April 2015 - Pki-devel - Dogtag PKI List Archives

[PATCH] 0010..0013 DNP3/IECUserRoles extension support
by Fraser Tweedale 23 Jun '15

23 Jun '15

Here is the first (rough) cut of IEC 62351-8 (IECUserRoles) extension support and a DNP3 profile that makes use of it. This is to meet (some of) the PKI needs for the "Smart Grid" DNP3 Secure Authentication v5 (SAv5) standard. In brief, the SN and all the IECUserRoles params will be given in profile inputs, and the key is taken from a CertReqInput. There's still a bit of work to go - notably, some of the IECUserRoles fields are unimplemented, and some of those that *are* implemented are not yet read out of the profile input but rather are hardcoded. The extension *does* appear on the certificate, so I should get that all completed tomorrow. Cheers, Fraser

2 6

remove RAEnrollProfile.java?
by Fraser Tweedale 16 Jun '15

16 Jun '15

The RAEnrollProfile class is not used or referenced anywhere in the codebase. I presume it was related to the RA, but even immediately before removal of the RA it did not seem to be used, so it seems safe to remove it. Comments? Fraser

2 2

[PATCH] 0031..0033 minor LDAPProfileSubsystem fixes
by Fraser Tweedale 08 May '15

08 May '15

These patches address the issues outlined in https://www.redhat.com/archives/pki-devel/2015-April/msg00028.html.

2 5

[PATCH] 0026 Add lightweight sub-CA support
by Fraser Tweedale 07 May '15

07 May '15

G'day, The first major patch for lightweight sub-CAs is attached for review. Some important features are not yet implemented in this patch: - Sub-CA creation - Caching of sub-CA instances - Signing key replication for clones - CRLs (the OCSP servlet works for sub-CAs, however) - Sub-CA support is possibly missing from some web servlets / templates. Let me know if you hit any. Because sub-CA creation is not implemented, if you want to test this patch you will need to: 1. Use the top-level CA to sign a sub-CA certificate and manually install it in the NSSDB with the nickname: "${TOPLEVEL_CA_NICKNAME} ${SUB_CA_HANDLE}" 2. Create the sub-CA certificate repository OU: "ou=${SUB_CA_HANDLE},ou=certificateRepository,ou=ca,o=pki-tomcat-CA" 3. When submitting requests or other queries via HTTP, edit the initial link target or form action to include the query parameter: "?caRef=${SUB_CA_HANDLE}" (Subsequent pages should not require this intervention.) I have also updated the design proposal with some refinements and details of the implementation so far: http://pki.fedoraproject.org/wiki/Lightweight_sub-CAs Looking forward to your feedback / bug reports! Fraser

1 1

[PATCH] pki-cfu-0055-Ticket-1295-CA-OCSP-via-GET-does-not-work.patch
by Christina Fu 06 May '15

06 May '15

This patch should address the issue reported in: https://fedorahosted.org/pki/ticket/1295 Please review. thanks, Christina

