From 55cadc4e2caba0448325506ad6541f68454a0755 Mon Sep 17 00:00:00 2001
From: Endi Sukma Dewata <edewata@redhat.com>
Date: Tue, 21 Aug 2012 17:38:29 -0500
Subject: [PATCH] Added proxy realm.

CMS engine is a singleton and it's used by PKI realm to authenticate
users accessing the subsystem. Since a Tomcat instance may contain
multiple subsystems, each having separate realm, the PKI JAR links
need to be moved into WEB-INF/lib so that they will run inside
separate class loaders.

Tomcat also requires that the authenticator and realm classes be
available in common/lib. To address this a new package pki-tomcat.jar
has been added. The package contains the authenticator and a proxy
realm. When the subsystems start running, they will register their
own realms into the proxy realms such that the authentications will
be forwarded to the appropriate subsystems.

Ticket #89
---
 .../shared/webapps/ca/META-INF}/context.xml        |  21 +---
 base/common/shared/conf/context.xml                |   4 -
 base/common/src/CMakeLists.txt                     |  51 +++++++-
 .../netscape/cms/servlet/base/CMSStartServlet.java |   8 ++
 .../src/com/netscape/cms/tomcat/ProxyRealm.java    | 139 +++++++++++++++++++++
 .../tomcat}/SSLAuthenticatorWithFallback.java      |   2 +-
 base/deploy/scripts/operations                     |  52 +++++---
 base/deploy/src/scriptlets/instance_layout.py      |  14 +--
 base/deploy/src/scriptlets/pkiparser.py            |  83 ++++++------
 base/deploy/src/scriptlets/war_explosion.py        |  12 ++
 .../shared/webapps/kra/META-INF}/context.xml       |  21 +---
 .../shared/webapps/ocsp/META-INF}/context.xml      |  21 +---
 base/setup/scripts/functions                       |   3 +-
 .../shared/webapps/tks/META-INF}/context.xml       |  21 +---
 specs/pki-core.spec                                |   7 +-
 15 files changed, 305 insertions(+), 154 deletions(-)
 copy base/{common/shared/conf => ca/shared/webapps/ca/META-INF}/context.xml (58%)
 create mode 100644 base/common/src/com/netscape/cms/tomcat/ProxyRealm.java
 rename base/common/src/com/netscape/{cmscore/realm => cms/tomcat}/SSLAuthenticatorWithFallback.java (99%)
 copy base/{common/shared/conf => kra/shared/webapps/kra/META-INF}/context.xml (58%)
 copy base/{common/shared/conf => ocsp/shared/webapps/ocsp/META-INF}/context.xml (58%)
 copy base/{common/shared/conf => tks/shared/webapps/tks/META-INF}/context.xml (58%)

diff --git a/base/common/shared/conf/context.xml b/base/ca/shared/webapps/ca/META-INF/context.xml
similarity index 58%
copy from base/common/shared/conf/context.xml
copy to base/ca/shared/webapps/ca/META-INF/context.xml
index b28f1bd20c82e3f0f720034af27f7979b136c02b..975ecabf1fc1687572b0b0787d9f2edf9a8bc48c 100644
--- a/base/common/shared/conf/context.xml
+++ b/base/ca/shared/webapps/ca/META-INF/context.xml
@@ -22,25 +22,10 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<!-- The contents of this file will be loaded for each web application -->
-<Context>
+<Context crossContext="true" allowLinking="true">
 
-    <!-- Default set of monitored resources -->
-    <WatchedResource>WEB-INF/web.xml</WatchedResource>
+    <Valve className="com.netscape.cms.tomcat.SSLAuthenticatorWithFallback" />
 
-    <!-- Uncomment this to disable session persistence across Tomcat restarts -->
-    <!--
-    <Manager pathname="" />
-    -->
-
-    <!-- Uncomment this to enable Comet connection tacking (provides events
-         on session expiration as well as webapp lifecycle) -->
-    <!--
-    <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
-    -->
-
-    <Valve className="com.netscape.cmscore.realm.SSLAuthenticatorWithFallback" />
-
-    <Realm className="com.netscape.cmscore.realm.PKIRealm" />
+    <Realm className="com.netscape.cms.tomcat.ProxyRealm" />
 
 </Context>
diff --git a/base/common/shared/conf/context.xml b/base/common/shared/conf/context.xml
index b28f1bd20c82e3f0f720034af27f7979b136c02b..4b00dbe3caf7027d699ce3ed8ffee55fc3a2168b 100644
--- a/base/common/shared/conf/context.xml
+++ b/base/common/shared/conf/context.xml
@@ -39,8 +39,4 @@
     <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
     -->
 
