>From 675d4499b41932e7a1af20f937212d944cf4bd90 Mon Sep 17 00:00:00 2001
From: Abhishek Koneru <akoneru@redhat.com>
Date: Wed, 9 Apr 2014 13:59:26 -0400
Subject: [PATCH] Fixes for comments on patches 87 and 89

---
 base/common/CMakeLists.txt                         | 11 +++
 base/common/kra/templates/key-archive.xml          | 15 ++++
 base/common/kra/templates/key-generate.xml         | 10 +++
 base/common/kra/templates/key-retrieve.xml         | 13 +++
 base/common/src/com/netscape/certsrv/key/Key.java  | 13 +++
 .../src/com/netscape/certsrv/key/KeyClient.java    | 30 ++++++-
 .../src/com/netscape/certsrv/key/KeyTemplate.java  | 22 +++++
 .../certsrv/key/SymKeyGenerationRequest.java       | 12 +++
 .../src/com/netscape/certsrv/key/Template.java     | 21 -----
 .../com/netscape/cmstools/key/KeyArchiveCLI.java   |  6 +-
 .../src/com/netscape/cmstools/key/KeyCLI.java      |  6 +-
 .../com/netscape/cmstools/key/KeyGenerateCLI.java  | 28 ++-----
 .../com/netscape/cmstools/key/KeyModifyCLI.java    |  9 +-
 .../com/netscape/cmstools/key/KeyRecoverCLI.java   | 12 +--
 .../netscape/cmstools/key/KeyRequestReviewCLI.java |  4 +-
 .../netscape/cmstools/key/KeyRequestShowCLI.java   |  2 +-
 .../com/netscape/cmstools/key/KeyRetrieveCLI.java  | 51 ++++++++++--
 .../src/com/netscape/cmstools/key/KeyShowCLI.java  |  2 +-
 ...emplateFindCLI.java => KeyTemplateFindCLI.java} | 16 ++--
 ...emplateShowCLI.java => KeyTemplateShowCLI.java} | 97 +++++++++-------------
 .../src/com/netscape/cms/servlet/test/DRMTest.java |  6 +-
 specs/pki-core.spec                                |  7 +-
 22 files changed, 244 insertions(+), 149 deletions(-)
 create mode 100644 base/common/kra/templates/key-archive.xml
 create mode 100644 base/common/kra/templates/key-generate.xml
 create mode 100644 base/common/kra/templates/key-retrieve.xml
 create mode 100644 base/common/src/com/netscape/certsrv/key/KeyTemplate.java
 delete mode 100644 base/common/src/com/netscape/certsrv/key/Template.java
 rename base/java-tools/src/com/netscape/cmstools/key/{KeyRequestTemplateFindCLI.java => KeyTemplateFindCLI.java} (65%)
 rename base/java-tools/src/com/netscape/cmstools/key/{KeyRequestTemplateShowCLI.java => KeyTemplateShowCLI.java} (53%)

diff --git a/base/common/CMakeLists.txt b/base/common/CMakeLists.txt
index 1094be0c535b527061e4beefa8b0fbd8efe8a31f..f9b4e3c6bcd72f9f4ff11224d36aed591af7353a 100644
--- a/base/common/CMakeLists.txt
+++ b/base/common/CMakeLists.txt
@@ -57,6 +57,17 @@ install(
     PATTERN ".gitignore" EXCLUDE
 )
 
+install(
+    DIRECTORY
+        kra
+    DESTINATION
+        ${DATA_INSTALL_DIR}/
+    FILE_PERMISSIONS
+        OWNER_READ
+        GROUP_READ
+        WORLD_READ
+)
+
 # install empty directories
 install(
     DIRECTORY
diff --git a/base/common/kra/templates/key-archive.xml b/base/common/kra/templates/key-archive.xml
new file mode 100644
index 0000000000000000000000000000000000000000..a698d59e122df5881cfb5590f721b4ba51da043f
--- /dev/null
+++ b/base/common/kra/templates/key-archive.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<KeyArchivalRequest>
+    <Attributes>
+        <Attribute name="clientKeyID"></Attribute>
+        <Attribute name="dataType">symmetricKey/passphrase/asymmetricKey</Attribute>
+        <Attribute name="keyAlgorithm"></Attribute>
+        <Attribute name="keySize">0</Attribute>
+        <Attribute name="algorithmOID"></Attribute>
+        <Attribute name="symmetricAlgorithmParams">Base64 encoded NonceData</Attribute>
+        <Attribute name="wrappedPrivateData">Base64 encoded session key wrapped secret</Attribute>
+        <Attribute name="transWrappedSessionKey">Base64 encoded transport key wrapped session key</Attribute>
+        <Attribute name="pkiArchiveOptions">Base 64 encoded PKIArchiveOptions object</Attribute>
+    </Attributes>
+    <ClassName>com.netscape.certsrv.key.KeyArchivalRequest</ClassName>
+</KeyArchivalRequest>
diff --git a/base/common/kra/templates/key-generate.xml b/base/common/kra/templates/key-generate.xml
new file mode 100644
index 0000000000000000000000000000000000000000..ef1df4113fda23a53812b3511947d6b95039e40d
--- /dev/null
+++ b/base/common/kra/templates/key-generate.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<SymKeyGenerationRequest>
+    <Attributes>
+        <Attribute name="clientKeyID"></Attribute>
+        <Attribute name="keyAlgorithm">[AES/DES/DES3/DESede/RC2/RC4]</Attribute>
+        <Attribute name="keySize">128</Attribute>
+        <Attribute name="keyUsage">wrap,unwrap,sign,verify,encrypt,decrypt</Attribute>
+    </Attributes>
+    <ClassName>com.netscape.certsrv.key.SymKeyGenerationRequest</ClassName>
+</SymKeyGenerationRequest>
diff --git a/base/common/kra/templates/key-retrieve.xml b/base/common/kra/templates/key-retrieve.xml
new file mode 100644
index 0000000000000000000000000000000000000000..b3bb75b5810898738f06be8c3b00ecc05970dcef
--- /dev/null
+++ b/base/common/kra/templates/key-retrieve.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<KeyRecoveryRequest>
+    <Attributes>
+        <Attribute name="keyId">1</Attribute>
+        <Attribute name="requestId">1</Attribute>
+        <Attribute name="nonceData">Base64 encoded NonceData</Attribute>
+        <Attribute name="passphrase">Passphrase to encrypt the secret with/Passphrase for the PKCS12 file returned</Attribute>
+        <Attribute name="sessionWrappedPassphrase">Base64 encoded session key wrapped passphrase</Attribute>
+        <Attribute name="transWrappedSessionKey">Base64 encoded transport key wrapped session key</Attribute>
+        <Attribute name="certificate">Base64 certificate used for recoring the key.</Attribute>
+    </Attributes>
+    <ClassName>com.netscape.certsrv.key.KeyRecoveryRequest</ClassName>
+</KeyRecoveryRequest>
diff --git a/base/common/src/com/netscape/certsrv/key/Key.java b/base/common/src/com/netscape/certsrv/key/Key.java
index 1b88075e44768fda36dbeb2a1efe812f65f248ac..5f5baf7075e0cbcc474483cf69322b4a1fffa780 100644
--- a/base/common/src/com/netscape/certsrv/key/Key.java
+++ b/base/common/src/com/netscape/certsrv/key/Key.java
@@ -1,5 +1,10 @@
 package com.netscape.certsrv.key;
 
