From 51a27d6bd82d44cefe53a7cb3b27558ffe2bcc32 Mon Sep 17 00:00:00 2001
From: "Endi S. Dewata" <edewata@redhat.com>
Date: Wed, 7 May 2014 16:01:25 -0400
Subject: [PATCH] Fixed problem adding enabled TPS profile.

The profile, profile mapping, connector, and authenticator services
in TPS have been modified to allow adding enabled entries directly
if the user has the proper rights.

The authenticator database has been moved into the config package
for consistency.

Ticket #948
---
 .../cmscore/src/com/netscape/cmscore/dbs/CSCfgDatabase.java |  5 -----
 .../src/org/dogtagpki/server/tps/TPSSubsystem.java          |  2 +-
 .../server/tps/{dbs => config}/AuthenticatorDatabase.java   |  7 ++-----
 .../server/tps/{dbs => config}/AuthenticatorRecord.java     |  2 +-
 .../org/dogtagpki/server/tps/config/ConnectorDatabase.java  |  2 +-
 .../org/dogtagpki/server/tps/config/ProfileDatabase.java    |  2 +-
 .../dogtagpki/server/tps/config/ProfileMappingDatabase.java |  2 +-
 .../org/dogtagpki/server/tps/rest/AuthenticatorService.java | 13 +++++++++++--
 .../src/org/dogtagpki/server/tps/rest/ConnectorService.java |  9 +++++++++
 .../dogtagpki/server/tps/rest/ProfileMappingService.java    |  9 +++++++++
 .../src/org/dogtagpki/server/tps/rest/ProfileService.java   |  9 +++++++++
 11 files changed, 45 insertions(+), 17 deletions(-)
 rename base/tps-tomcat/src/org/dogtagpki/server/tps/{dbs => config}/AuthenticatorDatabase.java (95%)
 rename base/tps-tomcat/src/org/dogtagpki/server/tps/{dbs => config}/AuthenticatorRecord.java (95%)

diff --git a/base/server/cmscore/src/com/netscape/cmscore/dbs/CSCfgDatabase.java b/base/server/cmscore/src/com/netscape/cmscore/dbs/CSCfgDatabase.java
index 51a32182c7148dd9053463a56680e39725adbfcb..dcc57eda7daced29a504900fb1d649000c5ae84b 100644
--- a/base/server/cmscore/src/com/netscape/cmscore/dbs/CSCfgDatabase.java
+++ b/base/server/cmscore/src/com/netscape/cmscore/dbs/CSCfgDatabase.java
@@ -62,11 +62,6 @@ public class CSCfgDatabase<E extends CSCfgRecord> extends Database<E> {
         return configStore.getString("config." + substoreName + "." + recordID + ".state", "Disabled");
     }
 
-    public void createRecordStatus(String recordID, String status) throws EBaseException {
-        if (status == null || requiresApproval()) status = "Disabled";
-        setRecordStatus(recordID, status);
-    }
-
     public void setRecordStatus(String recordID, String status) throws EBaseException {
         configStore.put("config." + substoreName + "." + recordID + ".state", status);
         configStore.put("config." + substoreName + "." + recordID + ".timestamp",
diff --git a/base/tps-tomcat/src/org/dogtagpki/server/tps/TPSSubsystem.java b/base/tps-tomcat/src/org/dogtagpki/server/tps/TPSSubsystem.java
index 1d5c9d2b9c9d7a0fe01646e7792fff061b7df2d7..990573303e815117ffb8ef2f02e1adabfe9179d3 100644
--- a/base/tps-tomcat/src/org/dogtagpki/server/tps/TPSSubsystem.java
+++ b/base/tps-tomcat/src/org/dogtagpki/server/tps/TPSSubsystem.java
@@ -18,12 +18,12 @@
 package org.dogtagpki.server.tps;
 
