From bb5d5b827bf326c2d931e2477977a90fdecf2405 Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Tue, 1 Sep 2015 09:57:42 -0400 Subject: [PATCH] Add ability to request cert from subca via REST Add the optional "ca" query parameter for REST cert request submission. Also update the ca-cert-request-submit CLI command with an option to provide an AuthorityID. --- .../src/com/netscape/cms/servlet/test/CATest.java | 4 ++-- .../dogtagpki/server/ca/rest/CertRequestService.java | 11 ++++++++++- .../src/com/netscape/certsrv/cert/CertClient.java | 7 +++++-- .../netscape/certsrv/cert/CertRequestResource.java | 4 +++- .../netscape/cmstools/cert/CertRequestSubmitCLI.java | 20 +++++++++++++++++++- .../cmstools/client/ClientCertRequestCLI.java | 2 +- 6 files changed, 40 insertions(+), 8 deletions(-) diff --git a/base/ca/functional/src/com/netscape/cms/servlet/test/CATest.java b/base/ca/functional/src/com/netscape/cms/servlet/test/CATest.java index 15023cad939abb11927abc64fe5916e04cb65661..5876c57f985caa38ad5895f4368113620370910d 100644 --- a/base/ca/functional/src/com/netscape/cms/servlet/test/CATest.java +++ b/base/ca/functional/src/com/netscape/cms/servlet/test/CATest.java @@ -288,7 +288,7 @@ public class CATest { private static void enrollAndApproveCertRequest(CertClient client, CertEnrollmentRequest data) { CertRequestInfos reqInfo = null; try { - reqInfo = client.enrollRequest(data); + reqInfo = client.enrollRequest(data, null); } catch (Exception e) { e.printStackTrace(); log(e.toString()); @@ -308,7 +308,7 @@ public class CATest { private static void enrollCertRequest(CertClient client, CertEnrollmentRequest data) { CertRequestInfos reqInfo = null; try { - reqInfo = client.enrollRequest(data); + reqInfo = client.enrollRequest(data, null); } catch (Exception e) { e.printStackTrace(); log(e.toString()); diff --git a/base/ca/src/org/dogtagpki/server/ca/rest/CertRequestService.java b/base/ca/src/org/dogtagpki/server/ca/rest/CertRequestService.java index 95f1f4c20086ddb45846f65b1db157bff238708a..654d814d8a963892a6b39a1f77745e1071a5408d 100644 --- a/base/ca/src/org/dogtagpki/server/ca/rest/CertRequestService.java +++ b/base/ca/src/org/dogtagpki/server/ca/rest/CertRequestService.java @@ -40,7 +40,9 @@ import com.netscape.certsrv.base.BadRequestDataException; import com.netscape.certsrv.base.BadRequestException; import com.netscape.certsrv.base.EBaseException; import com.netscape.certsrv.base.PKIException; +import com.netscape.certsrv.base.ResourceNotFoundException; import com.netscape.certsrv.base.UnauthorizedException; +import com.netscape.certsrv.ca.CANotFoundException; import com.netscape.certsrv.cert.CertEnrollmentRequest; import com.netscape.certsrv.cert.CertRequestInfo; import com.netscape.certsrv.cert.CertRequestInfos; @@ -113,7 +115,11 @@ public class CertRequestService extends PKIService implements CertRequestResourc } @Override - public Response enrollCert(CertEnrollmentRequest data) { + public Response enrollCert(CertEnrollmentRequest data, String aidString) { + // Ignore the aidString param; it is pulled out of the + // servletRequest that is passed to CertRequestDAO, + // but is included in the signature so that clients + // can easily provide it via @QueryParam if (data == null) { CMS.debug("enrollCert: data is null"); @@ -137,6 +143,9 @@ public class CertRequestService extends PKIService implements CertRequestResourc } catch (BadRequestDataException e) { CMS.debug("enrollCert: bad request data: " + e); throw new BadRequestException(e.toString()); + } catch (CANotFoundException e) { + CMS.debug("enrollCert: unknown CA: " + e); + throw new ResourceNotFoundException(e.toString()); } catch (EBaseException e) { throw new PKIException(e); } catch (Exception e) { diff --git a/base/common/src/com/netscape/certsrv/cert/CertClient.java b/base/common/src/com/netscape/certsrv/cert/CertClient.java index 42b04b7021f0063894c340c177915d799b621ddd..211711b3da64e5125beee000759c2f2926d85e86 100644 --- a/base/common/src/com/netscape/certsrv/cert/CertClient.java +++ b/base/common/src/com/netscape/certsrv/cert/CertClient.java @@ -21,6 +21,7 @@ import java.net.URISyntaxException; import