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlRootElement;
+
 import com.netscape.cmsutil.util.Utils;
 
 /**
@@ -10,18 +15,26 @@ import com.netscape.cmsutil.util.Utils;
  * @author akoneru
  *
  */
+@XmlRootElement(name="Key")
+@XmlAccessorType(XmlAccessType.NONE)
 public class Key {
 
+    @XmlElement
     private byte[] encryptedData;
 
+    @XmlElement
     private byte[] nonceData;
 
+    @XmlElement
     private String p12Data;
 
+    @XmlElement
     private String algorithm;
 
+    @XmlElement
     private Integer size;
 
+    @XmlElement
     private byte[] data;
 
     public Key() {
diff --git a/base/common/src/com/netscape/certsrv/key/KeyClient.java b/base/common/src/com/netscape/certsrv/key/KeyClient.java
index 97793ab396130607ca77090d1f3b88fde07f8425..be326125d9ee5d540eefaaaa0598ad9d54c04767 100644
--- a/base/common/src/com/netscape/certsrv/key/KeyClient.java
+++ b/base/common/src/com/netscape/certsrv/key/KeyClient.java
@@ -18,6 +18,7 @@
 package com.netscape.certsrv.key;
 
 import java.net.URISyntaxException;
+import java.util.Arrays;
 import java.util.List;
 
 import javax.ws.rs.core.Response;
@@ -195,7 +196,8 @@ public class KeyClient extends Client {
         if (id == null || status == null) {
             throw new IllegalArgumentException("Key Id and status must be specified.");
         }
-        if ((!status.equalsIgnoreCase(KeyResource.KEY_STATUS_ACTIVE)) && (!status.equalsIgnoreCase(KeyResource.KEY_STATUS_INACTIVE))) {
+        if (!status.equalsIgnoreCase(KeyResource.KEY_STATUS_ACTIVE)
+                && !status.equalsIgnoreCase(KeyResource.KEY_STATUS_INACTIVE)) {
             throw new IllegalArgumentException("Invalid status value.");
         }
         Response response = keyClient.modifyKeyStatus(id, status);
@@ -666,16 +668,38 @@ public class KeyClient extends Client {
      *         object that describes the URL for the request and generated key.
      */
     public KeyRequestResponse generateSymmetricKey(String clientKeyId, String keyAlgorithm, int keySize,
-            List<String> usages, String transWrappedSessionKey) {
+            String usages, String transWrappedSessionKey) {
         if (clientKeyId == null) {
             throw new IllegalArgumentException("Client Key Identifier must be specified.");
         }
 
+        //Validate the usages list
+        List<String> usagesList = null;
+        if (usages != null) {
+            List<String> validUsages = SymKeyGenerationRequest.getValidUsagesList();
+            String[] list = usages.split(",");
+            String invalidUsages = null;
+            ;
+            for (int i = 0; i < list.length; i++) {
+                if (!validUsages.contains(list[i])) {
+                    if (invalidUsages == null) {
+                        invalidUsages = list[i];
+                    } else {
+                        invalidUsages = invalidUsages + ", " + list[i];
+                    }
+                }
+            }
+            if (invalidUsages != null) {
+                throw new IllegalArgumentException("Invalid usages specified. [" + invalidUsages + "]");
+            }
+            usagesList = Arrays.asList(list);
+        }
+
         SymKeyGenerationRequest data = new SymKeyGenerationRequest();
         data.setClientKeyId(clientKeyId);
         data.setKeyAlgorithm(keyAlgorithm);
         data.setKeySize(new Integer(keySize));
-        data.setUsages(usages);
+        data.setUsages(usagesList);
         data.setTransWrappedSessionKey(transWrappedSessionKey);
 