2 4

Fwd: Re: patches to fix pkispawn issues
by Matthew Harmsen 29 Apr '15

29 Apr '15

-------- Forwarded Message -------- Subject: Re: [Pki-devel] patches to fix pkispawn issues Date: Wed, 29 Apr 2015 15:26:48 -0600 From: Matthew Harmsen <mharmsen(a)redhat.com> To: alee(a)redhat.com On 04/29/15 13:34, Ade Lee wrote: > Attached revised patch to address issue found. > If the port is not found, we will now prompt. > > Ade > > On Wed, 2015-04-29 at 13:10 -0600, Matthew Harmsen wrote: >> On 04/29/15 11:58, Ade Lee wrote: >> >>> Please review attached patches: >>> >>> commit d33caa4c1302ecc1d2fc3c42d85544a2653dd09a >>> Author: Ade Lee<alee(a)redhat.com> >>> Date: Wed Apr 29 12:46:19 2015 -0400 >>> >>> Fix interactive install to not reprompt for ports >>> >>> Ports are already set when deploying into an existing instance. >>> Having a user re-enter these is repetitious and error prone. >>> >>> commit f0a5c5c79e9918c362f73103891e11f2f7dc6bbb >>> Author: Ade Lee<alee(a)redhat.com> >>> Date: Wed Apr 29 11:11:41 2015 -0400 >>> >>> Trac Ticket 1196 - serverCertNick.conf is replaced incorrectly >>> >>> When second subsystem is installed, serverCertNick.conf and other >>> top level >>> tomcat config files should not be replaced. >>> >>> commit b0317d50fd302086dd324f69d11647f655ddd9bd >>> Author: Ade Lee<alee(a)redhat.com> >>> Date: Wed Apr 29 10:57:09 2015 -0400 >>> >>> Code cleanup - simplify pkispawn code >>> >>> All subsystems are now tomcat instances. Conditionals based on >>> whether the subsystem is a tomcat instance or not are no longer >>> required. >>> >>> >>> >>> _______________________________________________ >>> Pki-devel mailing list >>> Pki-devel(a)redhat.com >>> https://www.redhat.com/mailman/listinfo/pki-devel >> NACK >> >> Unfortunately, as discussed on IRC, if non-interactive mode was >> utilized to originally setup your instance, and then further instances >> utilized interactive mode within that instance, reading directories >> under /etc/sysconfig/pki/tomcat/pki-tomcat may find a 'deployment.cfg' >> that only contains the file that was utilized to non-interactively >> install the original instance. This would return data to make >> existing_data true, but unfortunately would not contain the fields >> required. ACK CAVEAT: Will change line in set_port() from: * if existing_data[tag]: to: * if tag in existing_data:

1 0

patches to fix pkispawn issues
by Ade Lee 29 Apr '15

29 Apr '15

Please review attached patches: commit d33caa4c1302ecc1d2fc3c42d85544a2653dd09a Author: Ade Lee <alee(a)redhat.com> Date: Wed Apr 29 12:46:19 2015 -0400 Fix interactive install to not reprompt for ports Ports are already set when deploying into an existing instance. Having a user re-enter these is repetitious and error prone. commit f0a5c5c79e9918c362f73103891e11f2f7dc6bbb Author: Ade Lee <alee(a)redhat.com> Date: Wed Apr 29 11:11:41 2015 -0400 Trac Ticket 1196 - serverCertNick.conf is replaced incorrectly When second subsystem is installed, serverCertNick.conf and other top level tomcat config files should not be replaced. commit b0317d50fd302086dd324f69d11647f655ddd9bd Author: Ade Lee <alee(a)redhat.com> Date: Wed Apr 29 10:57:09 2015 -0400 Code cleanup - simplify pkispawn code All subsystems are now tomcat instances. Conditionals based on whether the subsystem is a tomcat instance or not are no longer required.

2 2

[PATCH] two more patches for nuxwdog
by Ade Lee 28 Apr '15

28 Apr '15

1. Patch 1 allows one to easily enable/disable nuxwdog for a particular instance. In this case, one would use: pki-server instance-nuxwdog-enable <instance> OR pki-server instance-nuxwdog-disable <instance> OR pki-server nuxwdog-enable/disable (for all instances on system) 2. Documentation will follow in subsequent patches ie. when the man page for pki-server is created. 3. Patch 2 just amends the pki java security policy to allow the instance to be started with nuxwdog and java security policy on. At this point, you still need selinux permissive, although I will be filing a BZ to add the required rules. Please review, Ade

2 3

Karma Request for Dogtag 10.2.3 in Fedora 22
by Matthew Harmsen 27 Apr '15

27 Apr '15

Everyone, Please provide Karma for the following Dogtag 10.2.3 packages for Fedora 22: * dogtag-pki-theme-10.2.3-1.fc22 <https://admin.fedoraproject.org/updates/dogtag-pki-theme-10.2.3-1.fc22> * pki-core-10.2.3-1.fc22 <https://admin.fedoraproject.org/updates/pki-core-10.2.3-1.fc22> * pki-console-10.2.3-1.fc22 <https://admin.fedoraproject.org/updates/pki-console-10.2.3-1.fc22> * dogtag-pki-10.2.3-1.fc22 <https://admin.fedoraproject.org/updates/dogtag-pki-10.2.3-1.fc22> Thanks, -- Matt

2 2

another patch to javadocs working on f23
by Ade Lee 24 Apr '15

24 Apr '15

This disables doclint test for Java 1.8 +

1 0