From 25b5897f9bd02858906bd9b847a5552a5cca33fe Mon Sep 17 00:00:00 2001
From: Endi Sukma Dewata <edewata@redhat.com>
Date: Tue, 21 Aug 2012 17:38:29 -0500
Subject: [PATCH] Added proxy realm.

CMS engine is a singleton and it's used by PKI realm to authenticate
users accessing the subsystem. Since a Tomcat instance may contain
multiple subsystems, each having separate realm, the PKI JAR files
need to be moved into WEB-INF/lib so that they will run inside
separate class loaders. Note that Tomcat requires that the JAR files
be copied into this folder, they cannot be linked.

Tomcat also requires that the authenticator and realm classes be
available in common/lib. To address this a new package pki-tomcat.jar
has been added. The package contains the authenticator and a proxy
realm. When the subsystems start running, they will register their
own realms into the proxy realms such that the authentications will
be forwarded to the appropriate subsystems.

Ticket #89
---
 .../shared/webapps/ca/META-INF}/context.xml        |  19 +--
 base/common/shared/conf/context.xml                |   4 -
 base/common/src/CMakeLists.txt                     |  51 +++++++-
 .../netscape/cms/servlet/base/CMSStartServlet.java |   8 ++
 .../src/com/netscape/cms/tomcat/ProxyRealm.java    | 131 +++++++++++++++++++++
 .../tomcat}/SSLAuthenticatorWithFallback.java      |   2 +-
 base/deploy/src/scriptlets/instance_layout.py      |  14 +--
 base/deploy/src/scriptlets/pkiparser.py            |  83 ++++++-------
 base/deploy/src/scriptlets/war_explosion.py        |  20 +++-
 .../shared/webapps/kra/META-INF}/context.xml       |  19 +--
 .../shared/webapps/ocsp/META-INF}/context.xml      |  19 +--
 .../shared/webapps/tks/META-INF}/context.xml       |  19 +--
 specs/pki-core.spec                                |   7 +-
 13 files changed, 258 insertions(+), 138 deletions(-)
 copy base/{common/shared/conf => ca/shared/webapps/ca/META-INF}/context.xml (59%)
 create mode 100644 base/common/src/com/netscape/cms/tomcat/ProxyRealm.java
 rename base/common/src/com/netscape/{cmscore/realm => cms/tomcat}/SSLAuthenticatorWithFallback.java (99%)
 copy base/{common/shared/conf => kra/shared/webapps/kra/META-INF}/context.xml (59%)
 copy base/{common/shared/conf => ocsp/shared/webapps/ocsp/META-INF}/context.xml (59%)
 copy base/{common/shared/conf => tks/shared/webapps/tks/META-INF}/context.xml (59%)

diff --git a/base/common/shared/conf/context.xml b/base/ca/shared/webapps/ca/META-INF/context.xml
similarity index 59%
copy from base/common/shared/conf/context.xml
copy to base/ca/shared/webapps/ca/META-INF/context.xml
index b28f1bd20c82e3f0f720034af27f7979b136c02b..4186c0b89099945450895cde641a6c1b646b1543 100644
--- a/base/common/shared/conf/context.xml
+++ b/base/ca/shared/webapps/ca/META-INF/context.xml
@@ -22,25 +22,10 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<!-- The contents of this file will be loaded for each web application -->
 <Context>
 
-    <!-- Default set of monitored resources -->
-    <WatchedResource>WEB-INF/web.xml</WatchedResource>
+    <Valve className="com.netscape.cms.tomcat.SSLAuthenticatorWithFallback" />
 
-    <!-- Uncomment this to disable session persistence across Tomcat restarts -->
-    <!--
-    <Manager pathname="" />
-    -->
-
-    <!-- Uncomment this to enable Comet connection tacking (provides events
-         on session expiration as well as webapp lifecycle) -->
-    <!--
-    <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
-    -->
-
-    <Valve className="com.netscape.cmscore.realm.SSLAuthenticatorWithFallback" />
-
-    <Realm className="com.netscape.cmscore.realm.PKIRealm" />
+    <Realm className="com.netscape.cms.tomcat.ProxyRealm" />
 
