From 27082fcb110d34960725c649bbfe8c0c63872ed9 Mon Sep 17 00:00:00 2001
From: Endi Sukma Dewata <edewata@redhat.com>
Date: Mon, 8 Oct 2012 16:52:53 -0400
Subject: [PATCH] Added PKIConnection.

The code in PKIClient has been refactored into PKIConnection
such that a single connection object can be used by several
REST clients. The PKIClient will remain the base class for
all REST clients.

Ticket #357
---
 .../src/com/netscape/certsrv/ca/CAClient.java      |   9 +
 .../src/com/netscape/certsrv/cert/CertClient.java  |   9 +
 .../src/com/netscape/certsrv/client/PKIClient.java | 306 +--------------------
 .../client/{PKIClient.java => PKIConnection.java}  |  36 +--
 .../com/netscape/certsrv/group/GroupClient.java    |   9 +
 .../src/com/netscape/certsrv/kra/DRMClient.java    |   9 +
 .../certsrv/system/SystemConfigClient.java         |   9 +
 .../src/com/netscape/certsrv/user/UserClient.java  |   9 +
 .../cms/servlet/csadmin/ConfigurationUtils.java    |  14 +-
 .../src/com/netscape/cmstools/cert/CertCLI.java    |   3 +-
 .../cmstools/cert/CertRequestApproveCLI.java       |  31 +--
 .../src/com/netscape/cmstools/cli/MainCLI.java     |  10 +
 .../src/com/netscape/cmstools/group/GroupCLI.java  |   3 +-
 .../cmstools/system/SecurityDomainCLI.java         |   1 -
 .../src/com/netscape/cmstools/user/UserCLI.java    |   3 +-
 15 files changed, 105 insertions(+), 356 deletions(-)
 copy base/common/src/com/netscape/certsrv/client/{PKIClient.java => PKIConnection.java} (94%)

diff --git a/base/common/src/com/netscape/certsrv/ca/CAClient.java b/base/common/src/com/netscape/certsrv/ca/CAClient.java
index 62e7a24381ce6c3d964c811b43c5ff03f8f987d4..2c026b799b58ebab36a6f4e2ee955890e7e5593b 100644
--- a/base/common/src/com/netscape/certsrv/ca/CAClient.java
+++ b/base/common/src/com/netscape/certsrv/ca/CAClient.java
@@ -31,6 +31,7 @@ import com.netscape.certsrv.cert.CertReviewResponse;
 import com.netscape.certsrv.cert.CertSearchRequest;
 import com.netscape.certsrv.client.ClientConfig;
 import com.netscape.certsrv.client.PKIClient;
+import com.netscape.certsrv.client.PKIConnection;
 import com.netscape.certsrv.dbs.certdb.CertId;
 import com.netscape.certsrv.profile.ProfileData;
 import com.netscape.certsrv.profile.ProfileDataInfos;
@@ -43,9 +44,17 @@ public class CAClient extends PKIClient {
     private CertRequestResource certRequestClient;
     private ProfileResource profileClient;
 
+    public CAClient(PKIConnection connection) throws URISyntaxException {
+        super(connection);
+        init();
+    }
+
     public CAClient(ClientConfig config) throws URISyntaxException {
         super(config);
+        init();
+    }
 
+    public void init() throws URISyntaxException {
         certRequestClient = createProxy(CertRequestResource.class);
         certClient = createProxy(CertResource.class);
         profileClient = createProxy(ProfileResource.class);
diff --git a/base/common/src/com/netscape/certsrv/cert/CertClient.java b/base/common/src/com/netscape/certsrv/cert/CertClient.java
index a92e63522eee62519cc24fcd97622d31abc811b8..da60ed085f7de8e8ae79e56156c301d8362d7f49 100644
--- a/base/common/src/com/netscape/certsrv/cert/CertClient.java
+++ b/base/common/src/com/netscape/certsrv/cert/CertClient.java
@@ -21,6 +21,7 @@ import java.net.URISyntaxException;
 
 import com.netscape.certsrv.client.ClientConfig;
 import com.netscape.certsrv.client.PKIClient;
+import com.netscape.certsrv.client.PKIConnection;
 import com.netscape.certsrv.dbs.certdb.CertId;
 import com.netscape.certsrv.request.RequestId;
 
@@ -32,9 +33,17 @@ public class CertClient extends PKIClient {
     public CertResource certClient;
     public CertRequestResource certRequestResource;
 
