<?xml version="1.0" encoding="UTF-8" standalone="no"?>
|
<!DOCTYPE stax SYSTEM "../stax.dtd">
|
<!--
|
! CDDL HEADER START
|
!
|
! The contents of this file are subject to the terms of the
|
! Common Development and Distribution License, Version 1.0 only
|
! (the "License"). You may not use this file except in compliance
|
! with the License.
|
!
|
! You can obtain a copy of the license at
|
! trunk/opends/resource/legal-notices/OpenDS.LICENSE
|
! or https://OpenDS.dev.java.net/OpenDS.LICENSE.
|
! See the License for the specific language governing permissions
|
! and limitations under the License.
|
!
|
! When distributing Covered Code, include this CDDL HEADER in each
|
! file and include the License file at
|
! trunk/opends/resource/legal-notices/OpenDS.LICENSE. If applicable,
|
! add the following below this CDDL HEADER, with the fields enclosed
|
! by brackets "[]" replaced with your own identifying information:
|
! Portions Copyright [yyyy] [name of copyright owner]
|
!
|
! CDDL HEADER END
|
!
|
! Copyright 2007-2010 Sun Microsystems, Inc.
|
! -->
|
<stax>
|
<!-- **************************************************** -->
|
<!-- generate a certificate -->
|
<!-- **************************************************** -->
|
<function name="genCertificate">
|
<function-prolog>
|
This function generates a server certificate
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">
|
<function-arg-description>
|
Pathname to installation root
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="certAlias" type="optional" default="'server-cert'">
|
<function-arg-description>
|
Alias certificate
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="dname" type="optional" default="'cn=server,O=Sun Microsystems,C=US'">
|
<function-arg-description>
|
Certificate subject
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="keystore" type="optional" default="'keystore'">
|
<function-arg-description>
|
Path for the key store file
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="storepass" type="optional" default="'servercert'">
|
<function-arg-description>
|
Password to protect the contents of the key store
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="keypass" type="optional" default="'servercert'">
|
<function-arg-description>
|
Password to protect the private key on the key store: keypass
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="storetype" type="optional" default="'JKS'">
|
<function-arg-description>
|
The storetype. can be JKS or PKCS12
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="expectedRC" type="optional" default="0">
|
<function-arg-description>
|
Expected return code value. Default value is 0.
|
Wildcard 'noCheck' to not check the RC
|
</function-arg-description>
|
</function-arg-def>
|
</function-map-args>
|
<sequence>
|
<!-- Local variables -->
|
<script>
|
if dsPath:
|
dsConfigPath='%s/config' % (dsPath)
|
dsBinPath='%s/%s' % (dsPath,fileFolder)
|
</script>
|
<call function="'runCommand'">
|
{ 'name' : 'Generate a Certificate',
|
'location' : location,
|
'command' : '%s/bin/keytool' % JAVA_HOME,
|
'arguments' : '-genkey -alias %s -keyalg rsa -dname "%s" -keystore %s -storepass %s -keypass %s -storetype %s ' % (certAlias,dname,keystore,storepass,keypass,storetype),
|
'path' : dsConfigPath,
|
'expectedRC': expectedRC
|
}
|
</call>
|
<return>STAXResult</return>
|
</sequence>
|
</function>
|
|
|
<!-- **************************************************** -->
|
<!-- Self signed a certificate -->
|
<!-- **************************************************** -->
|
<function name="SelfSignCertificate">
|
<function-prolog>
|
This function self-signs a certificate
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">
|
<function-arg-description>
|
Pathname to installation root
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="certAlias" type="optional" default="'server-cert'">
|
<function-arg-description>
|
Alias certificate
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="keystore" type="optional" default="'keystore'">
|
<function-arg-description>
|
Path for the key store file
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="storepass" type="optional" default="'servercert'">
|
<function-arg-description>
|
Password to protect the contents of the key store
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="keypass" type="optional" default="'servercert'">
|
<function-arg-description>
|
Password to protect the private key on the key store: keypass
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="storetype" type="optional" default="'JKS'">
|
<function-arg-description>
|
The storetype. can be JKS or PKCS12
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="expectedRC" type="optional" default="0">
|
<function-arg-description>
|
Expected return code value. Default value is 0.
|
Wildcard 'noCheck' to not check the RC
|
</function-arg-description>
|
</function-arg-def>
|
</function-map-args>
|
<sequence>
|
<!-- Local variables -->
|
<script>
|
if dsPath:
|
dsConfigPath='%s/config' % (dsPath)
|
dsBinPath='%s/%s' % (dsPath,fileFolder)
|
</script>
|
|
<call function="'runCommand'" >
|
{ 'name' : 'Generate a Self-Signed Server Certificate',
|
'location' : location,
|
'command' : '%s/bin/keytool' % JAVA_HOME,
|
'arguments' : '-selfcert -alias %s -keystore "%s" -keypass "%s" -storepass "%s" -storetype "%s" ' % (certAlias,keystore,keypass,storepass,storetype),
|
'path' : dsConfigPath,
|
'expectedRC': expectedRC
|
}
|
</call>
|
<return>STAXResult</return>
|
</sequence>
|
</function>
|
|
|
<!-- **************************************************** -->
|
<!-- Export a certificate -->
|
<!-- **************************************************** -->
|
<function name="ExportCertificate">
|
<function-prolog>
|
This function exports a certificate
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">
|
<function-arg-description>
|
Pathname to installation root
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="certAlias" type="optional" default="'server-cert'">
|
<function-arg-description>
|
Alias certificate
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="keystore" type="optional" default="'keystore'">
|
<function-arg-description>
|
Path for the key store file
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="storepass" type="optional" default="'servercert'">
|
<function-arg-description>
|
Password to protect the contents of the key store
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="format" type="optional">
|
<function-arg-description>
|
Format of the certificate. By default, it's in binary encoding
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="storetype" type="optional" default="'JKS'">
|
<function-arg-description>
|
The storetype. can be JKS or PKCS12
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="outputfile" type="required">
|
<function-arg-description>
|
Output file to store certificate
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="expectedRC" type="optional" default="0">
|
<function-arg-description>
|
Expected return code value. Default value is 0.
