conn.tks1.hostport=[TKS_HOST]:[TKS_PORT] -conn.tks1.keepAlive=false -conn.tks1.keySet=defKeySet -conn.tks1.retryConnect=3 -conn.tks1.serverKeygen=[SERVER_KEYGEN] -conn.tks1.servlet.computeRandomData=/tks/agent/tks/computeRandomData -conn.tks1.servlet.computeSessionKey=/tks/agent/tks/computeSessionKey -conn.tks1.servlet.createKeySetData=/tks/agent/tks/createKeySetData -conn.tks1.servlet.encryptData=/tks/agent/tks/encryptData -conn.tks1.SSLOn=true -conn.tks1.timeout=100 -conn.tks1.tksSharedSymKeyName=sharedSecret -cs.state=0 -cs.type=TPS -dbs.ldap=internaldb -dbs.newSchemaEntryAdded=true -debug.append=true -debug.enabled=true -debug.filename=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/debug -debug.hashkeytypes= -debug.level=0 -debug.showcaller=false -failover.pod.enable=false -general.applet_ext=ijc -general.pwlength.min=16 -general.search.sizelimit.default=100 -general.search.sizelimit.max=2000 -general.search.timelimit.default=10 -general.search.timelimit.max=10 -general.verifyProof=1 -installDate=[INSTALL_TIME] -instanceId=[PKI_INSTANCE_NAME] -instanceRoot=[PKI_INSTANCE_PATH] -internaldb._000=## -internaldb._001=## Internal Database -internaldb._002=## -internaldb.ldapauth.authtype=BasicAuth -internaldb.ldapauth.bindDN=cn=Directory Manager -internaldb.ldapauth.bindPWPrompt=Internal LDAP Database -internaldb.ldapauth.clientCertNickname= -internaldb.ldapconn.host= -internaldb.ldapconn.port= -internaldb.ldapconn.secureConn=false -internaldb.maxConns=15 -internaldb.minConns=3 -internaldb.multipleSuffix.enable=false -jss._000=## -jss._001=## JSS -jss._002=## -jss.configDir=[PKI_INSTANCE_PATH]/alias/ -jss.enable=true -jss.ocspcheck.enable=false -jss.secmodName=secmod.db -jss.ssl.cipherfortezza=true -jss.ssl.cipherpref= -jss.ssl.cipherversion=cipherdomestic -keys.ecc.curve.default=nistp256 -keys.ecc.curve.display.list=nistp256 (secp256r1),nistp384 (secp384r1),nistp521 (secp521r1),nistk163 (sect163k1),sect163r1,nistb163 (sect163r2),sect193r1,sect193r2,nistk233 (sect233k1),nistb233 (sect233r1),sect239k1,nistk283 (sect283k1),nistb283 (sect283r1),nistk409 (sect409k1),nistb409 (sect409r1),nistk571 (sect571k1),nistb571 (sect571r1),secp160k1,secp160r1,secp160r2,secp192k1,nistp192 (secp192r1, prime192v1),secp224k1,nistp224 (secp224r1),secp256k1,prime192v2,prime192v3,prime239v1,prime239v2,prime239v3,c2pnb163v1,c2pnb163v2,c2pnb163v3,c2pnb176v1,c2tnb191v1,c2tnb191v2,c2tnb191v3,c2pnb208w1,c2tnb239v1,c2tnb239v2,c2tnb239v3,c2pnb272w1,c2pnb304w1,c2tnb359w1,c2pnb368w1,c2tnb431r1,secp112r1,secp112r2,secp128r1,secp128r2,sect113r1,sect113r2,sect131r1,sect131r2 -keys.ecc.curve.list=nistp256,nistp384,nistp521,sect163k1,nistk163,sect163r1,sect163r2,nistb163,sect193r1,sect193r2,sect233k1,nistk233,sect233r1,nistb233,sect239k1,sect283k1,nistk283,sect283r1,nistb283,sect409k1,nistk409,sect409r1,nistb409,sect571k1,nistk571,sect571r1,nistb571,secp160k1,secp160r1,secp160r2,secp192k1,secp192r1,nistp192,secp224k1,secp224r1,nistp224,secp256k1,secp256r1,secp384r1,secp521r1,prime192v1,prime192v2,prime192v3,prime239v1,prime239v2,prime239v3,c2pnb163v1,c2pnb163v2,c2pnb163v3,c2pnb176v1,c2tnb191v1,c2tnb191v2,c2tnb191v3,c2pnb208w1,c2tnb239v1,c2tnb239v2,c2tnb239v3,c2pnb272w1,c2pnb304w1,c2tnb359w1,c2pnb368w1,c2tnb431r1,secp112r1,secp112r2,secp128r1,secp128r2,sect113r1,sect113r2,sect131r1,sect131r2 -keys.rsa.keysize.default=2048 -log._000=## -log._001=## Logging -log._002=## -logAudit.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/access -logError.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/error -log.impl.file.class=com.netscape.cms.logging.RollingLogFile -log.instance.SignedAudit._000=## -log.instance.SignedAudit._001=## Signed Audit Logging -log.instance.SignedAudit._002=## -log.instance.SignedAudit._003=## -log.instance.SignedAudit._004=## Available Audit events: -log.instance.SignedAudit._005=## AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE,OCSP_ADD_CA_REQUEST,OCSP_ADD_CA_REQUEST_PROCESSED,OCSP_REMOVE_CA_REQUEST,OCSP_REMOVE_CA_REQUEST_PROCESSED_SUCCESS,OCSP_REMOVE_CA_REQUEST_PROCESSED_FAILURE,COMPUTE_RANDOM_DATA_REQUEST,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE,CIMC_CERT_VERIFICATION -log.instance.SignedAudit._006=## -log.instance.SignedAudit.bufferSize=512 -log.instance.SignedAudit.enable=true -log.instance.SignedAudit.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,ROLE_ASSUME,CONFIG_CERT_POLICY,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_OCSP_PROFILE,CONFIG_AUTH,CONFIG_ROLE,CONFIG_ACL,CONFIG_SIGNED_AUDIT,CONFIG_ENCRYPTION,CONFIG_TRUSTED_PUBLIC_KEY,CONFIG_DRM,SELFTESTS_EXECUTION,AUDIT_LOG_DELETE,LOG_PATH_CHANGE,LOG_EXPIRATION_CHANGE,PRIVATE_KEY_ARCHIVE_REQUEST,PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS,PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE,KEY_RECOVERY_REQUEST,KEY_RECOVERY_REQUEST_ASYNC,KEY_RECOVERY_AGENT_LOGIN,KEY_RECOVERY_REQUEST_PROCESSED,KEY_RECOVERY_REQUEST_PROCESSED_ASYNC,KEY_GEN_ASYMMETRIC,NON_PROFILE_CERT_REQUEST,PROFILE_CERT_REQUEST,CERT_REQUEST_PROCESSED,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,AUTHZ_SUCCESS,AUTHZ_FAIL,INTER_BOUNDARY,AUTH_FAIL,AUTH_SUCCESS,CERT_PROFILE_APPROVAL,PROOF_OF_POSSESSION,CRL_RETRIEVAL,CRL_VALIDATION,CMC_SIGNED_REQUEST_SIG_VERIFY,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS,SERVER_SIDE_KEYGEN_REQUEST,COMPUTE_SESSION_KEY_REQUEST,COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS, COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE,DIVERSIFY_KEY_REQUEST,DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS, DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE,ENCRYPT_DATA_REQUEST,ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS,ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE,OCSP_ADD_CA_REQUEST,OCSP_ADD_CA_REQUEST_PROCESSED,OCSP_REMOVE_CA_REQUEST,OCSP_REMOVE_CA_REQUEST_PROCESSED_SUCCESS,OCSP_REMOVE_CA_REQUEST_PROCESSED_FAILURE,COMPUTE_RANDOM_DATA_REQUEST,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS,COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE,CIMC_CERT_VERIFICATION,LOGGING_SIGNED_AUDIT_SIGNING,ENROLLMENT,PIN_RESET,FORMAT,CONFIG,CONFIG_TOKEN,CONFIG_PROFILE,APPLET_UPGRADE,KEY_CHANGEOVER,RENEWAL,CIMC_CERT_VERIFICATION -log.instance.SignedAudit.expirationTime=0 -log.instance.SignedAudit.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/signedAudit/tps_cert-tps_audit -log.instance.SignedAudit.flushInterval=5 -log.instance.SignedAudit.level=1 -log.instance.SignedAudit.logSigning=false -log.instance.SignedAudit.maxFileSize=2000 -log.instance.SignedAudit.pluginName=file -log.instance.SignedAudit.rolloverInterval=2592000 -log.instance.SignedAudit.signedAudit:_000=## -log.instance.SignedAudit.signedAudit:_001=## Fill in the nickname of a trusted signing certificate to allow TPS audit logs to be signed -log.instance.SignedAudit.signedAudit:_002=## -log.instance.SignedAudit.signedAuditCertNickname=auditSigningCert cert-[PKI_INSTANCE_NAME] -log.instance.SignedAudit.type=signedAudit -log.instance.System._000=## -log.instance.System._001=## System Logging -log.instance.System._002=## -log.instance.System.bufferSize=512 -log.instance.System.enable=true -log.instance.System.expirationTime=0 -log.instance.System.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/system -log.instance.System.flushInterval=5 -log.instance.System.level=3 -log.instance.System.maxFileSize=2000 -log.instance.System.pluginName=file -log.instance.System.rolloverInterval=2592000 -log.instance.System.type=system -log.instance.Transactions._000=## -log.instance.Transactions._001=## Transaction Logging -log.instance.Transactions._002=## -log.instance.Transactions.bufferSize=512 -log.instance.Transactions.enable=true -log.instance.Transactions.expirationTime=0 -log.instance.Transactions.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/transactions -log.instance.Transactions.flushInterval=5 -log.instance.Transactions.level=1 -log.instance.Transactions.maxFileSize=2000 -log.instance.Transactions.pluginName=file -log.instance.Transactions.rolloverInterval=2592000 -log.instance.Transactions.type=transaction -machineName=[PKI_HOSTNAME] -multiroles._000=## -multiroles._001=## multiroles -multiroles._002=## -multiroles.enable=true -multiroles.false.groupEnforceList=Administrators,Auditors,Trusted Managers,Certificate Manager Agents,Registration Manager Agents,Data Recovery Manager Agents,Online Certificate Status Manager Agents,Token Key Service Manager Agents,Enterprise CA Administrators,Enterprise KRA Administrators,Enterprise OCSP Administrators,Enterprise RA Administrators,Enterprise TKS Administrators,Enterprise TPS Administrators,Security Domain Administrators,Subsystem Group,ClonedSubsystems -multiroles.false.groupEnforceList=Administrators,Auditors,Trusted Managers,Certificate Manager Agents,Registration Manager Agents,Data Recovery Manager Agents,Online Certificate Status Manager Agents,Token Key Service Manager Agents,Enterprise CA Administrators,Enterprise KRA Adminstrators,Enterprise OCSP Administrators,Enterprise RA Administrators,Enterprise TKS Administrators,Enterprise TPS Administrators,Security Domain Administrators,Subsystem Group -multiroles=true -op.enroll._000=######################################### -op.enroll._001=# Default Operations -op.enroll._002=# -op.enroll._003=# op..mapping.order=,, -op.enroll._004=# - contains at least one value or a series -op.enroll._005=# of comma-separated mapping values which -op.enroll._006=# are checked in sequential order -op.enroll._007=# op..mapping..filter.tokenType=userKey -op.enroll._008=# - can be either empty or token type -op.enroll._009=# specified by the client -op.enroll._010=# op..mapping..filter.tokenATR= -op.enroll._011=# - can be either empty or token ATR -op.enroll._012=# specified by the client -op.enroll._013=# op..mapping..filter.appletMajorVersion=1 -op.enroll._014=# - can be either empty or applet major version -op.enroll._015=# specified by the client -op.enroll._016=# op..mapping..filter.appletMinorVersion= -op.enroll._017=# - can be either empty or applet minor version -op.enroll._018=# specified by the client -op.enroll._019=# - if major and minor versions are both zero, this -op.enroll._020=# indicate there is no applet on the token. -op.enroll._021=# op..mapping..target.tokenType=userKey -op.enroll._022=# - if tokenType, tokenATR, appletMajorVersion, -op.enroll._023=# and appletMinorVersion are matched, value in -op.enroll._024=# targetTokenType will be used to locate -op.enroll._025=# the corresponding token profile to -op.enroll._026=# process the request. -op.enroll._027=# -op.enroll._028=# where -op.enroll._029=# - operation; enroll,pinReset,format -op.enroll._030=# - mapping ID; order is specifiable -op.enroll._031=# -op.enroll._032=# Token ATR: -op.enroll._033=# Web Store - 3B759400006202020201 -op.enroll._034=######################################### -op.enroll.allowUnknownToken=true -op.enroll.mapping.0.filter.appletMajorVersion=1 -op.enroll.mapping.0.filter.appletMinorVersion= -op.enroll.mapping.0.filter.tokenATR= -op.enroll.mapping.0.filter.tokenCUID.end= -op.enroll.mapping.0.filter.tokenCUID.start= -op.enroll.mapping.0.filter.tokenType=userKey -op.enroll.mapping.0.target.tokenType=userKey -op.enroll.mapping.1.filter.appletMajorVersion= -op.enroll.mapping.1.filter.appletMinorVersion= -op.enroll.mapping.1.filter.tokenATR= -op.enroll.mapping.1.filter.tokenCUID.end= -op.enroll.mapping.1.filter.tokenCUID.start= -op.enroll.mapping.1.filter.tokenType=soKey -op.enroll.mapping.1.target.tokenType=soKey -op.enroll.mapping.2.filter.appletMajorVersion= -op.enroll.mapping.2.filter.appletMinorVersion= -op.enroll.mapping.2.filter.tokenATR= -op.enroll.mapping.2.filter.tokenCUID.end= -op.enroll.mapping.2.filter.tokenCUID.start= -op.enroll.mapping.2.filter.tokenType= -op.enroll.mapping.2.target.tokenType=userKey -op.enroll.mapping.order=0,1,2 -op.enroll.soKey._079=#op.enroll.userKey.keyGen.signing.publisherId=fileBasedPublisher -op.enroll.soKey.auth.enable=true -op.enroll.soKey.auth.id=ldap2 -op.enroll.soKey.cardmgr_instance=A0000000030000 -op.enroll.soKey.issuerinfo.enable=true -op.enroll.soKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/so/index.cgi -op.enroll.soKey.keyGen.encryption.ca.conn=ca1 -op.enroll.soKey.keyGen.encryption.ca.profileId=caTokenUserEncryptionKeyEnrollment -op.enroll.soKey.keyGen.encryption.certAttrId=c2 -op.enroll.soKey.keyGen.encryption.certId=C2 -op.enroll.soKey.keyGen.encryption.cuid_label=$cuid$ -op.enroll.soKey.keyGen.encryption.keySize=1024 -op.enroll.soKey.keyGen.encryption.keyUsage=0 -op.enroll.soKey.keyGen.encryption.keyUser=0 -op.enroll.soKey.keyGen.encryption.label=encryption key for $userid$ -op.enroll.soKey.keyGen.encryption.overwrite=true -op.enroll.soKey.keyGen.encryption.privateKeyAttrId=k4 -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.decrypt=true -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.derive=false -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.encrypt=false -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.private=true -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.sensitive=true -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.sign=false -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.signRecover=false -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.token=true -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.unwrap=true -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.verify=false -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.verifyRecover=false -op.enroll.soKey.keyGen.encryption.private.keyCapabilities.wrap=false -op.enroll.soKey.keyGen.encryption.privateKeyNumber=4 -op.enroll.soKey.keyGen.encryption.publicKeyAttrId=k5 -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.decrypt=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.derive=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.encrypt=true -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.private=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.sensitive=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.sign=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.signRecover=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.token=true -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.unwrap=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.verify=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.verifyRecover=false -op.enroll.soKey.keyGen.encryption.public.keyCapabilities.wrap=true -op.enroll.soKey.keyGen.encryption.publicKeyNumber=5 -op.enroll.soKey.keyGen.encryption.recovery.destroyed.revokeCert=false -op.enroll.soKey.keyGen.encryption.recovery.destroyed.revokeCert.reason=0 -op.enroll.soKey.keyGen.encryption.recovery.destroyed.scheme=RecoverLast -op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.revokeCert.reason=1 -op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.revokeCert=true -op.enroll.soKey.keyGen.encryption.recovery.keyCompromise.scheme=GenerateNewKey -op.enroll.soKey.keyGen.encryption.recovery.onHold.revokeCert.reason=6 -op.enroll.soKey.keyGen.encryption.recovery.onHold.revokeCert=true -op.enroll.soKey.keyGen.encryption.recovery.onHold.scheme=GenerateNewKey -op.enroll.soKey.keyGen.encryption.serverKeygen.archive=true -op.enroll.soKey.keyGen.encryption.serverKeygen.drm.conn=drm1 -op.enroll.soKey.keyGen.encryption.serverKeygen.enable=[SERVER_KEYGEN] -op.enroll.soKey.keyGen.keyType.num=2 -op.enroll.soKey.keyGen.keyType.value.0=signing -op.enroll.soKey.keyGen.keyType.value.1=encryption -op.enroll.soKey.keyGen.recovery.destroyed.keyType.num=2 -op.enroll.soKey.keyGen.recovery.destroyed.keyType.value.0=signing -op.enroll.soKey.keyGen.recovery.destroyed.keyType.value.1=encryption -op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.num=2 -op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.value.0=signing -op.enroll.soKey.keyGen.recovery.keyCompromise.keyType.value.1=encryption -op.enroll.soKey.keyGen.recovery.onHold.keyType.num=2 -op.enroll.soKey.keyGen.recovery.onHold.keyType.value.0=signing -op.enroll.soKey.keyGen.recovery.onHold.keyType.value.1=encryption -op.enroll.soKey.keyGen.signing.ca.conn=ca1 -op.enroll.soKey.keyGen.signing.ca.profileId=caTokenUserSigningKeyEnrollment -op.enroll.soKey.keyGen.signing.certAttrId=c1 -op.enroll.soKey.keyGen.signing.certId=C1 -op.enroll.soKey.keyGen.signing.cuid_label=$cuid$ -op.enroll.soKey.keyGen.signing.keySize=1024 -op.enroll.soKey.keyGen.signing.keyUsage=0 -op.enroll.soKey.keyGen.signing.keyUser=0 -op.enroll.soKey.keyGen.signing.label=signing key for $userid$ -op.enroll.soKey.keyGen.signing.overwrite=true -op.enroll.soKey.keyGen.signing.privateKeyAttrId=k2 -op.enroll.soKey.keyGen.signing.private.keyCapabilities.decrypt=false -op.enroll.soKey.keyGen.signing.private.keyCapabilities.derive=false -op.enroll.soKey.keyGen.signing.private.keyCapabilities.encrypt=false -op.enroll.soKey.keyGen.signing.private.keyCapabilities.private=true -op.enroll.soKey.keyGen.signing.private.keyCapabilities.sensitive=true -op.enroll.soKey.keyGen.signing.private.keyCapabilities.signRecover=true -op.enroll.soKey.keyGen.signing.private.keyCapabilities.sign=true -op.enroll.soKey.keyGen.signing.private.keyCapabilities.token=true -op.enroll.soKey.keyGen.signing.private.keyCapabilities.unwrap=false -op.enroll.soKey.keyGen.signing.private.keyCapabilities.verify=false -op.enroll.soKey.keyGen.signing.private.keyCapabilities.verifyRecover=false -op.enroll.soKey.keyGen.signing.private.keyCapabilities.wrap=false -op.enroll.soKey.keyGen.signing.privateKeyNumber=2 -op.enroll.soKey.keyGen.signing.publicKeyAttrId=k3 -op.enroll.soKey.keyGen.signing.public.keyCapabilities.decrypt=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.derive=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.encrypt=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.private=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.sensitive=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.sign=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.signRecover=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.token=true -op.enroll.soKey.keyGen.signing.public.keyCapabilities.unwrap=false -op.enroll.soKey.keyGen.signing.public.keyCapabilities.verifyRecover=true -op.enroll.soKey.keyGen.signing.public.keyCapabilities.verify=true -op.enroll.soKey.keyGen.signing.public.keyCapabilities.wrap=false -op.enroll.soKey.keyGen.signing.publicKeyNumber=3 -op.enroll.soKey.keyGen.signing.recovery.destroyed.revokeCert.reason=0 -op.enroll.soKey.keyGen.signing.recovery.destroyed.revokeCert=true -op.enroll.soKey.keyGen.signing.recovery.destroyed.scheme=GenerateNewKey -op.enroll.soKey.keyGen.signing.recovery.keyCompromise.revokeCert.reason=1 -op.enroll.soKey.keyGen.signing.recovery.keyCompromise.revokeCert=true -op.enroll.soKey.keyGen.signing.recovery.keyCompromise.scheme=GenerateNewKey -op.enroll.soKey.keyGen.signing.recovery.onHold.revokeCert.reason=6 -op.enroll.soKey.keyGen.signing.recovery.onHold.revokeCert=true -op.enroll.soKey.keyGen.signing.recovery.onHold.scheme=GenerateNewKey -op.enroll.soKey.keyGen.tokenName=$auth.cn$ -op.enroll.soKey.loginRequest.enable=true -op.enroll.soKey.pinReset.enable=true -op.enroll.soKey.pinReset.pin.maxLen=10 -op.enroll.soKey.pinReset.pin.maxRetries=127 -op.enroll.soKey.pinReset.pin.minLen=4 -op.enroll.soKey.pkcs11obj.compress.enable=true -op.enroll.soKey.pkcs11obj.enable=true -op.enroll.soKeyTemporary.auth.enable=true -op.enroll.soKeyTemporary.auth.id=ldap2 -op.enroll.soKeyTemporary.cardmgr_instance=A0000000030000 -op.enroll.soKeyTemporary.keyGen.auth.ca.conn=ca1 -op.enroll.soKeyTemporary.keyGen.auth.ca.profileId=caTempTokenDeviceKeyEnrollment -op.enroll.soKeyTemporary.keyGen.auth.certAttrId=c0 -op.enroll.soKeyTemporary.keyGen.auth.certId=C0 -op.enroll.soKeyTemporary.keyGen.auth.cuid_label=$cuid$ -op.enroll.soKeyTemporary.keyGen.auth.keySize=1024 -op.enroll.soKeyTemporary.keyGen.auth.keyUsage=0 -op.enroll.soKeyTemporary.keyGen.auth.keyUser=15 -op.enroll.soKeyTemporary.keyGen.auth.label=Temporary Key for $userid$ -op.enroll.soKeyTemporary.keyGen.auth.overwrite=false -op.enroll.soKeyTemporary.keyGen.auth.privateKeyAttrId=k0 -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.decrypt=false -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.derive=false -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.encrypt=false -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.private=false -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.sensitive=true -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.signRecover=true -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.sign=true -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.token=true -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.unwrap=false -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.verifyRecover=true -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.verify=true -op.enroll.soKeyTemporary.keyGen.auth.private.keyCapabilities.wrap=false -op.enroll.soKeyTemporary.keyGen.auth.privateKeyNumber=0 -op.enroll.soKeyTemporary.keyGen.auth.publicKeyAttrId=k1 -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.decrypt=false -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.derive=false -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.encrypt=false -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.private=false -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.sensitive=true -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.signRecover=true -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.sign=true -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.token=true -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.unwrap=false -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.verifyRecover=true -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.verify=true -op.enroll.soKeyTemporary.keyGen.auth.public.keyCapabilities.wrap=false -op.enroll.soKeyTemporary.keyGen.auth.publicKeyNumber=1 -op.enroll.soKeyTemporary.keyGen.encryption.ca.conn=ca1 -op.enroll.soKeyTemporary.keyGen.encryption.ca.profileId=caTempTokenUserEncryptionKeyEnrollment -op.enroll.soKeyTemporary.keyGen.encryption.certAttrId=c2 -op.enroll.soKeyTemporary.keyGen.encryption.certId=C2 -op.enroll.soKeyTemporary.keyGen.encryption.cuid_label=$cuid$ -op.enroll.soKeyTemporary.keyGen.encryption.keySize=1024 -op.enroll.soKeyTemporary.keyGen.encryption.keyUsage=0 -op.enroll.soKeyTemporary.keyGen.encryption.keyUser=0 -op.enroll.soKeyTemporary.keyGen.encryption.label=encryption key for $userid$ -op.enroll.soKeyTemporary.keyGen.encryption.overwrite=true -op.enroll.soKeyTemporary.keyGen.encryption.privateKeyAttrId=k4 -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.decrypt=true -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.derive=false -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.encrypt=false -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.private=true -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.sensitive=true -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.sign=false -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.signRecover=false -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.token=true -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.unwrap=true -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.verify=false -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.verifyRecover=false -op.enroll.soKeyTemporary.keyGen.encryption.private.keyCapabilities.wrap=false -op.enroll.soKeyTemporary.keyGen.encryption.privateKeyNumber=4 -op.enroll.soKeyTemporary.keyGen.encryption.publicKeyAttrId=k5 -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.decrypt=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.derive=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.encrypt=true -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.private=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.sensitive=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.sign=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.signRecover=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.token=true -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.unwrap=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.verify=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.verifyRecover=false -op.enroll.soKeyTemporary.keyGen.encryption.public.keyCapabilities.wrap=true -op.enroll.soKeyTemporary.keyGen.encryption.publicKeyNumber=5 -op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert.reason=0 -op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert=true -op.enroll.soKeyTemporary.keyGen.encryption.recovery.onHold.scheme=RecoverLast -op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.archive=true -op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.drm.conn=drm1 -op.enroll.soKeyTemporary.keyGen.encryption.serverKeygen.enable=true -op.enroll.soKeyTemporary.keyGen.keyType.num=3 -op.enroll.soKeyTemporary.keyGen.keyType.value.0=auth -op.enroll.soKeyTemporary.keyGen.keyType.value.1=signing -op.enroll.soKeyTemporary.keyGen.keyType.value.2=encryption -op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.num=2 -op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.value.0=signing -op.enroll.soKeyTemporary.keyGen.recovery.onHold.keyType.value.1=encryption -op.enroll.soKeyTemporary.keyGen.signing.ca.conn=ca1 -op.enroll.soKeyTemporary.keyGen.signing.ca.profileId=caTempTokenUserSigningKeyEnrollment -op.enroll.soKeyTemporary.keyGen.signing.certAttrId=c1 -op.enroll.soKeyTemporary.keyGen.signing.certId=C1 -op.enroll.soKeyTemporary.keyGen.signing.cuid_label=$cuid$ -op.enroll.soKeyTemporary.keyGen.signing.keySize=1024 -op.enroll.soKeyTemporary.keyGen.signing.keyUsage=0 -op.enroll.soKeyTemporary.keyGen.signing.keyUser=0 -op.enroll.soKeyTemporary.keyGen.signing.label=signing key for $userid$ -op.enroll.soKeyTemporary.keyGen.signing.overwrite=true -op.enroll.soKeyTemporary.keyGen.signing.privateKeyAttrId=k2 -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.decrypt=false -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.derive=false -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.encrypt=false -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.private=true -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.sensitive=true -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.signRecover=true -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.sign=true -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.token=true -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.unwrap=false -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.verify=false -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.verifyRecover=false -op.enroll.soKeyTemporary.keyGen.signing.private.keyCapabilities.wrap=false -op.enroll.soKeyTemporary.keyGen.signing.privateKeyNumber=2 -op.enroll.soKeyTemporary.keyGen.signing.publicKeyAttrId=k3 -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.decrypt=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.derive=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.encrypt=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.private=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.sensitive=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.sign=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.signRecover=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.token=true -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.unwrap=false -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.verifyRecover=true -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.verify=true -op.enroll.soKeyTemporary.keyGen.signing.public.keyCapabilities.wrap=false -op.enroll.soKeyTemporary.keyGen.signing.publicKeyNumber=3 -op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.revokeCert.reason=0 -op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.revokeCert=true -op.enroll.soKeyTemporary.keyGen.signing.recovery.onHold.scheme=GenerateNewKey -op.enroll.soKeyTemporary.keyGen.tokenName=$auth.cn$ (Temporary) -op.enroll.soKeyTemporary.loginRequest.enable=true -op.enroll.soKeyTemporary.pinReset.enable=true -op.enroll.soKeyTemporary.pinReset.pin.maxLen=10 -op.enroll.soKeyTemporary.pinReset.pin.maxRetries=127 -op.enroll.soKeyTemporary.pinReset.pin.minLen=4 -op.enroll.soKeyTemporary.pkcs11obj.compress.enable=true -op.enroll.soKeyTemporary.pkcs11obj.enable=true -op.enroll.soKeyTemporary.tks.conn=tks1 -op.enroll.soKeyTemporary.tks.keySet=defKeyset -op.enroll.soKey.temporaryToken.tokenType=soKeyTemporary -op.enroll.soKeyTemporary.update.applet.directory=[TPS_DIR]/applets -op.enroll.soKeyTemporary.update.applet.emptyToken.enable=true -op.enroll.soKeyTemporary.update.applet.enable=true -op.enroll.soKeyTemporary.update.applet.encryption=true -op.enroll.soKeyTemporary.update.applet.requiredVersion=1.4.4d40a449 -op.enroll.soKeyTemporary.update.symmetricKeys.enable=false -op.enroll.soKeyTemporary.update.symmetricKeys.requiredVersion=1 -op.enroll.soKey.tks.conn=tks1 -op.enroll.soKey.update.applet.directory=[TPS_DIR]/applets -op.enroll.soKey.update.applet.emptyToken.enable=true -op.enroll.soKey.update.applet.enable=true -op.enroll.soKey.update.applet.encryption=true -op.enroll.soKey.update.applet.requiredVersion=1.4.4d40a449 -op.enroll.soKey.update.symmetricKeys.enable=false -op.enroll.soKey.update.symmetricKeys.requiredVersion=1 -op.enroll.userKey._000=######################################### -op.enroll.userKey._001=# Enrollment Operation For CoolKey -op.enroll.userKey._002=# -op.enroll.userKey._003=# op.enroll..keyGen..keySize=1024 -op.enroll.userKey._004=# - size of the key the token should generate -op.enroll.userKey._005=# - max value: 1024 -op.enroll.userKey._006=# -op.enroll.userKey._007=# op.enroll..keyGen..keyCapabilities.encrypt=false -op.enroll.userKey._008=# op.enroll..keyGen..keyCapabilities.sign=true -op.enroll.userKey._009=# op.enroll..keyGen..keyCapabilities.signRecover=true -op.enroll.userKey._010=# op.enroll..keyGen..keyCapabilities.decrypt=false -op.enroll.userKey._011=# op.enroll..keyGen..keyCapabilities.derive=false -op.enroll.userKey._012=# op.enroll..keyGen..keyCapabilities.unwrap=false -op.enroll.userKey._013=# op.enroll..keyGen..keyCapabilities.wrap=false -op.enroll.userKey._014=# op.enroll..keyGen..keyCapabilities.verifyRecover=true -op.enroll.userKey._015=# op.enroll..keyGen..keyCapabilities.verify=true -op.enroll.userKey._016=# op.enroll..keyGen..keyCapabilities.sensitive=true -op.enroll.userKey._017=# op.enroll..keyGen..keyCapabilities.private=true -op.enroll.userKey._018=# op.enroll..keyGen..keyCapabilities.token=true -op.enroll.userKey._019=# - specify the PKCS11 attributes to set on the token -op.enroll.userKey._020=# -op.enroll.userKey._021=# op.enroll.userKey.keyGen.signing.cuid_label -op.enroll.userKey._022=# - specify the CUID shown in the certificate -op.enroll.userKey._023=# -op.enroll.userKey._024=# op.enroll.userKey.keyGen.signing.label -op.enroll.userKey._025=# - specify the token name. all resulting labels for co-existing keys -op.enroll.userKey._026=# on the same token must be unique -op.enroll.userKey._027=# - $pretty_cuid$ - Pretty Print CUID (i.e. 4090-0062-FF02-0000-0B9C) -op.enroll.userKey._028=# - $cuid$ - CUID (i.e. 40900062FF0200000B9C) -op.enroll.userKey._029=# - $msn$ - MSN -op.enroll.userKey._030=# - $userid$ - User ID -op.enroll.userKey._031=# - $profileId$ - Profile ID -op.enroll.userKey._032=# -op.enroll.userKey._033=# op.enroll..keyGen..overwrite=true|false -op.enroll.userKey._034=# - if key and certificate exist, should RA overwrite them -op.enroll.userKey._035=# -op.enroll.userKey._036=# op.enroll..keyGen..certId=C1 -op.enroll.userKey._037=# op.enroll..keyGen..certAttrId=c1 -op.enroll.userKey._038=# op.enroll..keyGen..privateKeyAttrId=k2 -op.enroll.userKey._039=# op.enroll..keyGen..publicKeyAttrId=k3 -op.enroll.userKey._040=# op.enroll..keyGen..privateKeyNumber=2 -op.enroll.userKey._041=# op.enroll..keyGen..publicKeyNumber=3 -op.enroll.userKey._042=# - specify name PKCS11 object IDs -op.enroll.userKey._043=# - Lower case letters signify objects containing PKCS11 object attributes, -op.enroll.userKey._044=# in the format described below. -op.enroll.userKey._045=# 'c' An object containing PKCS11 attributes for a certificate. -op.enroll.userKey._046=# 'k' An object containing PKCS11 attributes for a public or private key -op.enroll.userKey._047=# 'r' An object containing PKCS11 attributes for an "reader". -op.enroll.userKey._048=# - Upper case letters signify objects containing raw data corresponding to -op.enroll.userKey._049=# the lower case letters described above. For example, object "C0" -op.enroll.userKey._050=# contains raw data corresponding to object "c0". -op.enroll.userKey._051=# 'C' This object contains an entire DER cert, and nothing else. -op.enroll.userKey._052=# 'K' This object contains a MUSCLE "key blob". TPS does not use this. -op.enroll.userKey._053=# -op.enroll.userKey._054=# op.enroll..keyGen..keyUsage=0 -op.enroll.userKey._055=# op.enroll..keyGen..keyUser=0 -op.enroll.userKey._056=# - user specifies which PIN user should be granted -op.enroll.userKey._057=# use privilege of the generated private key, or -op.enroll.userKey._058=# 15 if all users have use privilege for the private key -op.enroll.userKey._059=# - Valid uage: (only specifies the usage for the private key) -op.enroll.userKey._060=# 0 - default usage (Signing only for this APDU) -op.enroll.userKey._061=# 1 - signing only -op.enroll.userKey._062=# 2 - decryption only -op.enroll.userKey._063=# 3 - signing and decryption -op.enroll.userKey._064=# -op.enroll.userKey._065=# op.enroll..pkcs11obj.enable=true|false -op.enroll.userKey._066=# - enable writing of PKCS11 cache object to the token -op.enroll.userKey._067=# -op.enroll.userKey._068=# op.enroll..pkcs11obj.compress.enable=true|false -op.enroll.userKey._069=# - enable compression for writing of PKCS11 cache object to the token -op.enroll.userKey._070=# -op.enroll.userKey._071=# op.enroll..pinReset.pin.maxRetries=127 -op.enroll.userKey._072=# - max number of retries before blocking the token -op.enroll.userKey._073=# - max value: 127 -op.enroll.userKey._074=# -op.enroll.userKey._075=# There is a special case of tokenType userKeyTemporary. -op.enroll.userKey._076=# Make sure the profile specified by the profileId to have -op.enroll.userKey._077=# short validity period (eg, 7 days) for the certificate. -op.enroll.userKey._078=# -op.enroll.userKey._079=#op.enroll.userKey.keyGen.signing.publisherId=fileBasedPublisher -op.enroll.userKey._079=# The three recovery schemes supported are: -op.enroll.userKey._080=# -op.enroll.userKey._080=#op.enroll.userKeyTemporary.keyGen.signing.publisherId=fileBasedPublisher -op.enroll.userKey._081=# * GenerateNewKey - Generate a new -op.enroll.userKey._082=# cert for the -op.enroll.userKey._083=# encryption cert. -op.enroll.userKey._084=# * RecoverLast - Recover the most -op.enroll.userKey._085=# recent cert for the -op.enroll.userKey._086=# encryption cert. -op.enroll.userKey._087=# * GenerateNewKeyandRecoverLast - Generate new cert AND -op.enroll.userKey._088=# recover last for -op.enroll.userKey._089=# encryption cert. -op.enroll.userKey._090=######################################### -op.enroll.userKey.auth.enable=true -op.enroll.userKey.auth.id=ldap1 -op.enroll.userKey.cardmgr_instance=A0000000030000 -op.enroll.userKey.issuerinfo.enable=true -op.enroll.userKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi -op.enroll.userKey.keyGen.encryption.ca.conn=ca1 -op.enroll.userKey.keyGen.encryption.ca.profileId=caTokenUserEncryptionKeyEnrollment -op.enroll.userKey.keyGen.encryption.certAttrId=c2 -op.enroll.userKey.keyGen.encryption.certId=C2 -op.enroll.userKey.keyGen.encryption.cuid_label=$cuid$ -op.enroll.userKey.keyGen.encryption.keySize=1024 -op.enroll.userKey.keyGen.encryption.keyUsage=0 -op.enroll.userKey.keyGen.encryption.keyUser=0 -op.enroll.userKey.keyGen.encryption.label=encryption key for $userid$ -op.enroll.userKey.keyGen.encryption.overwrite=true -op.enroll.userKey.keyGen.encryption.privateKeyAttrId=k4 -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.decrypt=true -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.derive=false -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.encrypt=false -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.private=true -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.sensitive=true -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.sign=false -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.signRecover=false -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.token=true -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.unwrap=true -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.verify=false -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.verifyRecover=false -op.enroll.userKey.keyGen.encryption.private.keyCapabilities.wrap=false -op.enroll.userKey.keyGen.encryption.privateKeyNumber=4 -op.enroll.userKey.keyGen.encryption.publicKeyAttrId=k5 -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.decrypt=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.derive=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.encrypt=true -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.private=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.sensitive=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.sign=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.signRecover=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.token=true -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.unwrap=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.verify=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.verifyRecover=false -op.enroll.userKey.keyGen.encryption.public.keyCapabilities.wrap=true -op.enroll.userKey.keyGen.encryption.publicKeyNumber=5 -op.enroll.userKey.keyGen.encryption.recovery.destroyed.revokeCert=false -op.enroll.userKey.keyGen.encryption.recovery.destroyed.revokeCert.reason=0 -op.enroll.userKey.keyGen.encryption.recovery.destroyed.scheme=RecoverLast -op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.revokeCert.reason=1 -op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.revokeCert=true -op.enroll.userKey.keyGen.encryption.recovery.keyCompromise.scheme=GenerateNewKey -op.enroll.userKey.keyGen.encryption.recovery.onHold.revokeCert.reason=6 -op.enroll.userKey.keyGen.encryption.recovery.onHold.revokeCert=true -op.enroll.userKey.keyGen.encryption.recovery.onHold.scheme=GenerateNewKey -op.enroll.userKey.keyGen.encryption.serverKeygen.archive=true -op.enroll.userKey.keyGen.encryption.serverKeygen.drm.conn=drm1 -op.enroll.userKey.keyGen.encryption.serverKeygen.enable=[SERVER_KEYGEN] -op.enroll.userKey.keyGen.keyType.num=2 -op.enroll.userKey.keyGen.keyType.value.0=signing -op.enroll.userKey.keyGen.keyType.value.1=encryption -op.enroll.userKey.keyGen.recovery.destroyed.keyType.num=2 -op.enroll.userKey.keyGen.recovery.destroyed.keyType.value.0=signing -op.enroll.userKey.keyGen.recovery.destroyed.keyType.value.1=encryption -op.enroll.userKey.keyGen.recovery.keyCompromise.keyType.num=2 -op.enroll.userKey.keyGen.recovery.keyCompromise.keyType.value.0=signing -op.enroll.userKey.keyGen.recovery.keyCompromise.keyType.value.1=encryption -op.enroll.userKey.keyGen.recovery.onHold.keyType.num=2 -op.enroll.userKey.keyGen.recovery.onHold.keyType.value.0=signing -op.enroll.userKey.keyGen.recovery.onHold.keyType.value.1=encryption -op.enroll.userKey.keyGen.signing.ca.conn=ca1 -op.enroll.userKey.keyGen.signing.ca.profileId=caTokenUserSigningKeyEnrollment -op.enroll.userKey.keyGen.signing.certAttrId=c1 -op.enroll.userKey.keyGen.signing.certId=C1 -op.enroll.userKey.keyGen.signing.cuid_label=$cuid$ -op.enroll.userKey.keyGen.signing.keySize=1024 -op.enroll.userKey.keyGen.signing.keyUsage=0 -op.enroll.userKey.keyGen.signing.keyUser=0 -op.enroll.userKey.keyGen.signing.label=signing key for $userid$ -op.enroll.userKey.keyGen.signing.overwrite=true -op.enroll.userKey.keyGen.signing.privateKeyAttrId=k2 -op.enroll.userKey.keyGen.signing.private.keyCapabilities.decrypt=false -op.enroll.userKey.keyGen.signing.private.keyCapabilities.derive=false -op.enroll.userKey.keyGen.signing.private.keyCapabilities.encrypt=false -op.enroll.userKey.keyGen.signing.private.keyCapabilities.private=true -op.enroll.userKey.keyGen.signing.private.keyCapabilities.sensitive=true -op.enroll.userKey.keyGen.signing.private.keyCapabilities.signRecover=true -op.enroll.userKey.keyGen.signing.private.keyCapabilities.sign=true -op.enroll.userKey.keyGen.signing.private.keyCapabilities.token=true -op.enroll.userKey.keyGen.signing.private.keyCapabilities.unwrap=false -op.enroll.userKey.keyGen.signing.private.keyCapabilities.verify=false -op.enroll.userKey.keyGen.signing.private.keyCapabilities.verifyRecover=false -op.enroll.userKey.keyGen.signing.private.keyCapabilities.wrap=false -op.enroll.userKey.keyGen.signing.privateKeyNumber=2 -op.enroll.userKey.keyGen.signing.publicKeyAttrId=k3 -op.enroll.userKey.keyGen.signing.public.keyCapabilities.decrypt=false -op.enroll.userKey.keyGen.signing.public.keyCapabilities.derive=false -op.enroll.userKey.keyGen.signing.public.keyCapabilities.encrypt=false -op.enroll.userKey.keyGen.signing.public.keyCapabilities.private=false -op.enroll.userKey.keyGen.signing.public.keyCapabilities.sensitive=false -op.enroll.userKey.keyGen.signing.public.keyCapabilities.sign=false -op.enroll.userKey.keyGen.signing.public.keyCapabilities.signRecover=false -op.enroll.userKey.keyGen.signing.public.keyCapabilities.token=true -op.enroll.userKey.keyGen.signing.public.keyCapabilities.unwrap=false -op.enroll.userKey.keyGen.signing.public.keyCapabilities.verifyRecover=true -op.enroll.userKey.keyGen.signing.public.keyCapabilities.verify=true -op.enroll.userKey.keyGen.signing.public.keyCapabilities.wrap=false -op.enroll.userKey.keyGen.signing.publicKeyNumber=3 -op.enroll.userKey.keyGen.signing.recovery.destroyed.revokeCert.reason=0 -op.enroll.userKey.keyGen.signing.recovery.destroyed.revokeCert=true -op.enroll.userKey.keyGen.signing.recovery.destroyed.scheme=GenerateNewKey -op.enroll.userKey.keyGen.signing.recovery.keyCompromise.revokeCert.reason=1 -op.enroll.userKey.keyGen.signing.recovery.keyCompromise.revokeCert=true -op.enroll.userKey.keyGen.signing.recovery.keyCompromise.scheme=GenerateNewKey -op.enroll.userKey.keyGen.signing.recovery.onHold.revokeCert.reason=6 -op.enroll.userKey.keyGen.signing.recovery.onHold.revokeCert=true -op.enroll.userKey.keyGen.signing.recovery.onHold.scheme=GenerateNewKey -op.enroll.userKey.keyGen.tokenName=$auth.cn$ -op.enroll.userKey.loginRequest.enable=true -op.enroll.userKey.pinReset.enable=true -op.enroll.userKey.pinReset.pin.maxLen=10 -op.enroll.userKey.pinReset.pin.maxRetries=127 -op.enroll.userKey.pinReset.pin.minLen=4 -op.enroll.userKey.pkcs11obj.compress.enable=true -op.enroll.userKey.pkcs11obj.enable=true -op.enroll.userKey.renewal._000=######################################### -op.enroll.userKey.renewal._001=# Token Renewal. -op.enroll.userKey.renewal._002=# -op.enroll.userKey.renewal._003=# For each token in TPS UI, set the -op.enroll.userKey.renewal._004=# following to trigger renewal -op.enroll.userKey.renewal._005=# operations: -op.enroll.userKey.renewal._006=# -op.enroll.userKey.renewal._007=# RENEW=YES -op.enroll.userKey.renewal._008=# -op.enroll.userKey.renewal._009=# Optional grace period enforcement -op.enroll.userKey.renewal._010=# must coincide exactly with what -op.enroll.userKey.renewal._011=# the CA enforces. -op.enroll.userKey.renewal._012=# -op.enroll.userKey.renewal._013=# In case of renewal, encryption certId -op.enroll.userKey.renewal._014=# values are for completeness only, server -op.enroll.userKey.renewal._015=# code calculates actual values used. -op.enroll.userKey.renewal._016=# -op.enroll.userKey.renewal._017=######################################### -op.enroll.userKey.renewal.encryption.ca.conn=ca1 -op.enroll.userKey.renewal.encryption.ca.profileId=caTokenUserEncryptionKeyRenewal -op.enroll.userKey.renewal.encryption.certAttrId=c2 -op.enroll.userKey.renewal.encryption.certId=C2 -op.enroll.userKey.renewal.encryption.enable=true -op.enroll.userKey.renewal.encryption.gracePeriod.after=30 -op.enroll.userKey.renewal.encryption.gracePeriod.before=30 -op.enroll.userKey.renewal.encryption.gracePeriod.enable=false -op.enroll.userKey.renewal.keyType.num=2 -op.enroll.userKey.renewal.keyType.value.0=signing -op.enroll.userKey.renewal.keyType.value.1=encryption -op.enroll.userKey.renewal.signing.ca.conn=ca1 -op.enroll.userKey.renewal.signing.ca.profileId=caTokenUserSigningKeyRenewal -op.enroll.userKey.renewal.signing.certAttrId=c1 -op.enroll.userKey.renewal.signing.certId=C1 -op.enroll.userKey.renewal.signing.enable=true -op.enroll.userKey.renewal.signing.gracePeriod.after=30 -op.enroll.userKey.renewal.signing.gracePeriod.before=30 -op.enroll.userKey.renewal.signing.gracePeriod.enable=false -op.enroll.userKeyTemporary.auth.enable=true -op.enroll.userKeyTemporary.auth.id=ldap1 -op.enroll.userKeyTemporary.cardmgr_instance=A0000000030000 -op.enroll.userKeyTemporary.keyGen.auth.ca.conn=ca1 -op.enroll.userKeyTemporary.keyGen.auth.ca.profileId=caTempTokenDeviceKeyEnrollment -op.enroll.userKeyTemporary.keyGen.auth.certAttrId=c0 -op.enroll.userKeyTemporary.keyGen.auth.certId=C0 -op.enroll.userKeyTemporary.keyGen.auth.cuid_label=$cuid$ -op.enroll.userKeyTemporary.keyGen.auth.keySize=1024 -op.enroll.userKeyTemporary.keyGen.auth.keyUsage=0 -op.enroll.userKeyTemporary.keyGen.auth.keyUser=15 -op.enroll.userKeyTemporary.keyGen.auth.label=Temporary Key for $userid$ -op.enroll.userKeyTemporary.keyGen.auth.overwrite=false -op.enroll.userKeyTemporary.keyGen.auth.privateKeyAttrId=k0 -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.decrypt=false -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.derive=false -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.encrypt=false -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.private=false -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.sensitive=true -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.signRecover=true -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.sign=true -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.token=true -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.unwrap=false -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.verifyRecover=true -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.verify=true -op.enroll.userKeyTemporary.keyGen.auth.private.keyCapabilities.wrap=false -op.enroll.userKeyTemporary.keyGen.auth.privateKeyNumber=0 -op.enroll.userKeyTemporary.keyGen.auth.publicKeyAttrId=k1 -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.decrypt=false -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.derive=false -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.encrypt=false -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.private=false -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.sensitive=true -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.signRecover=true -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.sign=true -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.token=true -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.unwrap=false -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.verifyRecover=true -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.verify=true -op.enroll.userKeyTemporary.keyGen.auth.public.keyCapabilities.wrap=false -op.enroll.userKeyTemporary.keyGen.auth.publicKeyNumber=1 -op.enroll.userKeyTemporary.keyGen.encryption.ca.conn=ca1 -op.enroll.userKeyTemporary.keyGen.encryption.ca.profileId=caTempTokenUserEncryptionKeyEnrollment -op.enroll.userKeyTemporary.keyGen.encryption.certAttrId=c2 -op.enroll.userKeyTemporary.keyGen.encryption.certId=C2 -op.enroll.userKeyTemporary.keyGen.encryption.cuid_label=$cuid$ -op.enroll.userKeyTemporary.keyGen.encryption.keySize=1024 -op.enroll.userKeyTemporary.keyGen.encryption.keyUsage=0 -op.enroll.userKeyTemporary.keyGen.encryption.keyUser=0 -op.enroll.userKeyTemporary.keyGen.encryption.label=encryption key for $userid$ -op.enroll.userKeyTemporary.keyGen.encryption.overwrite=true -op.enroll.userKeyTemporary.keyGen.encryption.privateKeyAttrId=k4 -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.decrypt=true -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.derive=false -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.encrypt=false -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.private=true -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.sensitive=true -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.sign=false -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.signRecover=false -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.token=true -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.unwrap=true -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.verify=false -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.verifyRecover=false -op.enroll.userKeyTemporary.keyGen.encryption.private.keyCapabilities.wrap=false -op.enroll.userKeyTemporary.keyGen.encryption.privateKeyNumber=4 -op.enroll.userKeyTemporary.keyGen.encryption.publicKeyAttrId=k5 -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.decrypt=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.derive=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.encrypt=true -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.private=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.sensitive=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.sign=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.signRecover=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.token=true -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.unwrap=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.verify=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.verifyRecover=false -op.enroll.userKeyTemporary.keyGen.encryption.public.keyCapabilities.wrap=true -op.enroll.userKeyTemporary.keyGen.encryption.publicKeyNumber=5 -op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert.reason=0 -op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.revokeCert=true -op.enroll.userKeyTemporary.keyGen.encryption.recovery.onHold.scheme=RecoverLast -op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.archive=true -op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.drm.conn=drm1 -op.enroll.userKeyTemporary.keyGen.encryption.serverKeygen.enable=true -op.enroll.userKeyTemporary.keyGen.keyType.num=3 -op.enroll.userKeyTemporary.keyGen.keyType.value.0=auth -op.enroll.userKeyTemporary.keyGen.keyType.value.1=signing -op.enroll.userKeyTemporary.keyGen.keyType.value.2=encryption -op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.num=2 -op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.value.0=signing -op.enroll.userKeyTemporary.keyGen.recovery.onHold.keyType.value.1=encryption -op.enroll.userKeyTemporary.keyGen.signing.ca.conn=ca1 -op.enroll.userKeyTemporary.keyGen.signing.ca.profileId=caTempTokenUserSigningKeyEnrollment -op.enroll.userKeyTemporary.keyGen.signing.certAttrId=c1 -op.enroll.userKeyTemporary.keyGen.signing.certId=C1 -op.enroll.userKeyTemporary.keyGen.signing.cuid_label=$cuid$ -op.enroll.userKeyTemporary.keyGen.signing.keySize=1024 -op.enroll.userKeyTemporary.keyGen.signing.keyUsage=0 -op.enroll.userKeyTemporary.keyGen.signing.keyUser=0 -op.enroll.userKeyTemporary.keyGen.signing.label=signing key for $userid$ -op.enroll.userKeyTemporary.keyGen.signing.overwrite=true -op.enroll.userKeyTemporary.keyGen.signing.privateKeyAttrId=k2 -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.decrypt=false -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.derive=false -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.encrypt=false -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.private=true -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.sensitive=true -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.signRecover=true -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.sign=true -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.token=true -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.unwrap=false -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.verify=false -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.verifyRecover=false -op.enroll.userKeyTemporary.keyGen.signing.private.keyCapabilities.wrap=false -op.enroll.userKeyTemporary.keyGen.signing.privateKeyNumber=2 -op.enroll.userKeyTemporary.keyGen.signing.publicKeyAttrId=k3 -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.decrypt=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.derive=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.encrypt=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.private=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.sensitive=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.sign=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.signRecover=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.token=true -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.unwrap=false -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.verifyRecover=true -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.verify=true -op.enroll.userKeyTemporary.keyGen.signing.public.keyCapabilities.wrap=false -op.enroll.userKeyTemporary.keyGen.signing.publicKeyNumber=3 -op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.revokeCert.reason=0 -op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.revokeCert=true -op.enroll.userKeyTemporary.keyGen.signing.recovery.onHold.scheme=GenerateNewKey -op.enroll.userKeyTemporary.keyGen.tokenName=$auth.cn$ (Temporary) -op.enroll.userKeyTemporary.loginRequest.enable=true -op.enroll.userKeyTemporary.pinReset.enable=true -op.enroll.userKeyTemporary.pinReset.pin.maxLen=10 -op.enroll.userKeyTemporary.pinReset.pin.maxRetries=127 -op.enroll.userKeyTemporary.pinReset.pin.minLen=4 -op.enroll.userKeyTemporary.pkcs11obj.compress.enable=true -op.enroll.userKeyTemporary.pkcs11obj.enable=true -op.enroll.userKeyTemporary.tks.conn=tks1 -op.enroll.userKey.temporaryToken.tokenType=userKeyTemporary -op.enroll.userKeyTemporary.update.applet.directory=[TPS_DIR]/applets -op.enroll.userKeyTemporary.update.applet.emptyToken.enable=true -op.enroll.userKeyTemporary.update.applet.enable=true -op.enroll.userKeyTemporary.update.applet.encryption=true -op.enroll.userKeyTemporary.update.applet.requiredVersion=1.4.4d40a449 -op.enroll.userKeyTemporary.update.symmetricKeys.enable=false -op.enroll.userKeyTemporary.update.symmetricKeys.requiredVersion=1 -op.enroll.userKey.tks.conn=tks1 -op.enroll.userKey.update.applet.directory=[TPS_DIR]/applets -op.enroll.userKey.update.applet.emptyToken.enable=true -op.enroll.userKey.update.applet.enable=true -op.enroll.userKey.update.applet.encryption=true -op.enroll.userKey.update.applet.requiredVersion=1.4.4d40a449 -op.enroll.userKey.update.symmetricKeys.enable=false -op.enroll.userKey.update.symmetricKeys.requiredVersion=1 -op.format._000=######################################### -op.format._001=# Format Operation For tokenKey -op.format._002=# -op.format._003=# op.format.tokenKey.update.applet.emptyToken.enable=false -op.format._004=# - update applet or not if token is empty -op.format._005=# -op.format._006=# - applicable to CoolKey -op.format._007=# - applicable to HouseKey -op.format._008=# - applicable to HouseKey with Legacy Applet -op.format._009=######################################### -op.format.allowUnknownToken=true -op.format.cleanToken.auth.enable=false -op.format.cleanToken.auth.id=ldap1 -op.format.cleanToken.ca.conn=ca1 -op.format.cleanToken.cardmgr_instance=A0000000030000 -op.format.cleanToken.issuerinfo.enable=true -op.format.cleanToken.issuerinfo.value= -op.format.cleanToken.loginRequest.enable=true -op.format.cleanToken.revokeCert=true -op.format.cleanToken.tks.conn=tks1 -op.format.cleanToken.update.applet.directory=[TPS_DIR]/applets -op.format.cleanToken.update.applet.emptyToken.enable=true -op.format.cleanToken.update.applet.encryption=true -op.format.cleanToken.update.applet.requiredVersion=1.4.4d40a449 -op.format.cleanToken.update.symmetricKeys.enable=false -op.format.cleanToken.update.symmetricKeys.requiredVersion=1 -op.format.mapping.0.filter.appletMajorVersion= -op.format.mapping.0.filter.appletMinorVersion= -op.format.mapping.0.filter.tokenATR= -op.format.mapping.0.filter.tokenCUID.end= -op.format.mapping.0.filter.tokenCUID.start= -op.format.mapping.0.filter.tokenType=soCleanUserToken -op.format.mapping.0.target.tokenType=soCleanUserToken -op.format.mapping.1.filter.appletMajorVersion= -op.format.mapping.1.filter.appletMinorVersion= -op.format.mapping.1.filter.tokenATR= -op.format.mapping.1.filter.tokenCUID.end= -op.format.mapping.1.filter.tokenCUID.start= -op.format.mapping.1.filter.tokenType=soUserKey -op.format.mapping.1.target.tokenType=soUserKey -op.format.mapping.2.filter.appletMajorVersion= -op.format.mapping.2.filter.appletMinorVersion= -op.format.mapping.2.filter.tokenATR= -op.format.mapping.2.filter.tokenCUID.end= -op.format.mapping.2.filter.tokenCUID.start= -op.format.mapping.2.filter.tokenType=soKey -op.format.mapping.2.target.tokenType=soKey -op.format.mapping.3.filter.appletMajorVersion= -op.format.mapping.3.filter.appletMinorVersion= -op.format.mapping.3.filter.tokenATR= -op.format.mapping.3.filter.tokenCUID.end= -op.format.mapping.3.filter.tokenCUID.start= -op.format.mapping.3.filter.tokenType=userKey -op.format.mapping.3.target.tokenType=userKey -op.format.mapping.4.filter.appletMajorVersion= -op.format.mapping.4.filter.appletMinorVersion= -op.format.mapping.4.filter.tokenATR= -op.format.mapping.4.filter.tokenCUID.end= -op.format.mapping.4.filter.tokenCUID.start= -op.format.mapping.4.filter.tokenType=soCleanSOToken -op.format.mapping.4.target.tokenType=soCleanSOToken -op.format.mapping.5.filter.appletMajorVersion= -op.format.mapping.5.filter.appletMinorVersion= -op.format.mapping.5.filter.tokenATR= -op.format.mapping.5.filter.tokenCUID.end= -op.format.mapping.5.filter.tokenCUID.start= -op.format.mapping.5.filter.tokenType=cleanToken -op.format.mapping.5.target.tokenType=cleanToken -op.format.mapping.6.filter.appletMajorVersion= -op.format.mapping.6.filter.appletMinorVersion= -op.format.mapping.6.filter.tokenATR= -op.format.mapping.6.filter.tokenCUID.end= -op.format.mapping.6.filter.tokenCUID.start= -op.format.mapping.6.target.tokenType=tokenKey -op.format.mapping.order=0,1,2,3,4,5,6 -op.format.soCleanSOToken.auth.enable=false -op.format.soCleanSOToken.auth.id=ldap1 -op.format.soCleanSOToken.ca.conn=ca1 -op.format.soCleanSOToken.cardmgr_instance=A0000000030000 -op.format.soCleanSOToken.issuerinfo.enable=true -op.format.soCleanSOToken.issuerinfo.value= -op.format.soCleanSOToken.loginRequest.enable=false -op.format.soCleanSOToken.revokeCert=true -op.format.soCleanSOToken.tks.conn=tks1 -op.format.soCleanSOToken.update.applet.directory=[TPS_DIR]/applets -op.format.soCleanSOToken.update.applet.emptyToken.enable=true -op.format.soCleanSOToken.update.applet.encryption=true -op.format.soCleanSOToken.update.applet.requiredVersion=1.4.4d40a449 -op.format.soCleanSOToken.update.symmetricKeys.enable=false -op.format.soCleanSOToken.update.symmetricKeys.requiredVersion=1 -op.format.soCleanUserToken.auth.enable=false -op.format.soCleanUserToken.auth.id=ldap1 -op.format.soCleanUserToken.ca.conn=ca1 -op.format.soCleanUserToken.cardmgr_instance=A0000000030000 -op.format.soCleanUserToken.issuerinfo.enable=true -op.format.soCleanUserToken.issuerinfo.value= -op.format.soCleanUserToken.loginRequest.enable=false -op.format.soCleanUserToken.revokeCert=true -op.format.soCleanUserToken.tks.conn=tks1 -op.format.soCleanUserToken.update.applet.directory=[TPS_DIR]/applets -op.format.soCleanUserToken.update.applet.emptyToken.enable=true -op.format.soCleanUserToken.update.applet.encryption=true -op.format.soCleanUserToken.update.applet.requiredVersion=1.4.4d40a449 -op.format.soCleanUserToken.update.symmetricKeys.enable=false -op.format.soCleanUserToken.update.symmetricKeys.requiredVersion=1 -op.format.soKey.auth.enable=true -op.format.soKey.auth.id=ldap2 -op.format.soKey.ca.conn=ca1 -op.format.soKey.cardmgr_instance=A0000000030000 -op.format.soKey.issuerinfo.enable=true -op.format.soKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/so/index.cgi -op.format.soKey.loginRequest.enable=true -op.format.soKey.revokeCert=true -op.format.soKey.tks.conn=tks1 -op.format.soKey.update.applet.directory=[TPS_DIR]/applets -op.format.soKey.update.applet.emptyToken.enable=true -op.format.soKey.update.applet.encryption=true -op.format.soKey.update.applet.requiredVersion=1.4.4d40a449 -op.format.soKey.update.symmetricKeys.enable=false -op.format.soKey.update.symmetricKeys.requiredVersion=1 -op.format.soUserKey.auth.enable=false -op.format.soUserKey.auth.id=ldap1 -op.format.soUserKey.ca.conn=ca1 -op.format.soUserKey.cardmgr_instance=A0000000030000 -op.format.soUserKey.issuerinfo.enable=true -op.format.soUserKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi -op.format.soUserKey.loginRequest.enable=false -op.format.soUserKey.revokeCert=true -op.format.soUserKey.tks.conn=tks1 -op.format.soUserKey.update.applet.directory=[TPS_DIR]/applets -op.format.soUserKey.update.applet.emptyToken.enable=true -op.format.soUserKey.update.applet.encryption=true -op.format.soUserKey.update.applet.requiredVersion=1.4.4d40a449 -op.format.soUserKey.update.symmetricKeys.enable=false -op.format.soUserKey.update.symmetricKeys.requiredVersion=1 -op.format.tokenKey.auth.enable=true -op.format.tokenKey.auth.id=ldap1 -op.format.tokenKey.ca.conn=ca1 -op.format.tokenKey.cardmgr_instance=A0000000030000 -op.format.tokenKey.issuerinfo.enable=true -op.format.tokenKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi -op.format.tokenKey.loginRequest.enable=true -op.format.tokenKey.revokeCert=true -op.format.tokenKey.tks.conn=tks1 -op.format.tokenKey.update.applet.directory=[TPS_DIR]/applets -op.format.tokenKey.update.applet.emptyToken.enable=true -op.format.tokenKey.update.applet.encryption=true -op.format.tokenKey.update.applet.requiredVersion=1.4.4d40a449 -op.format.tokenKey.update.symmetricKeys.enable=false -op.format.tokenKey.update.symmetricKeys.requiredVersion=1 -op.format.userKey.auth.enable=true -op.format.userKey.auth.id=ldap1 -op.format.userKey.ca.conn=ca1 -op.format.userKey.cardmgr_instance=A0000000030000 -op.format.userKey.issuerinfo.enable=true -op.format.userKey.issuerinfo.value=http://[PKI_HOSTNAME]:[PKI_UNSECURE_PORT]/cgi-bin/home/index.cgi -op.format.userKey.loginRequest.enable=true -op.format.userKey.revokeCert=true -op.format.userKey.tks.conn=tks1 -op.format.userKey.update.applet.directory=[TPS_DIR]/applets -op.format.userKey.update.applet.emptyToken.enable=true -op.format.userKey.update.applet.encryption=true -op.format.userKey.update.applet.requiredVersion=1.4.4d40a449 -op.format.userKey.update.symmetricKeys.enable=false -op.format.userKey.update.symmetricKeys.requiredVersion=1 -op.pinReset._000=######################################### -op.pinReset._001=# Certificate Chain Imports -op.pinReset._002=# -op.pinReset._003=# op.enroll.certificates.num=1 -op.pinReset._004=# op.enroll.certificates.value.0=caCert -op.pinReset._005=# op.enroll.certificates.caCert.nickName=caCert0 pki-tps -op.pinReset._006=# op.enroll.certificates.caCert.certId=C5 -op.pinReset._007=# op.enroll.certificates.caCert.certAttrId=c5 -op.pinReset._008=# op.enroll.certificates.caCert.label=caCert Label -op.pinReset._009=######################################### -op.pinReset._010=######################################### -op.pinReset._011=# Pin Reset Operation For CoolKey -op.pinReset._012=# -op.pinReset._013=# op.pinReset.userKey.update.applet.emptyToken.enable=false -op.pinReset._014=# - update applet or not if token is empty -op.pinReset._015=# -op.pinReset._016=# - N/A for HouseKey -op.pinReset._017=# - N/A for HouseKey with Legacy Applet -op.pinReset._018=######################################### -op.pinReset.mapping.0.filter.appletMajorVersion= -op.pinReset.mapping.0.filter.appletMinorVersion= -op.pinReset.mapping.0.filter.tokenATR= -op.pinReset.mapping.0.filter.tokenCUID.end= -op.pinReset.mapping.0.filter.tokenCUID.start= -op.pinReset.mapping.0.filter.tokenType= -op.pinReset.mapping.0.target.tokenType=userKey -op.pinReset.mapping.order=0 -op.pinReset.userKey.auth.enable=true -op.pinReset.userKey.auth.id=ldap1 -op.pinReset.userKey.cardmgr_instance=A0000000030000 -op.pinReset.userKey.loginRequest.enable=true -op.pinReset.userKey.pinReset.pin.maxLen=10 -op.pinReset.userKey.pinReset.pin.minLen=4 -op.pinReset.userKey.tks.conn=tks1 -op.pinReset.userKey.update.applet.directory=[TPS_DIR]/applets -op.pinReset.userKey.update.applet.emptyToken.enable=true -op.pinReset.userKey.update.applet.enable=false -op.pinReset.userKey.update.applet.encryption=true -op.pinReset.userKey.update.applet.requiredVersion=1.4.4d40a449 -op.pinReset.userKey.update.symmetricKeys.enable=false -op.pinReset.userKey.update.symmetricKeys.requiredVersion=1 -os.serverName=cert-[PKI_INSTANCE_NAME] -os.userid=nobody -passwordClass=com.netscape.cmsutil.password.PlainPasswordFile -passwordFile=[PKI_INSTANCE_PATH]/conf/password.conf -pidDir=[PKI_PIDDIR] -pkicreate.admin_secure_port=[PKI_ADMIN_SECURE_PORT] -pkicreate.agent_secure_port=[PKI_AGENT_SECURE_PORT] -pkicreate.ee_secure_port=[PKI_EE_SECURE_PORT] -pkicreate.group=[PKI_GROUP] -pkicreate.pki_instance_name=[PKI_INSTANCE_NAME] -pkicreate.pki_instance_root=[PKI_INSTANCE_ROOT] -pkicreate.secure_port=[PKI_SECURE_PORT] -pkicreate.subsystem_type=[PKI_SUBSYSTEM_TYPE] -pkicreate.systemd.servicename=[PKI_SYSTEMD_SERVICENAME] -pkicreate.tomcat_server_port=[TOMCAT_SERVER_PORT] -pkicreate.unsecure_port=[PKI_UNSECURE_PORT] -pkicreate.user=[PKI_USER] -pkiremove.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] -preop.admincert.profile=caAdminCert -preop.admin.group=TUS Agents,TUS Operators,TUS Administrators,TUS Officers -preop.admin.name=Token Processing Service Manager Administrator -preop.cert.admin.defaultSigningAlgorithm=SHA256withRSA -preop.cert.admin.dn=uid=admin,cn=admin -preop.cert.admin.keysize.custom_size=2048 -preop.cert.admin.keysize.size=2048 -preop.cert.admin.profile=adminCert.profile -preop.cert.audit_signing.cncomponent.override=true -preop.cert.audit_signing.defaultSigningAlgorithm=SHA256withRSA -preop.cert.audit_signing.dn=CN=TPS Audit Signing Certificate -preop.cert.audit_signing.enable=true -preop.cert.audit_signing.keysize.custom_size=2048 -preop.cert.audit_signing.keysize.size=2048 -preop.cert.audit_signing.nickname=auditSigningCert cert-[PKI_INSTANCE_NAME] -preop.cert.audit_signing.profile=caInternalAuthAuditSigningCert -preop.cert.audit_signing.signing.required=false -preop.cert.audit_signing.subsystem=tps -preop.cert.audit_signing.type=remote -preop.cert.audit_signing.userfriendlyname=TPS Audit Signing Certificate -preop.cert.list=sslserver,subsystem,audit_signing -preop.cert.rsalist=audit_signing -preop.cert.sslserver.cncomponent.override=false -preop.cert.sslserver.defaultSigningAlgorithm=SHA256withRSA -preop.cert.sslserver.dn=CN=[PKI_HOSTNAME] -preop.cert.sslserver.enable=true -preop.cert.sslserver.keysize.custom_size=2048 -preop.cert.sslserver.keysize.size=2048 -preop.cert.sslserver.nickname=[PKI_SSL_SERVER_NICKNAME] -preop.cert.sslserver.profile=caInternalAuthServerCert -preop.cert.sslserver.signing.required=false -preop.cert.sslserver.subsystem=tps -preop.cert.sslserver.type=remote -preop.cert.sslserver.userfriendlyname=SSL Server Certificate -preop.cert.subsystem.cncomponent.override=true -preop.cert.subsystem.defaultSigningAlgorithm=SHA256withRSA -preop.cert.subsystem.dn=CN=TPS Subsystem Certificate -preop.cert.subsystem.enable=true -preop.cert.subsystem.keysize.custom_size=2048 -preop.cert.subsystem.keysize.size=2048 -preop.cert.subsystem.nickname=subsystemCert cert-[PKI_INSTANCE_NAME] -preop.cert.subsystem.profile=caInternalAuthSubsystemCert -preop.cert.subsystem.signing.required=false -preop.cert.subsystem.subsystem=tps -preop.cert.subsystem.type=remote -preop.cert.subsystem.userfriendlyname=Subsystem Certificate -preop.configModules.count=3 -preop.configModules.module0.commonName=NSS Internal PKCS #11 Module -preop.configModules.module0.imagePath=/pki/images/clearpixel.gif -preop.configModules.module0.userFriendlyName=NSS Internal PKCS #11 Module -preop.configModules.module1.commonName=nfast -preop.configModules.module1.imagePath=/pki/images/clearpixel.gif -preop.configModules.module1.userFriendlyName=nCipher's nFast Token Hardware Module -preop.configModules.module2.commonName=lunasa -preop.configModules.module2.imagePath=/pki/images/clearpixel.gif -preop.configModules.module2.userFriendlyName=SafeNet's LunaSA Token Hardware Module -preop.hierarchy.profile=caCert.profile -preop.internaldb.data_ldif=/usr/share/pki/tps/conf/db.ldif -preop.internaldb.index_ldif=/usr/share/pki/tps/conf/index.ldif -preop.internaldb.ldif=/usr/share/pki/tps/conf/database.ldif -preop.internaldb.manager_ldif=/usr/share/pki/tps/conf/manager.ldif -preop.internaldb.post_ldif=/usr/share/pki/tps/conf/vlv.ldif,/usr/share/pki/tps/conf/vlvtasks.ldif -preop.internaldb.schema.ldif=/usr/share/pki/tps/conf/schema.ldif -preop.internaldb.wait_dn=cn=index1160528734, cn=index, cn=tasks, cn=config -preop.module.token=Internal Key Storage Token -preop.pin=[PKI_RANDOM_NUMBER] -preop.product.name=CS -preop.securitydomain.admin_url=https://[PKI_HOSTNAME]:8443 -preop.system.fullname=Token Key Service -preop.system.name=TPS -preop.wizard.name=TPS Setup Wizard -proxy.securePort=[PKI_PROXY_SECURE_PORT] -proxy.unsecurePort=[PKI_PROXY_UNSECURE_PORT] -registry.file=[PKI_INSTANCE_PATH]/conf/registry.cfg -selftests._000=## -selftests._001=## Self Tests -selftests._002=## -selftests._003=## The Self-Test plugin TPSSystemCertsVerification uses the -selftests._004=## following parameters (where certusage is optional): -selftests._005=## tps.cert.list = -selftests._006=## tps.cert..nickname -selftests._007=## tps.cert..certusage -selftests._008=## -selftests.container.instance.SystemCertsVerification=com.netscape.cms.selftests.common.SystemCertsVerification -selftests.container.logger.bufferSize=512 -selftests.container.logger.class=com.netscape.cms.logging.RollingLogFile -selftests.container.logger.enable=true -selftests.container.logger.expirationTime=0 -selftests.container.logger.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/selftests.log -selftests.container.logger.flushInterval=5 -selftests.container.logger.level=1 -selftests.container.logger.maxFileSize=2000 -selftests.container.logger.register=false -selftests.container.logger.rolloverInterval=2592000 -selftests.container.logger.type=transaction -selftests.container.order.onDemand=SystemCertsVerification:critical -selftests.container.order.startup=SystemCertsVerification:critical -selftests.plugin.SystemCertsVerification.SubId=tps -service.instanceDir=[PKI_INSTANCE_ROOT] -service.instanceID=[PKI_INSTANCE_NAME] -service.machineName=[PKI_HOSTNAME] -service.non_clientauth_securePort=[PKI_EE_SECURE_PORT] -service.securePort=[PKI_AGENT_SECURE_PORT] -service.unsecurePort=[PKI_UNSECURE_PORT] -smtp.host=localhost -smtp.port=25 -subsystem.0.class=org.dogtagpki.tps.server.TPSSubsystem -subsystem.0.id=tps -subsystem.1.class=com.netscape.cmscore.selftests.SelfTestSubsystem -subsystem.1.id=selftests -subsystem.2.class=com.netscape.cmscore.util.StatsSubsystem -subsystem.2.id=stats -target._000=######################################### -target._001=# entries to enable configuration of parameter sets through the TPS UI agent and admin tabs -target._002=# -target._003=# target.configure.list = comma separated lists of all parameter sets that can be configured by the admin. -target._004=# Each entry will show up (with underscore replaced by space) under Advanced Configuration on the admin tab. -target._005=# -target._006=# target.agent_approve.list = comma separated subset of above list. Parameter sets in this list -target._007=# will show up in the agent tab (under advanced configuration) and will require agent involvement -target._008=# (enable/ disable) to be edited. -target._009=# -target._010=# For the wording to display correctly, the values in the above list should be plurals. -target._011=# -target._012=# Each parameter set in the lists above requires three parameters: -target._013=# target..list : list of choices of this parameter set type (will display in the drop down box) -target._014=# target..pattern : the regular expression to select parameters in CS.cfg for this parameter set. -target._015=# target..displayname: used in the UI display text. This should be the singular form of . -target._016=# -target._017=# The exception is the parameter set Generals, which has only a pattern and displayname defined. -target._018=# -target._019=######################################## -target.agent_approve.list=Profiles -target.Authentication_Sources.displayname=Authentication Source -target.Authentication_Sources.list=0,1 -target.Authentication_Sources.pattern=auth\.instance\.$name\..* -target.configure.list=Profiles,Subsystem_Connections,Profile_Mappings,Authentication_Sources -target.Generals.displayname=General -target.Generals.pattern=^applet\..*\|^general\..*\|^failover.pod.enable\|^channel\..* -target.Profile_Mappings.displayname=Profile Mapping -target.Profile_Mappings.list=enroll,format,pinReset -target.Profile_Mappings.pattern=op\.$name\.mapping\..* -target.Profiles.displayname=Profile -target.Profiles.list=userKey,soKey,soCleanUserToken,soUserKey,cleanToken,soCleanSoToken,tokenKey -target.Profiles.pattern=op\..*\.$name\..* -target.Subsystem_Connections.displayname=Subsystem Connection -target.Subsystem_Connections.list=ca1,drm1,tks1 -target.Subsystem_Connections.pattern=conn\.$name\..* -tokendb._000=######################################### -tokendb._001=# tokendb.auditLog: -tokendb._002=# - audit log path -tokendb._003=# tokendb.host: -tokendb._004=# - tokendb host name -tokendb._005=# tokendb.port: -tokendb._006=# - tokendb port number -tokendb._007=# tokendb.bindDN: -tokendb._008=# - tokendb administration DN (i.e. cn=Directory Manager) -tokendb._009=# tokendb.bindPassPath: -tokendb._010=# - tokendb administration password file path -tokendb._011=# tokendb.templateDir -tokendb._012=# - directory where all the tokendb templates are located -tokendb._013=# tokendb.userBaseDN: -tokendb._014=# - directory base DN for users and groups -tokendb._015=# tokendb.baseDN: -tokendb._016=# - directory base DN for tokens -tokendb._017=# tokendb.activityBaseDN: -tokendb._018=# - directory base DN for activities -tokendb._019=# tokendb.indexTemplate=index.template -tokendb._020=# - index template -tokendb._021=# tokendb.newTemplate=new.template -tokendb._022=# - add template -tokendb._023=# tokendb.showTemplate=show.template -tokendb._024=# - show template -tokendb._025=# tokendb.errorTemplate=error.template -tokendb._026=# - error template -tokendb._027=# tokendb.searchTemplate=search.template -tokendb._028=# - search template -tokendb._029=# tokendb.searchResultTemplate=searchResults.template -tokendb._030=# - search result template -tokendb._031=# tokendb.editTemplate=edit.template -tokendb._032=# - edit template -tokendb._033=# tokendb.editResultTemplate=editResults.template -tokendb._034=# - edit result template -tokendb._035=# tokendb.addResultTemplate=addResults.template -tokendb._036=# - add result template -tokendb._037=# tokendb.deleteResultTemplate=deleteResults.template -tokendb._038=# - delete result template -tokendb._039=# tokendb.searchActivityTemplate=searchActivity.template -tokendb._040=# - search activity template -tokendb._041=# tokendb.searchActivityResultTemplate=searchActivityResults.template -tokendb._042=# - search activity result template -tokendb._043=# tokendb.showAdminTemplate=showAdmin.template -tokendb._044=# - show admin template -tokendb._045=# tokendb.editAdminTemplate=editAdmin.template -tokendb._046=# - edit admin template -tokendb._047=# tokendb.editAdminResultTemplate=editAdminResults.template -tokendb._048=# - edit admin result template -tokendb._049=# tokendb.searchAdminTemplate=searchAdmin.template -tokendb._050=# - search admin template -tokendb._051=# tokendb.searchAdminResultTemplate=searchAdminResults.template -tokendb._052=# - search admin result template -tokendb._053=# tokendb.defaultPolicy: -tokendb._054=# Supported Policy (Separated by ; [Semicolon]): -tokendb._055=# For example, PIN_RESET=YES|NO;RE_ENROLL=YES|NO -tokendb._056=# PIN_RESET=YES|NO -tokendb._057=# - If not present, pin reset by user is allowed. -tokendb._058=# - If present and agent change PIN_RESET from NO -tokendb._059=# to YES, user is allowed to do pin reset. This -tokendb._060=# policy will be changed back to NO after pin reset. -tokendb._061=# RE_ENROLL=YES|NO -tokendb._062=# - If not present, re-enrollment is allowed. -tokendb._063=# - If present, re-enrollment is allowed when RE_ENROLL -tokendb._064=# is set to YES. Otherwise, re-enrollment is not -tokendb._065=# allowed. -tokendb._066=# tokendb.allowedTransitions: -tokendb._067=# - has transitions between the following states -tokendb._068=# TOKEN_UNINITIALIZED = 0, -tokendb._069=# TOKEN_DAMAGED =1, -tokendb._070=# TOKEN_PERM_LOST=2, -tokendb._071=# TOKEN_TEMP_LOST=3, -tokendb._072=# TOKEN_FOUND =4, -tokendb._073=# TOKEN_TEMP_LOST_PERM_LOST =5, -tokendb._074=# TOKEN_TERMINATED = 6 -tokendb._075=######################################### -tokendb.activityBaseDN=ou=Activities,[TOKENDB_ROOT] -tokendb.addConfigTemplate=addConfig.template -tokendb.addResultTemplate=addResults.template -tokendb.agentSelectConfigTemplate=agentSelectConfig.template -tokendb.agentViewConfigTemplate=agentViewConfig.template -tokendb.allowedTransitions=0:1,0:2,0:3,0:4,0:5,0:6,3:4,3:5,3:6,4:1,4:2,4:3,4:6 -tokendb.auditAdminTemplate=auditAdmin.template -tokendb.auditLog=[PKI_INSTANCE_PATH]/logs/tokendb-audit.log -tokendb.baseDN=ou=Tokens,[TOKENDB_ROOT] -tokendb.bindDN=cn=Directory Manager -tokendb.bindPassPath=[PKI_INSTANCE_PATH]/conf/password.conf -tokendb.certBaseDN=ou=Certificates,[TOKENDB_ROOT] -tokendb.confirmConfigChangesTemplate=confirmConfigChanges.template -tokendb.confirmDeleteConfigTemplate=confirmDeleteConfig.template -tokendb.defaultPolicy=RE_ENROLL=YES -tokendb.deleteResultTemplate=deleteResults.template -tokendb.deleteTemplate=delete.template -tokendb.doTokenConfirmTemplate=doTokenConfirm.template -tokendb.doTokenTemplate=doToken.template -tokendb.editConfigTemplate=editConfig.template -tokendb.editResultTemplate=editResults.template -tokendb.editTemplate=edit.template -tokendb.editUserTemplate=editUser.template -tokendb.errorTemplate=error.template -tokendb.hostport=[TOKENDB_HOST]:[TOKENDB_PORT] -tokendb.indexAdminTemplate=indexAdmin.template -tokendb.indexOperatorTemplate=indexOperator.template -tokendb.indexTemplate=index.template -tokendb.newTemplate=new.template -tokendb.newUserTemplate=newUser.template -tokendb.revokeTemplate=revoke.template -tokendb.searchActivityAdminResultTemplate=searchActivityAdminResults.template -tokendb.searchActivityAdminTemplate=searchActivityAdmin.template -tokendb.searchActivityResultTemplate=searchActivityResults.template -tokendb.searchActivityTemplate=searchActivity.template -tokendb.searchAdminResultTemplate=searchAdminResults.template -tokendb.searchAdminTemplate=searchAdmin.template -tokendb.searchCertificateResultTemplate=searchCertificateResults.template -tokendb.searchCertificateTemplate=searchCertificate.template -tokendb.searchResultTemplate=searchResults.template -tokendb.searchTemplate=search.template -tokendb.searchUserResultTemplate=searchUserResults.template -tokendb.searchUserTemplate=searchUser.template -tokendb.selectConfigTemplate=selectConfig.template -tokendb.selfTestResultsTemplate=selfTestResults.template -tokendb.selfTestTemplate=selfTest.template -tokendb.showAdminTemplate=showAdmin.template -tokendb.showCertTemplate=showCert.template -tokendb.showTemplate=show.template -tokendb.ssl=false -tokendb.templateDir=[PKI_INSTANCE_PATH]/docroot/tus -tokendb.userBaseDN=[TOKENDB_ROOT] -tokendb.userDeleteTemplate=userDelete.template -tps._000=######################################## -tps._001=# For verifying system certificates -tps._002=# tps.cert.list=sslserver,subsystem,audit_signing -tps._003=# tps.cert.sslserver.nickname=xxx -tps._005=# tps.cert.subsystem.nickname=xxx -tps._007=# tps.cert.audit_signing.nickname=xxx -tps._008=# operations.allowedTransitions: -tps._009=# - token operations, like formatting and enrollment have transitions between the following states -tps._010=# TOKEN_UNINITIALIZED = 0, -tps._011=# TOKEN_DAMAGED =1, -tps._012=# TOKEN_PERM_LOST=2, -tps._013=# TOKEN_TEMP_LOST=3, -tps._014=# TOKEN_FOUND =4, -tps._015=# TOKEN_TEMP_LOST_PERM_LOST =5, -tps._016=# TOKEN_TERMINATED = 6 -tps._017=# Sample: tps.operations.allowedTransitions=0:0,0:4,4:6,6:0 -tps._018=######################################## -tps.cert.audit_signing.certusage=ObjectSigner -tps.cert.audit_signing.nickname=[HSM_LABEL][NICKNAME] -tps.cert.list=sslserver,subsystem,audit_signing -tps.cert.sslserver.certusage=SSLServer -tps.cert.subsystem.certusage=SSLClient -tps.operations.allowedTransitions=0:0,0:4,4:0 -usrgrp._000=## -usrgrp._001=## User/Group -usrgrp._002=## -usrgrp.ldap=internaldb diff --git a/base/tps/shared/conf/acl.ldif b/base/tps/shared/conf/acl.ldif deleted file mode 100644 index fb63122d1..000000000 --- a/base/tps/shared/conf/acl.ldif +++ /dev/null @@ -1,22 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: cn=aclResources,{rootSuffix} -objectClass: top -objectClass: CertACLS -cn: aclResources -resourceACLS: certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete -resourceACLS: certServer.acl.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify) group="Administrators":Administrators, agents and auditors are allowed to read ACL configuration but only administrators allowed to modify -resourceACLS: certServer.log.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify) group="Administrators":Administrators, Agents, and auditors are allowed to read the log configuration but only administrators are allowed to modify -resourceACLS: certServer.log.configuration.fileName:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";deny (modify) user=anybody:Nobody is allowed to modify a fileName parameter -#resourceACLS: certServer.log.configuration.signedAudit.expirationTime:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";deny (modify) user=anybody:Nobody is allowed to modify an expirationTime parameter -resourceACLS: certServer.log.content.signedAudit:read:allow (read) group="Auditors":Only auditor is allowed to read the signed audit log -resourceACLS: certServer.log.content.system:read:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents":Administrators, auditors, and agents are allowed to read the log content -resourceACLS: certServer.log.content.transactions:read:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents":Administrators, auditors, and agents are allowed to read the log content -resourceACLS: certServer.auth.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify) group="Administrators":Administrators, agents, and auditors are allowed to read authentication configuration but only administrators allowed to modify -resourceACLS: certServer.registry.configuration:read,modify:allow (read) group="Administrators" || group="Auditors" || group="Token Processing Service Manager Agents";allow (modify) group="Administrators":this acl is shared by all admin servlets -resourceACLS: certServer.admin.certificate:import:allow (import) user="anybody":Any user may import a certificate -resourceACLS: certServer.admin.request.enrollment:submit,read,execute:allow (submit) user="anybody":Anybody may submit an enrollment request -resourceACLS: certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to clone the configuration. diff --git a/base/tps/shared/conf/catalina.policy b/base/tps/shared/conf/catalina.policy deleted file mode 100644 index 5ccc7959e..000000000 --- a/base/tps/shared/conf/catalina.policy +++ /dev/null @@ -1,182 +0,0 @@ -// --- BEGIN COPYRIGHT BLOCK --- -// Copyright (C) 2006-2010 Red Hat, Inc. -// All rights reserved. -// Modifications: configuration parameters -// --- END COPYRIGHT BLOCK --- - -// Licensed to the Apache Software Foundation (ASF) under one or more -// contributor license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright ownership. -// The ASF licenses this file to You under the Apache License, Version 2.0 -// (the "License"); you may not use this file except in compliance with -// the License. You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -// ============================================================================ -// catalina.corepolicy - Security Policy Permissions for Tomcat 6 -// -// This file contains a default set of security policies to be enforced (by the -// JVM) when Catalina is executed with the "-security" option. In addition -// to the permissions granted here, the following additional permissions are -// granted to the codebase specific to each web application: -// -// * Read access to the document root directory -// -// $Id$ -// ============================================================================ - - -// ========== SYSTEM CODE PERMISSIONS ========================================= - - -// These permissions apply to javac -grant codeBase "file:${java.home}/lib/-" { - permission java.security.AllPermission; -}; - -// These permissions apply to all shared system extensions -grant codeBase "file:${java.home}/jre/lib/ext/-" { - permission java.security.AllPermission; -}; - -// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre -grant codeBase "file:${java.home}/../lib/-" { - permission java.security.AllPermission; -}; - -// These permissions apply to all shared system extensions when -// ${java.home} points at $JAVA_HOME/jre -grant codeBase "file:${java.home}/lib/ext/-" { - permission java.security.AllPermission; -}; - - -// ========== CATALINA CODE PERMISSIONS ======================================= - - -// These permissions apply to the daemon code -grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" { - permission java.security.AllPermission; -}; - -// These permissions apply to the logging API -grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" { - permission java.util.PropertyPermission "java.util.logging.config.class", "read"; - permission java.util.PropertyPermission "java.util.logging.config.file", "read"; - permission java.io.FilePermission "${java.home}${file.separator}lib${file.separator}logging.properties", "read"; - permission java.lang.RuntimePermission "shutdownHooks"; - permission java.io.FilePermission "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read"; - permission java.util.PropertyPermission "catalina.base", "read"; - permission java.util.logging.LoggingPermission "control"; - permission java.io.FilePermission "${catalina.base}${file.separator}logs", "read, write"; - permission java.io.FilePermission "${catalina.base}${file.separator}logs${file.separator}*", "read, write"; - permission java.lang.RuntimePermission "getClassLoader"; - // To enable per context logging configuration, permit read access to the appropriate file. - // Be sure that the logging configuration is secure before enabling such access - // eg for the examples web application: - // permission java.io.FilePermission "${catalina.base}${file.separator}webapps${file.separator}examples${file.separator}WEB-INF${file.separator}classes${file.separator}logging.properties", "read"; -}; - -// These permissions apply to the server startup code -grant codeBase "file:${catalina.home}/bin/bootstrap.jar" { - permission java.security.AllPermission; -}; - -// These permissions apply to the servlet API classes -// and those that are shared across all class loaders -// located in the "lib" directory -grant codeBase "file:${catalina.home}/lib/-" { - permission java.security.AllPermission; -}; - - -// ========== WEB APPLICATION PERMISSIONS ===================================== - - -// These permissions are granted by default to all web applications -// In addition, a web application will be given a read FilePermission -// and JndiPermission for all files and directories in its document root. -grant { - // Required for JNDI lookup of named JDBC DataSource's and - // javamail named MimePart DataSource used to send mail - permission java.util.PropertyPermission "java.home", "read"; - permission java.util.PropertyPermission "java.naming.*", "read"; - permission java.util.PropertyPermission "javax.sql.*", "read"; - - // OS Specific properties to allow read access - permission java.util.PropertyPermission "os.name", "read"; - permission java.util.PropertyPermission "os.version", "read"; - permission java.util.PropertyPermission "os.arch", "read"; - permission java.util.PropertyPermission "file.separator", "read"; - permission java.util.PropertyPermission "path.separator", "read"; - permission java.util.PropertyPermission "line.separator", "read"; - - // JVM properties to allow read access - permission java.util.PropertyPermission "java.version", "read"; - permission java.util.PropertyPermission "java.vendor", "read"; - permission java.util.PropertyPermission "java.vendor.url", "read"; - permission java.util.PropertyPermission "java.class.version", "read"; - permission java.util.PropertyPermission "java.specification.version", "read"; - permission java.util.PropertyPermission "java.specification.vendor", "read"; - permission java.util.PropertyPermission "java.specification.name", "read"; - - permission java.util.PropertyPermission "java.vm.specification.version", "read"; - permission java.util.PropertyPermission "java.vm.specification.vendor", "read"; - permission java.util.PropertyPermission "java.vm.specification.name", "read"; - permission java.util.PropertyPermission "java.vm.version", "read"; - permission java.util.PropertyPermission "java.vm.vendor", "read"; - permission java.util.PropertyPermission "java.vm.name", "read"; - - // Required for OpenJMX - permission java.lang.RuntimePermission "getAttribute"; - - // Allow read of JAXP compliant XML parser debug - permission java.util.PropertyPermission "jaxp.debug", "read"; - - // Precompiled JSPs need access to this package. - permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime"; - permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*"; - - // Precompiled JSPs need access to this system property. - permission java.util.PropertyPermission "org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER", "read"; -}; - - -// You can assign additional permissions to particular web applications by -// adding additional "grant" entries here, based on the code base for that -// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files. -// -// Different permissions can be granted to JSP pages, classes loaded from -// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/ -// directory, or even to individual jar files in the /WEB-INF/lib/ directory. -// -// For instance, assume that the standard "examples" application -// included a JDBC driver that needed to establish a network connection to the -// corresponding database and used the scrape taglib to get the weather from -// the NOAA web server. You might create a "grant" entries like this: -// -// The permissions granted to the context root directory apply to JSP pages. -// grant codeBase "file:${catalina.home}/webapps/examples/-" { -// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; -// permission java.net.SocketPermission "*.noaa.gov:80", "connect"; -// }; -// -// The permissions granted to the context WEB-INF/classes directory -// grant codeBase "file:${catalina.home}/webapps/examples/WEB-INF/classes/-" { -// }; -// -// The permission granted to your JDBC driver -// grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/driver.jar!/-" { -// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; -// }; -// The permission granted to the scrape taglib -// grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/scrape.jar!/-" { -// permission java.net.SocketPermission "*.noaa.gov:80", "connect"; -// }; diff --git a/base/tps/shared/conf/catalina.properties b/base/tps/shared/conf/catalina.properties deleted file mode 100644 index f6d1d1415..000000000 --- a/base/tps/shared/conf/catalina.properties +++ /dev/null @@ -1,87 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006-2010 Red Hat, Inc. -# All rights reserved. -# Modifications: configuration parameters -# --- END COPYRIGHT BLOCK --- - -# Licensed to the Apache Software Foundation (ASF) under one or more -# contributor license agreements. See the NOTICE file distributed with -# this work for additional information regarding copyright ownership. -# The ASF licenses this file to You under the Apache License, Version 2.0 -# (the "License"); you may not use this file except in compliance with -# the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# -# List of comma-separated packages that start with or equal this string -# will cause a security exception to be thrown when -# passed to checkPackageAccess unless the -# corresponding RuntimePermission ("accessClassInPackage."+package) has -# been granted. -package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,org.apache.jasper.,sun.beans. -# -# List of comma-separated packages that start with or equal this string -# will cause a security exception to be thrown when -# passed to checkPackageDefinition unless the -# corresponding RuntimePermission ("defineClassInPackage."+package) has -# been granted. -# -# by default, no packages are restricted for definition, and none of -# the class loaders supplied with the JDK call checkPackageDefinition. -# -package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,org.apache.jasper. - -# -# -# List of comma-separated paths defining the contents of the "common" -# classloader. Prefixes should be used to define what is the repository type. -# Path may be relative to the CATALINA_HOME or CATALINA_BASE path or absolute. -# If left as blank,the JVM system loader will be used as Catalina's "common" -# loader. -# Examples: -# "foo": Add this folder as a class repository -# "foo/*.jar": Add all the JARs of the specified folder as class -# repositories -# "foo/bar.jar": Add bar.jar as a class repository -common.loader=${catalina.home}/lib,${catalina.home}/lib/*.jar,[TOMCAT_INSTANCE_COMMON_LIB] - -# -# List of comma-separated paths defining the contents of the "server" -# classloader. Prefixes should be used to define what is the repository type. -# Path may be relative to the CATALINA_HOME or CATALINA_BASE path or absolute. -# If left as blank, the "common" loader will be used as Catalina's "server" -# loader. -# Examples: -# "foo": Add this folder as a class repository -# "foo/*.jar": Add all the JARs of the specified folder as class -# repositories -# "foo/bar.jar": Add bar.jar as a class repository -server.loader= - -# -# List of comma-separated paths defining the contents of the "shared" -# classloader. Prefixes should be used to define what is the repository type. -# Path may be relative to the CATALINA_BASE path or absolute. If left as blank, -# the "common" loader will be used as Catalina's "shared" loader. -# Examples: -# "foo": Add this folder as a class repository -# "foo/*.jar": Add all the JARs of the specified folder as class -# repositories -# "foo/bar.jar": Add bar.jar as a class repository -# Please note that for single jars, e.g. bar.jar, you need the URL form -# starting with file:. -shared.loader= - -# -# String cache configuration. -tomcat.util.buf.StringCache.byte.enabled=true -#tomcat.util.buf.StringCache.char.enabled=true -#tomcat.util.buf.StringCache.trainThreshold=500000 -#tomcat.util.buf.StringCache.cacheSize=5000 diff --git a/base/tps/shared/conf/context.xml b/base/tps/shared/conf/context.xml deleted file mode 100644 index ba139add2..000000000 --- a/base/tps/shared/conf/context.xml +++ /dev/null @@ -1,40 +0,0 @@ - - - - - - - - WEB-INF/web.xml - - - - - - - - diff --git a/base/tps/shared/conf/database.ldif b/base/tps/shared/conf/database.ldif deleted file mode 100644 index d3c5f9e68..000000000 --- a/base/tps/shared/conf/database.ldif +++ /dev/null @@ -1,9 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: cn=config -changetype: modify -replace: nsslapd-maxbersize -nsslapd-maxbersize: 209715200 diff --git a/base/tps/shared/conf/db.ldif b/base/tps/shared/conf/db.ldif deleted file mode 100644 index 1dada984a..000000000 --- a/base/tps/shared/conf/db.ldif +++ /dev/null @@ -1,54 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: ou=Tokens,{rootSuffix} -objectclass: top -objectclass: organizationalunit -ou: Tokens - -dn: ou=Activities,{rootSuffix} -objectclass: top -objectclass: organizationalunit -ou: Activities - -dn: ou=Certificates,{rootSuffix} -objectclass: top -objectclass: organizationalunit -ou: Certificates - -dn: ou=People,{rootSuffix} -objectclass: top -objectclass: organizationalunit -ou: People -aci: (targetattr!