+    public CertClient(PKIConnection connection) throws URISyntaxException {
+        super(connection);
+        init();
+    }
+
     public CertClient(ClientConfig config) throws URISyntaxException {
         super(config);
+        init();
+    }
 
+    public void init() throws URISyntaxException {
         certClient = createProxy(CertResource.class);
         certRequestResource = createProxy(CertRequestResource.class);
     }
diff --git a/base/common/src/com/netscape/certsrv/client/PKIClient.java b/base/common/src/com/netscape/certsrv/client/PKIClient.java
index e725faa13e97b6184d07b0737619378a95680d7e..482ed9fde5b7f2be841fe4f1278a50d9e3518f6b 100644
--- a/base/common/src/com/netscape/certsrv/client/PKIClient.java
+++ b/base/common/src/com/netscape/certsrv/client/PKIClient.java
@@ -1,319 +1,27 @@
 package com.netscape.certsrv.client;
 
-import java.io.File;
-import java.io.IOException;
-import java.net.InetAddress;
-import java.net.InetSocketAddress;
-import java.net.Socket;
-import java.net.URI;
 import java.net.URISyntaxException;
-import java.net.UnknownHostException;
-import java.util.ArrayList;
-import java.util.Enumeration;
-import java.util.List;
 
-import javax.ws.rs.core.MediaType;
-
-import org.apache.commons.httpclient.ConnectTimeoutException;
-import org.apache.http.Header;
-import org.apache.http.HttpEntityEnclosingRequest;
-import org.apache.http.HttpException;
-import org.apache.http.HttpRequest;
-import org.apache.http.HttpRequestInterceptor;
-import org.apache.http.HttpResponse;
-import org.apache.http.HttpResponseInterceptor;
-import org.apache.http.ProtocolException;
-import org.apache.http.auth.AuthScope;
-import org.apache.http.auth.UsernamePasswordCredentials;
-import org.apache.http.auth.params.AuthPNames;
-import org.apache.http.client.methods.HttpUriRequest;
-import org.apache.http.client.params.AuthPolicy;
-import org.apache.http.client.params.HttpClientParams;
-import org.apache.http.conn.scheme.LayeredSchemeSocketFactory;
-import org.apache.http.conn.scheme.Scheme;
-import org.apache.http.conn.scheme.SchemeSocketFactory;
-import org.apache.http.impl.client.ClientParamsStack;
-import org.apache.http.impl.client.DefaultHttpClient;
-import org.apache.http.impl.client.DefaultRedirectStrategy;
-import org.apache.http.impl.client.EntityEnclosingRequestWrapper;
-import org.apache.http.impl.client.RequestWrapper;
-import org.apache.http.params.HttpParams;
-import org.apache.http.protocol.HttpContext;
-import org.jboss.resteasy.client.ClientExecutor;
-import org.jboss.resteasy.client.ClientRequest;
 import org.jboss.resteasy.client.ClientResponse;
-import org.jboss.resteasy.client.ClientResponseFailure;
-import org.jboss.resteasy.client.ProxyFactory;
-import org.jboss.resteasy.client.core.BaseClientResponse;
-import org.jboss.resteasy.client.core.executors.ApacheHttpClient4Executor;
-import org.jboss.resteasy.client.core.extractors.ClientErrorHandler;
-import org.jboss.resteasy.spi.ResteasyProviderFactory;
-import org.mozilla.jss.CryptoManager;
-import org.mozilla.jss.crypto.AlreadyInitializedException;
-import org.mozilla.jss.ssl.SSLCertificateApprovalCallback;
-import org.mozilla.jss.ssl.SSLSocket;
 
 
 public class PKIClient {
 
-    protected boolean verbose;
+    PKIConnection connection;
 
-    protected ClientConfig config;
-
-    protected ResteasyProviderFactory providerFactory;
-    protected ClientErrorHandler errorHandler;
-    protected ClientExecutor executor;
+    public PKIClient(PKIConnection connection) {
+        this.connection = connection;
+    }
 