-    <Valve className="com.netscape.cmscore.realm.SSLAuthenticatorWithFallback" />
-
-    <Realm className="com.netscape.cmscore.realm.PKIRealm" />
-
 </Context>
diff --git a/base/common/src/CMakeLists.txt b/base/common/src/CMakeLists.txt
index dc61b4ca762ab3d543f1b65a0959ac0ff29c92fe..f3702d4546723e653381fe9bc982445124a0b35f 100644
--- a/base/common/src/CMakeLists.txt
+++ b/base/common/src/CMakeLists.txt
@@ -171,6 +171,8 @@ set(PKI_CERTSRV_JAR ${CMAKE_BINARY_DIR}/dist/pki-certsrv.jar CACHE INTERNAL "pki
 javac(pki-cms-classes
     SOURCES
         com/netscape/cms/*.java
+    EXCLUDE
+        com/netscape/cms/tomcat/*.java
     CLASSPATH
         ${PKI_NSUTIL_JAR} ${PKI_CMSUTIL_JAR}
         ${LDAPJDK_JAR} ${SERVLET_JAR} ${VELOCITY_JAR} ${XALAN_JAR} ${XERCES_JAR}
@@ -192,6 +194,8 @@ jar(pki-cms-jar
         ${CMAKE_BINARY_DIR}/classes
     FILES
         com/netscape/cms/*.class
+    EXCLUDE
+        com/netscape/cms/tomcat/*.class
     DEPENDS
         pki-cms-classes
 )
@@ -249,12 +253,55 @@ if(WITH_JAVADOC)
 endif(WITH_JAVADOC)
 
 
+# build pki-tomcat
+javac(pki-tomcat-classes
+    SOURCES
+        com/netscape/cms/tomcat/*.java
+    CLASSPATH
+        ${SERVLET_JAR} ${TOMCAT_CATALINA_JAR}
+    OUTPUT_DIR
+        ${CMAKE_BINARY_DIR}/classes
+    DEPENDS
+        pki-cms
+)
+
+jar(pki-tomcat-jar
+    CREATE
+        ${CMAKE_BINARY_DIR}/dist/pki-tomcat-${APPLICATION_VERSION}.jar
+    INPUT_DIR
+        ${CMAKE_BINARY_DIR}/classes
+    FILES
+        com/netscape/cms/tomcat/*.class
+    DEPENDS
+        pki-tomcat-classes
+)
+
+link(pki-tomcat
+    SOURCE
+        ${CMAKE_BINARY_DIR}/dist/pki-tomcat.jar
+    DEST
+        pki-tomcat-${APPLICATION_VERSION}.jar
+    DEPENDS
+        pki-tomcat-jar
+)
+
+install(
+    FILES
+        ${CMAKE_BINARY_DIR}/dist/pki-tomcat.jar
+        ${CMAKE_BINARY_DIR}/dist/pki-tomcat-${APPLICATION_VERSION}.jar
+    DESTINATION
+        ${JAVA_JAR_INSTALL_DIR}/pki
+)
+
+set(PKI_TOMCAT_JAR ${CMAKE_BINARY_DIR}/dist/pki-tomcat.jar CACHE INTERNAL "pki-tomcat jar file")
+
+
 # build pki-cmscore
 javac(pki-cmscore-classes
     SOURCES
         com/netscape/cmscore/*.java
     CLASSPATH
-        ${PKI_NSUTIL_JAR} ${PKI_CMSUTIL_JAR}
+        ${PKI_NSUTIL_JAR} ${PKI_CMSUTIL_JAR} ${PKI_TOMCAT_JAR}
         ${LDAPJDK_JAR} ${SERVLET_JAR} ${VELOCITY_JAR} ${XALAN_JAR} ${XERCES_JAR}
         ${JSS_JAR} ${COMMONS_CODEC_JAR} ${COMMONS_HTTPCLIENT_JAR}
         ${APACHE_COMMONS_LANG_JAR}
@@ -264,7 +311,7 @@ javac(pki-cmscore-classes
     OUTPUT_DIR
         ${CMAKE_BINARY_DIR}/classes
     DEPENDS
-        pki-nsutil pki-cmsutil pki-certsrv pki-cms
+        pki-nsutil pki-cmsutil pki-certsrv pki-cms pki-tomcat
 )
 
 jar(pki-cmscore-jar
diff --git a/base/common/src/com/netscape/cms/servlet/base/CMSStartServlet.java b/base/common/src/com/netscape/cms/servlet/base/CMSStartServlet.java
index a8a4008b78cd3ec0e6561db453a5858ef741e906..e00f2bdba2417d889276b22049f779ecd572fb9d 100644
--- a/base/common/src/com/netscape/cms/servlet/base/CMSStartServlet.java
+++ b/base/common/src/com/netscape/cms/servlet/base/CMSStartServlet.java
@@ -29,6 +29,8 @@ import javax.servlet.http.HttpServletResponse;
 
 import com.netscape.certsrv.apps.CMS;
 import com.netscape.certsrv.base.EBaseException;
+import com.netscape.cms.tomcat.ProxyRealm;
+import com.netscape.cmscore.realm.PKIRealm;
 import com.netscape.cmsutil.util.Utils;
 