="userPassword")(version 3.0; acl "Enable anonymous access"; allow (read, search, compare)userdn="ldap:///anyone";) - -dn: ou=Groups,{rootSuffix} -objectclass: top -objectclass: organizationalunit -ou: Groups - -dn: cn=TUS Agents,ou=Groups,{rootSuffix} -objectClass: top -objectClass: groupOfUniqueNames -cn: TUS Agents -description: Agents for TUS - -dn: cn=TUS Officers,ou=Groups,{rootSuffix} -objectClass: top -objectClass: groupOfUniqueNames -cn: TUS Officers -description: Security Officers for TUS - -dn: cn=TUS Administrators,ou=Groups,{rootSuffix} -objectClass: top -objectClass: groupOfUniqueNames -cn: TUS Administrators -description: Administrators for TUS - -dn: cn=TUS Operators,ou=Groups,{rootSuffix} -objectClass: top -objectClass: groupOfUniqueNames -cn: TUS Operators -description: Operators for TUS diff --git a/base/tps/shared/conf/etc/init.d/pki-tpsd b/base/tps/shared/conf/etc/init.d/pki-tpsd deleted file mode 100755 index 7b991f39c..000000000 --- a/base/tps/shared/conf/etc/init.d/pki-tpsd +++ /dev/null @@ -1,86 +0,0 @@ -#!/bin/bash -# -# --- BEGIN COPYRIGHT BLOCK --- -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; version 2 of the License. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License along -# with this program; if not, write to the Free Software Foundation, Inc., -# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -# -# Copyright (C) 2007-2010 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -# pki-tpsd Startup script for pki-tps with tomcat7 -# -# chkconfig: - 84 16 -# description: Token Processing Service (Tomcat 7.0) -# processname: pki-tpsd -# piddir: /var/run/pki/tps -# - -PROG_NAME=`basename $0` -SERVICE_NAME="pki-tpsd" -SERVICE_PROG="/sbin/service" -PKI_PATH="/usr/share/pki/tps" -PKI_REGISTRY="/etc/sysconfig/pki/tps" -PKI_TYPE="pki-tps" -PKI_TOTAL_PORTS=6 - -# Avoid using 'systemctl' for now -SYSTEMCTL_SKIP_REDIRECT=1 -export SYSTEMCTL_SKIP_REDIRECT - -# Disallow 'others' the ability to 'write' to new files -umask 00002 - -command="$1" -pki_instance="$2" - -# Source function library. -. /etc/init.d/functions - -# Source the PKI function library -. /usr/share/pki/scripts/functions - -# See how we were called. -case $command in - status) - registry_status - exit $? - ;; - start) - start - exit $? - ;; - restart) - restart - exit $? - ;; - stop) - stop - exit $? - ;; - condrestart|force-restart|try-restart) - [ ! -f ${lockfile} ] || restart - exit $? - ;; - reload) - echo "The 'reload' action is an unimplemented feature." - exit ${default_error} - ;; - *) - echo "unknown action ($command)" - usage - echo "where valid instance names include:" - list_instances - exit ${default_error} - ;; -esac diff --git a/base/tps/shared/conf/index.ldif b/base/tps/shared/conf/index.ldif deleted file mode 100644 index d896de394..000000000 --- a/base/tps/shared/conf/index.ldif +++ /dev/null @@ -1,76 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; -# version 2.1 of the License. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301 USA -# -# Copyright (C) 2007 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: cn=tokenUserID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: tokenUserID -nsindextype: eq -nsindextype: pres -nsindextype: sub -nssystemindex: false - -dn: cn=tokenID,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: tokenID -nsindextype: eq -nsindextype: pres -nsindextype: sub -nssystemindex: false - -dn: cn=dateOfCreate,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: dateOfCreate -nsindextype: eq -nsindextype: pres -nsindextype: sub -nssystemindex: false - -dn: cn=dateOfModify,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: dateOfModify -nsindextype: eq -nsindextype: pres -nsindextype: sub -nssystemindex: false - -dn: cn=userCertificate,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: userCertificate -nsindextype: eq -nssystemindex: false - -dn: cn=tokenSerial,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: tokenSerial -nsindextype: eq -nssystemindex: false - -dn: cn=tokenKeyType,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -objectclass: top -objectclass: nsIndex -cn: tokenKeyType -nsindextype: eq -nssystemindex: false diff --git a/base/tps/shared/conf/jk2.manifest b/base/tps/shared/conf/jk2.manifest deleted file mode 100644 index 986d7b874..000000000 --- a/base/tps/shared/conf/jk2.manifest +++ /dev/null @@ -1,2 +0,0 @@ -Main-Class: org.apache.jk.apr.TomcatStarter -Class-Path: ../lib/tomcat.jar log4j.jar log4j-core.jar ../lib/common/log4j.jar ../lib/common/log4j-core.jar ../lib/common/classes ../lib/common/commons-logging.jar bootstrap.jar ../server/lib/commons-logging.jar ../server/lib/jmx.jar jmx.jar commons-logging-api.jar diff --git a/base/tps/shared/conf/jk2.properties b/base/tps/shared/conf/jk2.properties deleted file mode 100644 index 934d6ed54..000000000 --- a/base/tps/shared/conf/jk2.properties +++ /dev/null @@ -1,31 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -## THIS FILE MAY BE OVERRIDEN AT RUNTIME. MAKE SURE TOMCAT IS STOPED -## WHEN YOU EDIT THE FILE. - -## COMMENTS WILL BE _LOST_ - -## DOCUMENTATION OF THE FORMAT IN JkMain javadoc. - -# Set the desired handler list -# handler.list=apr,request,channelJni -# -# Override the default port for the socketChannel -# channelSocket.port=8019 -# Default: -# channelUnix.file=${jkHome}/work/jk2.socket -# Just to check if the the config is working -# shm.file=${jkHome}/work/jk2.shm - -# In order to enable jni use any channelJni directive -# channelJni.disabled = 0 -# And one of the following directives: - -# apr.jniModeSo=/opt/apache2/modules/mod_jk2.so - -# If set to inprocess the mod_jk2 will Register natives itself -# This will enable the starting of the Tomcat from mod_jk2 -# apr.jniModeSo=inprocess diff --git a/base/tps/shared/conf/jkconf.ant.xml b/base/tps/shared/conf/jkconf.ant.xml deleted file mode 100644 index 48396f1b7..000000000 --- a/base/tps/shared/conf/jkconf.ant.xml +++ /dev/null @@ -1,55 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/base/tps/shared/conf/jkconfig.manifest b/base/tps/shared/conf/jkconfig.manifest deleted file mode 100644 index 3ba1f2e3e..000000000 --- a/base/tps/shared/conf/jkconfig.manifest +++ /dev/null @@ -1,2 +0,0 @@ -Main-Class: org.apache.jk.config.WebXml2Jk -Class-Path: tomcat-jk2.jar commons-logging.jar crimson.jar xercesImpl.jar xmlApis.jar tomcat-util.jar log4j.jar log4j-core.jar diff --git a/base/tps/shared/conf/logging.properties b/base/tps/shared/conf/logging.properties deleted file mode 100644 index 796cfc071..000000000 --- a/base/tps/shared/conf/logging.properties +++ /dev/null @@ -1,70 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006-2010 Red Hat, Inc. -# All rights reserved. -# Modifications: configuration parameters -# --- END COPYRIGHT BLOCK --- - -# Licensed to the Apache Software Foundation (ASF) under one or more -# contributor license agreements. See the NOTICE file distributed with -# this work for additional information regarding copyright ownership. -# The ASF licenses this file to You under the Apache License, Version 2.0 -# (the "License"); you may not use this file except in compliance with -# the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler - -.handlers = 1catalina.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler - -############################################################ -# Handler specific properties. -# Describes specific configuration info for Handlers. -############################################################ - -1catalina.org.apache.juli.FileHandler.level = FINE -1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs -1catalina.org.apache.juli.FileHandler.prefix = catalina. - -2localhost.org.apache.juli.FileHandler.level = FINE -2localhost.org.apache.juli.FileHandler.directory = ${catalina.base}/logs -2localhost.org.apache.juli.FileHandler.prefix = localhost. - -3manager.org.apache.juli.FileHandler.level = FINE -3manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs -3manager.org.apache.juli.FileHandler.prefix = manager. - -4host-manager.org.apache.juli.FileHandler.level = FINE -4host-manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs -4host-manager.org.apache.juli.FileHandler.prefix = host-manager. - -java.util.logging.ConsoleHandler.level = FINE -java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter - - -############################################################ -# Facility specific properties. -# Provides extra control for each logger. -############################################################ - -org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = INFO -org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = 2localhost.org.apache.juli.FileHandler - -org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = INFO -org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = 3manager.org.apache.juli.FileHandler - -org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].level = INFO -org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = 4host-manager.org.apache.juli.FileHandler - -# For example, set the com.xyz.foo logger to only log SEVERE -# messages: -#org.apache.catalina.startup.ContextConfig.level = FINE -#org.apache.catalina.startup.HostConfig.level = FINE -#org.apache.catalina.session.ManagerBase.level = FINE -#org.apache.catalina.core.AprLifecycleListener.level=FINE diff --git a/base/tps/shared/conf/manager.ldif b/base/tps/shared/conf/manager.ldif deleted file mode 100644 index 18700dd4b..000000000 --- a/base/tps/shared/conf/manager.ldif +++ /dev/null @@ -1,46 +0,0 @@ -# acis for cert manager - -dn: ou=csusers,cn=config -objectClass: top -objectClass: organizationalUnit -ou: csusers - -dn: {rootSuffix} -changetype: modify -add: aci -aci: (targetattr=*)(version 3.0; acl "cert manager access v2"; allow (all) userdn = "ldap:///{dbuser}";) - -dn: cn=ldbm database,cn=plugins,cn=config -changetype: modify -add: aci -aci: (targetattr=*)(version 3.0; acl "Cert Manager access for VLV searches"; allow (read) userdn="ldap:///{dbuser}";) - -dn: cn=config -changetype: modify -add: aci -aci: (targetattr != aci)(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///{dbuser}";) - -dn: ou=csusers,cn=config -changetype: modify -add: aci -aci: (targetattr != aci)(version 3.0; aci "cert manager manage replication users"; allow (all) userdn = "ldap:///{dbuser}";) - -dn: cn="{rootSuffix}",cn=mapping tree,cn=config -changetype: modify -add: aci -aci: (targetattr=*)(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///{dbuser}";) - -dn: cn="{rootSuffix}",cn=mapping tree,cn=config -changetype: modify -add: aci -aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///{dbuser}";) - -dn: cn="{rootSuffix}",cn=mapping tree,cn=config -changetype: modify -add: aci -aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///{dbuser}";) - -dn: cn=tasks,cn=config -changetype: modify -add: aci -aci: (targetattr=*)(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///{dbuser}";) diff --git a/base/tps/shared/conf/schema.ldif b/base/tps/shared/conf/schema.ldif deleted file mode 100644 index bde045630..000000000 --- a/base/tps/shared/conf/schema.ldif +++ /dev/null @@ -1,58 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; -# version 2.1 of the License. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301 USA -# -# Copyright (C) 2007 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: cn=schema -changetype: modify -add: attributeTypes -attributeTypes: ( dateOfCreate-oid NAME 'dateOfCreate' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( dateOfModify-oid NAME 'dateOfModify' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( modified-oid NAME 'modified' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenUserID-oid NAME 'tokenUserID' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenStatus-oid NAME 'tokenStatus' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenAppletID-oid NAME 'tokenAppletID' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( keyInfo-oid NAME 'keyInfo' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( numberOfResets-oid NAME 'numberOfResets' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) -attributeTypes: ( numberOfEnrollments-oid NAME 'numberOfEnrollments' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) -attributeTypes: ( numberOfRenewals-oid NAME 'numberOfRenewals' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) -attributeTypes: ( numberOfRecoveries-oid NAME 'numberOfRecoveries' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN 'user defined' ) -attributeTypes: ( allowPinReset-oid NAME 'allowPinReset' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( extensions-oid NAME 'extensions' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenOp-oid NAME 'tokenOp' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenID-oid NAME 'tokenID' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenMsg-oid NAME 'tokenMsg' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenResult-oid NAME 'tokenResult' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenIP-oid NAME 'tokenIP' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenPolicy-oid NAME 'tokenPolicy' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenIssuer-oid NAME 'tokenIssuer' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenSubject-oid NAME 'tokenSubject' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenSerial-oid NAME 'tokenSerial' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenOrigin-oid NAME 'tokenOrigin' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenType-oid NAME 'tokenType' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenKeyType-oid NAME 'tokenKeyType' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenReason-oid NAME 'tokenReason' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenNotBefore-oid NAME 'tokenNotBefore' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( tokenNotAfter-oid NAME 'tokenNotAfter' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -attributeTypes: ( profileID-oid NAME 'profileID' DESC 'CMS defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' ) -- -add: objectClasses -objectClasses: ( tokenRecord-oid NAME 'tokenRecord' DESC 'CMS defined class' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ modified $ tokenReason $ tokenUserID $ tokenStatus $ tokenAppletID $ keyInfo $ tokenPolicy $ extensions $ numberOfResets $ numberOfEnrollments $ numberOfRenewals $ numberOfRecoveries $ userCertificate $ tokenType ) X-ORIGIN 'user defined' ) -objectClasses: ( tokenActivity-oid NAME 'tokenActivity' DESC 'CMS defined class' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ tokenOp $ tokenIP $ tokenResult $ tokenID $ tokenUserID $ tokenMsg $ extensions $ tokenType ) X-ORIGIN 'user defined' ) -objectClasses: ( tokenCert-oid NAME 'tokenCert' DESC 'CMS defined class' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ userCertificate $ tokenUserID $ tokenID $ tokenIssuer $ tokenOrigin $ tokenSubject $ tokenSerial $ tokenStatus $ tokenType $ tokenKeyType $ tokenNotBefore $ tokenNotAfter $ extensions ) X-ORIGIN 'user defined' ) -objectClasses: ( tpsProfileID-oid NAME 'tpsProfileID' DESC 'CMS defined class' SUP top AUXILIARY MAY ( profileID ) X-ORIGIN 'user-defined' ) diff --git a/base/tps/shared/conf/server-minimal.xml b/base/tps/shared/conf/server-minimal.xml deleted file mode 100644 index fc855c6e3..000000000 --- a/base/tps/shared/conf/server-minimal.xml +++ /dev/null @@ -1,29 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - diff --git a/base/tps/shared/conf/server.xml b/base/tps/shared/conf/server.xml deleted file mode 100644 index b66cb51ae..000000000 --- a/base/tps/shared/conf/server.xml +++ /dev/null @@ -1,258 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - [PKI_UNSECURE_PORT_SERVER_COMMENT] - - - - [PKI_SECURE_PORT_SERVER_COMMENT] - - - - - [PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_ADMIN_SECURE_PORT_SERVER_COMMENT] - - [PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT] - - [PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT][PKI_EE_SECURE_PORT_SERVER_COMMENT] - - [PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT] - - - - - - - -[PKI_OPEN_AJP_PORT_COMMENT] - -[PKI_CLOSE_AJP_PORT_COMMENT] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/base/tps/shared/conf/shm.manifest b/base/tps/shared/conf/shm.manifest deleted file mode 100644 index 0505c085b..000000000 --- a/base/tps/shared/conf/shm.manifest +++ /dev/null @@ -1,2 +0,0 @@ -Main-Class: org.apache.jk.common.Shm -Class-Path: tomcat-jk2.jar commons-logging.jar tomcat-util.jar log4j.jar log4j-core.jar diff --git a/base/tps/shared/conf/tomcat-jk2.manifest b/base/tps/shared/conf/tomcat-jk2.manifest deleted file mode 100644 index acfef4a90..000000000 --- a/base/tps/shared/conf/tomcat-jk2.manifest +++ /dev/null @@ -1,7 +0,0 @@ -Manifest-version: 1.0 -Extension-Name: org.apache.jk -Specification-Vendor: Apache Software Foundation -Specification-Version: 2.0 -Implementation-Vendor-Id: org.apache -Implementation-Vendor: Apache Software Foundation -Implementation-Version: 2.1 diff --git a/base/tps/shared/conf/tomcat-users.xml b/base/tps/shared/conf/tomcat-users.xml deleted file mode 100644 index daa9260cc..000000000 --- a/base/tps/shared/conf/tomcat-users.xml +++ /dev/null @@ -1,45 +0,0 @@ - - - - - - - - - - - - - - - - - - - - diff --git a/base/tps/shared/conf/tomcat6.conf b/base/tps/shared/conf/tomcat6.conf deleted file mode 100644 index 2d7def5ec..000000000 --- a/base/tps/shared/conf/tomcat6.conf +++ /dev/null @@ -1,58 +0,0 @@ -# Service-specific configuration file for tomcat6. This will be sourced by -# the SysV init script after the global configuration file -# /etc/tomcat6/tomcat6.conf, thus allowing values to be overridden in -# a per-service manner. -# -# NEVER change the init script itself. To change values for all services make -# your changes in /etc/tomcat6/tomcat6.conf -# -# To change values for a specific service make your edits here. -# To create a new service create a link from /etc/init.d/ to -# /etc/init.d/tomcat6 (do not copy the init script) and make a copy of the -# /etc/sysconfig/tomcat6 file to /etc/sysconfig/ and change -# the property values so the two services won't conflict. Register the new -# service in the system as usual (see chkconfig and similars). -# - -# Where your java installation lives -#JAVA_HOME="/usr/lib/jvm/java" - -# Where your tomcat installation lives -CATALINA_BASE="[PKI_INSTANCE_PATH]" -#CATALINA_HOME="/usr/share/tomcat6" -#JASPER_HOME="/usr/share/tomcat6" -#CATALINA_TMPDIR="/var/cache/tomcat6/temp" - -# You can pass some parameters to java here if you wish to -#JAVA_OPTS="-Xminf0.1 -Xmaxf0.3" - -# Use JAVA_OPTS to set java.library.path for libtcnative.so -#JAVA_OPTS="-Djava.library.path=/usr/lib64" - -# What user should run tomcat -TOMCAT_USER="[PKI_USER]" - -# You can change your tomcat locale here -#LANG="en_US" - -# Run tomcat under the Java Security Manager -#SECURITY_MANAGER="false" - -# Time to wait in seconds, before killing process -#SHUTDOWN_WAIT="30" - -# Whether to annoy the user with "attempting to shut down" messages or not -#SHUTDOWN_VERBOSE="false" - -# Set the TOMCAT_PID location -CATALINA_PID="[TOMCAT_PIDFILE]" - -# Set the tomcat log file -TOMCAT_LOG="[TOMCAT_LOG_DIR]/tomcat-initd.log" - -# Connector port is 8080 for this tomcat6 instance -#CONNECTOR_PORT="8080" - -# If you wish to further customize your tomcat environment, -# put your own definitions here -# (i.e. LD_LIBRARY_PATH for some jdbc drivers) diff --git a/base/tps/shared/conf/uriworkermap.properties b/base/tps/shared/conf/uriworkermap.properties deleted file mode 100644 index c89dd82a6..000000000 --- a/base/tps/shared/conf/uriworkermap.properties +++ /dev/null @@ -1,18 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -# uriworkermap.properties - IIS -# -# This file provides sample mappings for example ajp13w -# worker defined in workermap.properties.minimal -# The general sytax for this file is: -# [URL]=[Worker name] - -/servlet-examples/*=ajp13w - -# Optionally filter out all .jpeg files inside that context -# For no mapping the url has to start with exclamation (!) - -!