         return createRequest(data);
diff --git a/base/common/src/com/netscape/certsrv/key/KeyTemplate.java b/base/common/src/com/netscape/certsrv/key/KeyTemplate.java
new file mode 100644
index 0000000000000000000000000000000000000000..8f85b404b5cfc4fa2100c96a4715e40c628f1ee1
--- /dev/null
+++ b/base/common/src/com/netscape/certsrv/key/KeyTemplate.java
@@ -0,0 +1,22 @@
+package com.netscape.certsrv.key;
+
+public class KeyTemplate {
+
+    String ID;
+    String name;
+    String description;
+
+    public KeyTemplate(String ID, String name, String description) {
+        super();
+        this.ID = ID;
+        this.name = name;
+        this.description = description;
+    }
+
+    public void printTemplateInfo() {
+        System.out.println();
+        System.out.println("  Template ID: " + ID);
+        System.out.println("  Template Name: " + name);
+        System.out.println("  Template Description: " + description);
+    }
+}
\ No newline at end of file
diff --git a/base/common/src/com/netscape/certsrv/key/SymKeyGenerationRequest.java b/base/common/src/com/netscape/certsrv/key/SymKeyGenerationRequest.java
index 27dc69fd553e128ecf035c3b38ce1eedb9aab7e6..1bbcbefbb700285c63844e340c5c90013273b728 100644
--- a/base/common/src/com/netscape/certsrv/key/SymKeyGenerationRequest.java
+++ b/base/common/src/com/netscape/certsrv/key/SymKeyGenerationRequest.java
@@ -156,6 +156,18 @@ public class SymKeyGenerationRequest extends ResourceMessage {
         }
     }
 
+    public static List<String> getValidUsagesList(){
+        List<String> list = new ArrayList<String>();
+        list.add(WRAP_USAGE);
+        list.add(UWRAP_USAGE);
+        list.add(DECRYPT_USAGE);
+        list.add(ENCRYPT_USAGE);
+        list.add(KEY_USAGE);
+        list.add(SIGN_USAGE);
+
+        return list;
+    }
+
     public static void main(String args[]) throws Exception {
 
         SymKeyGenerationRequest before = new SymKeyGenerationRequest();
diff --git a/base/common/src/com/netscape/certsrv/key/Template.java b/base/common/src/com/netscape/certsrv/key/Template.java
deleted file mode 100644
index bfcf61eb77c46ac54ba469113883b886ac98c79e..0000000000000000000000000000000000000000
--- a/base/common/src/com/netscape/certsrv/key/Template.java
+++ /dev/null
@@ -1,21 +0,0 @@
-package com.netscape.certsrv.key;
-
-
-public class Template{
-    String templateID;
-    String templateName;
-    String templateDescription;
-    public Template(String templateID, String templateName, String templateDescription) {
-        super();
-        this.templateID = templateID;
-        this.templateName = templateName;
-        this.templateDescription = templateDescription;
-    }
-
-    public void printTemplateInfo(){
-        System.out.println();
-        System.out.println("  Template ID: " + templateID);
-        System.out.println("  Template Name: " + templateName);
-        System.out.println("  Template Description: " + templateDescription);
-    }
-}
\ No newline at end of file
diff --git a/base/java-tools/src/com/netscape/cmstools/key/KeyArchiveCLI.java b/base/java-tools/src/com/netscape/cmstools/key/KeyArchiveCLI.java
index ced51ad74e854be85973feb2d754326b074cabab..796d5b3deb68a8c200a3c0c205735c684b295257 100644
--- a/base/java-tools/src/com/netscape/cmstools/key/KeyArchiveCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/key/KeyArchiveCLI.java
@@ -21,7 +21,7 @@ public class KeyArchiveCLI extends CLI {
     public KeyCLI keyCLI;
 
     public KeyArchiveCLI(KeyCLI keyCLI) {
-        super("archive", "Archive a secret at the DRM.", keyCLI);
+        super("archive", "Archive a secret in the DRM.", keyCLI);
         this.keyCLI = keyCLI;
     }
 
@@ -31,7 +31,7 @@ public class KeyArchiveCLI extends CLI {
 
     public void execute(String[] args) {
 
-        Option option = new Option(null, "clientKeyId", true, "Unique client key identifier.");
+        Option option = new Option(null, "clientKeyID", true, "Unique client key identifier.");
         option.setArgName("Client Key Identifier");
         options.addOption(option);
 
@@ -58,7 +58,7 @@ public class KeyArchiveCLI extends CLI {
 
         KeyRequestResponse response = null;
 
-        if ((requestFile != null) && (requestFile.trim().length() != 0)) {
+        if (requestFile != null) {
             // Case where the request template file is used. For pre-encrypted data.
             try {
                 JAXBContext context = JAXBContext.newInstance(KeyArchivalRequest.class);
diff --git a/base/java-tools/src/com/netscape/cmstools/key/KeyCLI.java b/base/java-tools/src/com/netscape/cmstools/key/KeyCLI.java
index f64b8d76214cb51a33dd7818d3a6d5ea051404ef..1b8ae64b552a22072c1c39a37c77afcbacdb97da 100644
--- a/base/java-tools/src/com/netscape/cmstools/key/KeyCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/key/KeyCLI.java
@@ -43,8 +43,8 @@ public class KeyCLI extends CLI {
         addModule(new KeyShowCLI(this));
         addModule(new KeyRequestShowCLI(this));
         addModule(new KeyModifyCLI(this));
-        addModule(new KeyRequestTemplateFindCLI(this));
-        addModule(new KeyRequestTemplateShowCLI(this));
+        addModule(new KeyTemplateFindCLI(this));
+        addModule(new KeyTemplateShowCLI(this));
         addModule(new KeyArchiveCLI(this));
         addModule(new KeyRetrieveCLI(this));
         addModule(new KeyGenerateCLI(this));
@@ -72,7 +72,7 @@ public class KeyCLI extends CLI {
 