     public PKIClient(ClientConfig config) {
-        this.config = config;
-
-        DefaultHttpClient httpClient = new DefaultHttpClient();
-
-        // Register https scheme.
-        Scheme scheme = new Scheme("https", 443, new JSSProtocolSocketFactory());
-        httpClient.getConnectionManager().getSchemeRegistry().register(scheme);
-
-        if (config.getUsername() != null && config.getPassword() != null) {
-            List<String> authPref = new ArrayList<String>();
-            authPref.add(AuthPolicy.BASIC);
-            httpClient.getParams().setParameter(AuthPNames.PROXY_AUTH_PREF, authPref);
-
-            httpClient.getCredentialsProvider().setCredentials(
-                    AuthScope.ANY,
-                    new UsernamePasswordCredentials(config.getUsername(), config.getPassword()));
-        }
-
-        httpClient.addRequestInterceptor(new HttpRequestInterceptor() {
-            @Override
-            public void process(HttpRequest request, HttpContext context) throws HttpException, IOException {
-                if (verbose) {
-                    System.out.println("HTTP request: "+request.getRequestLine());
-                    for (Header header : request.getAllHeaders()) {
-                        System.out.println("  "+header.getName()+": "+header.getValue());
-                    }
-                }
-
-                // Set the request parameter to follow redirections.
-                HttpParams params = request.getParams();
-                if (params instanceof ClientParamsStack) {
-                    ClientParamsStack paramsStack = (ClientParamsStack)request.getParams();
-                    params = paramsStack.getRequestParams();
-                }
-                HttpClientParams.setRedirecting(params, true);
-            }
-        });
-
-        httpClient.addResponseInterceptor(new HttpResponseInterceptor() {
-            @Override
-            public void process(HttpResponse response, HttpContext context) throws HttpException, IOException {
-                if (verbose) {
-                    System.out.println("HTTP response: "+response.getStatusLine());
-                    for (Header header : response.getAllHeaders()) {
-                        System.out.println("  "+header.getName()+": "+header.getValue());
-                    }
-                }
-            }
-        });
-
-        httpClient.setRedirectStrategy(new DefaultRedirectStrategy() {
-            @Override
-            public HttpUriRequest getRedirect(HttpRequest request, HttpResponse response, HttpContext context)
-                    throws ProtocolException {
-
-                HttpUriRequest uriRequest = super.getRedirect(request, response, context);
-
-                URI uri = uriRequest.getURI();
-                if (verbose) System.out.println("HTTP redirect: "+uri);
-
-                // Redirect the original request to the new URI.
-                RequestWrapper wrapper;
-                if (request instanceof HttpEntityEnclosingRequest) {
-                    wrapper = new EntityEnclosingRequestWrapper((HttpEntityEnclosingRequest)request);
-                } else {
-                    wrapper = new RequestWrapper(request);
-                }
-                wrapper.setURI(uri);
-
-                return wrapper;
-            }
-
-            @Override
-            public boolean isRedirected(HttpRequest request, HttpResponse response, HttpContext context)
-                    throws ProtocolException {
-
-                // The default redirection policy does not redirect POST or PUT.
-                // This overrides the policy to follow redirections for all HTTP methods.
-                return response.getStatusLine().getStatusCode() == 302;
-            }
-        });
-
-        executor = new ApacheHttpClient4Executor(httpClient);
-        providerFactory = ResteasyProviderFactory.getInstance();
-        providerFactory.addClientErrorInterceptor(new PKIErrorInterceptor());
-        errorHandler = new ClientErrorHandler(providerFactory.getClientErrorInterceptors());
-    }
-
-    private class ServerCertApprovalCB implements SSLCertificateApprovalCallback {
-
-        // Callback to approve or deny returned SSL server cert.
-        // Right now, simply approve the cert.
-        public boolean approve(org.mozilla.jss.crypto.X509Certificate serverCert,
-                SSLCertificateApprovalCallback.ValidityStatus status) {
-
-            if (verbose) System.out.println("Server certificate: "+serverCert.getSubjectDN());
-
-            SSLCertificateApprovalCallback.ValidityItem item;
-
-            Enumeration<?> errors = status.getReasons();
-            while (errors.hasMoreElements()) {
-                item = (SSLCertificateApprovalCallback.ValidityItem) errors.nextElement();
-                int reason = item.getReason();
-
-                if (reason == SSLCertificateApprovalCallback.ValidityStatus.UNTRUSTED_ISSUER ||
-                        reason == SSLCertificateApprovalCallback.ValidityStatus.BAD_CERT_DOMAIN) {
-
-                    // Allow these two since we haven't installed the CA cert for trust.
-
-                    return true;
-
-                }
-            }
-
-            // For other errors return false.
-
-            return false;
-        }
-    }
-
-    private class JSSProtocolSocketFactory implements SchemeSocketFactory, LayeredSchemeSocketFactory {
-
-        @Override
-        public Socket createSocket(HttpParams params) throws IOException {
-            return null;
-        }
-
-        @Override
-        public Socket connectSocket(Socket sock,
-                InetSocketAddress remoteAddress,
-                InetSocketAddress localAddress,
-                HttpParams params)
-                throws IOException,
-                UnknownHostException,
-                ConnectTimeoutException {
-
-            // Initialize JSS before using SSLSocket,
-            // otherwise it will throw UnsatisfiedLinkError.
-            if (config.getCertDatabase() == null) {
-                try {
-                    // No database specified, use $HOME/.pki/nssdb.
-                    File homeDir = new File(System.getProperty("user.home"));
-                    File pkiDir = new File(homeDir, ".pki");
-                    File nssdbDir = new File(pkiDir, "nssdb");
-                    nssdbDir.mkdirs();
-
-                    CryptoManager.initialize(nssdbDir.getAbsolutePath());
-
-                } catch (AlreadyInitializedException e) {
-                    // ignore
-
-                } catch (Exception e) {
-                    throw new Error(e);
-                }
-
-            } else {
-                // Database specified, already initialized by the main program.
-            }
-
-            String hostName = null;
-            int port = 0;
-            if (remoteAddress != null) {
-                hostName = remoteAddress.getHostName();
-                port = remoteAddress.getPort();
-            }
-
-            int localPort = 0;
-            InetAddress localAddr = null;
-
-            if (localAddress != null) {
-                localPort = localAddress.getPort();
-                localAddr = localAddress.getAddress();
-            }
-
-            SSLSocket socket;
-            if (sock == null) {
-                socket = new SSLSocket(InetAddress.getByName(hostName),
-                        port,
-                        localAddr,
-                        localPort,
-                        new ServerCertApprovalCB(),
-                        null);
-
-            } else {
-                socket = new SSLSocket(sock, hostName, new ServerCertApprovalCB(), null);
-            }
-
-            String certNickname = config.getCertNickname();
-            if (certNickname != null) {
-                if (verbose) System.out.println("Client certificate: "+certNickname);
-                socket.setClientCertNickname(certNickname);
-            }
-
-            return socket;
-        }
-
-        @Override
-        public boolean isSecure(Socket sock) {
-            // We only use this factory in the case of SSL Connections.
-            return true;
-        }
-
-        @Override
-        public Socket createLayeredSocket(Socket socket, String target, int port, boolean autoClose)
-                throws IOException, UnknownHostException {
-            // This method implementation is required to get SSL working.
-            return null;
-        }
-
+        this(new PKIConnection(config));
     }
 
