>From 835630d471a76d436694fc468b09ace67748d58f Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Wed, 29 Feb 2012 23:31:15 -0500
Subject: [PATCH] Fixes to cloning and security domain tables for client auth
 internaldb user

The mechanism for getting an ldap connection to the internaldb was incorrect,
both in the Security Domain Session Table and the DatabasePanel.  As a result,
connections to the internaldb failed for accessing the security domain session
table and when trying to clone a master which connects to its database using
client auth.

The thread that handles reading the security domain session table is now only
instantiated when running on a configured security domain master.

Additionally, needed acls for the client auth certificate ldap user have been
moved to manager.ldif.  This includes acls to allow creation and management of
replication agreements and replication users (now being created under
ou=csusers, cn=config)

Ticket #5
---
 pki/base/ca/shared/conf/CS.cfg.in                  |    1 +
 pki/base/ca/shared/conf/manager.ldif               |   48 ++++++
 .../servlet/csadmin/AdminAuthenticatePanel.java    |   13 +-
 .../cms/servlet/csadmin/DatabasePanel.java         |  155 +++++++++-----------
 .../csadmin/LDAPSecurityDomainSessionTable.java    |  103 +++----------
 .../cms/servlet/csadmin/RestoreKeyCertPanel.java   |   13 +-
 .../cms/servlet/csadmin/WizardPanelBase.java       |   30 +++--
 .../src/com/netscape/cmscore/apps/CMSEngine.java   |   23 ++--
 pki/base/kra/shared/conf/CS.cfg.in                 |    1 +
 pki/base/kra/shared/conf/manager.ldif              |   48 ++++++
 pki/base/ocsp/shared/conf/CS.cfg.in                |    1 +
 pki/base/ocsp/shared/conf/manager.ldif             |   48 ++++++
 pki/base/tks/shared/conf/CS.cfg.in                 |    1 +
 pki/base/tks/shared/conf/manager.ldif              |   48 ++++++
 14 files changed, 333 insertions(+), 200 deletions(-)
 create mode 100644 pki/base/ca/shared/conf/manager.ldif
 create mode 100644 pki/base/kra/shared/conf/manager.ldif
 create mode 100644 pki/base/ocsp/shared/conf/manager.ldif
 create mode 100644 pki/base/tks/shared/conf/manager.ldif

diff --git a/pki/base/ca/shared/conf/CS.cfg.in b/pki/base/ca/shared/conf/CS.cfg.in
index 1ba0d2f403464c035829c737077027e61236c95a..980ed58544b8a4fee3f196cd244d025af7e7221a 100644
--- a/pki/base/ca/shared/conf/CS.cfg.in
+++ b/pki/base/ca/shared/conf/CS.cfg.in
@@ -818,6 +818,7 @@ preop.internaldb.schema.ldif=/usr/share/[PKI_FLAVOR]/ca/conf/schema.ldif
 preop.internaldb.ldif=/usr/share/[PKI_FLAVOR]/ca/conf/database.ldif
 preop.internaldb.data_ldif=/usr/share/[PKI_FLAVOR]/ca/conf/db.ldif,/usr/share/[PKI_FLAVOR]/ca/conf/acl.ldif
 preop.internaldb.index_ldif=
+preop.internaldb.manager_ldif=/usr/share/[PKI_FLAVOR]/ca/conf/manager.ldif
 preop.internaldb.post_ldif=/usr/share/[PKI_FLAVOR]/ca/conf/index.ldif,/usr/share/[PKI_FLAVOR]/ca/conf/vlv.ldif,/usr/share/[PKI_FLAVOR]/ca/conf/vlvtasks.ldif
 preop.internaldb.wait_dn=cn=index1160589769, cn=index, cn=tasks, cn=config
 internaldb.multipleSuffix.enable=false
diff --git a/pki/base/ca/shared/conf/manager.ldif b/pki/base/ca/shared/conf/manager.ldif
new file mode 100644
index 0000000000000000000000000000000000000000..52e486987d721d799112ef61475e1a45ec19f1be
--- /dev/null
+++ b/pki/base/ca/shared/conf/manager.ldif
@@ -0,0 +1,48 @@
+# acis for cert manager
+
+dn: ou=csusers,cn=config
+objectClass: top
+objectClass: organizationalUnit
+ou: csusers
+
+dn: {rootSuffix}
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0; acl "cert manager access"; allow (all) userdn = "ldap:///{dbuser}";)
+
+dn: cn=ldbm database,cn=plugins,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0; acl "Cert Manager access for VLV searches"; allow (read) userdn="ldap:///{dbuser}";)
+
+dn: cn=config
+changetype: modify
+add: aci
+aci: (targetattr != aci)(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///{dbuser}";)
+
+dn: ou=csusers,cn=config
+changetype: modify
+add: aci
+aci: (targetattr != aci)(version 3.0; aci "cert manager manage replication users"; allow (all) userdn = "ldap:///{dbuser}";)
+
+dn: cn="{rootSuffix}",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///{dbuser}";)
+
+dn: cn="{rootSuffix}",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///{dbuser}";)
+
+dn: cn="{rootSuffix}",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///{dbuser}";)
+
+dn: cn=tasks,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///{dbuser}";)
+
+
diff --git a/pki/base/common/src/com/netscape/cms/servlet/csadmin/AdminAuthenticatePanel.java b/pki/base/common/src/com/netscape/cms/servlet/csadmin/AdminAuthenticatePanel.java
index 7912486f5afd29e3e821523325c0d52dafb3d309..b8cc8022e2bc6070c75ecc498c4ab16e6acc69fc 100644
--- a/pki/base/common/src/com/netscape/cms/servlet/csadmin/AdminAuthenticatePanel.java
+++ b/pki/base/common/src/com/netscape/cms/servlet/csadmin/AdminAuthenticatePanel.java
@@ -249,14 +249,13 @@ public class AdminAuthenticatePanel extends WizardPanelBase {
             if (!cstype.equals("ca")) {
                 c1.append(",preop.ca.hostname,preop.ca.httpport,preop.ca.httpsport,preop.ca.list,preop.ca.pkcs7,preop.ca.type");
             }
-
+            s1.append(",internaldb,internaldb.ldapauth,internaldb.ldapconn");
             String content =
-                    "uid="
-                            + uid
-                            + "&pwd="
-                            + pwd
-                            + "&op=get&names=cloning.module.token,instanceId,internaldb.basedn,internaldb.ldapauth.password,internaldb.replication.password,internaldb.ldapconn.host,internaldb.ldapconn.port,internaldb.ldapauth.bindDN"
-                            + c1.toString() + "&substores=" + s1.toString();
+                    "uid=" + uid
+                    + "&pwd=" + pwd
+                    + "&op=get&names=cloning.module.token,instanceId,"
+                    + "internaldb.ldapauth.password,internaldb.replication.password"
+                    + c1.toString() + "&substores=" + s1.toString();
 