 </Context>
diff --git a/base/common/shared/conf/context.xml b/base/common/shared/conf/context.xml
index b28f1bd20c82e3f0f720034af27f7979b136c02b..4b00dbe3caf7027d699ce3ed8ffee55fc3a2168b 100644
--- a/base/common/shared/conf/context.xml
+++ b/base/common/shared/conf/context.xml
@@ -39,8 +39,4 @@
     <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
     -->
 
-    <Valve className="com.netscape.cmscore.realm.SSLAuthenticatorWithFallback" />
-
-    <Realm className="com.netscape.cmscore.realm.PKIRealm" />
-
 </Context>
diff --git a/base/common/src/CMakeLists.txt b/base/common/src/CMakeLists.txt
index dc61b4ca762ab3d543f1b65a0959ac0ff29c92fe..f3702d4546723e653381fe9bc982445124a0b35f 100644
--- a/base/common/src/CMakeLists.txt
+++ b/base/common/src/CMakeLists.txt
@@ -171,6 +171,8 @@ set(PKI_CERTSRV_JAR ${CMAKE_BINARY_DIR}/dist/pki-certsrv.jar CACHE INTERNAL "pki
 javac(pki-cms-classes
     SOURCES
         com/netscape/cms/*.java
+    EXCLUDE
+        com/netscape/cms/tomcat/*.java
     CLASSPATH
         ${PKI_NSUTIL_JAR} ${PKI_CMSUTIL_JAR}
         ${LDAPJDK_JAR} ${SERVLET_JAR} ${VELOCITY_JAR} ${XALAN_JAR} ${XERCES_JAR}
@@ -192,6 +194,8 @@ jar(pki-cms-jar
         ${CMAKE_BINARY_DIR}/classes
     FILES
         com/netscape/cms/*.class
+    EXCLUDE
+        com/netscape/cms/tomcat/*.class
     DEPENDS
         pki-cms-classes
 )
@@ -249,12 +253,55 @@ if(WITH_JAVADOC)
 endif(WITH_JAVADOC)
 
 
+# build pki-tomcat
+javac(pki-tomcat-classes
+    SOURCES
+        com/netscape/cms/tomcat/*.java
+    CLASSPATH
+        ${SERVLET_JAR} ${TOMCAT_CATALINA_JAR}
+    OUTPUT_DIR
+        ${CMAKE_BINARY_DIR}/classes
+    DEPENDS
+        pki-cms
+)
+
+jar(pki-tomcat-jar
+    CREATE
+        ${CMAKE_BINARY_DIR}/dist/pki-tomcat-${APPLICATION_VERSION}.jar
+    INPUT_DIR
+        ${CMAKE_BINARY_DIR}/classes
+    FILES
+        com/netscape/cms/tomcat/*.class
+    DEPENDS
+        pki-tomcat-classes
+)
+
+link(pki-tomcat
+    SOURCE
+        ${CMAKE_BINARY_DIR}/dist/pki-tomcat.jar
+    DEST
+        pki-tomcat-${APPLICATION_VERSION}.jar
+    DEPENDS
+        pki-tomcat-jar
+)
+
+install(
+    FILES
+        ${CMAKE_BINARY_DIR}/dist/pki-tomcat.jar
+        ${CMAKE_BINARY_DIR}/dist/pki-tomcat-${APPLICATION_VERSION}.jar
+    DESTINATION
+        ${JAVA_JAR_INSTALL_DIR}/pki
+)
+
+set(PKI_TOMCAT_JAR ${CMAKE_BINARY_DIR}/dist/pki-tomcat.jar CACHE INTERNAL "pki-tomcat jar file")
+
+
 # build pki-cmscore
 javac(pki-cmscore-classes
     SOURCES
         com/netscape/cmscore/*.java
     CLASSPATH
-        ${PKI_NSUTIL_JAR} ${PKI_CMSUTIL_JAR}
+        ${PKI_NSUTIL_JAR} ${PKI_CMSUTIL_JAR} ${PKI_TOMCAT_JAR}
         ${LDAPJDK_JAR} ${SERVLET_JAR} ${VELOCITY_JAR} ${XALAN_JAR} ${XERCES_JAR}
         ${JSS_JAR} ${COMMONS_CODEC_JAR} ${COMMONS_HTTPCLIENT_JAR}
         ${APACHE_COMMONS_LANG_JAR}
@@ -264,7 +311,7 @@ javac(pki-cmscore-classes
     OUTPUT_DIR
         ${CMAKE_BINARY_DIR}/classes
     DEPENDS
-        pki-nsutil pki-cmsutil pki-certsrv pki-cms
+        pki-nsutil pki-cmsutil pki-certsrv pki-cms pki-tomcat
 )
 