         // create new key client
         keyClient = new KeyClient(client, subsystem);
-        if ((client.getConfig().getCertDatabase() != null) && (client.getConfig().getCertPassword() != null)) {
+        if (client.getConfig().getCertDatabase() != null && client.getConfig().getCertPassword() != null) {
             keyClient.setCrypto(new NSSCryptoProvider(client.getConfig()));
 
             // Set the transport cert for crypto operations
diff --git a/base/java-tools/src/com/netscape/cmstools/key/KeyGenerateCLI.java b/base/java-tools/src/com/netscape/cmstools/key/KeyGenerateCLI.java
index 5edf9489c7560d9f96afe9ec9facd0e18ee04591..2da821a45a5424a045618e835e5d9ec9ae861ebd 100644
--- a/base/java-tools/src/com/netscape/cmstools/key/KeyGenerateCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/key/KeyGenerateCLI.java
@@ -1,9 +1,5 @@
 package com.netscape.cmstools.key;
 
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.ParseException;
@@ -27,21 +23,20 @@ public class KeyGenerateCLI extends CLI {
 
     public void execute(String[] args) {
         Option option = new Option(null, "key-algorithm", true,
-                "Algorithm to be used to create a key.\n Supported types [AES,DES,DES3,RC2,RC4,DESede]");
-        option.setArgName("Key algorithm");
+                "Algorithm to be used to create a key.\nValid values: AES, DES, DES3, RC2, RC4, DESede.");
+        option.setArgName("algorithm");
         option.setRequired(true);
         options.addOption(option);
 
         option = new Option(null, "key-size", true,
-                "Size of the key to be generated. Required for all algorithms AES and RC2.\n"
-                        + "Valid size values:\n   AES - 128, 192. 256.\n   RC2 - >=8, <=128");
-        option.setArgName("Key size");
+                "Size of the key to be generated.\nThis is required for AES and RC2.\n"
+                        + "Valid values for AES: 128, 192. 256.\nValid values for RC2: 8-128.\n Valid values for RC4: Any positive integer.");
+        option.setArgName("size");
         options.addOption(option);
 
         option = new Option(null, "usages", true, "Comma seperated list of usages."
-                + "\n Usage1,Usage2,Usage3.. .\n "
-                + "Valid usages: [wrap, unwrap, sign, verify, encrypt, decrypt].");
-        option.setArgName("Usages");
+                + "\nValid values: wrap, unwrap, sign, verify, encrypt, decrypt.");
+        option.setArgName("list of usages");
         options.addOption(option);
 
         CommandLine cmd = null;
@@ -75,8 +70,6 @@ public class KeyGenerateCLI extends CLI {
                 keySize = "56";
                 break;
             case KeyRequestResource.RC4_ALGORITHM:
-                keySize = "0";
-                break;
             case KeyRequestResource.AES_ALGORITHM:
             case KeyRequestResource.RC2_ALGORITHM:
                 System.err.println("Error: Key size must be specified for the algorithm used.");
@@ -88,15 +81,10 @@ public class KeyGenerateCLI extends CLI {
                 System.exit(1);
             }
         }
-        List<String> usagesList = null;
-        if (cmd.getOptionValue("usages") != null) {
-            String[] usages = cmd.getOptionValue("usages").split(",");
-            usagesList = new ArrayList<String>(Arrays.asList(usages));
-        }
 
         KeyRequestResponse response = keyCLI.keyClient.generateSymmetricKey(clientKeyId, keyAlgorithm,
                 Integer.parseInt(keySize),
-                usagesList, null);
+                cmd.getOptionValue("usages"), null);
 
         MainCLI.printMessage("Key generation request info");
         KeyCLI.printKeyRequestInfo(response.getRequestInfo());
diff --git a/base/java-tools/src/com/netscape/cmstools/key/KeyModifyCLI.java b/base/java-tools/src/com/netscape/cmstools/key/KeyModifyCLI.java
index e5da6e792a489becd10b827a1daeab2b1caa7320..6ae49ce5db162be56dba47be6f9a7f5e0d14b24c 100644
--- a/base/java-tools/src/com/netscape/cmstools/key/KeyModifyCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/key/KeyModifyCLI.java
@@ -40,7 +40,7 @@ public class KeyModifyCLI extends CLI {
 
     public void execute(String[] args) {
 
-        Option option = new Option(null, "status", true, "Status of the key.\n Valid values:[active,inactive]");
+        Option option = new Option(null, "status", true, "Status of the key.\nValid values: active, inactive");
         option.setRequired(true);
         option.setArgName("status");
         options.addOption(option);
@@ -72,11 +72,6 @@ public class KeyModifyCLI extends CLI {
         keyCLI.keyClient.modifyKeyStatus(keyId, status);
 
