From dba2c4d36d2b8588956f3b7b84d512fc721b6784 Mon Sep 17 00:00:00 2001
From: Endi Sukma Dewata <edewata@redhat.com>
Date: Thu, 26 Jul 2012 20:40:08 -0500
Subject: [PATCH] Enabled SSL authenticator and PKI realm.

The SSL connection has been configured with clientAuth="want" so
users can choose whether to provide a client certificate or username
and password. The authentication and authorization will be handled
by the SSL authenticator with fallback and PKI realm. New access
control rules have been added for users, groups, and certs REST
services.

Ticket #107
---
 base/ca/shared/conf/acl.ldif                      |  3 ++
 base/ca/shared/conf/server.xml                    |  2 +-
 base/ca/shared/webapps/ca/WEB-INF/auth.properties |  9 ++++++
 base/ca/shared/webapps/ca/WEB-INF/web.xml         | 35 +++++++++++++++++++++++
 base/common/shared/conf/context.xml               |  4 +++
 base/common/shared/conf/server.xml                |  3 +-
 base/deploy/src/scriptlets/pkiparser.py           | 14 ++++++++-
 base/deploy/src/scriptlets/slot_substitution.py   | 12 ++++++++
 base/setup/pki                                    |  1 +
 base/setup/pkicreate                              |  2 +-
 10 files changed, 80 insertions(+), 5 deletions(-)
 create mode 100644 base/ca/shared/webapps/ca/WEB-INF/auth.properties

diff --git a/base/ca/shared/conf/acl.ldif b/base/ca/shared/conf/acl.ldif
index ceea1f27a4d9c5b6c297c33752c3bf46ee756dca..aec1447e56eafbc334f6b5d8fff662e2c976284e 100644
--- a/base/ca/shared/conf/acl.ldif
+++ b/base/ca/shared/conf/acl.ldif
@@ -51,3 +51,6 @@ resourceACLS: certServer.ca.connectorInfo:read,modify:allow (modify,read) group=
 resourceACLS: certServer.ca.registerUser:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators" || group="Enterprise TPS Administrators":Only Enterprise Administrators are allowed to register a new agent
 resourceACLS: certServer.clone.configuration:read,modify:allow (modify,read) group="Enterprise CA Administrators" || group="Enterprise KRA Administrators" || group="Enterprise RA Administrators" || group="Enterprise OCSP Administrators" || group="Enterprise TKS Administrators":Only Enterprise Administrators are allowed to clone the configuration.
 resourceACLS: certServer.admin.ocsp:read,modify:allow (modify,read) group="Enterprise OCSP Administrators":Only Enterprise Administrators are allowed to read or update the OCSP configuration.
+resourceACLS: certServer.ca.certs:execute:allow (execute) group="Certificate Manager Agents":Agents may execute cert operations
+resourceACLS: certServer.ca.groups:execute:allow (execute) group="Administrators":Admins may execute group operations
+resourceACLS: certServer.ca.users:execute:allow (execute) group="Administrators":Admins may execute user operations
diff --git a/base/ca/shared/conf/server.xml b/base/ca/shared/conf/server.xml
index 4056fbbb7e5c64c082c1b344c5f29f86f518efa3..60317d2fad41558b2b5a05ec986a5f7493efde5f 100644
--- a/base/ca/shared/conf/server.xml
+++ b/base/ca/shared/conf/server.xml
@@ -84,7 +84,7 @@ Tomcat Port         = [TOMCAT_SERVER_PORT] (for shutdown)
     -->
 