 import org.dogtagpki.server.tps.cms.ConnectionManager;
+import org.dogtagpki.server.tps.config.AuthenticatorDatabase;
 import org.dogtagpki.server.tps.config.ConfigDatabase;
 import org.dogtagpki.server.tps.config.ConnectorDatabase;
 import org.dogtagpki.server.tps.config.ProfileDatabase;
 import org.dogtagpki.server.tps.config.ProfileMappingDatabase;
 import org.dogtagpki.server.tps.dbs.ActivityDatabase;
-import org.dogtagpki.server.tps.dbs.AuthenticatorDatabase;
 import org.dogtagpki.server.tps.dbs.TPSCertDatabase;
 import org.dogtagpki.server.tps.dbs.TokenDatabase;
 import org.dogtagpki.server.tps.engine.TPSEngine;
diff --git a/base/tps-tomcat/src/org/dogtagpki/server/tps/dbs/AuthenticatorDatabase.java b/base/tps-tomcat/src/org/dogtagpki/server/tps/config/AuthenticatorDatabase.java
similarity index 95%
rename from base/tps-tomcat/src/org/dogtagpki/server/tps/dbs/AuthenticatorDatabase.java
rename to base/tps-tomcat/src/org/dogtagpki/server/tps/config/AuthenticatorDatabase.java
index 912207501fa0132b61f03d00f7b02089ab580fb6..292b80afbfa7679466bdbd7d6ef6491c30c77ff0 100644
--- a/base/tps-tomcat/src/org/dogtagpki/server/tps/dbs/AuthenticatorDatabase.java
+++ b/base/tps-tomcat/src/org/dogtagpki/server/tps/config/AuthenticatorDatabase.java
@@ -16,15 +16,12 @@
 // All rights reserved.
 // --- END COPYRIGHT BLOCK ---
 
-package org.dogtagpki.server.tps.dbs;
+package org.dogtagpki.server.tps.config;
 
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Map;
 
-import org.dogtagpki.server.tps.config.ConfigDatabase;
-import org.dogtagpki.server.tps.config.ConfigRecord;
-
 import com.netscape.certsrv.apps.CMS;
 import com.netscape.certsrv.base.EBaseException;
 import com.netscape.cmscore.dbs.CSCfgDatabase;
@@ -96,7 +93,7 @@ public class AuthenticatorDatabase extends CSCfgDatabase<AuthenticatorRecord> {
         configDatabase.addProperties(configRecord, authenticatorID, properties);
 
         // create status
-        createRecordStatus(authenticatorID, authenticatorRecord.getStatus());
+        setRecordStatus(authenticatorID, authenticatorRecord.getStatus());
 
         configDatabase.commit();
     }
diff --git a/base/tps-tomcat/src/org/dogtagpki/server/tps/dbs/AuthenticatorRecord.java b/base/tps-tomcat/src/org/dogtagpki/server/tps/config/AuthenticatorRecord.java
similarity index 95%
rename from base/tps-tomcat/src/org/dogtagpki/server/tps/dbs/AuthenticatorRecord.java
rename to base/tps-tomcat/src/org/dogtagpki/server/tps/config/AuthenticatorRecord.java
index 7586dbb0562bc7c63737e12d77b6e44e98026aa4..937a25e51e6404b7bdd1026ae38d1aad03145839 100644
--- a/base/tps-tomcat/src/org/dogtagpki/server/tps/dbs/AuthenticatorRecord.java
+++ b/base/tps-tomcat/src/org/dogtagpki/server/tps/config/AuthenticatorRecord.java
@@ -16,7 +16,7 @@
 // All rights reserved.
 // --- END COPYRIGHT BLOCK ---
 
-package org.dogtagpki.server.tps.dbs;
+package org.dogtagpki.server.tps.config;
 
 import com.netscape.cmscore.dbs.CSCfgRecord;
 
diff --git a/base/tps-tomcat/src/org/dogtagpki/server/tps/config/ConnectorDatabase.java b/base/tps-tomcat/src/org/dogtagpki/server/tps/config/ConnectorDatabase.java
index 6abbafa1dab1d13f8199f8bee70d15a0026c686c..313d8c901b6200165d0d4561faaefde4d630807f 100644
--- a/base/tps-tomcat/src/org/dogtagpki/server/tps/config/ConnectorDatabase.java
+++ b/base/tps-tomcat/src/org/dogtagpki/server/tps/config/ConnectorDatabase.java
@@ -95,7 +95,7 @@ public class ConnectorDatabase extends CSCfgDatabase<ConnectorRecord> {
         configDatabase.addProperties(configRecord, connectorID, properties);
 