 jar(pki-cmscore-jar
diff --git a/base/common/src/com/netscape/cms/servlet/base/CMSStartServlet.java b/base/common/src/com/netscape/cms/servlet/base/CMSStartServlet.java
index a8a4008b78cd3ec0e6561db453a5858ef741e906..e00f2bdba2417d889276b22049f779ecd572fb9d 100644
--- a/base/common/src/com/netscape/cms/servlet/base/CMSStartServlet.java
+++ b/base/common/src/com/netscape/cms/servlet/base/CMSStartServlet.java
@@ -29,6 +29,8 @@ import javax.servlet.http.HttpServletResponse;
 
 import com.netscape.certsrv.apps.CMS;
 import com.netscape.certsrv.base.EBaseException;
+import com.netscape.cms.tomcat.ProxyRealm;
+import com.netscape.cmscore.realm.PKIRealm;
 import com.netscape.cmsutil.util.Utils;
 
 /**
@@ -89,10 +91,16 @@ public class CMSStartServlet extends HttpServlet {
                 }
             }
         }
+
         try {
             CMS.start(path);
         } catch (EBaseException e) {
         }
+
+        // Register realm for this subsystem
+        String context = getServletContext().getContextPath();
+        if (context.startsWith("/")) context = context.substring(1);
+        ProxyRealm.registerRealm(context, new PKIRealm());
     }
 