             boolean success = updateConfigEntries(host, httpsport, true,
                     "/" + cstype + "/admin/" + cstype + "/getConfigEntries", content, config,
diff --git a/pki/base/common/src/com/netscape/cms/servlet/csadmin/DatabasePanel.java b/pki/base/common/src/com/netscape/cms/servlet/csadmin/DatabasePanel.java
index 5615c6dfb012adcb502f7b4531f26c19834ffccb..71338099ba51c4dc1b8b660a322fd9bacfddcdc9 100644
--- a/pki/base/common/src/com/netscape/cms/servlet/csadmin/DatabasePanel.java
+++ b/pki/base/common/src/com/netscape/cms/servlet/csadmin/DatabasePanel.java
@@ -52,6 +52,7 @@ import com.netscape.certsrv.base.EBaseException;
 import com.netscape.certsrv.base.IConfigStore;
 import com.netscape.certsrv.ca.ICertificateAuthority;
 import com.netscape.certsrv.dbs.IDBSubsystem;
+import com.netscape.certsrv.ldap.ILdapConnFactory;
 import com.netscape.certsrv.property.Descriptor;
 import com.netscape.certsrv.property.IDescriptor;
 import com.netscape.certsrv.property.PropertySet;
@@ -318,8 +319,8 @@ public class DatabasePanel extends WizardPanelBase {
             String masterport = "";
             String masterbasedn = "";
             try {
-                masterhost = cs.getString("preop.internaldb.master.hostname", "");
-                masterport = cs.getString("preop.internaldb.master.port", "");
+                masterhost = cs.getString("preop.internaldb.master.ldapconn.host", "");
+                masterport = cs.getString("preop.internaldb.master.ldapconn.port", "");
                 masterbasedn = cs.getString("preop.internaldb.master.basedn", "");
             } catch (Exception e) {
             }
@@ -518,13 +519,10 @@ public class DatabasePanel extends WizardPanelBase {
         String baseDN = "";
         String database = "";
         String dn = "";
-        String dbuser = "";
 
         try {
             baseDN = cs.getString("internaldb.basedn");
             database = cs.getString("internaldb.database", "");
-            dbuser = "uid=" + cs.getString("cs.type") + "-" + cs.getString("machineName") + "-"
-                    + cs.getString("service.securePort") + ",ou=people," + baseDN;
         } catch (Exception e) {
             CMS.debug("DatabasePanel populateDB: " + e.toString());
             throw new IOException(
@@ -656,10 +654,6 @@ public class DatabasePanel extends WizardPanelBase {
             attrs.add(new LDAPAttribute("objectClass", oc3));
             attrs.add(new LDAPAttribute(n, v));
 
-            String dbuserACI = "(targetattr=\"*\")(version 3.0; acl \"Cert Manager access\"; allow (all) userdn=\"ldap:///"
-                    + dbuser + "\";)";
-            CMS.debug("ACI string is ["+ dbuserACI + "]");
-            attrs.add(new LDAPAttribute("aci", dbuserACI));
             LDAPEntry entry = new LDAPEntry(baseDN, attrs);
             conn.add(entry);
         } catch (Exception e) {
@@ -727,23 +721,6 @@ public class DatabasePanel extends WizardPanelBase {
             throw new IOException("Failed to find base DN");
         }
 
-        // add dbuser aci to cn=config
-        String dbuserACI = "(targetattr=\"*\")(version 3.0; acl \"Cert Manager access\"; allow (read) userdn=\"ldap:///"
-                + dbuser + "\";)";
-        CMS.debug("ACI string is [" + dbuserACI + "]");
-        String configDN = "cn=ldbm database,cn=plugins,cn=config";
-        try {
-
-            LDAPAttribute attr = new LDAPAttribute("aci", dbuserACI);
-            LDAPModification mod = new LDAPModification(LDAPModification.ADD, attr);
-            conn.modify(configDN, mod);
-        } catch (LDAPException e) {
-            if (e.getLDAPResultCode() != LDAPException.ATTRIBUTE_OR_VALUE_EXISTS) {
-                e.printStackTrace();
-                throw new IOException("Failed to add aci to " + configDN);
-            }
-        }
-
         String select = "";
         try {
             select = cs.getString("preop.subsystem.select", "");
@@ -753,9 +730,9 @@ public class DatabasePanel extends WizardPanelBase {
         if (select.equals("clone")) {
             // if this is clone, add index before replication
             // don't put in the schema or bad things will happen
-
             importLDIFS("preop.internaldb.ldif", conn);
             importLDIFS("preop.internaldb.index_ldif", conn);
+            importLDIFS("preop.internaldb.manager_ldif", conn);
         } else {
             // data will be replicated from the master to the clone
             // so clone does not need the data
@@ -765,6 +742,7 @@ public class DatabasePanel extends WizardPanelBase {
             importLDIFS("preop.internaldb.ldif", conn);
             importLDIFS("preop.internaldb.data_ldif", conn);
             importLDIFS("preop.internaldb.index_ldif", conn);
+            importLDIFS("preop.internaldb.manager_ldif", conn);
         }
 
         try {
@@ -821,6 +799,16 @@ public class DatabasePanel extends WizardPanelBase {
             throw new IOException("instanceId is missing");
         }
 
