From cd01ffdba387e17cec779c62e24ddd17c0c1ad54 Mon Sep 17 00:00:00 2001
From: Matthew Harmsen <mharmsen@redhat.com>
Date: Wed, 8 Aug 2012 13:41:46 -0700
Subject: [PATCH] PKI Deployment Scriptlets

* TRAC Ticket #184 - Dogtag 10: Update PKI Deployment to handle
  cloning CA/KRA/OCSP/TKS . . .
* TRAC Ticket #285 - Dogtag 10: Fix installation issues for
  KRA, OCSP, and TKS
---
 base/deploy/config/pkideployment.cfg    |    1 +
 base/deploy/src/scriptlets/pkijython.py |   13 +++++++++++-
 base/deploy/src/scriptlets/pkiparser.py |   33 +++++++++++++++++++++++++++++++
 3 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/base/deploy/config/pkideployment.cfg b/base/deploy/config/pkideployment.cfg
index ae02bb4..80816e4 100644
--- a/base/deploy/config/pkideployment.cfg
+++ b/base/deploy/config/pkideployment.cfg
@@ -57,6 +57,7 @@ pki_ds_ldaps_port=636
 pki_ds_remove_data=True
 pki_ds_secure_connection=False
 pki_group=pkiuser
+pki_issuing_ca=
 pki_restart_configured_instance=True
 pki_security_domain_hostname=
 pki_security_domain_https_port=8443
diff --git a/base/deploy/src/scriptlets/pkijython.py b/base/deploy/src/scriptlets/pkijython.py
index e08b490..996f0bd 100644
--- a/base/deploy/src/scriptlets/pkijython.py
+++ b/base/deploy/src/scriptlets/pkijython.py
@@ -180,7 +180,7 @@ def generateCRMFRequest(token, keysize, subjectdn, dualkey):
         # 1st : Encryption key
         s1.addElement(crmfMsg)
         # 2nd : Signing Key
-        if dualkey:
+        if config.str2bool(dualkey):
             javasystem.out.println(log.PKI_JYTHON_IS_DUALKEY)
             seq1 = SEQUENCE()
             certReqSigning = CertRequest(INTEGER(1), certTemplate, seq1)
@@ -420,6 +420,17 @@ class rest_client:
                     else:
                         javasystem.out.println(log.PKI_JYTHON_CRMF_SUPPORT_ONLY)
                         javasystem.exit(1)
+            # Issuing CA Information
+            if master['pki_instance_type'] == "Tomcat":
+                if not config.str2bool(master['pki_clone']):
+                    if master['pki_subsystem'] == "CA":
+                        if config.str2bool(master['pki_external']) or\
+                           config.str2bool(master['pki_subordinate']):
+                            # External CA or Subordinate CA
+                            data.setIssuingCA(master['pki_issuing_ca'])
+                    else:
+                        # PKI KRA, PKI OCSP, or PKI TKS
+                        data.setIssuingCA(master['pki_issuing_ca'])
             # Create system certs
             systemCerts = ArrayList()
             # Create 'CA Signing Certificate'
diff --git a/base/deploy/src/scriptlets/pkiparser.py b/base/deploy/src/scriptlets/pkiparser.py
index bf22a4d..34bd85a 100644
--- a/base/deploy/src/scriptlets/pkiparser.py
+++ b/base/deploy/src/scriptlets/pkiparser.py
@@ -1455,6 +1455,7 @@ def compose_pki_master_dictionary():
         #     The following variables are established via the specified PKI
         #     deployment configuration file and potentially overridden below:
         #
+        #         config.pki_master_dict['pki_issuing_ca']
         #         config.pki_master_dict['pki_security_domain_hostname']
         #         config.pki_master_dict['pki_security_domain_name']
         #         config.pki_master_dict['pki_subsystem_name']
@@ -1475,6 +1476,11 @@ def compose_pki_master_dictionary():
                 config.pki_master_dict['pki_security_domain_name'] =\
                     config.pki_master_dict['pki_dns_domainname'] +\
                     " " + "Security Domain"
+            if not len(config.pki_master_dict['pki_issuing_ca']):
+                # Guess that it is the same as the
+                # config.pki_master_dict['pki_security_domain_uri']
+                config.pki_master_dict['pki_issuing_ca'] =\
+                    config.pki_master_dict['pki_security_domain_uri']
         elif config.pki_subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
             if config.pki_subsystem == "CA":