         KeyInfo keyInfo = keyCLI.keyClient.getKeyInfo(keyId);
-        if (keyInfo.getStatus().equalsIgnoreCase(status)) {
-            System.out.println("Success!");
-            KeyCLI.printKeyInfo(keyInfo);
-        } else {
-            System.out.println("Failure! Key status not modified.");
-        }
+        KeyCLI.printKeyInfo(keyInfo);
     }
 }
diff --git a/base/java-tools/src/com/netscape/cmstools/key/KeyRecoverCLI.java b/base/java-tools/src/com/netscape/cmstools/key/KeyRecoverCLI.java
index 9e226cf6588e7852390b0bad77775467561bee0b..baed8a8dfd14a98ae428c26783f4a30060b56d87 100644
--- a/base/java-tools/src/com/netscape/cmstools/key/KeyRecoverCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/key/KeyRecoverCLI.java
@@ -22,17 +22,17 @@ public class KeyRecoverCLI extends CLI {
     public KeyCLI keyCLI;
 
     public KeyRecoverCLI(KeyCLI keyCLI) {
-        super("recover", "Recover key", keyCLI);
+        super("recover", "Create a key recovery request", keyCLI);
         this.keyCLI = keyCLI;
     }
 
     public void printHelp() {
-        formatter.printHelp(getFullName() + " <Request ID> [OPTIONS]", options);
+        formatter.printHelp(getFullName() + " [OPTIONS]", options);
     }
 
     public void execute(String[] args) {
 
-        Option option = new Option(null, "keyId", true, "Key Identifier for the secret to be recovered.");
+        Option option = new Option(null, "keyID", true, "Key Identifier for the secret to be recovered.");
         option.setArgName("Key Identifier");
         options.addOption(option);
 
@@ -54,7 +54,7 @@ public class KeyRecoverCLI extends CLI {
 
         KeyRequestResponse response = null;
 
-        if ((requestFile != null) && (requestFile.trim().length() != 0)) {
+        if (requestFile != null) {
             try {
                 JAXBContext context = JAXBContext.newInstance(KeyRecoveryRequest.class);
                 Unmarshaller unmarshaller = context.createUnmarshaller();
@@ -77,11 +77,11 @@ public class KeyRecoverCLI extends CLI {
             }
 
         } else {
-            String keyId = cmd.getOptionValue("keyId");
+            String keyId = cmd.getOptionValue("keyID");
             response = keyCLI.keyClient.recoverKey(new KeyId(keyId), null, null, null, null);
         }
 
-        MainCLI.printMessage("Recovered Key Information");
+        MainCLI.printMessage("Key Recovery Request Information");
         KeyCLI.printKeyRequestInfo(response.getRequestInfo());
 
     }
diff --git a/base/java-tools/src/com/netscape/cmstools/key/KeyRequestReviewCLI.java b/base/java-tools/src/com/netscape/cmstools/key/KeyRequestReviewCLI.java
index 9f60fff8b4006af90dd71b4fbff457ff96799a53..ef4e6c823cb10c15483f7bf301652b57e6fba332 100644
--- a/base/java-tools/src/com/netscape/cmstools/key/KeyRequestReviewCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/key/KeyRequestReviewCLI.java
@@ -23,7 +23,7 @@ public class KeyRequestReviewCLI extends CLI {
 
     public void execute(String[] args) {
         Option option = new Option(null, "action", true,
-                "Action to be performed on the request.\n Available actions - [approve|reject|cancel].");
+                "Action to be performed on the request.\nValid values: approve, reject, cancel.");
         option.setArgName("Action to perform");
         option.setRequired(true);
         options.addOption(option);
@@ -40,7 +40,7 @@ public class KeyRequestReviewCLI extends CLI {
 
         String[] cmdArgs = cmd.getArgs();
         if (cmdArgs.length != 1) {
-            System.err.println("Error: Invalid arguements provided.");
+            System.err.println("Error: Invalid arguments provided.");
             printHelp();
             System.exit(1);
         }
diff --git a/base/java-tools/src/com/netscape/cmstools/key/KeyRequestShowCLI.java b/base/java-tools/src/com/netscape/cmstools/key/KeyRequestShowCLI.java
index 412748f873e292d47e2dd8501356c05490f4dd20..f360d86f3da353bc13f2151482bc014ffea6f534 100644
--- a/base/java-tools/src/com/netscape/cmstools/key/KeyRequestShowCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/key/KeyRequestShowCLI.java
@@ -32,7 +32,7 @@ public class KeyRequestShowCLI extends CLI {
     }
 
     public void printHelp() {
-        formatter.printHelp(getFullName() + " <Request Id>", options);
+        formatter.printHelp(getFullName() + " <Request ID>", options);
     }
 
     public void execute(String[] args) {
diff --git a/base/java-tools/src/com/netscape/cmstools/key/KeyRetrieveCLI.java b/base/java-tools/src/com/netscape/cmstools/key/KeyRetrieveCLI.java
index 5b5ddc6a7474177c31aa6d294d3e8a386211c4a9..9a8a75a5edb8bd9236594a998f6fafedfcfe2dd3 100644
--- a/base/java-tools/src/com/netscape/cmstools/key/KeyRetrieveCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/key/KeyRetrieveCLI.java
@@ -1,10 +1,12 @@
 package com.netscape.cmstools.key;
 
+import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
 
 import javax.xml.bind.JAXBContext;
 import javax.xml.bind.JAXBException;
+import javax.xml.bind.Marshaller;
 import javax.xml.bind.Unmarshaller;
 
 import org.apache.commons.cli.CommandLine;
@@ -20,6 +22,7 @@ import com.netscape.cmsutil.util.Utils;
 
 public class KeyRetrieveCLI extends CLI {
     public KeyCLI keyCLI;
+    private boolean clientEncryption = true;
 
     public KeyRetrieveCLI(KeyCLI keyCLI) {
         super("retrieve", "Retrieve key", keyCLI);
@@ -27,12 +30,12 @@ public class KeyRetrieveCLI extends CLI {
     }
 
     public void printHelp() {
-        formatter.printHelp(getFullName() + " <Request ID> [OPTIONS]", options);
+        formatter.printHelp(getFullName() + " [OPTIONS]", options);
     }
 
     public void execute(String[] args) {
 
-        Option option = new Option(null, "keyId", true, "Key Identifier for the secret to be recovered.");
+        Option option = new Option(null, "keyID", true, "Key Identifier for the secret to be recovered.");
         option.setArgName("Key Identifier");
         options.addOption(option);
 