+        String dbuser = null;
+        try {
+            dbuser = "uid=" + cs.getString("cs.type") + "-" + cs.getString("machineName") + "-"
+                    + cs.getString("service.securePort") + ",ou=people," + baseDN;
+        } catch (EBaseException e) {
+            CMS.debug("Unable to construct dbuser" + e.toString());
+            e.printStackTrace();
+            throw new IOException("unable to construct dbuser");
+        }
+
         String configDir = instancePath + File.separator + "conf";
 
         while (tokenizer.hasMoreTokens()) {
@@ -862,6 +850,8 @@ public class DatabasePanel extends WizardPanelBase {
                                 ps.print(baseDN);
                             } else if (tok.equals("database")) {
                                 ps.print(database);
+                            } else if (tok.equals("dbuser")) {
+                                ps.print(dbuser);
                             }
                             if ((s.length() + 1) == n1) {
                                 endOfline = true;
@@ -899,6 +889,7 @@ public class DatabasePanel extends WizardPanelBase {
 
         context.put("firsttime", "false");
         try {
+            @SuppressWarnings("unused")
             String s = cs.getString("preop.database.removeData"); // check whether it's first time
         } catch (Exception e) {
             context.put("firsttime", "true");
@@ -1087,7 +1078,6 @@ public class DatabasePanel extends WizardPanelBase {
 
     private void setupReplication(HttpServletRequest request,
                   Context context, String secure, String cloneStartTLS) throws IOException {
-        String bindpwd = HttpInput.getPassword(request, "__bindpwd");
         IConfigStore cs = CMS.getConfigStore();
 
         String cstype = "";
@@ -1112,46 +1102,49 @@ public class DatabasePanel extends WizardPanelBase {
         } catch (Exception e) {
         }
 
-        String master1_hostname = "";
-        int master1_port = -1;
-        String master1_binddn = "";
-        String master1_bindpwd = "";
-        String master1_replicationpwd = "";
-
+        // get connection to master
+        LDAPConnection masterConn = null;
+        ILdapConnFactory masterFactory = null;
         try {
-            master1_hostname = cs.getString("preop.internaldb.master.hostname", "");
-            master1_port = cs.getInteger("preop.internaldb.master.port", -1);
-            master1_binddn = cs.getString("preop.internaldb.master.binddn", "");
-            master1_bindpwd = cs.getString("preop.internaldb.master.bindpwd", "");
-            master1_replicationpwd = cs.getString("preop.internaldb.master.replicationpwd", "");
+            IConfigStore masterCfg = cs.getSubStore("preop.internaldb.master");
+            masterFactory = CMS.getLdapBoundConnFactory();
+            masterFactory.init(masterCfg);
+            masterConn = masterFactory.getConn();
         } catch (Exception e) {
+            CMS.debug("Failed to set up connection to master:" + e.toString());
+            e.printStackTrace();
+            throw new IOException("Failed to set up replication: No connection to master");
         }
 
-        String master2_hostname = "";
-        int master2_port = -1;
-        String master2_binddn = "";
-        String master2_bindpwd = "";
-        String master2_replicationpwd = "";
-
+        // get connection to replica
+        LDAPConnection replicaConn = null;
+        ILdapConnFactory replicaFactory = null;
         try {
-            master2_hostname = cs.getString("internaldb.ldapconn.host", "");
-            master2_port = cs.getInteger("internaldb.ldapconn.port", -1);
-            master2_binddn = cs.getString("internaldb.ldapauth.bindDN", "");
-            master2_bindpwd = bindpwd;
-            master2_replicationpwd = cs.getString("preop.internaldb.replicationpwd", "");
+            IConfigStore replicaCfg = cs.getSubStore("internaldb");
+            replicaFactory = CMS.getLdapBoundConnFactory();
+            replicaFactory.init(replicaCfg);
+            replicaConn = replicaFactory.getConn();
         } catch (Exception e) {
+            CMS.debug("Failed to set up connection to replica:" + e.toString());
+            e.printStackTrace();
+            throw new IOException("Failed to set up replication: No connection to replica");
         }
 
-        LDAPConnection conn1 = null;
-        LDAPConnection conn2 = null;
-        if (secure.equals("true")) {
-            CMS.debug("DatabasePanel setupReplication: creating secure (SSL) connections for internal ldap");
-            conn1 = new LDAPConnection(CMS.getLdapJssSSLSocketFactory());
-            conn2 = new LDAPConnection(CMS.getLdapJssSSLSocketFactory());
-        } else {
-            CMS.debug("DatabasePanel setupreplication: creating non-secure (non-SSL) connections for internal ldap");
-            conn1 = new LDAPConnection();
-            conn2 = new LDAPConnection();
+        String master_hostname = "";
+        int master_port = -1;
+        String master_replicationpwd = "";
+        String replica_hostname = "";
+        int replica_port = -1;
+        String replica_replicationpwd = "";
+
+        try {
+            master_hostname = cs.getString("preop.internaldb.master.ldapconn.host", "");
+            master_port = cs.getInteger("preop.internaldb.master.ldapconn.port", -1);
+            master_replicationpwd = cs.getString("preop.internaldb.master.replication.password", "");
+            replica_hostname = cs.getString("internaldb.ldapconn.host", "");
+            replica_port = cs.getInteger("internaldb.ldapconn.port", -1);
+            replica_replicationpwd = cs.getString("preop.internaldb.replicationpwd", "");
+        } catch (Exception e) {
         }
 
         String basedn = "";
@@ -1161,10 +1154,6 @@ public class DatabasePanel extends WizardPanelBase {
         }
 
         try {
-            conn1.connect(master1_hostname, master1_port, master1_binddn,
-                    master1_bindpwd);
-            conn2.connect(master2_hostname, master2_port, master2_binddn,
-                    master2_bindpwd);
             String suffix = cs.getString("internaldb.basedn", "");
 
             String replicadn = "cn=replica,cn=\"" + suffix + "\",cn=mapping tree,cn=config";
@@ -1173,40 +1162,40 @@ public class DatabasePanel extends WizardPanelBase {
             String masterBindUser = "Replication Manager " + masterAgreementName;
             String cloneBindUser = "Replication Manager " + cloneAgreementName;
 