 /**
@@ -89,10 +91,16 @@ public class CMSStartServlet extends HttpServlet {
                 }
             }
         }
+
         try {
             CMS.start(path);
         } catch (EBaseException e) {
         }
+
+        // Register realm for this subsystem
+        String context = getServletContext().getContextPath();
+        if (context.startsWith("/")) context = context.substring(1);
+        ProxyRealm.registerRealm(context, new PKIRealm());
     }
 
     public void doGet(HttpServletRequest req, HttpServletResponse res)
diff --git a/base/common/src/com/netscape/cms/tomcat/ProxyRealm.java b/base/common/src/com/netscape/cms/tomcat/ProxyRealm.java
new file mode 100644
index 0000000000000000000000000000000000000000..094c0561f49f4e79d910b1d9a30c13b10d04a297
--- /dev/null
+++ b/base/common/src/com/netscape/cms/tomcat/ProxyRealm.java
@@ -0,0 +1,139 @@
+package com.netscape.cms.tomcat;
+
+import java.beans.PropertyChangeListener;
+import java.io.IOException;
+import java.security.Principal;
+import java.security.cert.X509Certificate;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.catalina.Container;
+import org.apache.catalina.Context;
+import org.apache.catalina.Realm;
+import org.apache.catalina.Wrapper;
+import org.apache.catalina.connector.Request;
+import org.apache.catalina.connector.Response;
+import org.apache.catalina.deploy.SecurityConstraint;
+import org.ietf.jgss.GSSContext;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class ProxyRealm implements Realm {
+
+    public static Map<String, ProxyRealm> proxies = new HashMap<String, ProxyRealm>();
+
+    public Container container;
+    public Realm realm;
+
+    public ProxyRealm() {
+    }
+
+    @Override
+    public Container getContainer() {
+        return container;
+    }
+
+    @Override
+    public void setContainer(Container container) {
+        this.container = container;
+        if (container instanceof Context) {
+            Context context = (Context)container;
+            proxies.put(context.getBaseName(), this);
+        }
+    }
+
+    public Realm getRealm() {
+        return realm;
+    }
+
+    public void setRealm(Realm realm) {
+        this.realm = realm;
+        realm.setContainer(container);
+    }
+
+    public static void registerRealm(String contextName, Realm realm) {
+        ProxyRealm proxy = proxies.get(contextName);
+        if (proxy == null) return;
+
+        proxy.setRealm(realm);
+    }
+
+    @Override
+    public Principal authenticate(String username, String password) {
+        return realm.authenticate(username, password);
+    }
+
+    @Override
+    public Principal authenticate(X509Certificate certs[]) {
+        return realm.authenticate(certs);
+    }
+
+    @Override
+    public Principal authenticate(
+            String username,
+            String digest,
+            String nonce,
+            String nc,
+            String cnonce,
+            String qop,
+            String realmName,
+            String md5a2
+    ) {
+        return realm.authenticate(username, digest, nonce, nc, cnonce, qop, realmName, md5a2);
+    }
+
+    @Override
+    public Principal authenticate(GSSContext gssContext, boolean storeCreds) {
+        return realm.authenticate(gssContext, storeCreds);
+    }
+
+    @Override
+    public boolean hasResourcePermission(
+            Request request,
+            Response response,
+            SecurityConstraint[] constraints,
+            Context context
+    ) throws IOException {
+        return realm.hasResourcePermission(request, response, constraints, context);
+    }
+
+    @Override
+    public String getInfo() {
+        return realm.getInfo();
+    }
+
+    @Override
+    public void backgroundProcess() {
+        realm.backgroundProcess();
+    }
+
+    @Override
+    public SecurityConstraint[] findSecurityConstraints(Request request, Context context) {
+        return realm.findSecurityConstraints(request, context);
+    }
+
+    @Override
+    public boolean hasRole(Wrapper wrapper, Principal principal, String role) {
+        return realm.hasRole(wrapper, principal, role);
+    }
+
+    @Override
+    public boolean hasUserDataPermission(
+            Request request,
+            Response response,
+            SecurityConstraint[] constraint
+    ) throws IOException {
+        return realm.hasUserDataPermission(request,  response, constraint);
+    }
+
+    @Override
+    public void addPropertyChangeListener(PropertyChangeListener listener) {
+        realm.addPropertyChangeListener(listener);
+    }
+
+    @Override
+    public void removePropertyChangeListener(PropertyChangeListener listener) {
+        realm.removePropertyChangeListener(listener);
+    }
+}
diff --git a/base/common/src/com/netscape/cmscore/realm/SSLAuthenticatorWithFallback.java b/base/common/src/com/netscape/cms/tomcat/SSLAuthenticatorWithFallback.java
similarity index 99%
rename from base/common/src/com/netscape/cmscore/realm/SSLAuthenticatorWithFallback.java
rename to base/common/src/com/netscape/cms/tomcat/SSLAuthenticatorWithFallback.java
index 6b6af78a7306d97d2d69b5504f806922cdc40365..d1b3dc3f27e2f218a31cf2a519973879e635419c 100644
--- a/base/common/src/com/netscape/cmscore/realm/SSLAuthenticatorWithFallback.java
+++ b/base/common/src/com/netscape/cms/tomcat/SSLAuthenticatorWithFallback.java
@@ -16,7 +16,7 @@
 // All rights reserved.
 // --- END COPYRIGHT BLOCK ---
 