     public void doGet(HttpServletRequest req, HttpServletResponse res)
diff --git a/base/common/src/com/netscape/cms/tomcat/ProxyRealm.java b/base/common/src/com/netscape/cms/tomcat/ProxyRealm.java
new file mode 100644
index 0000000000000000000000000000000000000000..472081025183416a96e1a634d847b0b28cc08b46
--- /dev/null
+++ b/base/common/src/com/netscape/cms/tomcat/ProxyRealm.java
@@ -0,0 +1,131 @@
+package com.netscape.cms.tomcat;
+
+import java.beans.PropertyChangeListener;
+import java.io.IOException;
+import java.security.Principal;
+import java.security.cert.X509Certificate;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.catalina.Container;
+import org.apache.catalina.Context;
+import org.apache.catalina.Realm;
+import org.apache.catalina.Wrapper;
+import org.apache.catalina.connector.Request;
+import org.apache.catalina.connector.Response;
+import org.apache.catalina.deploy.SecurityConstraint;
+import org.ietf.jgss.GSSContext;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class ProxyRealm implements Realm {
+
+    public static Map<String, ProxyRealm> proxies = new HashMap<String, ProxyRealm>();
+
+    public Container container;
+    public Realm realm;
+
+    public ProxyRealm() {
+    }
+
+    @Override
+    public Container getContainer() {
+        return container;
+    }
+
+    @Override
+    public void setContainer(Container container) {
+        this.container = container;
+        if (container instanceof Context) {
+            Context context = (Context)container;
+            proxies.put(context.getBaseName(), this);
+        }
+    }
+
+    public static void registerRealm(String contextName, Realm realm) {
+        ProxyRealm proxy = proxies.get(contextName);
+        if (proxy == null) return;
+
+        proxy.realm = realm;
+        realm.setContainer(proxy.container);
+    }
+
+    @Override
+    public Principal authenticate(String username, String password) {
+        return realm.authenticate(username, password);
+    }
+
+    @Override
+    public Principal authenticate(X509Certificate certs[]) {
+        return realm.authenticate(certs);
+    }
+
+    @Override
+    public Principal authenticate(
+            String username,
+            String digest,
+            String nonce,
+            String nc,
+            String cnonce,
+            String qop,
+            String realmName,
+            String md5a2
+    ) {
+        return realm.authenticate(username, digest, nonce, nc, cnonce, qop, realmName, md5a2);
+    }
+
+    @Override
+    public Principal authenticate(GSSContext gssContext, boolean storeCreds) {
+        return realm.authenticate(gssContext, storeCreds);
+    }
+
+    @Override
+    public boolean hasResourcePermission(
+            Request request,
+            Response response,
+            SecurityConstraint[] constraints,
+            Context context
+    ) throws IOException {
+        return realm.hasResourcePermission(request, response, constraints, context);
+    }
+
+    @Override
+    public String getInfo() {
+        return realm.getInfo();
+    }
+
+    @Override
+    public void backgroundProcess() {
+        realm.backgroundProcess();
+    }
+
+    @Override
+    public SecurityConstraint[] findSecurityConstraints(Request request, Context context) {
+        return realm.findSecurityConstraints(request, context);
+    }
+
+    @Override
+    public boolean hasRole(Wrapper wrapper, Principal principal, String role) {
+        return realm.hasRole(wrapper, principal, role);
+    }
+
+    @Override
+    public boolean hasUserDataPermission(
+            Request request,
+            Response response,
+            SecurityConstraint[] constraint
+    ) throws IOException {
+        return realm.hasUserDataPermission(request,  response, constraint);
+    }
+
+    @Override
+    public void addPropertyChangeListener(PropertyChangeListener listener) {
+        realm.addPropertyChangeListener(listener);
+    }
+
+    @Override
+    public void removePropertyChangeListener(PropertyChangeListener listener) {
+        realm.removePropertyChangeListener(listener);
+    }
+}
diff --git a/base/common/src/com/netscape/cmscore/realm/SSLAuthenticatorWithFallback.java b/base/common/src/com/netscape/cms/tomcat/SSLAuthenticatorWithFallback.java
similarity index 99%
rename from base/common/src/com/netscape/cmscore/realm/SSLAuthenticatorWithFallback.java
rename to base/common/src/com/netscape/cms/tomcat/SSLAuthenticatorWithFallback.java
index 6b6af78a7306d97d2d69b5504f806922cdc40365..d1b3dc3f27e2f218a31cf2a519973879e635419c 100644
--- a/base/common/src/com/netscape/cmscore/realm/SSLAuthenticatorWithFallback.java
+++ b/base/common/src/com/netscape/cms/tomcat/SSLAuthenticatorWithFallback.java
@@ -16,7 +16,7 @@
 // All rights reserved.
 // --- END COPYRIGHT BLOCK ---
 
-package com.netscape.cmscore.realm;
+package com.netscape.cms.tomcat;
 