-            createReplicationManager(conn1, masterBindUser, master1_replicationpwd);
-            createReplicationManager(conn2, cloneBindUser, master2_replicationpwd);
+            createReplicationManager(masterConn, masterBindUser, master_replicationpwd);
+            createReplicationManager(replicaConn, cloneBindUser, replica_replicationpwd);
 
-            String dir1 = getInstanceDir(conn1);
-            createChangeLog(conn1, dir1 + "/changelogs");
+            String dir1 = getInstanceDir(masterConn);
+            createChangeLog(masterConn, dir1 + "/changelogs");
 
-            String dir2 = getInstanceDir(conn2);
-            createChangeLog(conn2, dir2 + "/changelogs");
+            String dir2 = getInstanceDir(replicaConn);
+            createChangeLog(replicaConn, dir2 + "/changelogs");
 
             int replicaId = cs.getInteger("dbs.beginReplicaNumber", 1);
 
-            replicaId = enableReplication(replicadn, conn1, masterBindUser, basedn, replicaId);
-            replicaId = enableReplication(replicadn, conn2, cloneBindUser, basedn, replicaId);
+            replicaId = enableReplication(replicadn, masterConn, masterBindUser, basedn, replicaId);
+            replicaId = enableReplication(replicadn, replicaConn, cloneBindUser, basedn, replicaId);
             cs.putString("dbs.beginReplicaNumber", Integer.toString(replicaId));
 
             CMS.debug("DatabasePanel setupReplication: Finished enabling replication");
 
-            createReplicationAgreement(replicadn, conn1, masterAgreementName,
-                    master2_hostname, master2_port, master2_replicationpwd, basedn, cloneBindUser, secure,
+            createReplicationAgreement(replicadn, masterConn, masterAgreementName,
+                    replica_hostname, replica_port, replica_replicationpwd, basedn, cloneBindUser, secure,
                     cloneStartTLS);
 
-            createReplicationAgreement(replicadn, conn2, cloneAgreementName,
-                    master1_hostname, master1_port, master1_replicationpwd, basedn, masterBindUser, secure,
+            createReplicationAgreement(replicadn, replicaConn, cloneAgreementName,
+                    master_hostname, master_port, master_replicationpwd, basedn, masterBindUser, secure,
                     cloneStartTLS);
 
             // initialize consumer
-            initializeConsumer(replicadn, conn1, masterAgreementName);
+            initializeConsumer(replicadn, masterConn, masterAgreementName);
 
-            while (!replicationDone(replicadn, conn1, masterAgreementName)) {
+            while (!replicationDone(replicadn, masterConn, masterAgreementName)) {
                 CMS.debug("DatabasePanel setupReplication: Waiting for replication to complete");
                 Thread.sleep(1000);
             }
 
-            String status = replicationStatus(replicadn, conn1, masterAgreementName);
+            String status = replicationStatus(replicadn, masterConn, masterAgreementName);
             if (!status.startsWith("0 ")) {
                 CMS.debug("DatabasePanel setupReplication: consumer initialization failed. " +
                         status);
@@ -1238,7 +1227,7 @@ public class DatabasePanel extends WizardPanelBase {
             throws LDAPException {
         LDAPAttributeSet attrs = null;
         LDAPEntry entry = null;
-        String dn = "cn=" + bindUser + ",cn=config";
+        String dn = "cn=" + bindUser + ",ou=csusers,cn=config";
         try {
             attrs = new LDAPAttributeSet();
             attrs.add(new LDAPAttribute("objectclass", "top"));
@@ -1315,7 +1304,7 @@ public class DatabasePanel extends WizardPanelBase {
             attrs.add(new LDAPAttribute("nsDS5ReplicaRoot", basedn));
             attrs.add(new LDAPAttribute("nsDS5ReplicaType", "3"));
             attrs.add(new LDAPAttribute("nsDS5ReplicaBindDN",
-                    "cn=" + bindUser + ",cn=config"));
+                    "cn=" + bindUser + ",ou=csusers,cn=config"));
             attrs.add(new LDAPAttribute("cn", "replica"));
             attrs.add(new LDAPAttribute("nsDS5ReplicaId", Integer.toString(id)));
             attrs.add(new LDAPAttribute("nsds5flags", "1"));
@@ -1330,7 +1319,7 @@ public class DatabasePanel extends WizardPanelBase {
                 try {
                     entry = conn.read(replicadn);
                     LDAPAttribute attr = entry.getAttribute("nsDS5ReplicaBindDN");
-                    attr.addValue("cn=" + bindUser + ",cn=config");
+                    attr.addValue("cn=" + bindUser + ",ou=csusers,cn=config");
                     LDAPModification mod = new LDAPModification(LDAPModification.REPLACE, attr);
                     conn.modify(replicadn, mod);
                 } catch (LDAPException ee) {
@@ -1367,7 +1356,7 @@ public class DatabasePanel extends WizardPanelBase {
             attrs.add(new LDAPAttribute("nsDS5ReplicaHost", replicahost));
             attrs.add(new LDAPAttribute("nsDS5ReplicaPort", "" + replicaport));
             attrs.add(new LDAPAttribute("nsDS5ReplicaBindDN",
-                    "cn=" + bindUser + ",cn=config"));
+                    "cn=" + bindUser + ",ou=csusers,cn=config"));
             attrs.add(new LDAPAttribute("nsDS5ReplicaBindMethod", "Simple"));
             attrs.add(new LDAPAttribute("nsds5replicacredentials", replicapwd));
 
diff --git a/pki/base/common/src/com/netscape/cms/servlet/csadmin/LDAPSecurityDomainSessionTable.java b/pki/base/common/src/com/netscape/cms/servlet/csadmin/LDAPSecurityDomainSessionTable.java
index 244b7df4cfd52df2d89d11596840b326987fb241..b9932722e772655fdd25cd632ce3bd11ca121d6c 100644
--- a/pki/base/common/src/com/netscape/cms/servlet/csadmin/LDAPSecurityDomainSessionTable.java
+++ b/pki/base/common/src/com/netscape/cms/servlet/csadmin/LDAPSecurityDomainSessionTable.java
@@ -17,7 +17,6 @@
 // --- END COPYRIGHT BLOCK ---
 package com.netscape.cms.servlet.csadmin;
 