-package com.netscape.cmscore.realm;
+package com.netscape.cms.tomcat;
 
 import java.io.IOException;
 import java.security.cert.X509Certificate;
diff --git a/base/deploy/scripts/operations b/base/deploy/scripts/operations
index bb573fcaf088a85548a50e1abc22e2439daf9eb7..61e4e5de95ff7757f13ce9e58c975764bed1a8eb 100644
--- a/base/deploy/scripts/operations
+++ b/base/deploy/scripts/operations
@@ -951,11 +951,10 @@ verify_symlinks()
     pki_registry_dir="/etc/sysconfig/pki/${PKI_WEB_SERVER_TYPE}/${PKI_INSTANCE_ID}"
     pki_systemd_dir="/etc/systemd/system/pki-tomcatd.target.wants"
     pki_systemd_link="pki-${PKI_WEB_SERVER_TYPE}d@${PKI_INSTANCE_ID}.service"
-    # FUTURE: "pki_<pki_subsystem>_webapps_jar_dir" directories
-    pki_ca_jar_dir="${pki_common_jar_dir}"
-    pki_kra_jar_dir="${pki_common_jar_dir}"
-    pki_ocsp_jar_dir="${pki_common_jar_dir}"
-    pki_tks_jar_dir="${pki_common_jar_dir}"
+    pki_ca_jar_dir="${PKI_INSTANCE_PATH}/webapps/ca/WEB-INF/lib"
+    pki_kra_jar_dir="${PKI_INSTANCE_PATH}/webapps/kra/WEB-INF/lib"
+    pki_ocsp_jar_dir="${PKI_INSTANCE_PATH}/webapps/ocsp/WEB-INF/lib"
+    pki_tks_jar_dir="${PKI_INSTANCE_PATH}/webapps/tks/WEB-INF/lib"
 
     # '${PKI_INSTANCE_PATH}' symlinks
     base_symlinks=(
@@ -977,7 +976,14 @@ verify_symlinks()
         [webapps]=${PKI_INSTANCE_PATH}/webapps)
 
     # '${pki_ca_jar_dir}' symlinks
-    ca_jar_symlinks[pki-ca.jar]=/usr/share/java/pki/pki-ca.jar
+    ca_jar_symlinks=(
+        [pki-certsrv.jar]=${java_dir}/pki/pki-certsrv.jar
+        [pki-cms.jar]=${java_dir}/pki/pki-cms.jar
+        [pki-cmsbundle.jar]=${java_dir}/pki/pki-cmsbundle.jar
+        [pki-cmscore.jar]=${java_dir}/pki/pki-cmscore.jar
+        [pki-cmsutil.jar]=${java_dir}/pki/pki-cmsutil.jar
+        [pki-nsutil.jar]=${java_dir}/pki/pki-nsutil.jar
+        [pki-ca.jar]=${java_dir}/pki/pki-ca.jar)
 
     # '${PKI_INSTANCE_PATH}/kra' symlinks
     kra_symlinks=(
@@ -988,7 +994,14 @@ verify_symlinks()
         [webapps]=${PKI_INSTANCE_PATH}/webapps)
 
     # '${pki_kra_jar_dir}' symlinks
-    kra_jar_symlinks[pki-kra.jar]=/usr/share/java/pki/pki-kra.jar
+    kra_jar_symlinks=(
+        [pki-certsrv.jar]=${java_dir}/pki/pki-certsrv.jar
+        [pki-cms.jar]=${java_dir}/pki/pki-cms.jar
+        [pki-cmsbundle.jar]=${java_dir}/pki/pki-cmsbundle.jar
+        [pki-cmscore.jar]=${java_dir}/pki/pki-cmscore.jar
+        [pki-cmsutil.jar]=${java_dir}/pki/pki-cmsutil.jar
+        [pki-nsutil.jar]=${java_dir}/pki/pki-nsutil.jar
+        [pki-kra.jar]=${java_dir}/pki/pki-kra.jar)
 
     # '${PKI_INSTANCE_PATH}/ocsp' symlinks
     ocsp_symlinks=(
@@ -999,7 +1012,14 @@ verify_symlinks()
         [webapps]=${PKI_INSTANCE_PATH}/webapps)
 
     # '${pki_ocsp_jar_dir}' symlinks
-    ocsp_jar_symlinks[pki-ocsp.jar]=/usr/share/java/pki/pki-ocsp.jar
+    ocsp_jar_symlinks=(
+        [pki-certsrv.jar]=${java_dir}/pki/pki-certsrv.jar
+        [pki-cms.jar]=${java_dir}/pki/pki-cms.jar
+        [pki-cmsbundle.jar]=${java_dir}/pki/pki-cmsbundle.jar
+        [pki-cmscore.jar]=${java_dir}/pki/pki-cmscore.jar
+        [pki-cmsutil.jar]=${java_dir}/pki/pki-cmsutil.jar
+        [pki-nsutil.jar]=${java_dir}/pki/pki-nsutil.jar
+        [pki-ocsp.jar]=${java_dir}/pki/pki-ocsp.jar)
 