 import java.io.IOException;
 import java.security.cert.X509Certificate;
diff --git a/base/deploy/src/scriptlets/instance_layout.py b/base/deploy/src/scriptlets/instance_layout.py
index d29b2d2d2207940b59722edd472b462b61ca13f0..8fd0396bc519cde25583a7be7e8e4ae57e22b632 100644
--- a/base/deploy/src/scriptlets/instance_layout.py
+++ b/base/deploy/src/scriptlets/instance_layout.py
@@ -97,18 +97,8 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
                 master['pki_jss_jar_link'])
             util.symlink.create(master['pki_ldapjdk_jar'],
                 master['pki_ldapjdk_jar_link'])
-            util.symlink.create(master['pki_certsrv_jar'],
-                master['pki_certsrv_jar_link'])
-            util.symlink.create(master['pki_cmsbundle'],
-                master['pki_cmsbundle_jar_link'])
-            util.symlink.create(master['pki_cmscore'],
-                master['pki_cmscore_jar_link'])
-            util.symlink.create(master['pki_cms'],
-                master['pki_cms_jar_link'])
-            util.symlink.create(master['pki_cmsutil'],
-                master['pki_cmsutil_jar_link'])
-            util.symlink.create(master['pki_nsutil'],
-                master['pki_nsutil_jar_link'])
+            util.symlink.create(master['pki_tomcat_jar'],
+                master['pki_tomcat_jar_link'])
             util.symlink.create(master['pki_resteasy_atom_provider_jar'],
                 master['pki_resteasy_atom_provider_jar_link'])
             util.symlink.create(master['pki_resteasy_jaxb_provider_jar'],
diff --git a/base/deploy/src/scriptlets/pkiparser.py b/base/deploy/src/scriptlets/pkiparser.py
index 1fe74e835c05c180cbb6f98a39d89815cfc69d1a..e0e708e76c5c937eba573e893a79a05e9369452b 100644
--- a/base/deploy/src/scriptlets/pkiparser.py
+++ b/base/deploy/src/scriptlets/pkiparser.py
@@ -696,6 +696,9 @@ def compose_pki_master_dictionary():
             config.pki_master_dict['pki_nsutil'] =\
                 os.path.join(config.PKI_DEPLOYMENT_PKI_JAR_SOURCE_ROOT,
                              "pki-nsutil.jar")
+            config.pki_master_dict['pki_tomcat_jar'] =\
+                os.path.join(config.PKI_DEPLOYMENT_PKI_JAR_SOURCE_ROOT,
+                             "pki-tomcat.jar")
             config.pki_master_dict['pki_resteasy_atom_provider_jar'] =\
                 os.path.join(config.PKI_DEPLOYMENT_RESTEASY_JAR_SOURCE_ROOT,
                              "resteasy-atom-provider.jar")
@@ -775,30 +778,10 @@ def compose_pki_master_dictionary():
                 os.path.join(
                     config.pki_master_dict['pki_tomcat_common_lib_path'],
                     "ldapjdk.jar")
-            config.pki_master_dict['pki_certsrv_jar_link'] =\
+            config.pki_master_dict['pki_tomcat_jar_link'] =\
                 os.path.join(
                     config.pki_master_dict['pki_tomcat_common_lib_path'],
-                    "pki-certsrv.jar")
-            config.pki_master_dict['pki_cmsbundle_jar_link'] =\
-                os.path.join(
-                    config.pki_master_dict['pki_tomcat_common_lib_path'],
-                    "pki-cmsbundle.jar")
-            config.pki_master_dict['pki_cmscore_jar_link'] =\
-                os.path.join(
-                    config.pki_master_dict['pki_tomcat_common_lib_path'],
-                    "pki-cmscore.jar")
-            config.pki_master_dict['pki_cms_jar_link'] =\
-                os.path.join(
-                    config.pki_master_dict['pki_tomcat_common_lib_path'],
-                    "pki-cms.jar")
-            config.pki_master_dict['pki_cmsutil_jar_link'] =\
-                os.path.join(
-                    config.pki_master_dict['pki_tomcat_common_lib_path'],
-                    "pki-cmsutil.jar")
-            config.pki_master_dict['pki_nsutil_jar_link'] =\
-                os.path.join(
-                    config.pki_master_dict['pki_tomcat_common_lib_path'],
-                    "pki-nsutil.jar")
+                    "pki-tomcat.jar")
             config.pki_master_dict['pki_resteasy_atom_provider_jar_link'] =\
                 os.path.join(
                     config.pki_master_dict['pki_tomcat_common_lib_path'],
@@ -938,58 +921,66 @@ def compose_pki_master_dictionary():
                     config.pki_master_dict['pki_tomcat_webapps_subsystem_path'],
                     "WEB-INF",
                     "lib")
+            config.pki_master_dict['pki_certsrv_jar_link'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_tomcat_webapps_subsystem_webinf_lib_path'],
+                    "pki-certsrv.jar")
+            config.pki_master_dict['pki_cmsbundle_jar_link'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_tomcat_webapps_subsystem_webinf_lib_path'],
+                    "pki-cmsbundle.jar")
+            config.pki_master_dict['pki_cmscore_jar_link'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_tomcat_webapps_subsystem_webinf_lib_path'],
+                    "pki-cmscore.jar")
+            config.pki_master_dict['pki_cms_jar_link'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_tomcat_webapps_subsystem_webinf_lib_path'],
+                    "pki-cms.jar")
+            config.pki_master_dict['pki_cmsutil_jar_link'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_tomcat_webapps_subsystem_webinf_lib_path'],
+                    "pki-cmsutil.jar")
+            config.pki_master_dict['pki_nsutil_jar_link'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_tomcat_webapps_subsystem_webinf_lib_path'],
+                    "pki-nsutil.jar")
             # Tomcat PKI subsystem war file convenience symbolic links
             if config.pki_master_dict['pki_subsystem'] == "CA":
                 config.pki_master_dict['pki_ca_jar'] =\
                     os.path.join(config.PKI_DEPLOYMENT_PKI_JAR_SOURCE_ROOT,
                                  "pki-ca.jar")
-                # config.pki_master_dict['pki_ca_jar_link'] =\
-                #     os.path.join(
-                #         config.pki_master_dict\
