Class EnrollProfile
- java.lang.Object
-
- com.netscape.cms.profile.common.Profile
-
- com.netscape.cms.profile.common.EnrollProfile
-
public abstract class EnrollProfile extends Profile
This class implements a generic enrollment profile.An enrollment profile contains a list of enrollment specific input plugins, default policies, constriant policies and output plugins.
This interface also defines a set of enrollment specific attribute names that can be used to retrieve values from an enrollment request.
- Version:
- $Revision$, $Date$
- Author:
- cfu
-
-
Field Summary
Fields Modifier and Type Field Description static java.lang.String
CTX_CERT_REQUEST_TYPE
Name of request attribute that stores the User Supplied Certificate Request Type.static java.lang.String
CTX_RENEWAL
Name of request attribute to indicate if this is a renewalstatic java.lang.String
CTX_RENEWAL_SEQ_NUM
Name of the request attribute that stores the sequence number for a renewal request.static org.slf4j.Logger
logger
static java.lang.String
REQ_TYPE_CMC
static java.lang.String
REQ_TYPE_CRMF
static java.lang.String
REQ_TYPE_KEYGEN
static java.lang.String
REQ_TYPE_PKCS10
Possible values for CTX_CERT_REQUEST_TYPE attribute.static java.lang.String
REQUEST_AUTHORITY_ID
ID of requested certificate authority (absense implies host authority)static java.lang.String
REQUEST_CERTINFO
Name of request attribute that stores the certificate template that will be signed and then become a certificate.static java.lang.String
REQUEST_EXTENSIONS
Name of request attribute that stores the End-User Supplied Extensions.static java.lang.String
REQUEST_ISSUED_CERT
Name of request attribute that stores the issued certificate.static java.lang.String
REQUEST_ISSUED_P12
Name of request attribute that stores the issued P12 from server-side keygen.static java.lang.String
REQUEST_LOCALE
Name of request attribute that stores the End-User Locale.static java.lang.String
REQUEST_SEQ_NUM
Name of request attribute that stores the sequence number.static java.lang.String
REQUEST_SIGNING_ALGORITHM
Name of request attribute that stores the End-User Supplied Signing Algorithm.static java.lang.String
REQUEST_USER_DATA
Arbitrary user-supplied data.static java.lang.String
REQUEST_VALIDITY
Name of request attribute that stores the End-User Supplied Validity.-
Fields inherited from class com.netscape.cms.profile.common.Profile
mAuthInstanceId, mAuthzAcl, mConfig, mId, mInputIds, mInputNames, mInputs, mOutputIds, mOutputs, mPolicySet, mUpdaterIds, mUpdaters, PROP_CLASS_ID, PROP_CONSTRAINT, PROP_DEFAULT, PROP_DESC, PROP_ENABLE, PROP_ENABLE_BY, PROP_GENERIC_EXT_DEFAULT, PROP_INPUT, PROP_INPUT_LIST, PROP_INSTANCE_ID, PROP_IS_RENEWAL, PROP_NAME, PROP_NO_CONSTRAINT, PROP_NO_DEFAULT, PROP_OUTPUT, PROP_OUTPUT_LIST, PROP_PARAMS, PROP_POLICY_LIST, PROP_UPDATER_LIST, PROP_VISIBLE, PROP_XML_OUTPUT, registry, signedAuditLogger
-
-
Constructor Summary
Constructors Constructor Description EnrollProfile()
-
Method Summary
All Methods Static Methods Instance Methods Abstract Methods Concrete Methods Modifier and Type Method Description protected java.lang.String
auditProfileID()
Signed Audit Log Profile ID This method is inherited by all extended "EnrollProfile"s, and is called to obtain the "ProfileID" for a signed audit log message.protected java.lang.String
auditRequesterID(IRequest request)
Signed Audit Log Requester ID This method is inherited by all extended "EnrollProfile"s, and is called to obtain the "RequesterID" for a signed audit log message.IRequest
createEnrollmentRequest()
IRequest[]
createRequests(java.util.Map<java.lang.String,java.lang.String> ctx, java.util.Locale locale)
Creates request.abstract void
execute(IRequest request)
Process a request after validation.void
fillCertReqMsg(java.util.Locale locale, org.mozilla.jss.pkix.crmf.CertReqMsg certReqMsg, org.mozilla.jss.netscape.security.x509.X509CertInfo info, IRequest req)
void
fillKeyGen(java.util.Locale locale, org.mozilla.jss.netscape.security.util.DerInputStream derIn, org.mozilla.jss.netscape.security.x509.X509CertInfo info, IRequest req)
void
fillNSHKEY(java.util.Locale locale, java.lang.String tcuid, java.lang.String skey, org.mozilla.jss.netscape.security.x509.X509CertInfo info, IRequest req)
void