-import java.io.IOException;
 import java.util.Date;
 import java.util.Enumeration;
 import java.util.Vector;
@@ -31,9 +30,11 @@ import netscape.ldap.LDAPSearchResults;
 import netscape.ldap.LDAPv2;
 
 import com.netscape.certsrv.apps.CMS;
+import com.netscape.certsrv.base.EBaseException;
 import com.netscape.certsrv.base.IConfigStore;
 import com.netscape.certsrv.base.ISecurityDomainSessionTable;
-import com.netscape.cmsutil.password.IPasswordStore;
+import com.netscape.certsrv.ldap.ELdapException;
+import com.netscape.certsrv.ldap.ILdapConnFactory;
 
 /**
  * This object stores the values for IP, uid and group based on the cookie id in LDAP.
@@ -43,9 +44,14 @@ public class LDAPSecurityDomainSessionTable
         implements ISecurityDomainSessionTable {
 
     private long m_timeToLive;
+    private ILdapConnFactory mLdapConnFactory = null;
 
-    public LDAPSecurityDomainSessionTable(long timeToLive) {
+    public LDAPSecurityDomainSessionTable(long timeToLive) throws ELdapException, EBaseException {
         m_timeToLive = timeToLive;
+        IConfigStore cs = CMS.getConfigStore();
+        IConfigStore internaldb = cs.getSubStore("internaldb");
+        mLdapConnFactory = CMS.getLdapBoundConnFactory();
+        mLdapConnFactory.init(internaldb);
     }
 
     public int addEntry(String sessionId, String ip,
@@ -67,7 +73,7 @@ public class LDAPSecurityDomainSessionTable
 
         try {
             // create session entry (if it does not exist)
-            conn = getLDAPConn();
+            conn = mLdapConnFactory.getConn();
 
             LDAPEntry entry = null;
             LDAPAttributeSet attrs = null;
@@ -112,7 +118,7 @@ public class LDAPSecurityDomainSessionTable
         }
 
         try {
-            conn.disconnect();
+            mLdapConnFactory.returnConn(conn);
         } catch (Exception e) {
             CMS.debug("SecurityDomainSessionTable:addEntry: Error in disconnecting from database: " + e);
         }
@@ -126,7 +132,7 @@ public class LDAPSecurityDomainSessionTable
         try {
             String basedn = cs.getString("internaldb.basedn");
             String dn = "cn=" + sessionId + ",ou=sessions,ou=Security Domain," + basedn;
-            conn = getLDAPConn();
+            conn = mLdapConnFactory.getConn();
             conn.delete(dn);
             status = SUCCESS;
         } catch (Exception e) {
@@ -138,7 +144,7 @@ public class LDAPSecurityDomainSessionTable
             }
         }
         try {
-            conn.disconnect();
+            mLdapConnFactory.returnConn(conn);
         } catch (Exception e) {
             CMS.debug("SecurityDomainSessionTable: removeEntry: Error in disconnecting from database: " + e);
         }
@@ -155,7 +161,7 @@ public class LDAPSecurityDomainSessionTable
             String filter = "(cn=" + sessionId + ")";
             String[] attrs = { "cn" };
 
-            conn = getLDAPConn();
+            conn = mLdapConnFactory.getConn();
             LDAPSearchResults res = conn.search(sessionsdn, LDAPv2.SCOPE_SUB, filter, attrs, false);
             if (res.getCount() > 0)
                 ret = true;
@@ -164,7 +170,7 @@ public class LDAPSecurityDomainSessionTable
         }
 
         try {
-            conn.disconnect();
+            mLdapConnFactory.returnConn(conn);
         } catch (Exception e) {
             CMS.debug("SecurityDomainSessionTable: isSessionIdExist: Error in disconnecting from database: " + e);
         }
@@ -182,7 +188,7 @@ public class LDAPSecurityDomainSessionTable
             String filter = "(objectclass=securityDomainSessionEntry)";
             String[] attrs = { "cn" };
 
-            conn = getLDAPConn();
+            conn = mLdapConnFactory.getConn();
             LDAPSearchResults res = conn.search(sessionsdn, LDAPv2.SCOPE_SUB, filter, attrs, false);
             while (res.hasMoreElements()) {
                 LDAPEntry entry = res.next();
@@ -201,7 +207,7 @@ public class LDAPSecurityDomainSessionTable
         }
 
         try {
-            conn.disconnect();
+            mLdapConnFactory.returnConn(conn);
         } catch (Exception e) {
             CMS.debug("SecurityDomainSessionTable: getSessionIds: Error in disconnecting from database: " + e);
         }
@@ -218,7 +224,7 @@ public class LDAPSecurityDomainSessionTable
             String sessionsdn = "ou=sessions,ou=Security Domain," + basedn;
             String filter = "(cn=" + sessionId + ")";
             String[] attrs = { attr };
-            conn = getLDAPConn();
+            conn = mLdapConnFactory.getConn();
             LDAPSearchResults res = conn.search(sessionsdn, LDAPv2.SCOPE_SUB, filter, attrs, false);
             if (res.getCount() > 0) {
                 LDAPEntry entry = res.next();
@@ -229,7 +235,7 @@ public class LDAPSecurityDomainSessionTable
         }
 
         try {
-            conn.disconnect();
+            mLdapConnFactory.returnConn(conn);
         } catch (Exception e) {
             CMS.debug("SecurityDomainSessionTable: isSessionIdExist: Error in disconnecting from database: " + e);
         }
@@ -271,7 +277,7 @@ public class LDAPSecurityDomainSessionTable
             String filter = "(objectclass=securityDomainSessionEntry)";
             String[] attrs = { "cn" };
 