     public <T> T createProxy(Class<T> clazz) throws URISyntaxException {
-        URI uri = new URI(config.getServerURI()+"/rest");
-        return ProxyFactory.create(clazz, uri, executor, providerFactory);
+        return connection.createProxy(clazz);
     }
 
-    @SuppressWarnings("unchecked")
     public <T> T getEntity(ClientResponse<T> response) {
-        BaseClientResponse<T> clientResponse = (BaseClientResponse<T>)response;
-        try {
-            clientResponse.checkFailureStatus();
-
-       } catch (ClientResponseFailure e) {
-            errorHandler.clientErrorHandling((BaseClientResponse<T>) e.getResponse(), e);
-
-       } catch (RuntimeException e) {
-            errorHandler.clientErrorHandling(clientResponse, e);
-       }
-
-       return response.getEntity();
-    }
-
-    public ClientResponse<String> post(String content) {
-        ClientResponse<String> response = null;
-        ClientRequest request = executor.createRequest(config.getServerURI().toString());
-        request.body(MediaType.APPLICATION_FORM_URLENCODED, content);
-        try {
-            response = request.post(String.class);
-        } catch (Exception e) {
-            e.printStackTrace();
-        }
-        return response;
-    }
-
-    public boolean isVerbose() {
-        return verbose;
-    }
-
-    public void setVerbose(boolean verbose) {
-        this.verbose = verbose;
+        return connection.getEntity(response);
     }
 }
diff --git a/base/common/src/com/netscape/certsrv/client/PKIClient.java b/base/common/src/com/netscape/certsrv/client/PKIConnection.java
similarity index 94%
copy from base/common/src/com/netscape/certsrv/client/PKIClient.java
copy to base/common/src/com/netscape/certsrv/client/PKIConnection.java
index e725faa13e97b6184d07b0737619378a95680d7e..578e1cf44ee39ec8df23d7866a732ce00ad54081 100644
--- a/base/common/src/com/netscape/certsrv/client/PKIClient.java
+++ b/base/common/src/com/netscape/certsrv/client/PKIConnection.java
@@ -54,21 +54,21 @@ import org.mozilla.jss.ssl.SSLCertificateApprovalCallback;
 import org.mozilla.jss.ssl.SSLSocket;
 