     # '${PKI_INSTANCE_PATH}/tks' symlinks
     tks_symlinks=(
@@ -1010,7 +1030,14 @@ verify_symlinks()
         [webapps]=${PKI_INSTANCE_PATH}/webapps)
 
     # '${pki_tks_jar_dir}' symlinks
-    tks_jar_symlinks[pki-tks.jar]=/usr/share/java/pki/pki-tks.jar
+    tks_jar_symlinks=(
+        [pki-certsrv.jar]=${java_dir}/pki/pki-certsrv.jar
+        [pki-cms.jar]=${java_dir}/pki/pki-cms.jar
+        [pki-cmsbundle.jar]=${java_dir}/pki/pki-cmsbundle.jar
+        [pki-cmscore.jar]=${java_dir}/pki/pki-cmscore.jar
+        [pki-cmsutil.jar]=${java_dir}/pki/pki-cmsutil.jar
+        [pki-nsutil.jar]=${java_dir}/pki/pki-nsutil.jar
+        [pki-tks.jar]=${java_dir}/pki/pki-tks.jar)
 
     # '${pki_common_jar_dir}' symlinks
     common_jar_symlinks=(
@@ -1025,12 +1052,7 @@ verify_symlinks()
         [jettison.jar]=${java_dir}/jettison.jar
         [jss4.jar]=${jni_dir}/jss4.jar
         [ldapjdk.jar]=${java_dir}/ldapjdk.jar
-        [pki-certsrv.jar]=/usr/share/java/pki/pki-certsrv.jar
-        [pki-cms.jar]=/usr/share/java/pki/pki-cms.jar
-        [pki-cmsbundle.jar]=/usr/share/java/pki/pki-cmsbundle.jar
-        [pki-cmscore.jar]=/usr/share/java/pki/pki-cmscore.jar
-        [pki-cmsutil.jar]=/usr/share/java/pki/pki-cmsutil.jar
-        [pki-nsutil.jar]=/usr/share/java/pki/pki-nsutil.jar
+        [pki-tomcat.jar]=${java_dir}/pki/pki-tomcat.jar
         [resteasy-atom-provider.jar]=${resteasy_java_dir}/resteasy-atom-provider.jar
         [resteasy-jaxb-provider.jar]=${resteasy_java_dir}/resteasy-jaxb-provider.jar
         [resteasy-jaxrs.jar]=${resteasy_java_dir}/resteasy-jaxrs.jar
diff --git a/base/deploy/src/scriptlets/instance_layout.py b/base/deploy/src/scriptlets/instance_layout.py
index d29b2d2d2207940b59722edd472b462b61ca13f0..8fd0396bc519cde25583a7be7e8e4ae57e22b632 100644
--- a/base/deploy/src/scriptlets/instance_layout.py
+++ b/base/deploy/src/scriptlets/instance_layout.py
@@ -97,18 +97,8 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
                 master['pki_jss_jar_link'])
             util.symlink.create(master['pki_ldapjdk_jar'],
                 master['pki_ldapjdk_jar_link'])
-            util.symlink.create(master['pki_certsrv_jar'],
-                master['pki_certsrv_jar_link'])
-            util.symlink.create(master['pki_cmsbundle'],
-                master['pki_cmsbundle_jar_link'])
-            util.symlink.create(master['pki_cmscore'],
-                master['pki_cmscore_jar_link'])
-            util.symlink.create(master['pki_cms'],
-                master['pki_cms_jar_link'])
-            util.symlink.create(master['pki_cmsutil'],
-                master['pki_cmsutil_jar_link'])
-            util.symlink.create(master['pki_nsutil'],
-                master['pki_nsutil_jar_link'])
+            util.symlink.create(master['pki_tomcat_jar'],
+                master['pki_tomcat_jar_link'])
             util.symlink.create(master['pki_resteasy_atom_provider_jar'],
                 master['pki_resteasy_atom_provider_jar_link'])
             util.symlink.create(master['pki_resteasy_jaxb_provider_jar'],
diff --git a/base/deploy/src/scriptlets/pkiparser.py b/base/deploy/src/scriptlets/pkiparser.py
index 4b6128440f28ffad5cb615e95cb05f3bd666c1ae..127e42822b6691c5e8db79cb98ae2bcbf04dcdd4 100644
--- a/base/deploy/src/scriptlets/pkiparser.py
+++ b/base/deploy/src/scriptlets/pkiparser.py
@@ -696,6 +696,9 @@ def compose_pki_master_dictionary():
             config.pki_master_dict['pki_nsutil'] =\
                 os.path.join(config.PKI_DEPLOYMENT_PKI_JAR_SOURCE_ROOT,
                              "pki-nsutil.jar")
+            config.pki_master_dict['pki_tomcat_jar'] =\
+                os.path.join(config.PKI_DEPLOYMENT_PKI_JAR_SOURCE_ROOT,
+                             "pki-tomcat.jar")
             config.pki_master_dict['pki_resteasy_atom_provider_jar'] =\
                 os.path.join(config.PKI_DEPLOYMENT_RESTEASY_JAR_SOURCE_ROOT,
                              "resteasy-atom-provider.jar")
@@ -775,30 +778,10 @@ def compose_pki_master_dictionary():
                 os.path.join(
                     config.pki_master_dict['pki_tomcat_common_lib_path'],
                     "ldapjdk.jar")
-            config.pki_master_dict['pki_certsrv_jar_link'] =\
+            config.pki_master_dict['pki_tomcat_jar_link'] =\
                 os.path.join(
                     config.pki_master_dict['pki_tomcat_common_lib_path'],
-                    "pki-certsrv.jar")
-            config.pki_master_dict['pki_cmsbundle_jar_link'] =\
-                os.path.join(
-                    config.pki_master_dict['pki_tomcat_common_lib_path'],
-                    "pki-cmsbundle.jar")
-            config.pki_master_dict['pki_cmscore_jar_link'] =\
-                os.path.join(
-                    config.pki_master_dict['pki_tomcat_common_lib_path'],
-                    "pki-cmscore.jar")
-            config.pki_master_dict['pki_cms_jar_link'] =\
-                os.path.join(
-                    config.pki_master_dict['pki_tomcat_common_lib_path'],
-                    "pki-cms.jar")
-            config.pki_master_dict['pki_cmsutil_jar_link'] =\
-                os.path.join(
-                    config.pki_master_dict['pki_tomcat_common_lib_path'],
-                    "pki-cmsutil.jar")
-            config.pki_master_dict['pki_nsutil_jar_link'] =\
-                os.path.join(
-                    config.pki_master_dict['pki_tomcat_common_lib_path'],
-                    "pki-nsutil.jar")
+                    "pki-tomcat.jar")
             config.pki_master_dict['pki_resteasy_atom_provider_jar_link'] =\
                 os.path.join(
                     config.pki_master_dict['pki_tomcat_common_lib_path'],
@@ -938,58 +921,66 @@ def compose_pki_master_dictionary():
                     config.pki_master_dict['pki_tomcat_webapps_subsystem_path'],
                     "WEB-INF",
                     "lib")
+            config.pki_master_dict['pki_certsrv_jar_link'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_tomcat_webapps_subsystem_webinf_lib_path'],
+                    "pki-certsrv.jar")
+            config.pki_master_dict['pki_cmsbundle_jar_link'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_tomcat_webapps_subsystem_webinf_lib_path'],
+                    "pki-cmsbundle.jar")