-            conn = getLDAPConn();
+            conn = mLdapConnFactory.getConn();
             LDAPSearchResults res = conn.search(sessionsdn, LDAPv2.SCOPE_SUB, filter, attrs, false);
             ret = res.getCount();
         } catch (Exception e) {
@@ -279,78 +285,11 @@ public class LDAPSecurityDomainSessionTable
         }
 
         try {
-            conn.disconnect();
+            mLdapConnFactory.returnConn(conn);
         } catch (Exception e) {
             CMS.debug("SecurityDomainSessionTable: getSessionIds: Error in disconnecting from database: " + e);
         }
 
         return ret;
     }
-
-    private LDAPConnection getLDAPConn()
-            throws IOException {
-        IConfigStore cs = CMS.getConfigStore();
-
-        String host = "";
-        String port = "";
-        String pwd = null;
-        String binddn = "";
-        String security = "";
-        String clientNick = "";
-
-        IPasswordStore pwdStore = CMS.getPasswordStore();
-
-        if (pwdStore != null) {
-            //CMS.debug("SecurityDomainSessionTable: getLDAPConn: password store available");
-            pwd = pwdStore.getPassword("internaldb");
-        }
-
-        if (pwd == null) {
-            throw new IOException("SecurityDomainSessionTable: Failed to obtain password from password store");
-        }
-
-        try {
-            host = cs.getString("internaldb.ldapconn.host");
-            port = cs.getString("internaldb.ldapconn.port");
-            binddn = cs.getString("internaldb.ldapauth.bindDN");
-            security = cs.getString("internaldb.ldapconn.secureConn");
-            clientNick = cs.getString("internaldb.ldapauth.clientCertNickname");
-        } catch (Exception e) {
-            CMS.debug("SecurityDomainSessionTable: getLDAPConn" + e.toString());
-            throw new IOException(
-                    "Failed to retrieve LDAP information from CS.cfg.");
-        }
-
-        int p = -1;
-
-        try {
-            p = Integer.parseInt(port);
-        } catch (Exception e) {
-            CMS.debug("SecurityDomainSessionTable getLDAPConn: " + e.toString());
-            throw new IOException("Port is not valid");
-        }
-
-        LDAPConnection conn = null;
-        if (!clientNick.equals("")) {
-            CMS.debug("SecurityDomainSessionTable getLDAPConn: creating secure (SSL) client auth connection for internal ldap");
-            conn = new LDAPConnection(CMS.getLdapJssSSLSocketFactory(clientNick));
-        } else if (security.equals("true")) {
-            //CMS.debug("SecurityDomainSessionTable getLDAPConn: creating secure (SSL) connection for internal ldap");
-            conn = new LDAPConnection(CMS.getLdapJssSSLSocketFactory());
-        } else {
-            //CMS.debug("SecurityDomainSessionTable getLDAPConn: creating non-secure (non-SSL) connection for internal ldap");
-            conn = new LDAPConnection();
-        }
-
-        //CMS.debug("SecurityDomainSessionTable connecting to " + host + ":" + p);
-        try {
-            conn.connect(host, p, binddn, pwd);
-        } catch (LDAPException e) {
-            CMS.debug("SecurityDomainSessionTable getLDAPConn: " + e.toString());
-            throw new IOException("Failed to connect to the internal database.");
-        }
-
-        return conn;
-    }
-
 }
diff --git a/pki/base/common/src/com/netscape/cms/servlet/csadmin/RestoreKeyCertPanel.java b/pki/base/common/src/com/netscape/cms/servlet/csadmin/RestoreKeyCertPanel.java
index 80a887fd2d09fdb09bf988df55912678d8a56379..ea0e79787046041709269a4a044c79236baa4100 100644
--- a/pki/base/common/src/com/netscape/cms/servlet/csadmin/RestoreKeyCertPanel.java
+++ b/pki/base/common/src/com/netscape/cms/servlet/csadmin/RestoreKeyCertPanel.java
@@ -456,14 +456,15 @@ public class RestoreKeyCertPanel extends WizardPanelBase {
                         s1.append(",");
                     s1.append("ca.connector.KRA");
                 }
+                
+                s1.append(",internaldb,internaldb.ldapauth,internaldb.ldapconn");
 
                 content =
-                        "op=get&names=cloning.token,instanceId,internaldb.basedn,internaldb.ldapauth.password,internaldb.replication.password,internaldb.ldapconn.host,internaldb.ldapconn.port,internaldb.ldapauth.bindDN"
-                                + c1.toString()
-                                + "&substores="
-                                + s1.toString()
-                                + "&xmlOutput=true&sessionID="
-                                + session_id;
+                        "op=get&names=cloning.token,instanceId,internaldb.basedn,internaldb.ldapauth.password,"
+                        + "internaldb.replication.password" + c1.toString()
+                        + "&substores=" + s1.toString()
+                        + "&xmlOutput=true&sessionID="
+                        + session_id;
                 boolean success = updateConfigEntries(master_hostname, master_port, true,
                         "/" + cstype + "/admin/" + cstype + "/getConfigEntries", content, config, response);
                 if (!success) {
diff --git a/pki/base/common/src/com/netscape/cms/servlet/csadmin/WizardPanelBase.java b/pki/base/common/src/com/netscape/cms/servlet/csadmin/WizardPanelBase.java
index 40190c9a75138163b7633e7669acb740a7ad64e0..d199bdc551ae0968ed121c17d4d6c03befcbfaa7 100644
--- a/pki/base/common/src/com/netscape/cms/servlet/csadmin/WizardPanelBase.java
+++ b/pki/base/common/src/com/netscape/cms/servlet/csadmin/WizardPanelBase.java
@@ -620,19 +620,11 @@ public class WizardPanelBase implements IWizardPanel {
                             }
                         }
 