-                #         ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
-                #         "pki-ca.jar")
                 config.pki_master_dict['pki_ca_jar_link'] =\
                     os.path.join(
-                        config.pki_master_dict['pki_tomcat_common_lib_path'],
+                        config.pki_master_dict\
+                        ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
                         "pki-ca.jar")
             elif config.pki_master_dict['pki_subsystem'] == "KRA":
                 config.pki_master_dict['pki_kra_jar'] =\
                     os.path.join(config.PKI_DEPLOYMENT_PKI_JAR_SOURCE_ROOT,
                                  "pki-kra.jar")
-                # config.pki_master_dict['pki_kra_jar_link'] =\
-                #     os.path.join(
-                #         config.pki_master_dict\
-                #         ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
-                #         "pki-kra.jar")
                 config.pki_master_dict['pki_kra_jar_link'] =\
                     os.path.join(
-                        config.pki_master_dict['pki_tomcat_common_lib_path'],
+                        config.pki_master_dict\
+                        ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
                         "pki-kra.jar")
             elif config.pki_master_dict['pki_subsystem'] == "OCSP":
                 config.pki_master_dict['pki_ocsp_jar'] =\
                     os.path.join(config.PKI_DEPLOYMENT_PKI_JAR_SOURCE_ROOT,
                                  "pki-ocsp.jar")
-                # config.pki_master_dict['pki_ocsp_jar_link'] =\
-                #     os.path.join(
-                #         config.pki_master_dict\
-                #         ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
-                #         "pki-ocsp.jar")
                 config.pki_master_dict['pki_ocsp_jar_link'] =\
                     os.path.join(
-                        config.pki_master_dict['pki_tomcat_common_lib_path'],
+                        config.pki_master_dict\
+                        ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
                         "pki-ocsp.jar")
             elif config.pki_master_dict['pki_subsystem'] == "TKS":
                 config.pki_master_dict['pki_tks_jar'] =\
                     os.path.join(config.PKI_DEPLOYMENT_PKI_JAR_SOURCE_ROOT,
                                  "pki-tks.jar")
-                # config.pki_master_dict['pki_tks_jar_link'] =\
-                #     os.path.join(
-                #         config.pki_master_dict\
-                #         ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
-                #         "pki-tks.jar")
                 config.pki_master_dict['pki_tks_jar_link'] =\
                     os.path.join(
-                        config.pki_master_dict['pki_tomcat_common_lib_path'],
+                        config.pki_master_dict\
+                        ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
                         "pki-tks.jar")
         # PKI Target (slot substitution) name/value pairs
         config.pki_master_dict['pki_target_cs_cfg'] =\
diff --git a/base/deploy/src/scriptlets/war_explosion.py b/base/deploy/src/scriptlets/war_explosion.py
index 16113ba7d72139b3b10145726f8d76111c3d2436..556af08a6b43381ad687641ec7fb87b9f5b8b860 100644
--- a/base/deploy/src/scriptlets/war_explosion.py
+++ b/base/deploy/src/scriptlets/war_explosion.py
@@ -44,17 +44,29 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
             util.directory.create(
                 master['pki_tomcat_webapps_subsystem_webinf_lib_path'])
             # establish Tomcat webapps subsystem WEB-INF lib symbolic links
+            util.file.copy(master['pki_certsrv_jar'],
+                master['pki_certsrv_jar_link'])
+            util.file.copy(master['pki_cmsbundle'],
+                master['pki_cmsbundle_jar_link'])
+            util.file.copy(master['pki_cmscore'],
+                master['pki_cmscore_jar_link'])
+            util.file.copy(master['pki_cms'],
+                master['pki_cms_jar_link'])
+            util.file.copy(master['pki_cmsutil'],
+                master['pki_cmsutil_jar_link'])
+            util.file.copy(master['pki_nsutil'],
+                master['pki_nsutil_jar_link'])
             if master['pki_subsystem'] == "CA":
-                util.symlink.create(master['pki_ca_jar'],
+                util.file.copy(master['pki_ca_jar'],
                                     master['pki_ca_jar_link'])
             elif master['pki_subsystem'] == "KRA":
-                util.symlink.create(master['pki_kra_jar'],
+                util.file.copy(master['pki_kra_jar'],
                                     master['pki_kra_jar_link'])
             elif master['pki_subsystem'] == "OCSP":
-                util.symlink.create(master['pki_ocsp_jar'],
+                util.file.copy(master['pki_ocsp_jar'],
                                     master['pki_ocsp_jar_link'])
             elif master['pki_subsystem'] == "TKS":
-                util.symlink.create(master['pki_tks_jar'],
+                util.file.copy(master['pki_tks_jar'],
                                     master['pki_tks_jar_link'])
             # set ownerships, permissions, and acls
             util.directory.set_mode(master['pki_tomcat_webapps_subsystem_path'])
diff --git a/base/common/shared/conf/context.xml b/base/kra/shared/webapps/kra/META-INF/context.xml
similarity index 59%
copy from base/common/shared/conf/context.xml
copy to base/kra/shared/webapps/kra/META-INF/context.xml
index b28f1bd20c82e3f0f720034af27f7979b136c02b..4186c0b89099945450895cde641a6c1b646b1543 100644
--- a/base/common/shared/conf/context.xml
+++ b/base/kra/shared/webapps/kra/META-INF/context.xml
@@ -22,25 +22,10 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<!-- The contents of this file will be loaded for each web application -->
 <Context>
 