+            config.pki_master_dict['pki_cmscore_jar_link'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_tomcat_webapps_subsystem_webinf_lib_path'],
+                    "pki-cmscore.jar")
+            config.pki_master_dict['pki_cms_jar_link'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_tomcat_webapps_subsystem_webinf_lib_path'],
+                    "pki-cms.jar")
+            config.pki_master_dict['pki_cmsutil_jar_link'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_tomcat_webapps_subsystem_webinf_lib_path'],
+                    "pki-cmsutil.jar")
+            config.pki_master_dict['pki_nsutil_jar_link'] =\
+                os.path.join(
+                    config.pki_master_dict['pki_tomcat_webapps_subsystem_webinf_lib_path'],
+                    "pki-nsutil.jar")
             # Tomcat PKI subsystem war file convenience symbolic links
             if config.pki_master_dict['pki_subsystem'] == "CA":
                 config.pki_master_dict['pki_ca_jar'] =\
                     os.path.join(config.PKI_DEPLOYMENT_PKI_JAR_SOURCE_ROOT,
                                  "pki-ca.jar")
-                # config.pki_master_dict['pki_ca_jar_link'] =\
-                #     os.path.join(
-                #         config.pki_master_dict\
-                #         ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
-                #         "pki-ca.jar")
                 config.pki_master_dict['pki_ca_jar_link'] =\
                     os.path.join(
-                        config.pki_master_dict['pki_tomcat_common_lib_path'],
+                        config.pki_master_dict\
+                        ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
                         "pki-ca.jar")
             elif config.pki_master_dict['pki_subsystem'] == "KRA":
                 config.pki_master_dict['pki_kra_jar'] =\
                     os.path.join(config.PKI_DEPLOYMENT_PKI_JAR_SOURCE_ROOT,
                                  "pki-kra.jar")
-                # config.pki_master_dict['pki_kra_jar_link'] =\
-                #     os.path.join(
-                #         config.pki_master_dict\
-                #         ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
-                #         "pki-kra.jar")
                 config.pki_master_dict['pki_kra_jar_link'] =\
                     os.path.join(
-                        config.pki_master_dict['pki_tomcat_common_lib_path'],
+                        config.pki_master_dict\
+                        ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
                         "pki-kra.jar")
             elif config.pki_master_dict['pki_subsystem'] == "OCSP":
                 config.pki_master_dict['pki_ocsp_jar'] =\
                     os.path.join(config.PKI_DEPLOYMENT_PKI_JAR_SOURCE_ROOT,
                                  "pki-ocsp.jar")
-                # config.pki_master_dict['pki_ocsp_jar_link'] =\
-                #     os.path.join(
-                #         config.pki_master_dict\
-                #         ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
-                #         "pki-ocsp.jar")
                 config.pki_master_dict['pki_ocsp_jar_link'] =\
                     os.path.join(
-                        config.pki_master_dict['pki_tomcat_common_lib_path'],
+                        config.pki_master_dict\
+                        ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
                         "pki-ocsp.jar")
             elif config.pki_master_dict['pki_subsystem'] == "TKS":
                 config.pki_master_dict['pki_tks_jar'] =\
                     os.path.join(config.PKI_DEPLOYMENT_PKI_JAR_SOURCE_ROOT,
                                  "pki-tks.jar")
-                # config.pki_master_dict['pki_tks_jar_link'] =\
-                #     os.path.join(
-                #         config.pki_master_dict\
-                #         ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
-                #         "pki-tks.jar")
                 config.pki_master_dict['pki_tks_jar_link'] =\
                     os.path.join(
-                        config.pki_master_dict['pki_tomcat_common_lib_path'],
+                        config.pki_master_dict\
+                        ['pki_tomcat_webapps_subsystem_webinf_lib_path'],
                         "pki-tks.jar")
         # PKI Target (slot substitution) name/value pairs
         config.pki_master_dict['pki_target_cs_cfg'] =\
diff --git a/base/deploy/src/scriptlets/war_explosion.py b/base/deploy/src/scriptlets/war_explosion.py
index 16113ba7d72139b3b10145726f8d76111c3d2436..851f1a7f20125a84ce4f5a4387bff6e3d203d4d8 100644
--- a/base/deploy/src/scriptlets/war_explosion.py
+++ b/base/deploy/src/scriptlets/war_explosion.py
@@ -44,6 +44,18 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
             util.directory.create(
                 master['pki_tomcat_webapps_subsystem_webinf_lib_path'])
             # establish Tomcat webapps subsystem WEB-INF lib symbolic links
+            util.symlink.create(master['pki_certsrv_jar'],
+                master['pki_certsrv_jar_link'])
+            util.symlink.create(master['pki_cmsbundle'],
+                master['pki_cmsbundle_jar_link'])
+            util.symlink.create(master['pki_cmscore'],
+                master['pki_cmscore_jar_link'])
+            util.symlink.create(master['pki_cms'],
+                master['pki_cms_jar_link'])
+            util.symlink.create(master['pki_cmsutil'],
+                master['pki_cmsutil_jar_link'])
+            util.symlink.create(master['pki_nsutil'],
+                master['pki_nsutil_jar_link'])
             if master['pki_subsystem'] == "CA":
                 util.symlink.create(master['pki_ca_jar'],
                                     master['pki_ca_jar_link'])
diff --git a/base/common/shared/conf/context.xml b/base/kra/shared/webapps/kra/META-INF/context.xml
similarity index 58%
copy from base/common/shared/conf/context.xml
copy to base/kra/shared/webapps/kra/META-INF/context.xml
index b28f1bd20c82e3f0f720034af27f7979b136c02b..975ecabf1fc1687572b0b0787d9f2edf9a8bc48c 100644
--- a/base/common/shared/conf/context.xml
+++ b/base/kra/shared/webapps/kra/META-INF/context.xml
@@ -22,25 +22,10 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<!-- The contents of this file will be loaded for each web application -->
-<Context>
+<Context crossContext="true" allowLinking="true">
 
