June 2016 - Pki-devel - Dogtag PKI List Archives

[pki-devel][PATCH] 0073-Separated-TPS-does-not-automatically-receive-shared-.patch
by John Magne 02 Jul '16

02 Jul '16

[PATCH] Separated TPS does not automatically receive shared secret from remote TKS. Support to allow the TPS to do the following: 1. Request that the TKS creates a shared secret with the proper ID, pointing to the TPS. 2. Have the TKS securely return the shared secret back to the TPS during the end of configuration. 3. The TPS then imports the wrapped shared secret into it's own internal NSS db permanenty and. 4. Given a name that is mapped to the TPS's id string. Additional fixes: 1. The TKS was modified to actually be able to use multiple shared secrets registered by multiple TPS instances. Caveat: At this point if the same remote TPS instance is created over and over again, the TPS's user in the TKS will accumulate "userCert" attributes, making the exportation of teh shared secret not functional. At this point we need to assume that the TPS user has ONE "userCert" registered at this time. Tested with a remote TPS talking to a shared TMS system consisting of a TPS, TKS, and KRA . The shared secret was imported successfully after manually deleting the user representing the TPS from previous installs. This way I was assured one cert stored for the user, since it had to be created fresh. Also tested that the TKS can work successfully with the new TPS AND the prior shared TPS on the original instance. The TKS can now host more than one shared secret in it's db and address the correct one when a given TPS makes a request of it. Please forgive some spurious changes that happened when formatting a couple of the files in question. Every legit change is related to the shared secret and can be found easily.

1 1

[pki-devel][PATCH] 0075-Generting-Symmetric-key-fails-with-key-generate-when.patch
by John Magne 01 Jul '16

01 Jul '16

Generting Symmetric key fails with key-generate when --usages verify is passed Ticket #1114 Minor adjustment to the man page for the key management commands to say which usages are appropriate for sym keys and those appropriate for asym keys.

2 2

[PATCH] 780 Fixed pki-server subsystem-cert-update.
by Endi Sukma Dewata 01 Jul '16

01 Jul '16

The pki-server subsystem-cert-update is supposed to restore the system certificate data and requests into CS.cfg. The command was broken since the CASubsystem class that contains the code to find the certificate requests from database was not loaded correctly. To fix the problem the CASubsystem class has been moved into the pki/server/__init__.py. All pki-server subsystem-* commands have been modified to check the validity of the instance. An option has been added to the pki-server subsystem-cert-show command to display the data and request of a particular system certificate. The redundant output of the pki-server subsystem-cert-update has been removed. The updated certificate data and request can be obtained using the pki-server subsystem-cert-show command. https://fedorahosted.org/pki/ticket/2385 -- Endi S. Dewata

2 2

[PATCH] 0124 Add profiles container to LDAP if missing
by Fraser Tweedale 01 Jul '16

01 Jul '16

The attached patch fixes https://fedorahosted.org/pki/ticket/2285. See commit message and bz1323400[1] for full history and details. [1] https://bugzilla.redhat.com/show_bug.cgi?id=1323400 The fix should be merged to master and DOGTAG_10_2_BRANCH, and a new 10.2.x release cut for f23. I have an f23 COPR build containing the fix for anyone wishing to test: https://copr.fedorainfracloud.org/coprs/ftweedal/freeipa/packages/ Huge props to Adam Williamson for doing a lot of legwork in tracking down the cause of this issue. Thanks, Fraser

2 2

[PATCH] 0125 AuthInfoAccess: use default OCSP URI if configured
by Fraser Tweedale 01 Jul '16

01 Jul '16

Attached patch fixes https://fedorahosted.org/pki/ticket/2387 (wanted for 10.3.4). Thanks, Fraser

2 2

[PATCH] 0126 Respond 400 if lightweight CA cert issuance fails
by Fraser Tweedale 01 Jul '16

01 Jul '16

The attached patch fixes https://fedorahosted.org/pki/ticket/2388. Wanted for 10.3.4. Thanks, Fraser

2 2

[PATCH] 0127 Fix build on Fedora 25
by Fraser Tweedale 01 Jul '16

01 Jul '16

The attached patch fixes build on Fedora 25 (JAX-RS API JAR had moved). It also removes a bunch of redundant find_file directives. This can probably be done for many other JARs but I've kept it to just the one for now. No urgency to get this in. Cheers, Fraser

2 2

[PATCH 0004] Updated notification message for kra-db-vlv-del command
by Abhijeet Kasurde 01 Jul '16

01 Jul '16

Hi All, Please review this patch, Partially fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1351295 -- Thanks, Abhijeet Kasurde IRC: akasurde http://akasurde.github.io

2 1

[pki-devel][PATCH 0003] Added condition for checking instance id in kra commands
by Abhijeet Kasurde 01 Jul '16

01 Jul '16

Hi All, Please review this patch. Partially fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1351295 -- Thanks, Abhijeet Kasurde IRC: akasurde http://akasurde.github.io

2 1

[pki-devel][PATCH 0002] Added fix for checking ldapmodify return code in db-schema-upgrade
by Abhijeet Kasurde 30 Jun '16

30 Jun '16

Hi All, Please review the patch. -- Thanks, Abhijeet Kasurde IRC: akasurde http://akasurde.github.io

2 1