fillNSNKEY(java.util.Locale locale, java.lang.String sn, java.lang.String skey, org.mozilla.jss.netscape.security.x509.X509CertInfo info, IRequest req)
void
fillPKCS10(java.util.Locale locale, org.mozilla.jss.netscape.security.pkcs.PKCS10 pkcs10, org.mozilla.jss.netscape.security.x509.X509CertInfo info, IRequest req)
void
fillTaggedRequest(java.util.Locale locale, org.mozilla.jss.pkix.cmc.TaggedRequest tagreq, org.mozilla.jss.netscape.security.x509.X509CertInfo info, IRequest req)
abstract IAuthority
getAuthority()
static org.mozilla.jss.netscape.security.x509.X509CertImpl
getCMCSigningCertFromCertSerial(java.lang.String certSerial)
getCMCSigningCertFromCertSerial is to be used when authentication was done with CMCUserSignedAuth where the resulting authToken contains IAuthManager.CRED_CMC_SIGNING_CERT, serial number This method takes the serial number and finds the cert from the CA's certdbstatic org.mozilla.jss.netscape.security.x509.CertificateSubjectName
getCMCSigningCertSNfromCertSerial(java.lang.String certSerial)
abstract org.mozilla.jss.netscape.security.x509.X500Name
getIssuerName()
java.util.Locale
getLocale(IRequest request)
protected org.mozilla.jss.pkix.crmf.PKIArchiveOptions
getPKIArchiveOptions(org.mozilla.jss.pkix.primitive.AVA ava)
org.mozilla.jss.pkix.cmc.PKIData
getPKIDataFromCMCblob(java.util.Locale locale, java.lang.String certReqBlob)
getPKIDataFromCMCblobjava.lang.String
getPolicySetId(IRequest req)
Perform simple policy set assignment.protected org.mozilla.jss.pkix.cmc.PopLinkWitnessV2
getPopLinkWitnessV2control(org.mozilla.jss.asn1.ASN1Value value)
getPopLinkWitnessV2controljava.lang.String
getRequestorDN(IRequest request)
Retrieves a localized string that represents requestor's distinguished name.org.mozilla.jss.pkix.cmc.TaggedRequest[]
parseCMC(java.util.Locale locale, java.lang.String certreq)
org.mozilla.jss.pkix.cmc.TaggedRequest[]
parseCMC(java.util.Locale locale, java.lang.String certreq, boolean donePOI)
void
populate(IRequest request)
Passes the request to the set of default policies that populate the profile information against the profile.void
populateInput(java.util.Map<java.lang.String,java.lang.String> ctx, IRequest request)
Populate inputvoid
setDefaultCertInfo(IRequest request)
Set Default X509CertInfo in the request.void
setPOPchallenge(IRequest req)
setPOPchallenge generates a POP challenge and sets necessary info in request for composing encryptedPOP latervoid
submit(IAuthToken token, IRequest request)
This method is called after the user submits the request from the end-entity page.void
submit(IAuthToken token, IRequest request, boolean explicitApprovalRequired)
byte[]
toByteArray(org.mozilla.jss.pkix.crmf.PKIArchiveOptions options)
org.mozilla.jss.pkix.crmf.PKIArchiveOptions
toPKIArchiveOptions(byte[] options)
void
validate(IRequest request)
Passes the request to the set of constraint policies that validate the request against the profile.void
verifyPOP(java.util.Locale locale, org.mozilla.jss.pkix.crmf.CertReqMsg certReqMsg)
protected boolean
verifyPopLinkWitnessV2(org.mozilla.jss.pkix.cmc.PopLinkWitnessV2 popLinkWitnessV2, byte[] randomSeed, byte[] sharedSecret, java.lang.String ident_string)
verifyPopLinkWitnessV2-
Methods inherited from class com.netscape.cms.profile.common.Profile
addInputName, auditSubjectID, createProfileInput, createProfileInput, createProfileOutput, createProfileOutput, createProfilePolicy, createProfilePolicy, deleteAllProfileInputs, deleteAllProfileOutputs, deleteAllProfilePolicies, deleteProfileInput, deleteProfileOutput, deleteProfilePolicy, getApprovedBy, getAuthenticatorId, getAuthzAcl, getConfigStore, getDescription, getId, getInput, getInputDescriptor, getInputNames, getName, getPolicies, getProfileInput, getProfileInputIds, getProfileOutput, getProfileOutputIds, getProfilePolicies, getProfilePolicy, getProfilePolicyIds, getProfilePolicySetIds, getProfileUpdater, getProfileUpdaterIds, init, isEnable, isRenewal, isVisible, isXmlOutput, setAuthenticatorId, setAuthzAcl, setDescription, setId, setInput, setName, setRenewal, setVisible, setXMLOutput
-
-
-
-
Field Detail
-
logger
public static org.slf4j.Logger logger
-
CTX_CERT_REQUEST_TYPE
public static final java.lang.String CTX_CERT_REQUEST_TYPE
Name of request attribute that stores the User Supplied Certificate Request Type.- See Also:
- Constant Field Values
-
REQ_TYPE_PKCS10
public static final java.lang.String REQ_TYPE_PKCS10
Possible values for CTX_CERT_REQUEST_TYPE attribute.- See Also:
- Constant Field Values
-
REQ_TYPE_CRMF
public static final java.lang.String REQ_TYPE_CRMF
- See Also:
- Constant Field Values
-
REQ_TYPE_CMC
public static final java.lang.String REQ_TYPE_CMC
- See Also:
- Constant Field Values
-
REQ_TYPE_KEYGEN
public static final java.lang.String REQ_TYPE_KEYGEN
- See Also:
- Constant Field Values
-
REQUEST_LOCALE
public static final java.lang.String REQUEST_LOCALE
Name of request attribute that stores the End-User Locale.The value is of type java.util.Locale.
- See Also:
- Constant Field Values
-
REQUEST_SEQ_NUM
public static final java.lang.String REQUEST_SEQ_NUM
Name of request attribute that stores the sequence number. Consider a CRMF request that may contain multiple certificate request. The first sub certificate certificate request has a sequence number of 0, the next one has a sequence of 1, and so on.The value is of type java.lang.Integer.
- See Also:
- Constant Field Values
-
CTX_RENEWAL_SEQ_NUM
public static final java.lang.String CTX_RENEWAL_SEQ_NUM
Name of the request attribute that stores the sequence number for a renewal request. Only one request at a time is permitted for a renewal. This value corresponds to the sequence number (and hence the appropriate certificate) of the original request- See Also:
- Constant Field Values
-
CTX_RENEWAL
public static final java.lang.String CTX_RENEWAL
Name of request attribute to indicate if this is a renewal- See Also:
- Constant Field Values
-
REQUEST_VALIDITY
public static final java.lang.String REQUEST_VALIDITY
Name of request attribute that stores the End-User Supplied Validity.The value is of type org.mozilla.jss.netscape.security.x509.CertificateValidity
- See Also:
- Constant Field Values
-
REQUEST_SIGNING_ALGORITHM
public static final java.lang.String REQUEST_SIGNING_ALGORITHM
Name of request attribute that stores the End-User Supplied Signing Algorithm.The value is of type org.mozilla.jss.netscape.security.x509.CertificateAlgorithmId
- See Also:
- Constant Field Values
-
REQUEST_EXTENSIONS
public static final java.lang.String REQUEST_EXTENSIONS
Name of request attribute that stores the End-User Supplied Extensions.The value is of type org.mozilla.jss.netscape.security.x509.CertificateExtensions
- See Also:
- Constant Field Values
-
REQUEST_CERTINFO
public static final java.lang.String REQUEST_CERTINFO
Name of request attribute that stores the certificate template that will be signed and then become a certificate.The value is of type org.mozilla.jss.netscape.security.x509.X509CertInfo
- See Also:
- Constant Field Values
-
REQUEST_ISSUED_CERT
public static final java.lang.String REQUEST_ISSUED_CERT
Name of request attribute that stores the issued certificate.The value is of type org.mozilla.jss.netscape.security.x509.X509CertImpl
- See Also:
- Constant Field Values
-
REQUEST_ISSUED_P12
public static final java.lang.String REQUEST_ISSUED_P12
Name of request attribute that stores the issued P12 from server-side keygen.- See Also:
- Constant Field Values
-
REQUEST_AUTHORITY_ID
public static final java.lang.String REQUEST_AUTHORITY_ID
ID of requested certificate authority (absense implies host authority)- See Also:
- Constant Field Values
-
REQUEST_USER_DATA
public static final java.lang.String REQUEST_USER_DATA
Arbitrary user-supplied data.- See Also:
- Constant Field Values
-
-
Method Detail
-
getAuthority
public abstract IAuthority getAuthority()
-
createRequests
public IRequest[] createRequests(java.util.Map<java.lang.String,java.lang.String> ctx, java.util.Locale locale) throws java.lang.Exception
Creates request.- Specified by:
createRequests
in classProfile
- Parameters:
ctx
- profile contextlocale
- user locale- Returns:
- a list of requests
- Throws:
java.lang.Exception
- failed to create requests
-
getIssuerName
public abstract org.mozilla.jss.netscape.security.x509.X500Name getIssuerName()
-
setDefaultCertInfo
public void setDefaultCertInfo(IRequest request) throws EProfileException
Set Default X509CertInfo in the request.- Parameters:
request
- profile-based certificate request.- Throws:
EProfileException
- failed to set the X509CertInfo.