-    <!-- Default set of monitored resources -->
-    <WatchedResource>WEB-INF/web.xml</WatchedResource>
+    <Valve className="com.netscape.cms.tomcat.SSLAuthenticatorWithFallback" />
 
-    <!-- Uncomment this to disable session persistence across Tomcat restarts -->
-    <!--
-    <Manager pathname="" />
-    -->
-
-    <!-- Uncomment this to enable Comet connection tacking (provides events
-         on session expiration as well as webapp lifecycle) -->
-    <!--
-    <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
-    -->
-
-    <Valve className="com.netscape.cmscore.realm.SSLAuthenticatorWithFallback" />
-
-    <Realm className="com.netscape.cmscore.realm.PKIRealm" />
+    <Realm className="com.netscape.cms.tomcat.ProxyRealm" />
 
 </Context>
diff --git a/base/common/shared/conf/context.xml b/base/ocsp/shared/webapps/ocsp/META-INF/context.xml
similarity index 58%
copy from base/common/shared/conf/context.xml
copy to base/ocsp/shared/webapps/ocsp/META-INF/context.xml
index b28f1bd20c82e3f0f720034af27f7979b136c02b..975ecabf1fc1687572b0b0787d9f2edf9a8bc48c 100644
--- a/base/common/shared/conf/context.xml
+++ b/base/ocsp/shared/webapps/ocsp/META-INF/context.xml
@@ -22,25 +22,10 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<!-- The contents of this file will be loaded for each web application -->
-<Context>
+<Context crossContext="true" allowLinking="true">
 