     [PKI_UNSECURE_PORT_SERVER_COMMENT]
-    <Connector name="[PKI_UNSECURE_PORT_CONNECTOR_NAME]" port="[PKI_UNSECURE_PORT]" protocol="HTTP/1.1" redirectPort="8443" 
+    <Connector name="[PKI_UNSECURE_PORT_CONNECTOR_NAME]" port="[PKI_UNSECURE_PORT]" protocol="HTTP/1.1" redirectPort="[PKI_SECURE_PORT]"
 	       maxHttpHeaderSize="8192"
 	       acceptCount="100" maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
 	       enableLookups="false" connectionTimeout="20000" disableUploadTimeout="true"
diff --git a/base/ca/shared/webapps/ca/WEB-INF/auth.properties b/base/ca/shared/webapps/ca/WEB-INF/auth.properties
new file mode 100644
index 0000000000000000000000000000000000000000..ebb1c6c3fd6a80addf52575d3bbfda21c352312a
--- /dev/null
+++ b/base/ca/shared/webapps/ca/WEB-INF/auth.properties
@@ -0,0 +1,9 @@
+# Restful API auth/authz mapping info
+#
+# Format:
+# <Rest API URL> = <ACL Resource ID>,<ACL resource operation>
+# ex:      /ca/pki/users = certServer.ca.users,read
+
+/ca/rest/admin/users = certServer.ca.users,execute
+/ca/rest/admin/groups = certServer.ca.groups,execute
+/ca/rest/agent/certs = certServer.ca.certs,execute
diff --git a/base/ca/shared/webapps/ca/WEB-INF/web.xml b/base/ca/shared/webapps/ca/WEB-INF/web.xml
index 7ec3932c929742a254cf754dcb7cab9cf03331df..af474872e94e2ade596bfb1ed44b0d70069b3b20 100644
--- a/base/ca/shared/webapps/ca/WEB-INF/web.xml
+++ b/base/ca/shared/webapps/ca/WEB-INF/web.xml
@@ -2382,5 +2382,40 @@
    <session-config>
         <session-timeout>30</session-timeout>
    </session-config>
+
+    <security-constraint>
+        <web-resource-collection>
+            <web-resource-name>Admin Services</web-resource-name>
+            <url-pattern>/rest/admin/*</url-pattern>
+        </web-resource-collection>
+        <auth-constraint>
+            <role-name>*</role-name>
+        </auth-constraint>
+        <user-data-constraint>
+            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
+        </user-data-constraint>
+    </security-constraint>
+
+    <security-constraint>
+        <web-resource-collection>
+            <web-resource-name>Agent Services</web-resource-name>
+            <url-pattern>/rest/agent/certs/*</url-pattern>
+        </web-resource-collection>
+        <auth-constraint>
+            <role-name>*</role-name>
+        </auth-constraint>
+        <user-data-constraint>
+            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
+        </user-data-constraint>
+    </security-constraint>
+
+    <login-config>
+        <realm-name>Certificate Authority</realm-name>
+    </login-config>
+
+    <security-role>
+        <role-name>*</role-name>
+    </security-role>
+
 </web-app>
 
diff --git a/base/common/shared/conf/context.xml b/base/common/shared/conf/context.xml
index 4b00dbe3caf7027d699ce3ed8ffee55fc3a2168b..b28f1bd20c82e3f0f720034af27f7979b136c02b 100644
--- a/base/common/shared/conf/context.xml
+++ b/base/common/shared/conf/context.xml
@@ -39,4 +39,8 @@
     <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
     -->
 
+    <Valve className="com.netscape.cmscore.realm.SSLAuthenticatorWithFallback" />
+
+    <Realm className="com.netscape.cmscore.realm.PKIRealm" />
+
 </Context>
diff --git a/base/common/shared/conf/server.xml b/base/common/shared/conf/server.xml
index d3c781a6ba4427868d841cc9da2228b1777c996b..596b7e356e3d1bb157d277cda996c6fc54beda78 100644
--- a/base/common/shared/conf/server.xml
+++ b/base/common/shared/conf/server.xml
@@ -117,7 +117,7 @@ Tomcat Port         = [TOMCAT_SERVER_PORT] (for shutdown)
     -->
 