-
createEnrollmentRequest
public IRequest createEnrollmentRequest() throws EProfileException
- Throws:
EProfileException
-
execute
public abstract void execute(IRequest request) throws EProfileException
Description copied from class:Profile
Process a request after validation.- Overrides:
execute
in classProfile
- Parameters:
request
- request to be processed- Throws:
EProfileException
- failed to process
-
getPolicySetId
public java.lang.String getPolicySetId(IRequest req)
Perform simple policy set assignment.- Specified by:
getPolicySetId
in classProfile
- Parameters:
req
- request- Returns:
- policy set id
-
getRequestorDN
public java.lang.String getRequestorDN(IRequest request)
Description copied from class:Profile
Retrieves a localized string that represents requestor's distinguished name. This string displayed in the request listing user interface.- Overrides:
getRequestorDN
in classProfile
- Parameters:
request
- request- Returns:
- distringuished name of the request owner
-
setPOPchallenge
public void setPOPchallenge(IRequest req) throws EBaseException
setPOPchallenge generates a POP challenge and sets necessary info in request for composing encryptedPOP later- Parameters:
req
- the request- Throws:
EBaseException
-
submit
public void submit(IAuthToken token, IRequest request) throws EDeferException, EProfileException
This method is called after the user submits the request from the end-entity page.- Specified by:
submit
in classProfile
- Parameters:
token
- authentication tokenrequest
- request to be processed- Throws:
EDeferException
- defer requestEProfileException
- failed to submit
-
submit
public void submit(IAuthToken token, IRequest request, boolean explicitApprovalRequired) throws EDeferException, EProfileException
- Specified by:
submit
in classProfile
- Throws:
EDeferException
EProfileException
-
getPKIDataFromCMCblob
public org.mozilla.jss.pkix.cmc.PKIData getPKIDataFromCMCblob(java.util.Locale locale, java.lang.String certReqBlob) throws EProfileException
getPKIDataFromCMCblob- Parameters:
certReqBlob
- cmc b64 encoded blob- Returns:
- PKIData
- Throws:
EProfileException
-
getCMCSigningCertSNfromCertSerial
public static org.mozilla.jss.netscape.security.x509.CertificateSubjectName getCMCSigningCertSNfromCertSerial(java.lang.String certSerial) throws java.lang.Exception
- Throws:
java.lang.Exception
-
getCMCSigningCertFromCertSerial
public static org.mozilla.jss.netscape.security.x509.X509CertImpl getCMCSigningCertFromCertSerial(java.lang.String certSerial) throws java.lang.Exception
getCMCSigningCertFromCertSerial is to be used when authentication was done with CMCUserSignedAuth where the resulting authToken contains IAuthManager.CRED_CMC_SIGNING_CERT, serial number This method takes the serial number and finds the cert from the CA's certdb- Throws:
java.lang.Exception
-
parseCMC
public org.mozilla.jss.pkix.cmc.TaggedRequest[] parseCMC(java.util.Locale locale, java.lang.String certreq) throws EProfileException
- Throws:
EProfileException
-
parseCMC
public org.mozilla.jss.pkix.cmc.TaggedRequest[] parseCMC(java.util.Locale locale, java.lang.String certreq, boolean donePOI) throws EProfileException
- Throws:
EProfileException
-
getPopLinkWitnessV2control
protected org.mozilla.jss.pkix.cmc.PopLinkWitnessV2 getPopLinkWitnessV2control(org.mozilla.jss.asn1.ASN1Value value)
getPopLinkWitnessV2control
-
verifyPopLinkWitnessV2
protected boolean verifyPopLinkWitnessV2(org.mozilla.jss.pkix.cmc.PopLinkWitnessV2 popLinkWitnessV2, byte[] randomSeed, byte[] sharedSecret, java.lang.String ident_string)
verifyPopLinkWitnessV2
-
fillTaggedRequest
public void fillTaggedRequest(java.util.Locale locale, org.mozilla.jss.pkix.cmc.TaggedRequest tagreq, org.mozilla.jss.netscape.security.x509.X509CertInfo info, IRequest req) throws EProfileException, ECMCPopFailedException, ECMCBadRequestException