-    <!-- Default set of monitored resources -->
-    <WatchedResource>WEB-INF/web.xml</WatchedResource>
+    <Valve className="com.netscape.cms.tomcat.SSLAuthenticatorWithFallback" />
 
-    <!-- Uncomment this to disable session persistence across Tomcat restarts -->
-    <!--
-    <Manager pathname="" />
-    -->
-
-    <!-- Uncomment this to enable Comet connection tacking (provides events
-         on session expiration as well as webapp lifecycle) -->
-    <!--
-    <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
-    -->
-
-    <Valve className="com.netscape.cmscore.realm.SSLAuthenticatorWithFallback" />
-
-    <Realm className="com.netscape.cmscore.realm.PKIRealm" />
+    <Realm className="com.netscape.cms.tomcat.ProxyRealm" />
 
 </Context>
diff --git a/base/common/shared/conf/context.xml b/base/ocsp/shared/webapps/ocsp/META-INF/context.xml
similarity index 59%
copy from base/common/shared/conf/context.xml
copy to base/ocsp/shared/webapps/ocsp/META-INF/context.xml
index b28f1bd20c82e3f0f720034af27f7979b136c02b..4186c0b89099945450895cde641a6c1b646b1543 100644
--- a/base/common/shared/conf/context.xml
+++ b/base/ocsp/shared/webapps/ocsp/META-INF/context.xml
@@ -22,25 +22,10 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<!-- The contents of this file will be loaded for each web application -->
 <Context>
 