javax.ws.rs.core.Response; +import com.netscape.certsrv.ca.AuthorityID; import com.netscape.certsrv.client.Client; import com.netscape.certsrv.client.PKIClient; import com.netscape.certsrv.client.SubsystemClient; @@ -85,8 +86,10 @@ public class CertClient extends Client { return client.getEntity(response, CertRequestInfo.class); } - public CertRequestInfos enrollRequest(CertEnrollmentRequest data) { - Response response = certRequestClient.enrollCert(data); + public CertRequestInfos enrollRequest( + CertEnrollmentRequest data, AuthorityID aid) { + String aidString = aid != null ? aid.toString() : null; + Response response = certRequestClient.enrollCert(data, aidString); return client.getEntity(response, CertRequestInfos.class); } diff --git a/base/common/src/com/netscape/certsrv/cert/CertRequestResource.java b/base/common/src/com/netscape/certsrv/cert/CertRequestResource.java index 7f08b4af392e3e56419abdad7cb66bd191688222..b877b681ccf905b4da2949fe04ec21e8a6407bba 100644 --- a/base/common/src/com/netscape/certsrv/cert/CertRequestResource.java +++ b/base/common/src/com/netscape/certsrv/cert/CertRequestResource.java @@ -37,7 +37,9 @@ public interface CertRequestResource { @POST @Path("certrequests") @ClientResponseType(entityType=CertRequestInfos.class) - public Response enrollCert(CertEnrollmentRequest data); + public Response enrollCert( + CertEnrollmentRequest data, + @QueryParam("authority") String caIDString); /** * Used to retrieve cert request info for a specific request diff --git a/base/java-tools/src/com/netscape/cmstools/cert/CertRequestSubmitCLI.java b/base/java-tools/src/com/netscape/cmstools/cert/CertRequestSubmitCLI.java index 608490bb73d7df482d87e67e9c15322ddc2e5f5a..e46079406bfbd1dbd47e32567b52dde85f181233 100644 --- a/base/java-tools/src/com/netscape/cmstools/cert/CertRequestSubmitCLI.java +++ b/base/java-tools/src/com/netscape/cmstools/cert/CertRequestSubmitCLI.java @@ -8,8 +8,10 @@ import java.util.Scanner; import javax.xml.bind.JAXBException; import org.apache.commons.cli.CommandLine; +import org.apache.commons.cli.Option; import org.apache.commons.cli.ParseException; +import com.netscape.certsrv.ca.AuthorityID; import com.netscape.certsrv.cert.CertEnrollmentRequest; import com.netscape.certsrv.cert.CertRequestInfos; import com.netscape.cmstools.cli.CLI; @@ -22,6 +24,10 @@ public class CertRequestSubmitCLI extends CLI { public CertRequestSubmitCLI(CertCLI certCLI) { super("request-submit", "Submit certificate request", certCLI); this.certCLI = certCLI; + + Option optCA = new Option(null, "authority", true, "Authority ID (omit for top-level CA)"); + optCA.setArgName("id"); + options.addOption(optCA); } public void printHelp() { @@ -55,9 +61,21 @@ public class CertRequestSubmitCLI extends CLI { System.exit(-1); } + AuthorityID aid = null; + if (cmd.hasOption("authority")) { + String aidString = cmd.getOptionValue("authority"); + try { + aid = new AuthorityID(aidString); + } catch (IllegalArgumentException e) { + System.err.println("Bad AuthorityID: " + aidString); + printHelp(); + System.exit(-1); + } + } + try { CertEnrollmentRequest erd = getEnrollmentRequest(cmdArgs[0]); - CertRequestInfos cri = certCLI.certClient.enrollRequest(erd); + CertRequestInfos cri = certCLI.certClient.enrollRequest(erd, aid); MainCLI.printMessage("Submitted certificate request"); CertCLI.printCertRequestInfos(cri); diff --git a/base/java-tools/src/com/netscape/cmstools/client/ClientCertRequestCLI.java b/base/java-tools/src/com/netscape/cmstools/client/ClientCertRequestCLI.java index e6bd0d98120295ef8e798925f4e9aceb3a0d43f6..13b8c632f9b6d3fce96fb07547852bdef552873d 100644 --- a/base/java-tools/src/com/netscape/cmstools/client/ClientCertRequestCLI.java +++ b/base/java-tools/src/com/netscape/cmstools/client/ClientCertRequestCLI.java @@ -283,7 +283,7 @@ public class ClientCertRequestCLI extends CLI { System.out.println("Sending certificate request."); } - CertRequestInfos infos = certClient.enrollRequest(request); + CertRequestInfos infos = certClient.enrollRequest(request, null); MainCLI.printMessage("Submitted certificate request"); CertCLI.printCertRequestInfos(infos); -- 2.4.3