/servlet-examples/*.jpeg=ajp13w diff --git a/base/tps/shared/conf/vlv.ldif b/base/tps/shared/conf/vlv.ldif deleted file mode 100644 index db7988e36..000000000 --- a/base/tps/shared/conf/vlv.ldif +++ /dev/null @@ -1,51 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; -# version 2.1 of the License. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301 USA -# -# Copyright (C) 2007 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: cn=tus-listTokens-vlv,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -cn: tus-listtokens-vlv -objectClass: top -objectClass: vlvsearch -vlvBase: ou=Tokens,{rootSuffix} -vlvFilter: (&(cn=*)(tokenUserID=*)) -vlvScope: 2 - -dn: cn=tus-listActivities-vlv,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -cn: tus-listActivities-vlv -objectClass: top -objectClass: vlvsearch -vlvBase: ou=Activities,{rootSuffix} -vlvFilter: (&(tokenID=*)(tokenUserID=*)) -vlvScope: 2 - -dn: cn=listTokensIndex,cn=tus-listTokens-vlv,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -cn: listTokensIndex -objectClass: top -objectClass: vlvindex -vlvSort: -dateOfModify -vlvEnabled: 1 -vlvUses: 0 - -dn: cn=listActivitiesIndex,cn=tus-listActivities-vlv,cn=userRoot,cn=ldbm database,cn=plugins,cn=config -cn: listActivitiesIndex -objectClass: top -objectClass: vlvindex -vlvSort: -dateOfCreate -vlvEnabled: 1 -vlvUses: 0 diff --git a/base/tps/shared/conf/vlvtasks.ldif b/base/tps/shared/conf/vlvtasks.ldif deleted file mode 100644 index b6b4bb762..000000000 --- a/base/tps/shared/conf/vlvtasks.ldif +++ /dev/null @@ -1,28 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# This library is free software; you can redistribute it and/or -# modify it under the terms of the GNU Lesser General Public -# License as published by the Free Software Foundation; -# version 2.1 of the License. -# -# This library is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# Lesser General Public License for more details. -# -# You should have received a copy of the GNU Lesser General Public -# License along with this library; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301 USA -# -# Copyright (C) 2007 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -dn: cn=index1160528734, cn=index, cn=tasks, cn=config -objectclass: top -objectclass: extensibleObject -cn: index1160528734 -ttl: 4 -nsInstance: userRoot -nsIndexVLVAttribute: listTokensIndex -nsIndexVLVAttribute: listActivitiesIndex diff --git a/base/tps/shared/conf/web.xml b/base/tps/shared/conf/web.xml deleted file mode 100644 index 8330ecca8..000000000 --- a/base/tps/shared/conf/web.xml +++ /dev/null @@ -1,993 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - default - org.apache.catalina.servlets.DefaultServlet - - debug - 0 - - - listings - false - - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - jsp - org.apache.jasper.servlet.JspServlet - - fork - false - - - xpoweredBy - false - - 3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - default - / - - - - - - - - jsp - *.jsp - - - - jsp - *.jspx - - - - - - - - - - - - - - - - 30 - - - - - - - - - - - - abs - audio/x-mpeg - - - ai - application/postscript - - - aif - audio/x-aiff - - - aifc - audio/x-aiff - - - aiff - audio/x-aiff - - - aim - application/x-aim - - - art - image/x-jg - - - asf - video/x-ms-asf - - - asx - video/x-ms-asf - - - au - audio/basic - - - avi - video/x-msvideo - - - avx - video/x-rad-screenplay - - - bcpio - application/x-bcpio - - - bin - application/octet-stream - - - bmp - image/bmp - - - body - text/html - - - cdf - application/x-cdf - - - cer - application/x-x509-ca-cert - - - class - application/java - - - cpio - application/x-cpio - - - csh - application/x-csh - - - css - text/css - - - dib - image/bmp - - - doc - application/msword - - - dtd - application/xml-dtd - - - dv - video/x-dv - - - dvi - application/x-dvi - - - eps - application/postscript - - - etx - text/x-setext - - - exe - application/octet-stream - - - gif - image/gif - - - gtar - application/x-gtar - - - gz - application/x-gzip - - - hdf - application/x-hdf - - - hqx - application/mac-binhex40 - - - htc - text/x-component - - - htm - text/html - - - html - text/html - - - hqx - application/mac-binhex40 - - - ief - image/ief - - - jad - text/vnd.sun.j2me.app-descriptor - - - jar - application/java-archive - - - java - text/plain - - - jnlp - application/x-java-jnlp-file - - - jpe - image/jpeg - - - jpeg - image/jpeg - - - jpg - image/jpeg - - - js - text/javascript - - - jsf - text/plain - - - jspf - text/plain - - - kar - audio/x-midi - - - latex - application/x-latex - - - m3u - audio/x-mpegurl - - - mac - image/x-macpaint - - - man - application/x-troff-man - - - mathml - application/mathml+xml - - - me - application/x-troff-me - - - mid - audio/x-midi - - - midi - audio/x-midi - - - mif - application/x-mif - - - mov - video/quicktime - - - movie - video/x-sgi-movie - - - mp1 - audio/x-mpeg - - - mp2 - audio/x-mpeg - - - mp3 - audio/x-mpeg - - - mpa - audio/x-mpeg - - - mpe - video/mpeg - - - mpeg - video/mpeg - - - mpega - audio/x-mpeg - - - mpg - video/mpeg - - - mpv2 - video/mpeg2 - - - ms - application/x-wais-source - - - nc - application/x-netcdf - - - oda - application/oda - - - ogg - application/ogg - - - pbm - image/x-portable-bitmap - - - pct - image/pict - - - pdf - application/pdf - - - pgm - image/x-portable-graymap - - - pic - image/pict - - - pict - image/pict - - - pls - audio/x-scpls - - - png - image/png - - - pnm - image/x-portable-anymap - - - pnt - image/x-macpaint - - - ppm - image/x-portable-pixmap - - - ppt - application/powerpoint - - - ps - application/postscript - - - psd - image/x-photoshop - - - qt - video/quicktime - - - qti - image/x-quicktime - - - qtif - image/x-quicktime - - - ras - image/x-cmu-raster - - - rdf - application/rdf+xml - - - rgb - image/x-rgb - - - rm - application/vnd.rn-realmedia - - - roff - application/x-troff - - - rtf - application/rtf - - - rtx - text/richtext - - - sh - application/x-sh - - - shar - application/x-shar - - - smf - audio/x-midi - - - sit - application/x-stuffit - - - snd - audio/basic - - - src - application/x-wais-source - - - sv4cpio - application/x-sv4cpio - - - sv4crc - application/x-sv4crc - - - svg - image/svg+xml - - - swf - application/x-shockwave-flash - - - t - application/x-troff - - - tar - application/x-tar - - - tcl - application/x-tcl - - - tex - application/x-tex - - - texi - application/x-texinfo - - - texinfo - application/x-texinfo - - - tif - image/tiff - - - tiff - image/tiff - - - tr - application/x-troff - - - tsv - text/tab-separated-values - - - txt - text/plain - - - ulw - audio/basic - - - ustar - application/x-ustar - - - vxml - application/voicexml+xml - - - xbm - image/x-xbitmap - - - xht - application/xhtml+xml - - - xhtml - application/xhtml+xml - - - xml - application/xml - - - xpm - image/x-xpixmap - - - xsl - application/xml - - - xslt - application/xslt+xml - - - xul - application/vnd.mozilla.xul+xml - - - xwd - image/x-xwindowdump - - - wav - audio/x-wav - - - svg - image/svg - - - svgz - image/svg - - - vsd - application/x-visio - - - - wbmp - image/vnd.wap.wbmp - - - - wml - text/vnd.wap.wml - - - - wmlc - application/vnd.wap.wmlc - - - - wmls - text/vnd.wap.wmlscript - - - - wmlscriptc - application/vnd.wap.wmlscriptc - - - wrl - x-world/x-vrml - - - Z - application/x-compress - - - z - application/x-compress - - - zip - application/zip - - - - - - - - - - - - - - - - - index.html - index.htm - index.jsp - - - - 404 - /404.html - - - - 500 - /500.html - - - diff --git a/base/tps/shared/conf/workers.properties b/base/tps/shared/conf/workers.properties deleted file mode 100644 index ae26a983c..000000000 --- a/base/tps/shared/conf/workers.properties +++ /dev/null @@ -1,209 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -# workers.properties - -# -# This file provides jk derived plugins with the needed information to -# connect to the different tomcat workers. Note that the distributed -# version of this file requires modification before it is usable by a -# plugin. -# -# As a general note, the characters $( and ) are used internally to define -# macros. Do not use them in your own configuration!!! -# -# Whenever you see a set of lines such as: -# x=value -# y=$(x)\something -# -# the final value for y will be value\something -# -# Normaly all you will need to do is un-comment and modify the first three -# properties, i.e. workers.tomcat_home, workers.java_home and ps. -# Most of the configuration is derived from these. -# -# When you are done updating workers.tomcat_home, workers.java_home and ps -# you should have 3 workers configured: -# -# - An ajp12 worker that connects to localhost:8007 -# - An ajp13 worker that connects to localhost:8009 -# - A jni inprocess worker. -# - A load balancer worker -# -# However by default the plugins will only use the ajp12 worker. To have -# the plugins use other workers you should modify the worker.list property. -# -# - -# OPTIONS ( very important for jni mode ) - -# -# workers.tomcat_home should point to the location where you -# installed tomcat. This is where you have your conf, webapps and lib -# directories. -# -workers.tomcat_home=/var/tomcat3 - -# -# workers.java_home should point to your Java installation. Normally -# you should have a bin and lib directories beneath it. -# -workers.java_home=/opt/IBMJava2-13 - -# -# You should configure your environment slash... ps=\ on NT and / on UNIX -# and maybe something different elsewhere. -# -ps=/ - -# -#------ ADVANCED MODE ------------------------------------------------ -#--------------------------------------------------------------------- -# - -# -#------ DEFAULT worket list ------------------------------------------ -#--------------------------------------------------------------------- -# -# -# The workers that your plugins should create and work with -# -# Add 'inprocess' if you want JNI connector -worker.list=ajp12, ajp13 -# , inprocess - - -# -#------ DEFAULT ajp12 WORKER DEFINITION ------------------------------ -#--------------------------------------------------------------------- -# - -# -# Defining a worker named ajp12 and of type ajp12 -# Note that the name and the type do not have to match. -# -worker.ajp12.port=8007 -worker.ajp12.host=localhost -worker.ajp12.type=ajp12 -# -# Specifies the load balance factor when used with -# a load balancing worker. -# Note: -# ----> lbfactor must be > 0 -# ----> Low lbfactor means less work done by the worker. -worker.ajp12.lbfactor=1 - -# -#------ DEFAULT ajp13 WORKER DEFINITION ------------------------------ -#--------------------------------------------------------------------- -# - -# -# Defining a worker named ajp13 and of type ajp13 -# Note that the name and the type do not have to match. -# -worker.ajp13.port=8009 -worker.ajp13.host=localhost -worker.ajp13.type=ajp13 -# -# Specifies the load balance factor when used with -# a load balancing worker. -# Note: -# ----> lbfactor must be > 0 -# ----> Low lbfactor means less work done by the worker. -worker.ajp13.lbfactor=1 - -# -# Specify the size of the open connection cache. -#worker.ajp13.cachesize - -# -#------ DEFAULT LOAD BALANCER WORKER DEFINITION ---------------------- -#--------------------------------------------------------------------- -# - -# -# The loadbalancer (type lb) workers perform wighted round-robin -# load balancing with sticky sessions. -# Note: -# ----> If a worker dies, the load balancer will check its state -# once in a while. Until then all work is redirected to peer -# workers. -worker.loadbalancer.type=lb -worker.loadbalancer.balanced_workers=ajp12, ajp13 - - -# -#------ DEFAULT JNI WORKER DEFINITION--------------------------------- -#--------------------------------------------------------------------- -# - -# -# Defining a worker named inprocess and of type jni -# Note that the name and the type do not have to match. -# -worker.inprocess.type=jni - -# -#------ CLASSPATH DEFINITION ----------------------------------------- -#--------------------------------------------------------------------- -# - -# -# Additional class path components. -# -worker.inprocess.class_path=$(workers.tomcat_home)$(ps)lib$(ps)tomcat.jar - -# -# Setting the command line for tomcat. -# Note: The cmd_line string may not contain spaces. -# -worker.inprocess.cmd_line=start - -# Not needed, but can be customized. -#worker.inprocess.cmd_line=-config -#worker.inprocess.cmd_line=$(workers.tomcat_home)$(ps)conf$(ps)server.xml -#worker.inprocess.cmd_line=-home -#worker.inprocess.cmd_line=$(workers.tomcat_home) - -# -# The JVM that we are about to use -# -# This is for Java2 -# -# Windows -worker.inprocess.jvm_lib=$(workers.java_home)$(ps)jre$(ps)bin$(ps)classic$(ps)jvm.dll -# IBM JDK1.3 -#worker.inprocess.jvm_lib=$(workers.java_home)$(ps)jre$(ps)bin$(ps)classic$(ps)libjvm.so -# Unix - Sun VM or blackdown -#worker.inprocess.jvm_lib=$(workers.java_home)$(ps)jre$(ps)lib$(ps)i386$(ps)classic$(ps)libjvm.so - -# -# And this is for jdk1.1.X -# -#worker.inprocess.jvm_lib=$(workers.java_home)$(ps)bin$(ps)javai.dll - - -# -# Setting the place for the stdout and stderr of tomcat -# -worker.inprocess.stdout=$(workers.tomcat_home)$(ps)logs$(ps)inprocess.stdout -worker.inprocess.stderr=$(workers.tomcat_home)$(ps)logs$(ps)inprocess.stderr - -# -# Setting the tomcat.home Java property -# -#worker.inprocess.sysprops=tomcat.home=$(workers.tomcat_home) - -# -# Java system properties -# -# worker.inprocess.sysprops=java.compiler=NONE -# worker.inprocess.sysprops=myprop=mypropvalue - -# -# Additional path components. -# -# worker.inprocess.ld_path=d:$(ps)SQLLIB$(ps)bin -# diff --git a/base/tps/shared/conf/workers.properties.minimal b/base/tps/shared/conf/workers.properties.minimal deleted file mode 100644 index 51980ac49..000000000 --- a/base/tps/shared/conf/workers.properties.minimal +++ /dev/null @@ -1,22 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -# workers.properties.minimal - -# -# This file provides minimal jk configuration properties needed to -# connect to Tomcat. -# -# The workers that jk should create and work with -# -worker.list=ajp13w - - -# -# Defining a worker named ajp13w and of type ajp13 -# Note that the name and the type do not have to match. -# -worker.ajp13w.type=ajp13 -worker.ajp13w.host=localhost -worker.ajp13w.port=8009 diff --git a/base/tps/shared/conf/workers2.properties b/base/tps/shared/conf/workers2.properties deleted file mode 100644 index 3c8e0f4a5..000000000 --- a/base/tps/shared/conf/workers2.properties +++ /dev/null @@ -1,136 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -[logger] -level=DEBUG - -[config:] -file=${serverRoot}/conf/workers2.properties -debug=0 -debugEnv=0 - -[uriMap:] -info=Maps the requests. Options: debug -debug=0 - -# Alternate file logger -#[logger.file:0] -#level=DEBUG -#file=${serverRoot}/logs/jk2.log - -[shm:] -info=Scoreboard. Required for reconfiguration and status with multiprocess servers -file=${serverRoot}/logs/jk2.shm -size=1000000 -debug=0 -disabled=0 - -[workerEnv:] -info=Global server options -timing=1 -debug=0 -# Default Native Logger (apache2 or win32 ) -# can be overriden to a file logger, useful -# when tracing win32 related issues -#logger=logger.file:0 - -[lb:lb] -info=Default load balancer. -debug=0 - -[lb:lb_1] -info=A second load balancer. -debug=0 - -[channel.socket:localhost:8009] -info=Ajp13 forwarding over socket -debug=0 -tomcatId=localhost:8009 - -[channel.socket:localhost:8019] -info=A second tomcat instance. -debug=0 -tomcatId=localhost:8019 -lb_factor=1 -#group=lb -group:lb:lb -#group=lb_1 -group:lb:lb_1 -disabled=0 - -[channel.un:/opt/33/work/jk2.socket] -info=A second channel connecting to localhost:8019 via unix socket -tomcatId=localhost:8019 -lb_factor=1 -debug=0 - -[channel.jni:jni] -info=The jni channel, used if tomcat is started inprocess - -[status:] -info=Status worker, displays runtime informations - -[vm:] -info=Parameters used to load a JVM in the server process -#JVM=C:\jdk\jre\bin\hotspot\jvm.dll -classpath=${TOMCAT_HOME}/bin/tomcat-jni.jar -classpath=${TOMCAT_HOME}/server/lib/commons-logging.jar -OPT=-Dtomcat.home=${TOMCAT_HOME} -OPT=-Dcatalina.home=${TOMCAT_HOME} -OPT=-Xmx128M -#OPT=-Djava.compiler=NONE -disabled=1 - -[worker.jni:onStartup] -info=Command to be executed by the VM on startup. This one will start tomcat. -class=org/apache/jk/apr/TomcatStarter -ARG=start -# For Tomcat 5 use the 'stard' for startup argument -# ARG=stard -disabled=1 -stdout=${serverRoot}/logs/stdout.log -stderr=${serverRoot}/logs/stderr.log - -[worker.jni:onShutdown] -info=Command to be executed by the VM on shutdown. This one will stop tomcat. -class=org/apache/jk/apr/TomcatStarter -ARG=stop -disabled=1 - -[uri:/jkstatus/*] -info=Display status information and checks the config file for changes. -group=status: - -[uri:127.0.0.1:8003] -info=Example virtual host. Make sure myVirtualHost is in /etc/hosts to test it -alias=myVirtualHost:8003 - -[uri:127.0.0.1:8003/ex] -info=Example webapp in the virtual host. It'll go to lb_1 ( i.e. localhost:8019 ) -context=/ex -group=lb_1 - -[uri:/examples] -info=Example webapp in the default context. -context=/examples -debug=0 - -[uri:/examples1/*] -info=A second webapp, this time going to the second tomcat only. -group=lb_1 -debug=0 - -[uri:/examples/servlet/*] -info=Prefix mapping - -[uri:/examples/*.jsp] -info=Extension mapping - -[uri:/examples/*] -info=Map the whole webapp - -[uri:/examples/servlet/HelloW] -info=Example with debug enabled. -debug=10 diff --git a/base/tps/shared/conf/workers2.properties.minimal b/base/tps/shared/conf/workers2.properties.minimal deleted file mode 100644 index 0e88d14c7..000000000 --- a/base/tps/shared/conf/workers2.properties.minimal +++ /dev/null @@ -1,60 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -# -# This is the minimal JK2 connector configuration file. -# - -[logger] -info=Native logger -level=ERROR - -[config:] -file=${serverRoot}/conf/workers2.properties -debug=0 -debugEnv=0 - -[uriMap:] -info=Maps the requests. -debug=0 - -[shm:] -info=Scoreboard. Required for reconfiguration and status with multiprocess servers -file=anonymous -debug=0 - -[workerEnv:] -info=Global server options -timing=0 -debug=0 - -[lb:lb] -info=Default load balancer. -debug=0 - -[channel.socket:localhost:8009] -info=Ajp13 forwarding over socket -debug=0 -tomcatId=localhost:8009 - -[uri:/admin] -info=Tomcat HTML based administration web application. -debug=0 - -[uri:/manager] -info=A scriptable management web application for the Tomcat Web Server. -debug=0 - -[uri:/jsp-examples] -info=JSP 2.0 Examples. -debug=0 - -[uri:/servlets-examples] -info=Servlet 2.4 Examples. -debug=0 - -[uri:/*.jsp] -info=JSP Extension mapping. -debug=0 diff --git a/base/tps/shared/etc/init.d/pki-tpsd b/base/tps/shared/etc/init.d/pki-tpsd deleted file mode 100755 index 7b991f39c..000000000 --- a/base/tps/shared/etc/init.d/pki-tpsd +++ /dev/null @@ -1,86 +0,0 @@ -#!