-    <!-- Default set of monitored resources -->
-    <WatchedResource>WEB-INF/web.xml</WatchedResource>
+    <Valve className="com.netscape.cms.tomcat.SSLAuthenticatorWithFallback" />
 
-    <!-- Uncomment this to disable session persistence across Tomcat restarts -->
-    <!--
-    <Manager pathname="" />
-    -->
-
-    <!-- Uncomment this to enable Comet connection tacking (provides events
-         on session expiration as well as webapp lifecycle) -->
-    <!--
-    <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
-    -->
-
-    <Valve className="com.netscape.cmscore.realm.SSLAuthenticatorWithFallback" />
-
-    <Realm className="com.netscape.cmscore.realm.PKIRealm" />
+    <Realm className="com.netscape.cms.tomcat.ProxyRealm" />
 
 </Context>
diff --git a/base/common/shared/conf/context.xml b/base/tks/shared/webapps/tks/META-INF/context.xml
similarity index 59%
copy from base/common/shared/conf/context.xml
copy to base/tks/shared/webapps/tks/META-INF/context.xml
index b28f1bd20c82e3f0f720034af27f7979b136c02b..4186c0b89099945450895cde641a6c1b646b1543 100644
--- a/base/common/shared/conf/context.xml
+++ b/base/tks/shared/webapps/tks/META-INF/context.xml
@@ -22,25 +22,10 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<!-- The contents of this file will be loaded for each web application -->
 <Context>
 
-    <!-- Default set of monitored resources -->
-    <WatchedResource>WEB-INF/web.xml</WatchedResource>
+    <Valve className="com.netscape.cms.tomcat.SSLAuthenticatorWithFallback" />
 
-    <!-- Uncomment this to disable session persistence across Tomcat restarts -->
-    <!--
-    <Manager pathname="" />
-    -->
-
-    <!-- Uncomment this to enable Comet connection tacking (provides events
-         on session expiration as well as webapp lifecycle) -->
-    <!--
-    <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
-    -->
-
-    <Valve className="com.netscape.cmscore.realm.SSLAuthenticatorWithFallback" />
-
-    <Realm className="com.netscape.cmscore.realm.PKIRealm" />
+    <Realm className="com.netscape.cms.tomcat.ProxyRealm" />
 
 </Context>
diff --git a/specs/pki-core.spec b/specs/pki-core.spec
index 35a9f2facf3392ca7914575a5e17dca2732f6492..9a02769ef33ae950a996d5eaf0689cb845ae262b 100644
--- a/specs/pki-core.spec
+++ b/specs/pki-core.spec
@@ -14,7 +14,7 @@ distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
 
 Name:             pki-core
 Version:          10.0.0
-Release:          %{?relprefix}27%{?prerel}%{?dist}
+Release:          %{?relprefix}28%{?prerel}%{?dist}
 Summary:          Certificate System - PKI Core Components
 URL:              http://pki.fedoraproject.org/
 License:          GPLv2
@@ -1205,6 +1205,8 @@ fi
 %{_javadir}/pki/pki-cmsbundle.jar
 %{_javadir}/pki/pki-cmscore-%{version}.jar
 %{_javadir}/pki/pki-cmscore.jar
+%{_javadir}/pki/pki-tomcat-%{version}.jar
+%{_javadir}/pki/pki-tomcat.jar
 %dir %{_localstatedir}/lock/pki/tomcat
 %dir %{_localstatedir}/run/pki/tomcat
 
@@ -1357,6 +1359,9 @@ fi
 
 
 %changelog
+* Wed Aug 22 2012 Endi S. Dewata <edewata@redhat.com> 10.0.0-0.28.a1
+- Added pki-tomcat.jar.
+
 * Tue Aug 21 2012 Endi S. Dewata <edewata@redhat.com> 10.0.0-0.27.a1
 - Moved WAR creation code into CMake scripts.
 
-- 
1.7.11.2