 
-public class PKIClient {
+public class PKIConnection {
 
-    protected boolean verbose;
+    boolean verbose;
 
-    protected ClientConfig config;
+    ClientConfig config;
 
-    protected ResteasyProviderFactory providerFactory;
-    protected ClientErrorHandler errorHandler;
-    protected ClientExecutor executor;
+    DefaultHttpClient httpClient = new DefaultHttpClient();
 
-    public PKIClient(ClientConfig config) {
+    ResteasyProviderFactory providerFactory;
+    ClientErrorHandler errorHandler;
+    ClientExecutor executor;
+
+    public PKIConnection(ClientConfig config) {
         this.config = config;
 
-        DefaultHttpClient httpClient = new DefaultHttpClient();
-
         // Register https scheme.
         Scheme scheme = new Scheme("https", 443, new JSSProtocolSocketFactory());
         httpClient.getConnectionManager().getSchemeRegistry().register(scheme);
@@ -287,26 +287,20 @@ public class PKIClient {
         try {
             clientResponse.checkFailureStatus();
 
-       } catch (ClientResponseFailure e) {
+        } catch (ClientResponseFailure e) {
             errorHandler.clientErrorHandling((BaseClientResponse<T>) e.getResponse(), e);
 
-       } catch (RuntimeException e) {
+        } catch (RuntimeException e) {
             errorHandler.clientErrorHandling(clientResponse, e);
-       }
+        }
 
-       return response.getEntity();
+        return response.getEntity();
     }
 
-    public ClientResponse<String> post(String content) {
-        ClientResponse<String> response = null;
+    public ClientResponse<String> post(String content) throws Exception {
         ClientRequest request = executor.createRequest(config.getServerURI().toString());
         request.body(MediaType.APPLICATION_FORM_URLENCODED, content);
-        try {
-            response = request.post(String.class);
-        } catch (Exception e) {
-            e.printStackTrace();
-        }
-        return response;
+        return request.post(String.class);
     }
 
     public boolean isVerbose() {
diff --git a/base/common/src/com/netscape/certsrv/group/GroupClient.java b/base/common/src/com/netscape/certsrv/group/GroupClient.java
index 43d0ae5d59f6068f1dca338fe255360b94c7f291..2f7041b3128965194623aadd99500acb8782e7cc 100644
--- a/base/common/src/com/netscape/certsrv/group/GroupClient.java
+++ b/base/common/src/com/netscape/certsrv/group/GroupClient.java
@@ -23,6 +23,7 @@ import org.jboss.resteasy.client.ClientResponse;
 
 import com.netscape.certsrv.client.ClientConfig;
 import com.netscape.certsrv.client.PKIClient;
+import com.netscape.certsrv.client.PKIConnection;
 
 /**
  * @author Endi S. Dewata
@@ -32,9 +33,17 @@ public class GroupClient extends PKIClient {
     public GroupResource groupClient;
     public GroupMemberResource groupMemberClient;
 
+    public GroupClient(PKIConnection connection) throws URISyntaxException {
+        super(connection);
+        init();
+    }
+
     public GroupClient(ClientConfig config) throws URISyntaxException {
         super(config);
+        init();
+    }
 
+    public void init() throws URISyntaxException {
         groupClient = createProxy(GroupResource.class);
         groupMemberClient = createProxy(GroupMemberResource.class);
     }
diff --git a/base/common/src/com/netscape/certsrv/kra/DRMClient.java b/base/common/src/com/netscape/certsrv/kra/DRMClient.java
index 3454e0995c505daa3d02b445b0237d1c70204c17..de2642eb14ccae885ddb1872ed8c99db79469fc2 100644
--- a/base/common/src/com/netscape/certsrv/kra/DRMClient.java
+++ b/base/common/src/com/netscape/certsrv/kra/DRMClient.java
@@ -9,6 +9,7 @@ import org.jboss.resteasy.client.ClientResponse;
 import com.netscape.certsrv.cert.CertData;
 import com.netscape.certsrv.client.ClientConfig;
 import com.netscape.certsrv.client.PKIClient;
+import com.netscape.certsrv.client.PKIConnection;
 import com.netscape.certsrv.dbs.keydb.KeyId;
 import com.netscape.certsrv.key.KeyArchivalRequest;
 import com.netscape.certsrv.key.KeyData;
@@ -29,9 +30,17 @@ public class DRMClient  extends PKIClient {
     private KeyRequestResource keyRequestClient;
     private SystemCertResource systemCertClient;
 