         // create status
-        createRecordStatus(connectorID, connectorRecord.getStatus());
+        setRecordStatus(connectorID, connectorRecord.getStatus());
 
         configDatabase.commit();
     }
diff --git a/base/tps-tomcat/src/org/dogtagpki/server/tps/config/ProfileDatabase.java b/base/tps-tomcat/src/org/dogtagpki/server/tps/config/ProfileDatabase.java
index 195580ff9376d99df89f3bdb92863459e60bc4d8..01225d309a74c5d9b0d7645f0757dfcac1ad55e0 100644
--- a/base/tps-tomcat/src/org/dogtagpki/server/tps/config/ProfileDatabase.java
+++ b/base/tps-tomcat/src/org/dogtagpki/server/tps/config/ProfileDatabase.java
@@ -94,7 +94,7 @@ public class ProfileDatabase extends CSCfgDatabase<ProfileRecord> {
         configDatabase.addProperties(configRecord, profileID, properties);
 
         // create status
-        createRecordStatus(profileID, profileRecord.getStatus());
+        setRecordStatus(profileID, profileRecord.getStatus());
 
         configDatabase.commit();
     }
diff --git a/base/tps-tomcat/src/org/dogtagpki/server/tps/config/ProfileMappingDatabase.java b/base/tps-tomcat/src/org/dogtagpki/server/tps/config/ProfileMappingDatabase.java
index 8310abe825535a59a2fdd547956b05b9053f587c..67a21d6ac349e39fc52e06feded1fdeedfd1e5d0 100644
--- a/base/tps-tomcat/src/org/dogtagpki/server/tps/config/ProfileMappingDatabase.java
+++ b/base/tps-tomcat/src/org/dogtagpki/server/tps/config/ProfileMappingDatabase.java
@@ -94,7 +94,7 @@ public class ProfileMappingDatabase extends CSCfgDatabase<ProfileMappingRecord>
         configDatabase.addProperties(configRecord, profileMappingID, properties);
 
         // create status
-        createRecordStatus(profileMappingID, profileMappingRecord.getStatus());
+        setRecordStatus(profileMappingID, profileMappingRecord.getStatus());
 
         configDatabase.commit();
     }
diff --git a/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/AuthenticatorService.java b/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/AuthenticatorService.java
index 6a66e9ec55cbc91d84587a04079b9247f0c39a89..3e123a84ebcb613a6cdbcdc0a38513601b743989 100644
--- a/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/AuthenticatorService.java
+++ b/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/AuthenticatorService.java
@@ -33,8 +33,8 @@ import javax.ws.rs.core.Response;
 import javax.ws.rs.core.UriInfo;
 
 import org.dogtagpki.server.tps.TPSSubsystem;
-import org.dogtagpki.server.tps.dbs.AuthenticatorDatabase;
-import org.dogtagpki.server.tps.dbs.AuthenticatorRecord;
+import org.dogtagpki.server.tps.config.AuthenticatorDatabase;
+import org.dogtagpki.server.tps.config.AuthenticatorRecord;
 import org.jboss.resteasy.plugins.providers.atom.Link;
 
 import com.netscape.certsrv.apps.CMS;
@@ -44,6 +44,7 @@ import com.netscape.certsrv.base.PKIException;
 import com.netscape.certsrv.tps.authenticator.AuthenticatorCollection;
 import com.netscape.certsrv.tps.authenticator.AuthenticatorData;
 import com.netscape.certsrv.tps.authenticator.AuthenticatorResource;
+import com.netscape.cms.realm.PKIPrincipal;
 import com.netscape.cms.servlet.base.PKIService;
 
 /**
@@ -178,6 +179,14 @@ public class AuthenticatorService extends PKIService implements AuthenticatorRes
             TPSSubsystem subsystem = (TPSSubsystem)CMS.getSubsystem(TPSSubsystem.ID);
             AuthenticatorDatabase database = subsystem.getAuthenticatorDatabase();
 
+            String status = authenticatorData.getStatus();
+            PKIPrincipal principal = (PKIPrincipal)servletRequest.getUserPrincipal();
+
+            if (status == null || database.requiresApproval() && !principal.hasRole("TUS Agents")) {
+                // if status is unspecified or user is not an agent, status is set to disabled
+                authenticatorData.setStatus("Disabled");
+            }
+
             database.addRecord(authenticatorData.getID(), createAuthenticatorRecord(authenticatorData));
             authenticatorData = createAuthenticatorData(database.getRecord(authenticatorData.getID()));
 
diff --git a/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/ConnectorService.java b/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/ConnectorService.java
index 91b7fe64b13463a0b9389ed8e5b334d8aaa69cbd..754baeae54a42cc8c2206b98e7f651827686f99a 100644
--- a/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/ConnectorService.java
+++ b/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/ConnectorService.java
@@ -44,6 +44,7 @@ import com.netscape.certsrv.base.PKIException;
 import com.netscape.certsrv.tps.connector.ConnectorCollection;
 import com.netscape.certsrv.tps.connector.ConnectorData;
 import com.netscape.certsrv.tps.connector.ConnectorResource;
+import com.netscape.cms.realm.PKIPrincipal;
 import com.netscape.cms.servlet.base.PKIService;
 