@@ -44,6 +47,10 @@ public class KeyRetrieveCLI extends CLI {
         option.setArgName("Input file path");
         options.addOption(option);
 
+        option = new Option(null, "output", true, "Location to store the retrieved key information");
+        option.setArgName("File path to store key information");
+        options.addOption(option);
+
         CommandLine cmd = null;
         try {
             cmd = parser.parse(options, args);
@@ -54,11 +61,16 @@ public class KeyRetrieveCLI extends CLI {
             System.exit(1);
         }
 
+        if(cmd.getOptions().length==0){
+            System.err.println("Error: Insufficient parameters provided.");
+            printHelp();
+            System.exit(-1);
+        }
         String requestFile = cmd.getOptionValue("input");
 
         Key keyData = null;
 
-        if ((requestFile != null) && (requestFile.trim().length() != 0)) {
+        if (requestFile != null) {
             try {
                 JAXBContext context = JAXBContext.newInstance(KeyRecoveryRequest.class);
                 Unmarshaller unmarshaller = context.createUnmarshaller();
@@ -103,9 +115,14 @@ public class KeyRetrieveCLI extends CLI {
             }
 
         } else {
-            String keyId = cmd.getOptionValue("keyId");
+            String keyId = cmd.getOptionValue("keyID");
+            clientEncryption = false;
             try {
                 keyData = keyCLI.keyClient.retrieveKey(new KeyId(keyId));
+
+                // No need to return the encrypted data since encryption
+                //is done locally.
+                keyData.setEncryptedData(null);
             } catch (Exception e) {
                 System.err.println(e.getMessage());
                 if (verbose)
@@ -113,18 +130,34 @@ public class KeyRetrieveCLI extends CLI {
                 System.exit(-1);
             }
         }
-        MainCLI.printMessage("Retrieve Key Information");
-        printKeyData(keyData);
+
+        String outputFilePath = cmd.getOptionValue("output");
+        if (outputFilePath != null) {
+            try {
+                JAXBContext context = JAXBContext.newInstance(Key.class);
+                Marshaller marshaller = context.createMarshaller();
+                marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true);
+                marshaller.marshal(keyData, new File(outputFilePath));
+            } catch (JAXBException e) {
+                System.err.println(e.getMessage());
+                if (verbose)
+                    e.printStackTrace();
+                System.exit(-1);
+            }
+        } else {
+            MainCLI.printMessage("Retrieve Key Information");
+            printKeyData(keyData);
+        }
     }
 
     public void printKeyData(Key key) {
         System.out.println("  Key Algorithm: " + key.getAlgorithm());
         System.out.println("  Key Size: " + key.getSize());
         System.out.println("  Nonce data: " + Utils.base64encode(key.getNonceData()));
-        System.out.println("  Encrypted Data:" + Utils.base64encode(key.getEncryptedData()));
-        if (key.getData() != null) {
+        if(clientEncryption)
+            System.out.println("  Encrypted Data:" + Utils.base64encode(key.getEncryptedData()));
+        if (!clientEncryption)
             System.out.println("  Actual archived data: " + Utils.base64encode(key.getData()));
-        }
         if (key.getP12Data() != null) {
             System.out.println("  Key data in PKCS12 format: " + key.getP12Data());
         }
diff --git a/base/java-tools/src/com/netscape/cmstools/key/KeyShowCLI.java b/base/java-tools/src/com/netscape/cmstools/key/KeyShowCLI.java
index cc76f4c4be596b1671a0c1646be346904f7fbd98..cef3864d0bd596808f1c89bcc1d60cabad2908d6 100644
--- a/base/java-tools/src/com/netscape/cmstools/key/KeyShowCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/key/KeyShowCLI.java
@@ -32,7 +32,7 @@ public class KeyShowCLI extends CLI {
     }
 
     public void printHelp() {
-        formatter.printHelp(getFullName() + " <Key Id>", options);
+        formatter.printHelp(getFullName() + " <Key ID>", options);
     }
 
     public void execute(String[] args) {
diff --git a/base/java-tools/src/com/netscape/cmstools/key/KeyRequestTemplateFindCLI.java b/base/java-tools/src/com/netscape/cmstools/key/KeyTemplateFindCLI.java
similarity index 65%
rename from base/java-tools/src/com/netscape/cmstools/key/KeyRequestTemplateFindCLI.java
rename to base/java-tools/src/com/netscape/cmstools/key/KeyTemplateFindCLI.java
index 375cb61b881293ef766fb2eaa257c34935697e00..9bbef9379c9e5294177c9c556c68897ad6ad9a68 100644
--- a/base/java-tools/src/com/netscape/cmstools/key/KeyRequestTemplateFindCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/key/KeyTemplateFindCLI.java
@@ -2,16 +2,16 @@ package com.netscape.cmstools.key;
 
 import java.util.ArrayList;
 
-import com.netscape.certsrv.key.Template;
+import com.netscape.certsrv.key.KeyTemplate;
 import com.netscape.cmstools.cli.CLI;
 import com.netscape.cmstools.cli.MainCLI;
 
-public class KeyRequestTemplateFindCLI extends CLI {
+public class KeyTemplateFindCLI extends CLI {
     public KeyCLI keyCLI;
 
