Parse ACL resource attributes, then update the ACLs memory store
This is intended to be used if storing ACLs on ldap is not desired,
and the caller is expected to call this method to add resource
and acl info into acls memory store.
Add profile input
signed.audit LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE used when
configuring cert profile (general settings and cert profile; obsoletes
extensions and constraints policies)
Add profile instance
signed.audit LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE used when
configuring cert profile (general settings and cert profile; obsoletes
extensions and constraints policies)
Add profile output
signed.audit LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE used when
configuring cert profile (general settings and cert profile; obsoletes
extensions and constraints policies)
Add policy profile
signed.audit LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE used when
configuring cert profile (general settings and cert profile; obsoletes
extensions and constraints policies)
The state of a request that has been approved by an agent, or
automatically by the policy engine, but have not been successfully
transmitted to the service module.
Approve request
(Certificate Request Processed - a manual "agent" profile based cert
acceptance)
signed.audit LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED used when a
certificate request has just been through the approval process
Signed Audit Parameters
This method is inherited by all extended admin servlets and
is called to extract parameters from the HttpServletRequest
and return a string of name;;value pairs separated by a '+'
if more than one name;;value pair exists.
Signed Audit Log Profile ID
This method is inherited by all extended "EnrollProfile"s,
and is called to obtain the "ProfileID" for
a signed audit log message.
Signed Audit Log Profile ID
This method is inherited by all extended "EnrollProfile"s,
and is called to obtain the "ProfileID" for
a signed audit log message.
Signed Audit Log Requester ID
This method is inherited by all extended "EnrollProfile"s,
and is called to obtain the "RequesterID" for
a signed audit log message.
Signed Audit Log Subject ID
This method is inherited by all extended "BasicProfile"s,
and is called to obtain the "SubjectID" for
a signed audit log message.
Signed Audit Log Subject ID
This method is inherited by all extended "CMSServlet"s,
and is called to obtain the "SubjectID" for
a signed audit log message.
Signed Audit Log Subject ID
This method is inherited by all extended "CMSServlet"s,
and is called to obtain the "SubjectID" for
a signed audit log message.
Signed Audit Log Subject ID
This method is inherited by all extended "CMSServlet"s,
and is called to obtain the "SubjectID" for
a signed audit log message.
Signed Audit Log Subject ID
This method is inherited by all extended "CMSServlet"s,
and is called to obtain the "SubjectID" for
a signed audit log message.
Authentication
signed.audit LOGGING_SIGNED_AUDIT_AUTH_FAIL used when authentication
fails (in case of SSL-client auth, only webserver env can pick up the
SSL violation; CS authMgr can pick up cert mis-match, so this event
is used)
signed.audit LOGGING_SIGNED_AUDIT_AUTH_SUCCESS used when authentication
succeeded
check the authorization permission for the user associated with
authToken on operation
Example:
For example, if UsrGrpAdminServlet needs to authorize the caller
it would do be done in the following fashion:
try {
authzTok = mAuthz.authorize("DirACLBasedAuthz", authToken, RES_GROUP, "read");
} catch (EBaseException e) {
log(ILogger.LL_FAILURE, "authorize call: "+ e.toString());
}
check the authorization permission for the user associated with
authToken on operation
Example:
For example, if UsrGrpAdminServlet needs to authorize the caller
it would do be done in the following fashion:
try {
authzTok = mAuthz.authorize("DirAclAuthz", authToken, RES_GROUP, "read");
} catch (EBaseException e) {
log(ILogger.LL_FAILURE, "authorize call: "+ e.toString());
}
Authorize must occur after Authenticate
signed.audit LOGGING_SIGNED_AUDIT_AUTHZ_FAIL used when authorization
has failed
signed.audit LOGGING_SIGNED_AUDIT_AUTHZ_SUCCESS used when authorization
is successful
signed.audit LOGGING_SIGNED_AUDIT_ROLE_ASSUME used when user assumes a
role (in current CMS that's when one accesses a role port)
Authorize must occur after Authenticate
signed.audit LOGGING_SIGNED_AUDIT_AUTHZ_FAIL used when authorization
has failed
signed.audit LOGGING_SIGNED_AUDIT_AUTHZ_SUCCESS used when authorization
is successful
signed.audit LOGGING_SIGNED_AUDIT_ROLE_ASSUME used when user assumes a
role (in current CS that's when one accesses a role port)
This class implements an enrollment default policy that
populates subject name based on the attribute values
in the authentication token (AuthToken) object.
Cancel request
(Certificate Request Processed - a manual "agent" profile based cert
cancellation)
signed.audit LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED used when a
certificate request has just been through the approval process
a listener for every completed enrollment request
Here is a list of available $TOKENs for email notification
templates if certificate is successfully issued:
$InstanceID
$SerialNumber
$HexSerialNumber
$HttpHost
$HttpPort
$RequestId
$IssuerDN
$SubjectDN
$NotBefore
$NotAfter
$SenderEmail
$RecipientEmail
Here is a list of available $TOKENs for email notification
templates if certificate request is rejected:
$RequestId
$InstanceID
a listener for every completed enrollment request
Here is a list of available $TOKENs for email notification
templates if certificate is successfully issued:
$InstanceID
$SerialNumber
$HexSerialNumber
$HttpHost
$HttpPort
$RequestId
$IssuerDN
$SubjectDN
$NotBefore
$NotAfter
$SenderEmail
$RecipientEmail
Here is a list of available $TOKENs for email notification
templates if certificate request is revoked:
$RequestId
$InstanceID
Takes the certificate info (serial number) and optional challenge phrase, creates a
revocation request and submits it to the authority subsystem for processing
This servlet deals with PKCS#10-based certificate requests from
CRS, now called SCEP, and defined at:
http://search.ietf.org/internet-drafts/draft-nourse-scep-02.txt
The router is hardcoded to look for the http://host:80/cgi-bin/pkiclient.exe
The HTTP parameters are 'operation' and 'message'
operation can be either 'GetCACert' or 'PKIOperation'
Delete profile input
signed.audit LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE used when
configuring cert profile (general settings and cert profile; obsoletes
extensions and constraints policies)
Delete profile instance
signed.audit LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE used when
configuring cert profile (general settings and cert profile; obsoletes
extensions and constraints policies)
Delete profile output
signed.audit LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE used when
configuring cert profile (general settings and cert profile; obsoletes
extensions and constraints policies)
Delete policy profile
signed.audit LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE used when
configuring cert profile (general settings and cert profile; obsoletes
extensions and constraints policies)
Constructs a "duplicate" self test exception where the parameter is a
duplicate from a substore.parameter/value pair; (the value passed in may
be null).
Constructs an "invalid" self test exception where the parameter is always
invalid from a substore.parameter/value pair; (the value passed in may
be null).
Constructs a "missing" self test exception where the parameter is always
missing from a substore.parameter/value pair; (the value passed in may
be null).