 /**
@@ -178,6 +179,14 @@ public class ConnectorService extends PKIService implements ConnectorResource {
             TPSSubsystem subsystem = (TPSSubsystem)CMS.getSubsystem(TPSSubsystem.ID);
             ConnectorDatabase database = subsystem.getConnectorDatabase();
 
+            String status = connectorData.getStatus();
+            PKIPrincipal principal = (PKIPrincipal)servletRequest.getUserPrincipal();
+
+            if (status == null || database.requiresApproval() && !principal.hasRole("TUS Agents")) {
+                // if status is unspecified or user is not an agent, status is set to disabled
+                connectorData.setStatus("Disabled");
+            }
+
             database.addRecord(connectorData.getID(), createConnectorRecord(connectorData));
             connectorData = createConnectorData(database.getRecord(connectorData.getID()));
 
diff --git a/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/ProfileMappingService.java b/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/ProfileMappingService.java
index 1425457f325d8268e56e100433cce2c72dfb2f71..552bba494951bbf6ab983be5590066ae9cb881c8 100644
--- a/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/ProfileMappingService.java
+++ b/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/ProfileMappingService.java
@@ -44,6 +44,7 @@ import com.netscape.certsrv.base.PKIException;
 import com.netscape.certsrv.tps.profile.ProfileMappingCollection;
 import com.netscape.certsrv.tps.profile.ProfileMappingData;
 import com.netscape.certsrv.tps.profile.ProfileMappingResource;
+import com.netscape.cms.realm.PKIPrincipal;
 import com.netscape.cms.servlet.base.PKIService;
 
 /**
@@ -174,6 +175,14 @@ public class ProfileMappingService extends PKIService implements ProfileMappingR
             TPSSubsystem subsystem = (TPSSubsystem)CMS.getSubsystem(TPSSubsystem.ID);
             ProfileMappingDatabase database = subsystem.getProfileMappingDatabase();
 
+            String status = profileMappingData.getStatus();
+            PKIPrincipal principal = (PKIPrincipal)servletRequest.getUserPrincipal();
+
+            if (status == null || database.requiresApproval() && !principal.hasRole("TUS Agents")) {
+                // if status is unspecified or user is not an agent, status is set to disabled
+                profileMappingData.setStatus("Disabled");
+            }
+
             database.addRecord(profileMappingData.getID(), createProfileMappingRecord(profileMappingData));
             profileMappingData = createProfileMappingData(database.getRecord(profileMappingData.getID()));
 
diff --git a/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/ProfileService.java b/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/ProfileService.java
index d21b8939ecf411cf38bdebbeaf65e2989e3b1777..7605132e22746164712392895609dfdc792f9061 100644
--- a/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/ProfileService.java
+++ b/base/tps-tomcat/src/org/dogtagpki/server/tps/rest/ProfileService.java
@@ -44,6 +44,7 @@ import com.netscape.certsrv.base.PKIException;
 import com.netscape.certsrv.tps.profile.ProfileCollection;
 import com.netscape.certsrv.tps.profile.ProfileData;
 import com.netscape.certsrv.tps.profile.ProfileResource;
+import com.netscape.cms.realm.PKIPrincipal;
 import com.netscape.cms.servlet.base.PKIService;
 
 /**
@@ -178,6 +179,14 @@ public class ProfileService extends PKIService implements ProfileResource {
             TPSSubsystem subsystem = (TPSSubsystem)CMS.getSubsystem(TPSSubsystem.ID);
             ProfileDatabase database = subsystem.getProfileDatabase();
 
+            String status = profileData.getStatus();
+            PKIPrincipal principal = (PKIPrincipal)servletRequest.getUserPrincipal();
+
+            if (status == null || database.requiresApproval() && !principal.hasRole("TUS Agents")) {
+                // if status is unspecified or user is not an agent, status is set to disabled
+                profileData.setStatus("Disabled");
+            }
+
             database.addRecord(profileData.getID(), createProfileRecord(profileData));
 
             profileData = createProfileData(database.getRecord(profileData.getID()));
-- 
1.8.4.2