-    public ArrayList<Template> templates = new ArrayList<Template>();
+    public ArrayList<KeyTemplate> templates = new ArrayList<KeyTemplate>();
 
-    public KeyRequestTemplateFindCLI(KeyCLI keyCLI) {
+    public KeyTemplateFindCLI(KeyCLI keyCLI) {
         super("template-find", "List request template IDs", keyCLI);
         this.keyCLI = keyCLI;
         createTemplateList();
@@ -23,19 +23,19 @@ public class KeyRequestTemplateFindCLI extends CLI {
 
     public void execute(String[] args) {
         MainCLI.printMessage("List of templates");
-        for (Template template : templates) {
+        for (KeyTemplate template : templates) {
             template.printTemplateInfo();
         }
     }
 
     public void createTemplateList() {
-        Template template = new Template("archiveKey", "Key Archival Request",
+        KeyTemplate template = new KeyTemplate("archiveKey", "Key Archival Request",
                 "Template file for submitting a key archival request");
         templates.add(template);
-        template = new Template("retrieveKey", "Key retrieval request",
+        template = new KeyTemplate("retrieveKey", "Key retrieval request",
                 "Template for submitting a key retrieval or key recovery request.");
         templates.add(template);
-        template = new Template("generateKey", "Symmetric Key generation request",
+        template = new KeyTemplate("generateKey", "Symmetric Key generation request",
                 "Template for submitting a request for generating a symmetric key.");
         templates.add(template);
     }
diff --git a/base/java-tools/src/com/netscape/cmstools/key/KeyRequestTemplateShowCLI.java b/base/java-tools/src/com/netscape/cmstools/key/KeyTemplateShowCLI.java
similarity index 53%
rename from base/java-tools/src/com/netscape/cmstools/key/KeyRequestTemplateShowCLI.java
rename to base/java-tools/src/com/netscape/cmstools/key/KeyTemplateShowCLI.java
index 87284f4991dcfa5d29c29fee57702112799c9f3f..f85bef94bdc6ca2b2ea5924f93f069fba876af88 100644
--- a/base/java-tools/src/com/netscape/cmstools/key/KeyRequestTemplateShowCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/key/KeyTemplateShowCLI.java
@@ -1,38 +1,37 @@
 package com.netscape.cmstools.key;
 
+import java.io.FileInputStream;
 import java.io.FileNotFoundException;
 import java.io.FileOutputStream;
 import java.io.OutputStream;
-import java.util.Arrays;
 
 import javax.xml.bind.JAXBContext;
 import javax.xml.bind.JAXBException;
 import javax.xml.bind.Marshaller;
+import javax.xml.bind.Unmarshaller;
 
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.ParseException;
 
 import com.netscape.certsrv.base.ResourceMessage;
-import com.netscape.certsrv.dbs.keydb.KeyId;
 import com.netscape.certsrv.key.KeyArchivalRequest;
 import com.netscape.certsrv.key.KeyRecoveryRequest;
 import com.netscape.certsrv.key.SymKeyGenerationRequest;
-import com.netscape.certsrv.request.RequestId;
 import com.netscape.cmstools.cli.CLI;
 import com.netscape.cmstools.cli.MainCLI;
 
-public class KeyRequestTemplateShowCLI extends CLI {
+public class KeyTemplateShowCLI extends CLI {
     public KeyCLI keyCLI;
 
-    public KeyRequestTemplateShowCLI(KeyCLI keyCLI) {
+    public KeyTemplateShowCLI(KeyCLI keyCLI) {
         super("template-show", "Get request template", keyCLI);
         this.keyCLI = keyCLI;
     }
 
     public void printHelp() {
         formatter.printHelp(getFullName()
-                + " <Template ID [archiveKey, retrieveKey, recoverKey, generateKey]> [OPTIONS]", options);
+                + " <Template ID> [OPTIONS]", options);
     }
 
     public void execute(String[] args) {
@@ -62,23 +61,31 @@ public class KeyRequestTemplateShowCLI extends CLI {
 
         ResourceMessage data = null;
         String message = null;
-        switch (templateId) {
-        case "archiveKey":
-            data = getSampleArchivalRequest();
-            message = "key archival request";
-            break;
-        case "retrieveKey":
-        case "recoverKey":
-            message = "key recover request";
-            data = getSampleRecoveryRequest();
-            break;
-        case "generateKey":
-            message = "symmetric key generation request";
-            data = getSampleGenerationRequest();
-            break;
-        default:
-            System.err.println("Error: Invalid template id.");
-            printHelp();
+        try {
+            switch (templateId) {
+            case "archiveKey":
+                data = readFromTemplateFile(KeyArchivalRequest.class, "/usr/share/pki/kra/templates/key-archive.xml");
+                message = "key archival request";
+                break;
+            case "retrieveKey":
+            case "recoverKey":
+                message = "key recover request";
+                data = readFromTemplateFile(KeyRecoveryRequest.class, "/usr/share/pki/kra/templates/key-retrieve.xml");
+                break;
+            case "generateKey":
+                message = "symmetric key generation request";
+                data = readFromTemplateFile(SymKeyGenerationRequest.class,
+                        "/usr/share/pki/kra/templates/key-generate.xml");
+                break;
+            default:
+                System.err.println("Error: Invalid template id.");
+                printHelp();
+                System.exit(-1);
+            }
+        } catch (FileNotFoundException | JAXBException e1) {
+            System.err.println("Error: " + e1.getMessage());
+            if (verbose)
+                e1.printStackTrace();
             System.exit(-1);
         }
 