-                        if (name.equals("internaldb.ldapconn.host")) {
-                            config.putString("preop.internaldb.master.hostname", v);
-                        } else if (name.equals("internaldb.ldapconn.port")) {
-                            config.putString("preop.internaldb.master.port", v);
-                        } else if (name.equals("internaldb.ldapauth.bindDN")) {
-                            config.putString("preop.internaldb.master.binddn", v);
-                        } else if (name.equals("internaldb.basedn")) {
+                        if (name.equals("internaldb.basedn")) {
                             config.putString(name, v);
                             config.putString("preop.internaldb.master.basedn", v);
-                        } else if (name.equals("internaldb.ldapauth.password")) {
-                            config.putString("preop.internaldb.master.bindpwd", v);
-                        } else if (name.equals("internaldb.replication.password")) {
-                            config.putString("preop.internaldb.master.replicationpwd", v);
+                        } else if (name.startsWith("internaldb")) {
+                            config.putString(name.replaceFirst("internaldb", "preop.internaldb.master"), v);
                         } else if (name.equals("instanceId")) {
                             config.putString("preop.master.instanceId", v);
                         } else if (name.equals("cloning.cert.signing.nickname")) {
@@ -681,6 +673,22 @@ public class WizardPanelBase implements IWizardPanel {
                         }
                     }
 
+                    // set master ldap password (if it exists) temporarily in password store
+                    // in case it is needed for replication.  Not stored in password.conf.
+                    try {
+                        String master_pwd = config.getString("preop.internaldb.master.ldapauth.password", "");
+                        if (!master_pwd.equals("")) {
+                            config.putString("preop.internaldb.master.ldapauth.bindPWPrompt", "master_internaldb");
+                            String passwordFile = config.getString("passwordFile");
+                            IConfigStore psStore = CMS.createFileConfigStore(passwordFile);
+                            psStore.putString("master_internaldb", master_pwd);
+                        }
+                    } catch (Exception e) {
+                        CMS.debug("updateConfigEntries: Failed to temporarily store master bindpwd: " + e.toString());
+                        e.printStackTrace();
+                        throw new IOException(e.toString());
+                    }
+
                     return true;
                 } else if (status.equals(AUTH_FAILURE)) {
                     reloginSecurityDomain(response);
diff --git a/pki/base/common/src/com/netscape/cmscore/apps/CMSEngine.java b/pki/base/common/src/com/netscape/cmscore/apps/CMSEngine.java
index 5fdcaece06b73fa23bfbc9b4ea50833b582b53c1..6ca1b6e7ef1f1ab36a1df3275f0369169a8b98f3 100644
--- a/pki/base/common/src/com/netscape/cmscore/apps/CMSEngine.java
+++ b/pki/base/common/src/com/netscape/cmscore/apps/CMSEngine.java
@@ -345,18 +345,19 @@ public class CMSEngine implements ICMSEngine {
         String secdomain_source = config.getString("securitydomain.source", "memory");
         String secdomain_check_interval = config.getString("securitydomain.checkinterval", "5000");
 
-        if (secdomain_source.equals("ldap")) {
-            mSecurityDomainSessionTable = new LDAPSecurityDomainSessionTable((new Long(flush_timeout)).longValue());
-        } else {
-            mSecurityDomainSessionTable = new SecurityDomainSessionTable((new Long(flush_timeout)).longValue());
-        }
+        if ((state == 1) && (!sd.equals("existing"))) {
+            // check session domain table only if this is a
+            // configured security domain host
+
+            if (secdomain_source.equals("ldap")) {
+                mSecurityDomainSessionTable = new LDAPSecurityDomainSessionTable((new Long(flush_timeout)).longValue());
+            } else {
+                mSecurityDomainSessionTable = new SecurityDomainSessionTable((new Long(flush_timeout)).longValue());
+            }
+
+            mSDTimer = new Timer();
+            SessionTimer timertask = new SessionTimer(mSecurityDomainSessionTable);
 
-        mSDTimer = new Timer();
-        SessionTimer timertask = new SessionTimer(mSecurityDomainSessionTable);
-        if ((state != 1) || (sd.equals("existing"))) {
-            // for non-security domain hosts or if not yet configured, 
-            // do not check session domain table
-        } else {
             mSDTimer.schedule(timertask, 5, (new Long(secdomain_check_interval)).longValue());
         }
 