                 if config.str2bool(config.pki_master_dict['pki_external']):
@@ -1486,6 +1492,9 @@ def compose_pki_master_dictionary():
                             "External CA" + " " +\
                             config.pki_master_dict['pki_hostname'] + " " +\
                             config.pki_master_dict['pki_https_port']
+                    if not len(config.pki_master_dict['pki_issuing_ca']):
+                        config.pki_master_dict['pki_issuing_ca'] =\
+                            "External CA"
                 elif not config.str2bool(config.pki_master_dict['pki_clone'])\
                      and not\
                      config.str2bool(config.pki_master_dict['pki_subordinate']):
@@ -1537,6 +1546,12 @@ def compose_pki_master_dictionary():
                                 "Subordinate CA" + " " +\
                                 config.pki_master_dict['pki_hostname'] + " " +\
                                 config.pki_master_dict['pki_https_port']
+                        if not len(config.pki_master_dict['pki_issuing_ca']):
+                            # Guess that it is the same as the
+                            # config.pki_master_dict['pki_security_domain_uri']
+                            config.pki_master_dict['pki_issuing_ca'] =\
+                                config.pki_master_dict\
+                                ['pki_security_domain_uri']
             else:
                 # PKI or Cloned KRA, OCSP, or TKS
                 config.pki_master_dict['pki_security_domain_type'] = "existing"
@@ -1572,6 +1587,12 @@ def compose_pki_master_dictionary():
                                 "PKI KRA" + " " +\
                                 config.pki_master_dict['pki_hostname'] + " " +\
                                 config.pki_master_dict['pki_https_port']
+                        if not len(config.pki_master_dict['pki_issuing_ca']):
+                            # Guess that it is the same as the
+                            # config.pki_master_dict['pki_security_domain_uri']
+                            config.pki_master_dict['pki_issuing_ca'] =\
+                                config.pki_master_dict\
+                                ['pki_security_domain_uri']
                 elif config.pki_subsystem == "OCSP":
                     if config.str2bool(config.pki_master_dict['pki_clone']):
                         # Cloned OCSP
@@ -1589,6 +1610,12 @@ def compose_pki_master_dictionary():
                                 "PKI OCSP" + " " +\
                                 config.pki_master_dict['pki_hostname'] + " " +\
                                 config.pki_master_dict['pki_https_port']
+                        if not len(config.pki_master_dict['pki_issuing_ca']):
+                            # Guess that it is the same as the
+                            # config.pki_master_dict['pki_security_domain_uri']
+                            config.pki_master_dict['pki_issuing_ca'] =\
+                                config.pki_master_dict\
+                                ['pki_security_domain_uri']
                 elif config.pki_subsystem == "TKS":
                     if config.str2bool(config.pki_master_dict['pki_clone']):
                         # Cloned TKS
@@ -1606,6 +1633,12 @@ def compose_pki_master_dictionary():
                                 "PKI TKS" + " " +\
                                 config.pki_master_dict['pki_hostname'] + " " +\
                                 config.pki_master_dict['pki_https_port']
+                        if not len(config.pki_master_dict['pki_issuing_ca']):
+                            # Guess that it is the same as the
+                            # config.pki_master_dict['pki_security_domain_uri']
+                            config.pki_master_dict['pki_issuing_ca'] =\
+                                config.pki_master_dict\
+                                ['pki_security_domain_uri']
         # Jython scriptlet
         # 'Directory Server' Configuration name/value pairs
         #
-- 
1.7.10.4