-
getPKIArchiveOptions
protected org.mozilla.jss.pkix.crmf.PKIArchiveOptions getPKIArchiveOptions(org.mozilla.jss.pkix.primitive.AVA ava)
-
toPKIArchiveOptions
public org.mozilla.jss.pkix.crmf.PKIArchiveOptions toPKIArchiveOptions(byte[] options)
-
toByteArray
public byte[] toByteArray(org.mozilla.jss.pkix.crmf.PKIArchiveOptions options)
-
fillCertReqMsg
public void fillCertReqMsg(java.util.Locale locale, org.mozilla.jss.pkix.crmf.CertReqMsg certReqMsg, org.mozilla.jss.netscape.security.x509.X509CertInfo info, IRequest req) throws EProfileException, ECMCUnsupportedExtException
-
fillPKCS10
public void fillPKCS10(java.util.Locale locale, org.mozilla.jss.netscape.security.pkcs.PKCS10 pkcs10, org.mozilla.jss.netscape.security.x509.X509CertInfo info, IRequest req) throws EProfileException, ECMCUnsupportedExtException
-
fillNSNKEY
public void fillNSNKEY(java.util.Locale locale, java.lang.String sn, java.lang.String skey, org.mozilla.jss.netscape.security.x509.X509CertInfo info, IRequest req) throws EProfileException
- Throws:
EProfileException
-
fillNSHKEY
public void fillNSHKEY(java.util.Locale locale, java.lang.String tcuid, java.lang.String skey, org.mozilla.jss.netscape.security.x509.X509CertInfo info, IRequest req) throws EProfileException
- Throws:
EProfileException
-
fillKeyGen
public void fillKeyGen(java.util.Locale locale, org.mozilla.jss.netscape.security.util.DerInputStream derIn, org.mozilla.jss.netscape.security.x509.X509CertInfo info, IRequest req) throws EProfileException
- Throws:
EProfileException
-
getLocale
public java.util.Locale getLocale(IRequest request)
-
populateInput
public void populateInput(java.util.Map<java.lang.String,java.lang.String> ctx, IRequest request) throws java.lang.Exception
Populate input(either all "agent" profile cert requests NOT made through a connector, or all "EE" profile cert requests NOT made through a connector)
- signed.audit LOGGING_SIGNED_AUDIT_PROFILE_CERT_REQUEST used when a profile cert request is made (before approval process)
- Overrides:
populateInput
in classProfile
- Parameters:
ctx
- profile contextrequest
- the certificate request- Throws:
java.lang.Exception
- an error related to this profile has occurred
-
populate
public void populate(IRequest request) throws EProfileException
Description copied from class:Profile
Passes the request to the set of default policies that populate the profile information against the profile.- Overrides:
populate
in classProfile
- Parameters:
request
- request- Throws:
EProfileException
- failed to populate default values
-
validate
public void validate(IRequest request) throws ERejectException
Passes the request to the set of constraint policies that validate the request against the profile.- Overrides:
validate
in classProfile
- Parameters:
request
- request- Throws:
ERejectException
- validation violation
-
auditRequesterID
protected java.lang.String auditRequesterID(IRequest request)
Signed Audit Log Requester ID This method is inherited by all extended "EnrollProfile"s, and is called to obtain the "RequesterID" for a signed audit log message.- Parameters:
request
- the actual request- Returns:
- id string containing the signed audit log message RequesterID
-
auditProfileID
protected java.lang.String auditProfileID()
Signed Audit Log Profile ID This method is inherited by all extended "EnrollProfile"s, and is called to obtain the "ProfileID" for a signed audit log message.- Returns:
- id string containing the signed audit log message ProfileID
-
verifyPOP
public void verifyPOP(java.util.Locale locale, org.mozilla.jss.pkix.crmf.CertReqMsg certReqMsg) throws EProfileException, ECMCPopFailedException
-
-