@@ -114,41 +121,13 @@ public class KeyRequestTemplateShowCLI extends CLI {
         marshaller.marshal(t, os);
     }
 
-    public KeyArchivalRequest getSampleArchivalRequest() {
-        KeyArchivalRequest data = new KeyArchivalRequest();
-        data.setClientKeyId("");
-        data.setDataType("symmetricKey/passphrase/asymmetricKey");
-        data.setKeyAlgorithm("");
-        data.setKeySize(0);
-        data.setClientKeyId("");
-        data.setAlgorithmOID("");
-        data.setSymmetricAlgorithmParams("Base64 encoded NonceData");
-        data.setWrappedPrivateData("Base64 encoded session key wrapped secret");
-        data.setTransWrappedSessionKey("Base64 encoded transport key wrapped session key");
-        data.setPKIArchiveOptions("Base 64 encoded PKIArchiveOptions object");
-        return data;
-    }
-
-    public KeyRecoveryRequest getSampleRecoveryRequest() {
-        KeyRecoveryRequest data = new KeyRecoveryRequest();
-        data.setKeyId(new KeyId("1"));
-        data.setRequestId(new RequestId("1"));
-        data.setNonceData("Base64 encoded NonceData");
-        data.setPassphrase("Passphrase to encrypt the secret with/Passphrase for the PKCS12 file returned");
-        data.setSessionWrappedPassphrase("Base64 encoded session key wrapped passphrase");
-        data.setTransWrappedSessionKey("Base64 encoded transport key wrapped session key");
-        data.setCertificate("Base64 certificate used for recoring the key.");
-
-        return data;
-    }
-
-    public SymKeyGenerationRequest getSampleGenerationRequest() {
-        SymKeyGenerationRequest data = new SymKeyGenerationRequest();
-        data.setClientKeyId("");
-        data.setKeyAlgorithm("[AES/DES/DES3/DESede/RC2/RC4]");
-        data.setKeySize(128);
-        data.setUsages(Arrays.asList(new String[] { "wrap", "unwrap", "sign", "verify", "encrypt", "decrypt" }));
-
-        return data;
+    public <T> T readFromTemplateFile(Class<T> t, String filePath) throws JAXBException, FileNotFoundException {
+        JAXBContext context = JAXBContext.newInstance(t);
+        Unmarshaller unmarshaller = context.createUnmarshaller();
+        FileInputStream fis = new FileInputStream(filePath);
+        @SuppressWarnings("unchecked")
+        T req = (T) unmarshaller.unmarshal(fis);
+
+        return req;
     }
 }
diff --git a/base/kra/functional/src/com/netscape/cms/servlet/test/DRMTest.java b/base/kra/functional/src/com/netscape/cms/servlet/test/DRMTest.java
index cb80039b76d642586b0f14bcd3c756ebf67cd44c..ba2d6930aac678bc5de46d9133fa5e77baa9d14f 100644
--- a/base/kra/functional/src/com/netscape/cms/servlet/test/DRMTest.java
+++ b/base/kra/functional/src/com/netscape/cms/servlet/test/DRMTest.java
@@ -17,10 +17,8 @@
 // --- END COPYRIGHT BLOCK ---
 package com.netscape.cms.servlet.test;
 
-import java.util.ArrayList;
 import java.util.Calendar;
 import java.util.Iterator;
-import java.util.List;
 import java.util.Random;
 
 import org.apache.commons.cli.CommandLine;
@@ -504,9 +502,7 @@ public class DRMTest {
 
         // test 18: Generate symmetric key
         clientKeyId = "Symmetric Key #1234f " + Calendar.getInstance().getTime().toString();
-        List<String> usages = new ArrayList<String>();
-        usages.add(SymKeyGenerationRequest.DECRYPT_USAGE);
-        usages.add(SymKeyGenerationRequest.ENCRYPT_USAGE);
+        String usages = SymKeyGenerationRequest.DECRYPT_USAGE + "," + SymKeyGenerationRequest.ENCRYPT_USAGE;
         KeyRequestResponse genKeyResponse = keyClient.generateSymmetricKey(clientKeyId,
                 KeyRequestResource.AES_ALGORITHM,
                 128, usages, null);
diff --git a/specs/pki-core.spec b/specs/pki-core.spec
index 6e10ac0e3608086e562d0ae218a5c675cd306612..d0fa1512dac2b9139ca5478d94690840689ec8d8 100644
--- a/specs/pki-core.spec
+++ b/specs/pki-core.spec
@@ -5,7 +5,7 @@ distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
 
 Name:             pki-core
 Version:          10.2.0
-Release:          0.1%{?dist}
+Release:          0.2%{?dist}
 Summary:          Certificate System - PKI Core Components
 URL:              http://pki.fedoraproject.org/
 License:          GPLv2
@@ -839,6 +839,7 @@ fi
 %{_datadir}/pki/VERSION
 %{_datadir}/pki/etc/
 %{_datadir}/pki/upgrade/
+%{_datadir}/pki/kra/templates
 %dir %{_sysconfdir}/pki
 %config(noreplace) %{_sysconfdir}/pki/pki.conf
 %dir %{_javadir}/pki
@@ -1010,6 +1011,10 @@ fi
 %endif # %{with server}
 
 %changelog
+* Thu Apr 10 2014 Abhishek Koneru <akoneru@redhat.com> 10.2.0-0.2
+- Added template files for archive, retrieve and generate key
+  requests to the client package.
+
 * Fri Nov 22 2013 Dogtag Team <pki-devel@redhat.com> 10.2.0-0.1
 - Added option to build without server packages.
 - Replaced Jettison with Jackson.
-- 
1.8.5.3