     [PKI_UNSECURE_PORT_SERVER_COMMENT]
-    <Connector name="[PKI_UNSECURE_PORT_CONNECTOR_NAME]" port="[PKI_UNSECURE_PORT]" protocol="HTTP/1.1" redirectPort="8443"
+    <Connector name="[PKI_UNSECURE_PORT_CONNECTOR_NAME]" port="[PKI_UNSECURE_PORT]" protocol="HTTP/1.1" redirectPort="[PKI_SECURE_PORT]"
            maxHttpHeaderSize="8192"
            acceptCount="100" maxThreads="150" minSpareThreads="25"
            enableLookups="false" connectionTimeout="20000" disableUploadTimeout="true"
@@ -186,7 +186,6 @@ Tomcat Port         = [TOMCAT_SERVER_PORT] (for shutdown)
            ocspTimeout="10"
            strictCiphers="false"
            clientAuth="[PKI_AGENT_CLIENTAUTH]"
-           clientauth="[PKI_AGENT_CLIENTAUTH]"
            sslOptions="[TOMCAT_SSL_OPTIONS]"
            ssl2Ciphers="[TOMCAT_SSL2_CIPHERS]"
            ssl3Ciphers="[TOMCAT_SSL3_CIPHERS]"
diff --git a/base/deploy/src/scriptlets/pkiparser.py b/base/deploy/src/scriptlets/pkiparser.py
index 5674cf87a99b1421471972971ab3ec4d45567858..66c1e40859acb31fbd05f8e811fceed66d0c6622 100644
--- a/base/deploy/src/scriptlets/pkiparser.py
+++ b/base/deploy/src/scriptlets/pkiparser.py
@@ -400,6 +400,9 @@ def compose_pki_master_dictionary():
             config.pki_master_dict['pki_source_server_xml'] =\
                 os.path.join(config.pki_master_dict['pki_source_shared_path'],
                              "server.xml")
+            config.pki_master_dict['pki_source_context_xml'] =\
+                os.path.join(config.pki_master_dict['pki_source_shared_path'],
+                             "context.xml")
             config.pki_master_dict['pki_source_tomcat_conf'] =\
                 os.path.join(config.pki_master_dict['pki_source_shared_path'],
                              "tomcat.conf")
@@ -984,6 +987,10 @@ def compose_pki_master_dictionary():
                 os.path.join(
                     config.pki_master_dict['pki_instance_configuration_path'],
                     "server.xml")
+            config.pki_master_dict['pki_target_context_xml'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_instance_configuration_path'],
+                    "context.xml")
             config.pki_master_dict['pki_target_tomcat_conf_instance_id'] =\
                 config.pki_master_dict['pki_root_prefix'] +\
                 "/etc/sysconfig/" +\
@@ -997,6 +1004,11 @@ def compose_pki_master_dictionary():
                     config.pki_master_dict['pki_tomcat_webapps_root_path'],
                     "index.jsp")
             # in-place slot substitution name/value pairs
+            config.pki_master_dict['pki_target_auth_properties'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_tomcat_webapps_subsystem_path'],
+                    "WEB-INF",
+                    "auth.properties")
             config.pki_master_dict['pki_target_velocity_properties'] =\
                 os.path.join(
                     config.pki_master_dict['pki_tomcat_webapps_subsystem_path'],
@@ -1131,7 +1143,7 @@ def compose_pki_master_dictionary():
             ['PKI_ADMIN_SECURE_PORT_SERVER_COMMENT_SLOT'] =\
                 ""
             config.pki_master_dict['PKI_AGENT_CLIENTAUTH_SLOT'] =\
-                "agent"
+                "want"
             config.pki_master_dict['PKI_AGENT_SECURE_PORT_SLOT'] =\
                 config.pki_master_dict['pki_https_port']
             config.pki_master_dict['PKI_AJP_PORT_SLOT'] =\
diff --git a/base/deploy/src/scriptlets/slot_substitution.py b/base/deploy/src/scriptlets/slot_substitution.py
index 3467596e8de7df52afa4aaa497ca225cea576077..482d1d9cbc4916587a337288e5fd3eb930987e55 100644