+    public DRMClient(PKIConnection connection) throws URISyntaxException {
+        super(connection);
+        init();
+    }
+
     public DRMClient(ClientConfig config) throws URISyntaxException {
         super(config);
+        init();
+    }
 
+    public void init() throws URISyntaxException {
         systemCertClient = createProxy(SystemCertResource.class);
         keyRequestClient = createProxy(KeyRequestResource.class);
         keyClient = createProxy(KeyResource.class);
diff --git a/base/common/src/com/netscape/certsrv/system/SystemConfigClient.java b/base/common/src/com/netscape/certsrv/system/SystemConfigClient.java
index fd14bbe19efda2d742d9c03939d3f96753a36d4f..4ccf152b35c9ee66be4b85ee39b7b89df5eb36ab 100644
--- a/base/common/src/com/netscape/certsrv/system/SystemConfigClient.java
+++ b/base/common/src/com/netscape/certsrv/system/SystemConfigClient.java
@@ -21,6 +21,7 @@ import java.net.URISyntaxException;
 
 import com.netscape.certsrv.client.ClientConfig;
 import com.netscape.certsrv.client.PKIClient;
+import com.netscape.certsrv.client.PKIConnection;
 
 
 /**
@@ -31,9 +32,17 @@ public class SystemConfigClient extends PKIClient {
 
     private SystemConfigResource configClient;
 
+    public SystemConfigClient(PKIConnection connection) throws URISyntaxException {
+        super(connection);
+        init();
+    }
+
     public SystemConfigClient(ClientConfig config) throws URISyntaxException {
         super(config);
+        init();
+    }
 
+    public void init() throws URISyntaxException {
         configClient = createProxy(SystemConfigResource.class);
     }
 
diff --git a/base/common/src/com/netscape/certsrv/user/UserClient.java b/base/common/src/com/netscape/certsrv/user/UserClient.java
index 95960e53ff8f6b5438b1ebfadb082aed25f6627a..23136200dfa7f5d4d0f55c2571c06e7812aa9d1a 100644
--- a/base/common/src/com/netscape/certsrv/user/UserClient.java
+++ b/base/common/src/com/netscape/certsrv/user/UserClient.java
@@ -23,6 +23,7 @@ import org.jboss.resteasy.client.ClientResponse;
 
 import com.netscape.certsrv.client.ClientConfig;
 import com.netscape.certsrv.client.PKIClient;
+import com.netscape.certsrv.client.PKIConnection;
 
 /**
  * @author Endi S. Dewata
@@ -32,9 +33,17 @@ public class UserClient extends PKIClient {
     public UserResource userClient;
     public UserCertResource userCertClient;
 
+    public UserClient(PKIConnection connection) throws URISyntaxException {
+        super(connection);
+        init();
+    }
+
     public UserClient(ClientConfig config) throws URISyntaxException {
         super(config);
+        init();
+    }
 
+    public void init() throws URISyntaxException {
         userClient = createProxy(UserResource.class);
         userCertClient = createProxy(UserCertResource.class);
     }
diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java b/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
index 531fc212faf735f3b5b9ac7b2f60eee6abd83676..e247b42973cb795334b00f6e53c03f170b139fa5 100644
--- a/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
+++ b/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
@@ -139,7 +139,7 @@ import com.netscape.certsrv.base.IConfigStore;
 import com.netscape.certsrv.base.ISubsystem;
 import com.netscape.certsrv.ca.ICertificateAuthority;
 import com.netscape.certsrv.client.ClientConfig;
-import com.netscape.certsrv.client.PKIClient;
+import com.netscape.certsrv.client.PKIConnection;
 import com.netscape.certsrv.dbs.IDBSubsystem;
 import com.netscape.certsrv.dbs.crldb.ICRLIssuingPointRecord;
 import com.netscape.certsrv.ldap.ILdapConnFactory;
@@ -205,15 +205,15 @@ public class ConfigurationUtils {
     public static ClientResponse<String> getClientResponse(String hostname, int port, boolean secure,
             String path, String content, String clientnickname,
             SSLCertificateApprovalCallback certApprovalCallback)
-            throws URISyntaxException {
+            throws Exception {
 