-    <!-- Default set of monitored resources -->
-    <WatchedResource>WEB-INF/web.xml</WatchedResource>
+    <Valve className="com.netscape.cms.tomcat.SSLAuthenticatorWithFallback" />
 
-    <!-- Uncomment this to disable session persistence across Tomcat restarts -->
-    <!--
-    <Manager pathname="" />
-    -->
-
-    <!-- Uncomment this to enable Comet connection tacking (provides events
-         on session expiration as well as webapp lifecycle) -->
-    <!--
-    <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
-    -->
-
-    <Valve className="com.netscape.cmscore.realm.SSLAuthenticatorWithFallback" />
-
-    <Realm className="com.netscape.cmscore.realm.PKIRealm" />
+    <Realm className="com.netscape.cms.tomcat.ProxyRealm" />
 
 </Context>
diff --git a/base/setup/scripts/functions b/base/setup/scripts/functions
index 20e5dcdff4fc9e7f3c6a7c687dcd06082298da8b..7eacd7e1fbcf8bcae3e192b24035afaf10d7504b 100644
--- a/base/setup/scripts/functions
+++ b/base/setup/scripts/functions
@@ -955,7 +955,8 @@ verify_symlinks()
         [jss4.jar]=${jni_dir}/jss4.jar
         [tomcatjss.jar]=/usr/share/java/tomcatjss.jar
         # Dogtag 9 -> Dogtag 10
-        [apache-commons-codec.jar]=/usr/share/java/commons-codec.jar)
+        [apache-commons-codec.jar]=/usr/share/java/commons-codec.jar
+        [pki-tomcat.jar]=/usr/share/java/pki/pki-tomcat.jar)
 
     # '${pki_webapps_jar_dir}' symlinks
     webapps_jar_symlinks=(
diff --git a/base/common/shared/conf/context.xml b/base/tks/shared/webapps/tks/META-INF/context.xml
similarity index 58%
copy from base/common/shared/conf/context.xml
copy to base/tks/shared/webapps/tks/META-INF/context.xml
index b28f1bd20c82e3f0f720034af27f7979b136c02b..975ecabf1fc1687572b0b0787d9f2edf9a8bc48c 100644
--- a/base/common/shared/conf/context.xml
+++ b/base/tks/shared/webapps/tks/META-INF/context.xml
@@ -22,25 +22,10 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<!-- The contents of this file will be loaded for each web application -->
-<Context>
+<Context crossContext="true" allowLinking="true">
 
-    <!-- Default set of monitored resources -->
-    <WatchedResource>WEB-INF/web.xml</WatchedResource>
+    <Valve className="com.netscape.cms.tomcat.SSLAuthenticatorWithFallback" />
 
-    <!-- Uncomment this to disable session persistence across Tomcat restarts -->
-    <!--
-    <Manager pathname="" />
-    -->
-
-    <!-- Uncomment this to enable Comet connection tacking (provides events
-         on session expiration as well as webapp lifecycle) -->
-    <!--
-    <Valve className="org.apache.catalina.valves.CometConnectionManagerValve" />
-    -->
-
-    <Valve className="com.netscape.cmscore.realm.SSLAuthenticatorWithFallback" />
-
-    <Realm className="com.netscape.cmscore.realm.PKIRealm" />
+    <Realm className="com.netscape.cms.tomcat.ProxyRealm" />
 
 </Context>
diff --git a/specs/pki-core.spec b/specs/pki-core.spec
index c493c397ccf1b0e173a6018ab0049ac58e3df42f..53311355f222fbd09e67208c87d350c0ecb3df08 100644
--- a/specs/pki-core.spec
+++ b/specs/pki-core.spec
@@ -14,7 +14,7 @@ distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
 
 Name:             pki-core
 Version:          10.0.0
-Release:          %{?relprefix}27%{?prerel}%{?dist}
+Release:          %{?relprefix}28%{?prerel}%{?dist}
 Summary:          Certificate System - PKI Core Components
 URL:              http://pki.fedoraproject.org/
 License:          GPLv2
@@ -1204,6 +1204,8 @@ fi
 %{_javadir}/pki/pki-cmsbundle.jar
 %{_javadir}/pki/pki-cmscore-%{version}.jar
 %{_javadir}/pki/pki-cmscore.jar
+%{_javadir}/pki/pki-tomcat-%{version}.jar
+%{_javadir}/pki/pki-tomcat.jar
 %dir %{_localstatedir}/lock/pki/tomcat
 %dir %{_localstatedir}/run/pki/tomcat
 
@@ -1356,6 +1358,9 @@ fi
 
 
 %changelog
+* Wed Aug 22 2012 Endi S. Dewata <edewata@redhat.com> 10.0.0-0.28.a1
+- Added pki-tomcat.jar.
+
 * Tue Aug 21 2012 Endi S. Dewata <edewata@redhat.com> 10.0.0-0.27.a1
 - Moved WAR creation code into CMake scripts.
 
-- 
1.7.11.2