--- a/base/deploy/src/scriptlets/slot_substitution.py
+++ b/base/deploy/src/scriptlets/slot_substitution.py
@@ -54,6 +54,10 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
                 master['pki_target_server_xml'],
                 overwrite_flag=True)
             util.file.copy_with_slot_substitution(
+                master['pki_source_context_xml'],
+                master['pki_target_context_xml'],
+                overwrite_flag=True)
+            util.file.copy_with_slot_substitution(
                 master['pki_source_tomcat_conf'],
                 master['pki_target_tomcat_conf_instance_id'],
                 uid=0, gid=0, overwrite_flag=True)
@@ -66,6 +70,8 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
                 master['pki_target_index_jsp'],
                 overwrite_flag=True)
             util.file.apply_slot_substitution(
+                master['pki_target_auth_properties'])
+            util.file.apply_slot_substitution(
                 master['pki_target_velocity_properties'])
             util.file.apply_slot_substitution(
                 master['pki_target_subsystem_web_xml'])
@@ -109,6 +115,10 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
                 master['pki_target_server_xml'],
                 overwrite_flag=True)
             util.file.copy_with_slot_substitution(
+                master['pki_source_context_xml'],
+                master['pki_target_context_xml'],
+                overwrite_flag=True)
+            util.file.copy_with_slot_substitution(
                 master['pki_source_tomcat_conf'],
                 master['pki_target_tomcat_conf_instance_id'],
                 uid=0, gid=0, overwrite_flag=True)
@@ -121,6 +131,8 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
                 master['pki_target_index_jsp'],
                 overwrite_flag=True)
             util.file.apply_slot_substitution(
+                master['pki_target_auth_properties'])
+            util.file.apply_slot_substitution(
                 master['pki_target_velocity_properties'])
             util.file.apply_slot_substitution(
                 master['pki_target_subsystem_web_xml'])
diff --git a/base/setup/pki b/base/setup/pki
index a2d5a69d6ee524350c9d9bd8fd3c9797ad9ac0b9..90c863f35804dd04934666a4ce53922ae932c5dd 100755
--- a/base/setup/pki
+++ b/base/setup/pki
@@ -75,6 +75,7 @@ $ENV{CLASSPATH} = "/usr/share/java/${PRODUCT}/pki-certsrv.jar:"
                 . "/usr/share/java/${PRODUCT}/pki-cms.jar:"
                 . "/usr/share/java/${PRODUCT}/pki-nsutil.jar:"
                 . "/usr/share/java/apache-commons-cli.jar:"
+                . "/usr/share/java/apache-commons-codec.jar:"
                 . "/usr/share/java/apache-commons-lang.jar:"
                 . "/usr/share/java/apache-commons-logging.jar:"
                 . "/usr/share/java/commons-httpclient.jar:"
diff --git a/base/setup/pkicreate b/base/setup/pkicreate
index 6abb737550ce370c572eae6b37f0ad78e72ff1b8..cc4ee703fa159e95c812c33e555ab5f6e08d25fd 100755
--- a/base/setup/pkicreate
+++ b/base/setup/pkicreate
@@ -2560,7 +2560,7 @@ LoadModule nss_module  /opt/fortitude/modules.local/libmodnss.so
             $slot_hash{$PKI_EE_SECURE_CLIENT_AUTH_PORT_COMMENT_SERVER_SLOT}    = "";
 
             # Set appropriate "clientAuth" parameter for "Shared Ports"
-            $slot_hash{$PKI_AGENT_CLIENTAUTH_SLOT} = "agent";
+            $slot_hash{$PKI_AGENT_CLIENTAUTH_SLOT} = "want";
 
             # Comment out the "Admin/EE" Ports
             $slot_hash{$PKI_OPEN_SEPARATE_PORTS_COMMENT_SERVER_SLOT}  = $PKI_OPEN_COMMENT;
-- 
1.7.11.2