         String protocol = secure ? "https" : "http";
         ClientConfig config = new ClientConfig();
         config.setServerURI(protocol + "://" + hostname + ":" + port + path);
         config.setCertNickname(clientnickname);
 
-        PKIClient client = new PKIClient(config);
-        ClientResponse<String> response = client.post(content);
+        PKIConnection connection = new PKIConnection(config);
+        ClientResponse<String> response = connection.post(content);
 
         return response;
     }
@@ -311,8 +311,7 @@ public class ConfigurationUtils {
         }
     }
 
-    public static String getInstallToken(String sdhost, int sdport, String user, String passwd)
-            throws EPropertyNotFound, EBaseException, URISyntaxException, IOException {
+    public static String getInstallToken(String sdhost, int sdport, String user, String passwd) throws Exception {
         IConfigStore cs = CMS.getConfigStore();
         boolean oldtoken = cs.getBoolean("cs.useOldTokenInterface", true);
 
@@ -343,8 +342,7 @@ public class ConfigurationUtils {
         }
     }
 
-    public static String getOldCookie(String sdhost, int sdport, String user, String passwd) throws IOException,
-            EPropertyNotFound, EBaseException, URISyntaxException {
+    public static String getOldCookie(String sdhost, int sdport, String user, String passwd) throws Exception {
         IConfigStore cs = CMS.getConfigStore();
 
         String subca_url = "https://" + CMS.getEEHost() + ":"
diff --git a/base/java-tools/src/com/netscape/cmstools/cert/CertCLI.java b/base/java-tools/src/com/netscape/cmstools/cert/CertCLI.java
index 6857b689ee6bb834f1560e9d806db939e9c34aee..034a12649441291f4d0f196b03bed862a9e4ce82 100644
--- a/base/java-tools/src/com/netscape/cmstools/cert/CertCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/cert/CertCLI.java
@@ -76,8 +76,7 @@ public class CertCLI extends CLI {
 
     public void execute(String[] args) throws Exception {
 
-        client = new CertClient(parent.config);
-        client.setVerbose(verbose);
+        client = new CertClient(parent.connection);
 
         if (args.length == 0) {
             printHelp();
diff --git a/base/java-tools/src/com/netscape/cmstools/cert/CertRequestApproveCLI.java b/base/java-tools/src/com/netscape/cmstools/cert/CertRequestApproveCLI.java
index 98a3a2b4f86cf22b931dfe995decb03651ef6f98..0c6db8a9034c910abc22add1f9f4de76c0cd9237 100644
--- a/base/java-tools/src/com/netscape/cmstools/cert/CertRequestApproveCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/cert/CertRequestApproveCLI.java
@@ -1,16 +1,13 @@
 package com.netscape.cmstools.cert;
 
 import java.io.FileInputStream;
-import java.io.FileNotFoundException;
 
 import javax.xml.bind.JAXBContext;
-import javax.xml.bind.JAXBException;
 import javax.xml.bind.Unmarshaller;
 
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.ParseException;
 
-import com.netscape.certsrv.base.PKIException;
 import com.netscape.certsrv.cert.CertReviewResponse;
 import com.netscape.cmstools.cli.CLI;
 import com.netscape.cmstools.cli.MainCLI;
@@ -24,7 +21,7 @@ public class CertRequestApproveCLI extends CLI {
     }
 
     @Override
-    public void execute(String[] args) {
+    public void execute(String[] args) throws Exception {
         CommandLine cmd = null;
 