/bin/bash -# -# --- BEGIN COPYRIGHT BLOCK --- -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; version 2 of the License. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License along -# with this program; if not, write to the Free Software Foundation, Inc., -# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -# -# Copyright (C) 2007-2010 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -# pki-tpsd Startup script for pki-tps with tomcat7 -# -# chkconfig: - 84 16 -# description: Token Processing Service (Tomcat 7.0) -# processname: pki-tpsd -# piddir: /var/run/pki/tps -# - -PROG_NAME=`basename $0` -SERVICE_NAME="pki-tpsd" -SERVICE_PROG="/sbin/service" -PKI_PATH="/usr/share/pki/tps" -PKI_REGISTRY="/etc/sysconfig/pki/tps" -PKI_TYPE="pki-tps" -PKI_TOTAL_PORTS=6 - -# Avoid using 'systemctl' for now -SYSTEMCTL_SKIP_REDIRECT=1 -export SYSTEMCTL_SKIP_REDIRECT - -# Disallow 'others' the ability to 'write' to new files -umask 00002 - -command="$1" -pki_instance="$2" - -# Source function library. -. /etc/init.d/functions - -# Source the PKI function library -. /usr/share/pki/scripts/functions - -# See how we were called. -case $command in - status) - registry_status - exit $? - ;; - start) - start - exit $? - ;; - restart) - restart - exit $? - ;; - stop) - stop - exit $? - ;; - condrestart|force-restart|try-restart) - [ ! -f ${lockfile} ] || restart - exit $? - ;; - reload) - echo "The 'reload' action is an unimplemented feature." - exit ${default_error} - ;; - *) - echo "unknown action ($command)" - usage - echo "where valid instance names include:" - list_instances - exit ${default_error} - ;; -esac diff --git a/base/tps/shared/lib/systemd/system/pki-tpsd.target b/base/tps/shared/lib/systemd/system/pki-tpsd.target deleted file mode 100644 index 443c2adad..000000000 --- a/base/tps/shared/lib/systemd/system/pki-tpsd.target +++ /dev/null @@ -1,6 +0,0 @@ -[Unit] -Description=PKI Token Processing Service -After=syslog.target network.target - -[Install] -WantedBy=multi-user.target diff --git a/base/tps/shared/lib/systemd/system/pki-tpsd@.service b/base/tps/shared/lib/systemd/system/pki-tpsd@.service deleted file mode 100644 index 4703b3fe8..000000000 --- a/base/tps/shared/lib/systemd/system/pki-tpsd@.service +++ /dev/null @@ -1,12 +0,0 @@ -[Unit] -Description=PKI Token Processing Service %i -After=pki-tpsd.target -BindTo=pki-tpsd.target - -[Service] -Type=forking -ExecStart=/usr/bin/pkicontrol start tps %i -ExecStop=/usr/bin/pkicontrol stop tps %i - -[Install] -WantedBy=multi-user.target diff --git a/base/tps/shared/webapps/tps/404.html b/base/tps/shared/webapps/tps/404.html deleted file mode 100755 index 0bf93578c..000000000 --- a/base/tps/shared/webapps/tps/404.html +++ /dev/null @@ -1,145 +0,0 @@ - - - - - - -TPS 404 Error! - - - - - - - - - -
- -
-
- -
- - -
- - -
-
- -
- -Certificate System TPS Error Page -
-

- -

- -

- - - diff --git a/base/tps/shared/webapps/tps/500.html b/base/tps/shared/webapps/tps/500.html deleted file mode 100755 index 3e1e8bb66..000000000 --- a/base/tps/shared/webapps/tps/500.html +++ /dev/null @@ -1,138 +0,0 @@ - - - - - - -TPS 500 Error! - - - - - - - - - -
- -
-
- -
- - -
- - -
-
- -
- -Certificate System TPS Error Page -
-

- -

- -

- - - diff --git a/base/tps/shared/webapps/tps/GenUnexpectedError.template b/base/tps/shared/webapps/tps/GenUnexpectedError.template deleted file mode 100644 index ea545c145..000000000 --- a/base/tps/shared/webapps/tps/GenUnexpectedError.template +++ /dev/null @@ -1,67 +0,0 @@ - - - - - -TPS Processing Error! - - - - -Problem Processing Your Request - - - - - - -
 
- - - - - - - - diff --git a/base/tps/shared/webapps/tps/META-INF/context.xml b/base/tps/shared/webapps/tps/META-INF/context.xml deleted file mode 100644 index e838503a6..000000000 --- a/base/tps/shared/webapps/tps/META-INF/context.xml +++ /dev/null @@ -1,37 +0,0 @@ - - - - - - - - - - - - - diff --git a/base/tps/shared/webapps/tps/WEB-INF/auth.properties b/base/tps/shared/webapps/tps/WEB-INF/auth.properties deleted file mode 100644 index 8ed17dbe0..000000000 --- a/base/tps/shared/webapps/tps/WEB-INF/auth.properties +++ /dev/null @@ -1,10 +0,0 @@ -# Restful API authorization mapping info -# -# Format: -# = , -# ex: admin.users = certServer.ca.users,read - -account.login = certServer.tps.account,login -account.logout = certServer.tps.account,logout -admin.users = certServer.tps.users,execute -admin.groups = certServer.tps.groups,execute diff --git a/base/tps/shared/webapps/tps/WEB-INF/velocity.properties b/base/tps/shared/webapps/tps/WEB-INF/velocity.properties deleted file mode 100644 index 5cd0454cc..000000000 --- a/base/tps/shared/webapps/tps/WEB-INF/velocity.properties +++ /dev/null @@ -1,13 +0,0 @@ -# --- BEGIN COPYRIGHT BLOCK --- -# Copyright (C) 2006 Red Hat, Inc. -# All rights reserved. -# --- END COPYRIGHT BLOCK --- -# -resource.loader = file -file.resource.loader.class = org.apache.velocity.runtime.resource.loader.FileResourceLoader -file.resource.loader.path = [PKI_INSTANCE_PATH]/[PKI_WEBAPPS_NAME]/[PKI_SUBSYSTEM_TYPE] -file.resource.loader.cache = true -file.resource.loader.modificationCheckInterval = 2 -input.encoding=UTF-8 -output.encoding=UTF-8 -runtime.log.logsystem.class=org.apache.velocity.runtime.log.NullLogSystem diff --git a/base/tps/shared/webapps/tps/WEB-INF/web.xml b/base/tps/shared/webapps/tps/WEB-INF/web.xml deleted file mode 100644 index 9a6c87462..000000000 --- a/base/tps/shared/webapps/tps/WEB-INF/web.xml +++ /dev/null @@ -1,188 +0,0 @@ - - - - - - Token Processing Service - - - csadmin-login - com.netscape.cms.servlet.csadmin.LoginServlet - - properties - /WEB-INF/velocity.properties - - - - - tpsstart - com.netscape.cms.servlet.base.CMSStartServlet - - AuthzMgr - BasicAclAuthz - - - cfgPath - [PKI_INSTANCE_PATH]/conf/[PKI_SUBSYSTEM_TYPE]/CS.cfg - - - ID - tpsstart - - 1 - - - - tpsug - com.netscape.cms.servlet.admin.UsrGrpAdminServlet - - ID - tpsug - - - AuthzMgr - BasicAclAuthz - - - - - tpslog - com.netscape.cms.servlet.admin.LogAdminServlet - - ID - tpslog - - AuthzMgr - BasicAclAuthz - - - - - tpsGetStatus - com.netscape.cms.servlet.csadmin.GetStatus - - GetClientCert - false - - - authority - tps - - - ID - tpsGetStatus - - - - - tps - org.dogtagpki.tps.server.TPSServlet - - - - org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap - - - - resteasy.servlet.mapping.prefix - /rest - - - - resteasy.resource.method-interceptors - org.jboss.resteasy.core.ResourceMethodSecurityInterceptor - - - - Resteasy - org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher - - javax.ws.rs.Application - org.dogtagpki.tps.server.TPSApplication - - - - - Resteasy - /rest/* - - - - tpsstart - /start - - - - tpsug - /ug - - - - tpslog - /log - - - - csadmin-login - /admin/console/config/login - - - - tpsGetStatus - /admin/tps/getStatus - - - - tps - /tps - - - - - - - - - - 30 - - - - - Account Services - /rest/account/* - - - * - - - CONFIDENTIAL - - - - - - Admin Services - /rest/admin/* - - - * - - - CONFIDENTIAL - - - - - Token Processing Service - - - - * - - - diff --git a/base/tps/shared/webapps/tps/index.html b/base/tps/shared/webapps/tps/index.html deleted file mode 100644 index 30662d47a..000000000 --- a/base/tps/shared/webapps/tps/index.html +++ /dev/null @@ -1,23 +0,0 @@ - - - - diff --git a/base/tps/shared/webapps/tps/services.template b/base/tps/shared/webapps/tps/services.template deleted file mode 100644 index c6792fea1..000000000 --- a/base/tps/shared/webapps/tps/services.template +++ /dev/null @@ -1,106 +0,0 @@ - - - - -TKS Services - - - - - - - - - - - - -
- -
-
- -
- - -
- - -
-
- -
- - - -Certificate System TKS Services Page -
-

- -

-

- - - - - - - - - - -
  
  
-
- - - diff --git a/scripts/compose_dogtag_pki_meta_packages b/scripts/compose_dogtag_pki_meta_packages index a2dd5752f..a70213c79 100755 --- a/scripts/compose_dogtag_pki_meta_packages +++ b/scripts/compose_dogtag_pki_meta_packages @@ -30,7 +30,7 @@ PKI_PWD=`pwd` ## if [ $WORK_DIR ]; then - PKI_PACKAGES="$WORK_DIR" + PKI_PACKAGES="`cd $WORK_DIR ; pwd`" else PKI_PACKAGES="${PKI_PWD}/packages" fi diff --git a/scripts/compose_dogtag_pki_theme_packages b/scripts/compose_dogtag_pki_theme_packages index f340dbf9c..5b52acaef 100755 --- a/scripts/compose_dogtag_pki_theme_packages +++ b/scripts/compose_dogtag_pki_theme_packages @@ -47,7 +47,7 @@ PKI_COMPONENT_LIST="test common-ui ra-ui tps-ui console-ui" ## if [ $WORK_DIR ]; then - PKI_PACKAGES="$WORK_DIR" + PKI_PACKAGES="`cd $WORK_DIR ; pwd`" else PKI_PACKAGES="${PKI_PWD}/packages" fi diff --git a/scripts/compose_ipa_pki_theme_packages b/scripts/compose_ipa_pki_theme_packages index eac6cddd6..8cd8768b0 100755 --- a/scripts/compose_ipa_pki_theme_packages +++ b/scripts/compose_ipa_pki_theme_packages @@ -47,7 +47,7 @@ PKI_COMPONENT_LIST="common-ui ca-ui" ## if [ $WORK_DIR ]; then - PKI_PACKAGES="$WORK_DIR" + PKI_PACKAGES="`cd $WORK_DIR ; pwd`" else PKI_PACKAGES="${PKI_PWD}/packages" fi diff --git a/scripts/compose_pki_console_packages b/scripts/compose_pki_console_packages index 22f17d07d..4e5bc66ba 100755 --- a/scripts/compose_pki_console_packages +++ b/scripts/compose_pki_console_packages @@ -47,7 +47,7 @@ PKI_COMPONENT_LIST="test console" ## if [ $WORK_DIR ]; then - PKI_PACKAGES="$WORK_DIR" + PKI_PACKAGES="`cd $WORK_DIR ; pwd`" else PKI_PACKAGES="${PKI_PWD}/packages" fi diff --git a/scripts/compose_pki_core_packages b/scripts/compose_pki_core_packages index 99d480c31..eb124ebb0 100755 --- a/scripts/compose_pki_core_packages +++ b/scripts/compose_pki_core_packages @@ -39,9 +39,9 @@ PKI_CORE_VERSION="10.1.0" ## PKI_SPECS_FILE="${PKI_DIR}/specs/${PKI_CORE}.spec" -PKI_COMPONENT_LIST="test setup symkey util common native-tools java-tools server selinux ca kra ocsp tks silent" +PKI_COMPONENT_LIST="test setup symkey util common native-tools java-tools server selinux ca kra ocsp tks tps-tomcat silent" -if [ "$JAVADOC" = "" ]; then +if [ "$WITHOUT_JAVADOC" = "" ]; then PKI_COMPONENT_LIST="$PKI_COMPONENT_LIST javadoc" fi @@ -50,7 +50,7 @@ fi ## if [ $WORK_DIR ]; then - PKI_PACKAGES="$WORK_DIR" + PKI_PACKAGES="`cd $WORK_DIR ; pwd`" else PKI_PACKAGES="${PKI_PWD}/packages" fi @@ -154,12 +154,25 @@ else cd ${PKI_BASE_DIR} cp -p ${PKI_BASE_MANIFEST} ${PKI_CORE_BASE_DIR} cp -p VERSION ${PKI_CORE_BASE_DIR} - for component in "${PKI_COMPONENT_LIST}" ; + for component in ${PKI_COMPONENT_LIST} ; do - find ${component} \ + if [ "${component}" = "tps-tomcat" ] ; then + # rename tps-tomcat to tps + dest="tps" + else + dest="${component}" + fi + + # copying ${PKI_BASE_DIR}/${component} to ${PKI_CORE_BASE_DIR}/${dest} + cd ${component} + mkdir ${PKI_CORE_BASE_DIR}/${dest} + + find \ -name .svn -prune -o \ -name *.swp -prune -o \ - -print | cpio -pdum ${PKI_CORE_BASE_DIR} > /dev/null 2>&1 + -print | cpio -pdum ${PKI_CORE_BASE_DIR}/${dest} > /dev/null 2>&1 + + cd .. done cd - > /dev/null 2>&1 diff --git a/scripts/compose_pki_migrate_packages b/scripts/compose_pki_migrate_packages index f9bcaccb8..be93c42c1 100755 --- a/scripts/compose_pki_migrate_packages +++ b/scripts/compose_pki_migrate_packages @@ -47,7 +47,7 @@ PKI_COMPONENT_LIST="test migrate" ## if [ $WORK_DIR ]; then - PKI_PACKAGES="$WORK_DIR" + PKI_PACKAGES="`cd $WORK_DIR ; pwd`" else PKI_PACKAGES="${PKI_PWD}/packages" fi diff --git a/scripts/compose_pki_ra_packages b/scripts/compose_pki_ra_packages index 0e93ee4e1..9aa4dda14 100755 --- a/scripts/compose_pki_ra_packages +++ b/scripts/compose_pki_ra_packages @@ -47,7 +47,7 @@ PKI_COMPONENT_LIST="ra" ## if [ $WORK_DIR ]; then - PKI_PACKAGES="$WORK_DIR" + PKI_PACKAGES="`cd $WORK_DIR ; pwd`" else PKI_PACKAGES="${PKI_PWD}/packages" fi diff --git a/scripts/compose_pki_tps_packages b/scripts/compose_pki_tps_packages index a23c52982..4ffa83cf5 100755 --- a/scripts/compose_pki_tps_packages +++ b/scripts/compose_pki_tps_packages @@ -47,7 +47,7 @@ PKI_COMPONENT_LIST="tps" ## if [ $WORK_DIR ]; then - PKI_PACKAGES="$WORK_DIR" + PKI_PACKAGES="`cd $WORK_DIR ; pwd`" else PKI_PACKAGES="${PKI_PWD}/packages" fi diff --git a/specs/pki-core.spec b/specs/pki-core.spec index fc277dd7d..3bf959da5 100644 --- a/specs/pki-core.spec +++ b/specs/pki-core.spec @@ -5,7 +5,7 @@ distutils.sysconfig import get_python_lib; print(get_python_lib(1))")} Name: pki-core Version: 10.1.0 -Release: 0.9%{?dist} +Release: 0.10%{?dist} Summary: Certificate System - PKI Core Components URL: http://pki.fedoraproject.org/ License: GPLv2 @@ -107,6 +107,7 @@ PKI Core contains ALL top-level java-based Tomcat PKI components: \ * pki-kra \ * pki-ocsp \ * pki-tks \ + * pki-tps-tomcat \ * pki-javadoc \ \ which comprise the following corresponding PKI subsystems: \ @@ -115,6 +116,7 @@ which comprise the following corresponding PKI subsystems: \ * Data Recovery Manager (DRM) \ * Online Certificate Status Protocol (OCSP) Manager \ * Token Key Service (TKS) \ + * Token Processing Service (TPS) \ \ For deployment purposes, PKI Core contains fundamental packages \ required by BOTH native-based Apache AND java-based Tomcat \ @@ -313,8 +315,9 @@ The PKI Server Framework is required by the following four PKI subsystems: the Certificate Authority (CA), the Data Recovery Manager (DRM), - the Online Certificate Status Protocol (OCSP) Manager, and - the Token Key Service (TKS). + the Online Certificate Status Protocol (OCSP) Manager, + the Token Key Service (TKS), and + the Token Processing Service (TPS). This package is a part of the PKI Core used by the Certificate System. The package contains scripts to create and remove PKI subsystems. @@ -476,6 +479,39 @@ provided by the PKI Core used by the Certificate System. %{overview} +%package -n pki-tps-tomcat +Summary: Certificate System - Token Processing Service +Group: System Environment/Daemons + +BuildArch: noarch + +Provides: pki-tps +Conflicts: pki-tps +Requires: java >= 1:1.7.0 +Requires: pki-server = %{version}-%{release} +Requires(post): systemd-units +Requires(preun): systemd-units +Requires(postun): systemd-units + +%description -n pki-tps-tomcat +The Token Processing System (TPS) is an optional PKI subsystem that acts +as a Registration Authority (RA) for authenticating and processing +enrollment requests, PIN reset requests, and formatting requests from +the Enterprise Security Client (ESC). + +TPS is designed to communicate with tokens that conform to +Global Platform's Open Platform Specification. + +TPS communicates over SSL with various PKI backend subsystems (including +the Certificate Authority (CA), the Data Recovery Manager (DRM), and the +Token Key Service (TKS)) to fulfill the user's requests. + +TPS also interacts with the token database, an LDAP server that stores +information about individual tokens. + +%{overview} + + %package -n pki-javadoc Summary: Certificate System - PKI Framework Javadocs Group: Documentation @@ -575,11 +611,17 @@ echo "D /var/lock/pki 0755 root root -" > %{buildroot}%{_sysconfdir}/tmpfil echo "D /var/lock/pki/tks 0755 root root -" >> %{buildroot}%{_sysconfdir}/tmpfiles.d/pki-tks.conf echo "D /var/run/pki 0755 root root -" >> %{buildroot}%{_sysconfdir}/tmpfiles.d/pki-tks.conf echo "D /var/run/pki/tks 0755 root root -" >> %{buildroot}%{_sysconfdir}/tmpfiles.d/pki-tks.conf +# generate 'pki-tps.conf' under the 'tmpfiles.d' directory +echo "D /var/lock/pki 0755 root root -" > %{buildroot}%{_sysconfdir}/tmpfiles.d/pki-tps.conf +echo "D /var/lock/pki/tps 0755 root root -" >> %{buildroot}%{_sysconfdir}/tmpfiles.d/pki-tps.conf +echo "D /var/run/pki 0755 root root -" >> %{buildroot}%{_sysconfdir}/tmpfiles.d/pki-tps.conf +echo "D /var/run/pki/tps 0755 root root -" >> %{buildroot}%{_sysconfdir}/tmpfiles.d/pki-tps.conf %{__rm} %{buildroot}%{_initrddir}/pki-cad %{__rm} %{buildroot}%{_initrddir}/pki-krad %{__rm} %{buildroot}%{_initrddir}/pki-ocspd %{__rm} %{buildroot}%{_initrddir}/pki-tksd +%{__rm} %{buildroot}%{_initrddir}/pki-tpsd %{__rm} -rf %{buildroot}%{_datadir}/pki/server/lib @@ -1089,6 +1131,27 @@ fi %config(noreplace) %{_sysconfdir}/tmpfiles.d/pki-tks.conf +%files -n pki-tps-tomcat +%defattr(-,root,root,-) +%doc base/tps/LICENSE +%dir %{_sysconfdir}/systemd/system/pki-tpsd.target.wants +%{_unitdir}/pki-tpsd@.service +%{_unitdir}/pki-tpsd.target +%{_javadir}/pki/pki-tps.jar +%dir %{_datadir}/pki/tps +%{_datadir}/pki/tps/conf/ +%{_datadir}/pki/tps/setup/ +%{_datadir}/pki/tps/webapps/ +%dir %{_localstatedir}/lock/pki/tps +%dir %{_localstatedir}/run/pki/tps +# Details: +# +# * https://fedoraproject.org/wiki/Features/var-run-tmpfs +# * https://fedoraproject.org/wiki/Tmpfiles.d_packaging_draft +# +%config(noreplace) %{_sysconfdir}/tmpfiles.d/pki-tps.conf + + %if %{?_without_javadoc:0}%{!?_without_javadoc:1} %files -n pki-javadoc %defattr(-,root,root,-) @@ -1097,6 +1160,9 @@ fi %changelog +* Wed Aug 14 2013 Endi S. Dewata 10.1.0-0.10 +- Moved Tomcat-based TPS into pki-core. + * Fri Aug 14 2013 Abhishek Koneru 10.1.0.0.9 - Listed new packages required during build, due to issues reported by pylint. diff --git a/specs/pki-tps.spec b/specs/pki-tps.spec index 4f26ebbc4..da7e9024f 100644 --- a/specs/pki-tps.spec +++ b/specs/pki-tps.spec @@ -1,6 +1,6 @@ Name: pki-tps Version: 10.1.0 -Release: 0.4%{?dist} +Release: 0.5%{?dist} Summary: Certificate System - Token Processing System URL: http://pki.fedoraproject.org/ License: LGPLv2 @@ -25,6 +25,7 @@ BuildRequires: svrcore-devel BuildRequires: zlib BuildRequires: zlib-devel +Conflicts: pki-tps-tomcat Requires: java >= 1:1.7.0 Requires: mod_nss Requires: mod_perl @@ -220,7 +221,6 @@ fi %{_bindir}/tpsclient %{_libdir}/httpd/modules/* %{_libdir}/tps/ -%{_javadir}/pki/pki-tps.jar %dir %{_datadir}/pki/tps %{_datadir}/pki/tps/applets/ %{_datadir}/pki/tps/cgi-bin/ @@ -230,7 +230,6 @@ fi %{_datadir}/pki/tps/samples/ %{_datadir}/pki/tps/scripts/ %{_datadir}/pki/tps/setup/ -%{_datadir}/pki/tps/webapps/ %dir %{_localstatedir}/lock/pki/tps %dir %{_localstatedir}/run/pki/tps # Details: @@ -242,6 +241,9 @@ fi %changelog +* Wed Aug 14 2013 Endi S. Dewata 10.1.0-0.5 +- Moved Tomcat-based TPS into pki-core. + * Thu Jul 11 2013 Ade Lee 10.1.0-0.4 - Add systemd build requirement to fix build failures in f19 -- cgit