diff --git a/pki/base/kra/shared/conf/CS.cfg.in b/pki/base/kra/shared/conf/CS.cfg.in
index 19570155c10caa109041d86d1227f8290edf80c4..a6d49ceb53be72edc8e920acb81ba7062f084ea4 100644
--- a/pki/base/kra/shared/conf/CS.cfg.in
+++ b/pki/base/kra/shared/conf/CS.cfg.in
@@ -225,6 +225,7 @@ preop.internaldb.schema.ldif=/usr/share/[PKI_FLAVOR]/kra/conf/schema.ldif
 preop.internaldb.ldif=/usr/share/[PKI_FLAVOR]/kra/conf/database.ldif
 preop.internaldb.data_ldif=/usr/share/[PKI_FLAVOR]/kra/conf/db.ldif,/usr/share/[PKI_FLAVOR]/kra/conf/acl.ldif
 preop.internaldb.index_ldif=
+preop.internaldb.manager_ldif=/usr/share/[PKI_FLAVOR]/ca/conf/manager.ldif
 preop.internaldb.post_ldif=/usr/share/[PKI_FLAVOR]/kra/conf/index.ldif,/usr/share/[PKI_FLAVOR]/kra/conf/vlv.ldif,/usr/share/[PKI_FLAVOR]/kra/conf/vlvtasks.ldif
 preop.internaldb.wait_dn=cn=index1160527115, cn=index, cn=tasks, cn=config
 internaldb.multipleSuffix.enable=false
diff --git a/pki/base/kra/shared/conf/manager.ldif b/pki/base/kra/shared/conf/manager.ldif
new file mode 100644
index 0000000000000000000000000000000000000000..52e486987d721d799112ef61475e1a45ec19f1be
--- /dev/null
+++ b/pki/base/kra/shared/conf/manager.ldif
@@ -0,0 +1,48 @@
+# acis for cert manager
+
+dn: ou=csusers,cn=config
+objectClass: top
+objectClass: organizationalUnit
+ou: csusers
+
+dn: {rootSuffix}
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0; acl "cert manager access"; allow (all) userdn = "ldap:///{dbuser}";)
+
+dn: cn=ldbm database,cn=plugins,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0; acl "Cert Manager access for VLV searches"; allow (read) userdn="ldap:///{dbuser}";)
+
+dn: cn=config
+changetype: modify
+add: aci
+aci: (targetattr != aci)(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///{dbuser}";)
+
+dn: ou=csusers,cn=config
+changetype: modify
+add: aci
+aci: (targetattr != aci)(version 3.0; aci "cert manager manage replication users"; allow (all) userdn = "ldap:///{dbuser}";)
+
+dn: cn="{rootSuffix}",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///{dbuser}";)
+
+dn: cn="{rootSuffix}",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///{dbuser}";)
+
+dn: cn="{rootSuffix}",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///{dbuser}";)
+
+dn: cn=tasks,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///{dbuser}";)
+
+
diff --git a/pki/base/ocsp/shared/conf/CS.cfg.in b/pki/base/ocsp/shared/conf/CS.cfg.in
index 4dbda23cb07cb8768e2cc8d4b559f7c2ef135157..5be916e7cc9cb620874e792566493d9b8f9147db 100644
--- a/pki/base/ocsp/shared/conf/CS.cfg.in
+++ b/pki/base/ocsp/shared/conf/CS.cfg.in
@@ -187,6 +187,7 @@ preop.internaldb.schema.ldif=/usr/share/[PKI_FLAVOR]/ocsp/conf/schema.ldif
 preop.internaldb.ldif=/usr/share/[PKI_FLAVOR]/ocsp/conf/database.ldif
 preop.internaldb.data_ldif=/usr/share/[PKI_FLAVOR]/ocsp/conf/db.ldif,/usr/share/[PKI_FLAVOR]/ocsp/conf/acl.ldif
 preop.internaldb.index_ldif=/usr/share/[PKI_FLAVOR]/ocsp/conf/index.ldif
+preop.internaldb.manager_ldif=/usr/share/[PKI_FLAVOR]/ca/conf/manager.ldif
 preop.internaldb.post_ldif=
 preop.internaldb.wait_dn=
 internaldb.multipleSuffix.enable=false
diff --git a/pki/base/ocsp/shared/conf/manager.ldif b/pki/base/ocsp/shared/conf/manager.ldif
new file mode 100644
index 0000000000000000000000000000000000000000..52e486987d721d799112ef61475e1a45ec19f1be
--- /dev/null
+++ b/pki/base/ocsp/shared/conf/manager.ldif
@@ -0,0 +1,48 @@
+# acis for cert manager
+
+dn: ou=csusers,cn=config
+objectClass: top
+objectClass: organizationalUnit
+ou: csusers
+
+dn: {rootSuffix}
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0; acl "cert manager access"; allow (all) userdn = "ldap:///{dbuser}";)
+
+dn: cn=ldbm database,cn=plugins,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0; acl "Cert Manager access for VLV searches"; allow (read) userdn="ldap:///{dbuser}";)
+
+dn: cn=config
+changetype: modify
+add: aci
+aci: (targetattr != aci)(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///{dbuser}";)
+
+dn: ou=csusers,cn=config
+changetype: modify
+add: aci
+aci: (targetattr != aci)(version 3.0; aci "cert manager manage replication users"; allow (all) userdn = "ldap:///{dbuser}";)
+
+dn: cn="{rootSuffix}",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///{dbuser}";)
+
+dn: cn="{rootSuffix}",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///{dbuser}";)
+
+dn: cn="{rootSuffix}",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///{dbuser}";)
+
+dn: cn=tasks,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///{dbuser}";)
+
+
diff --git a/pki/base/tks/shared/conf/CS.cfg.in b/pki/base/tks/shared/conf/CS.cfg.in
index bf195d23497b9582e331721de610056c333d54c7..195201e4d41a15e52fd2adedc10eb1f88ed30739 100644
--- a/pki/base/tks/shared/conf/CS.cfg.in
+++ b/pki/base/tks/shared/conf/CS.cfg.in
@@ -180,6 +180,7 @@ preop.internaldb.schema.ldif=/usr/share/[PKI_FLAVOR]/tks/conf/schema.ldif
 preop.internaldb.ldif=/usr/share/[PKI_FLAVOR]/tks/conf/database.ldif
 preop.internaldb.data_ldif=/usr/share/[PKI_FLAVOR]/tks/conf/db.ldif,/usr/share/[PKI_FLAVOR]/tks/conf/acl.ldif
 preop.internaldb.index_ldif=/usr/share/[PKI_FLAVOR]/tks/conf/index.ldif
+preop.internaldb.manager_ldif=/usr/share/[PKI_FLAVOR]/ca/conf/manager.ldif
 preop.internaldb.post_ldif=
 preop.internaldb.wait_dn=
 internaldb.multipleSuffix.enable=false
diff --git a/pki/base/tks/shared/conf/manager.ldif b/pki/base/tks/shared/conf/manager.ldif
new file mode 100644
index 0000000000000000000000000000000000000000..52e486987d721d799112ef61475e1a45ec19f1be
--- /dev/null
+++ b/pki/base/tks/shared/conf/manager.ldif
@@ -0,0 +1,48 @@
+# acis for cert manager
+
+dn: ou=csusers,cn=config
+objectClass: top
+objectClass: organizationalUnit
+ou: csusers
+
+dn: {rootSuffix}
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0; acl "cert manager access"; allow (all) userdn = "ldap:///{dbuser}";)
+
+dn: cn=ldbm database,cn=plugins,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0; acl "Cert Manager access for VLV searches"; allow (read) userdn="ldap:///{dbuser}";)
+
+dn: cn=config
+changetype: modify
+add: aci
+aci: (targetattr != aci)(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///{dbuser}";)
+
+dn: ou=csusers,cn=config
+changetype: modify
+add: aci
+aci: (targetattr != aci)(version 3.0; aci "cert manager manage replication users"; allow (all) userdn = "ldap:///{dbuser}";)
+
+dn: cn="{rootSuffix}",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///{dbuser}";)
+
+dn: cn="{rootSuffix}",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///{dbuser}";)
+
+dn: cn="{rootSuffix}",cn=mapping tree,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///{dbuser}";)
+
+dn: cn=tasks,cn=config
+changetype: modify
+add: aci
+aci: (targetattr=*)(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///{dbuser}";)
+
+
-- 
1.7.6.4