         try {
@@ -42,23 +39,15 @@ public class CertRequestApproveCLI extends CLI {
             printHelp();
             System.exit(-1);
         }
-        CertReviewResponse reviewInfo = null;
-        try {
-            JAXBContext context = JAXBContext.newInstance(CertReviewResponse.class);
-            Unmarshaller unmarshaller = context.createUnmarshaller();
-            FileInputStream fis = new FileInputStream(cLineArgs[0].trim());
-            reviewInfo = (CertReviewResponse) unmarshaller.unmarshal(fis);
-            parent.client.approveRequest(reviewInfo.getRequestId(), reviewInfo);
-        } catch (PKIException e) {
-            System.err.println(e.getMessage());
-            System.exit(-1);
-        } catch (JAXBException e) {
-            System.err.println("Error: " + e.getMessage());
-            System.exit(-1);
-        } catch (FileNotFoundException e) {
-            System.err.println("Error: " + e.getMessage());
-            System.exit(-1);
-        }
+
+        FileInputStream fis = new FileInputStream(cLineArgs[0].trim());
+
+        JAXBContext context = JAXBContext.newInstance(CertReviewResponse.class);
+        Unmarshaller unmarshaller = context.createUnmarshaller();
+        CertReviewResponse reviewInfo = (CertReviewResponse) unmarshaller.unmarshal(fis);
+
+        parent.client.approveRequest(reviewInfo.getRequestId(), reviewInfo);
+
         MainCLI.printMessage("Approved certificate request " + reviewInfo.getRequestId().toString());
     }
 
diff --git a/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java b/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java
index bcc3bb27e4dff1a0046e89279183e88fb6197ce9..6f1c4909f359df094a9635300d313cedca3f43f3 100644
--- a/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java
@@ -31,6 +31,7 @@ import org.mozilla.jss.util.IncorrectPasswordException;
 import org.mozilla.jss.util.Password;
 
 import com.netscape.certsrv.client.ClientConfig;
+import com.netscape.certsrv.client.PKIConnection;
 import com.netscape.cmstools.cert.CertCLI;
 import com.netscape.cmstools.group.GroupCLI;
 import com.netscape.cmstools.system.SecurityDomainCLI;
@@ -43,6 +44,8 @@ public class MainCLI extends CLI {
 
     public ClientConfig config = new ClientConfig();
 
+    public PKIConnection connection;
+
     public MainCLI() throws Exception {
         super("pki", "PKI command-line interface");
 
@@ -161,6 +164,11 @@ public class MainCLI extends CLI {
             config.setPassword(password);
     }
 
+    public void connect() throws Exception {
+        connection = new PKIConnection(config);
+        connection.setVerbose(verbose);
+    }
+
     public void execute(String[] args) throws Exception {
 
         CLI module;
@@ -268,6 +276,8 @@ public class MainCLI extends CLI {
                 }
             }
 
+            connect();
+
             // execute module command
             module.execute(moduleArgs);
 
diff --git a/base/java-tools/src/com/netscape/cmstools/group/GroupCLI.java b/base/java-tools/src/com/netscape/cmstools/group/GroupCLI.java
index ce28af24375ab38e39da2d9cb2717a9ec12abcd8..b2c38d8086570121468882febd4a1af969733c7f 100644
--- a/base/java-tools/src/com/netscape/cmstools/group/GroupCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/group/GroupCLI.java
@@ -75,8 +75,7 @@ public class GroupCLI extends CLI {
 
     public void execute(String[] args) throws Exception {
 
-        client = new GroupClient(parent.config);
-        client.setVerbose(verbose);
+        client = new GroupClient(parent.connection);
 
         if (args.length == 0) {
             printHelp();
diff --git a/base/java-tools/src/com/netscape/cmstools/system/SecurityDomainCLI.java b/base/java-tools/src/com/netscape/cmstools/system/SecurityDomainCLI.java
index 93c4c4b631e50770edba457fecff41e338c947f6..a6441e2fccebedc3ae972cea036b953768d46c63 100644
--- a/base/java-tools/src/com/netscape/cmstools/system/SecurityDomainCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/system/SecurityDomainCLI.java
@@ -65,7 +65,6 @@ public class SecurityDomainCLI extends CLI {
     public void execute(String[] args) throws Exception {
 
         client = new SecurityDomainClient(parent.config);
-        client.setVerbose(verbose);
 
         if (args.length == 0) {
             printHelp();
diff --git a/base/java-tools/src/com/netscape/cmstools/user/UserCLI.java b/base/java-tools/src/com/netscape/cmstools/user/UserCLI.java
index 301754a22a00adeff3422c518d75f1b8036c1f31..8c24d1746879081079b515379537c3433428a593 100644
--- a/base/java-tools/src/com/netscape/cmstools/user/UserCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/user/UserCLI.java
@@ -76,8 +76,7 @@ public class UserCLI extends CLI {
 
     public void execute(String[] args) throws Exception {
 
-        client = new UserClient(parent.config);
-        client.setVerbose(verbose);
+        client = new UserClient(parent.connection);
 
         if (args.length == 0) {
             printHelp();
-- 
1.7.11.4