|
Wildcard 'noCheck' to not check the RC
|
</function-arg-description>
|
</function-arg-def>
|
</function-map-args>
|
|
<sequence>
|
<!-- Local variables -->
|
<script>
|
if dsPath:
|
dsConfigPath='%s/config' % (dsPath)
|
dsBinPath='%s/%s' % (dsPath,fileFolder)
|
|
STAFCmdParams=''
|
|
if format:
|
STAFCmdParams='-%s' % (format)
|
</script>
|
|
<call function="'runCommand'">
|
{ 'name' : 'Export a Certificate',
|
'location' : location,
|
'command' : '%s/bin/keytool' % JAVA_HOME,
|
'arguments' : '-export -alias %s -file %s -keystore "%s" -storepass "%s" -storetype %s %s' % (certAlias,outputfile,keystore,storepass,storetype,STAFCmdParams),
|
'path' : dsConfigPath,
|
'expectedRC' : expectedRC
|
}
|
</call>
|
<return>STAXResult</return>
|
</sequence>
|
</function>
|
|
|
<!-- **************************************************** -->
|
<!-- Import a certificate -->
|
<!-- **************************************************** -->
|
<function name="ImportCertificate">
|
<function-prolog>
|
This function imports a certificate
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">
|
<function-arg-description>
|
Pathname to installation root
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="certAlias" type="optional" default="'server-cert'">
|
<function-arg-description>
|
Alias certificate
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="keystore" type="optional" default="'keystore'">
|
<function-arg-description>
|
Path for the key store file
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="storepass" type="optional" default="'servercert'">
|
<function-arg-description>
|
Password to protect the contents of the key store
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="storetype" type="optional" default="'JKS'">
|
<function-arg-description>
|
The storetype. can be JKS or PKCS12
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="inputfile" type="required">
|
<function-arg-description>
|
Certificate to import
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="expectedRC" type="optional" default="0">
|
<function-arg-description>
|
Expected return code value. Default value is 0.
|
Wildcard 'noCheck' to not check the RC
|
</function-arg-description>
|
</function-arg-def>
|
</function-map-args>
|
<sequence>
|
|
<!-- Local variables -->
|
<script>
|
if dsPath:
|
dsConfigPath='%s/config' % (dsPath)
|
dsBinPath='%s/%s' % (dsPath,fileFolder)
|
</script>
|
|
<call function="'runCommand'">
|
{ 'name' : 'Import a Certificate',
|
'location' : location,
|
'command' : '%s/bin/keytool' % JAVA_HOME,
|
'arguments' : '-import -alias %s -file %s -keystore "%s" -storepass "%s" -storetype %s -noprompt' % (certAlias,inputfile,keystore,storepass,storetype),
|
'path' : dsConfigPath,
|
'expectedRC' : expectedRC
|
}
|
</call>
|
<return>STAXResult</return>
|
</sequence>
|
</function>
|
|
<!-- **************************************************** -->
|
<!-- List a certificate -->
|
<!-- **************************************************** -->
|
<function name="ListCertificate">
|
<function-prolog>
|
This function lists a certificate
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">
|
<function-arg-description>
|
Pathname to installation root
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="certAlias" type="optional" default="'server-cert'">
|
<function-arg-description>
|
Alias certificate
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="keystore" type="optional" default="'keystore'">
|
<function-arg-description>
|
Path for the key store file
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="storepass" type="optional" default="'servercert'">
|
<function-arg-description>
|
Password to protect the contents of the key store
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="expectedRC" type="optional" default="0">
|
<function-arg-description>
|
Expected return code value. Default value is 0.
|
Wildcard 'noCheck' to not check the RC
|
</function-arg-description>
|
</function-arg-def>
|
</function-map-args>
|
|
<sequence>
|
<!-- Local variables -->
|
<script>
|
if dsPath:
|
dsConfigPath='%s/config' % (dsPath)
|
dsBinPath='%s/%s' % (dsPath,fileFolder)
|
|
STAFCmdParamsList=[]
|
STAFCmdParams=''
|
|
STAFCmdParamsList.append('-list')
|
STAFCmdParamsList.append('-v')
|
|
if certAlias:
|
STAFCmdParamsList.append('-alias %s' % certAlias)
|
|
if keystore:
|
STAFCmdParamsList.append('-keystore %s' % keystore)
|
|
if storepass:
|
STAFCmdParamsList.append('-storepass %s' % storepass)
|
|
STAFCmdParams=' '.join(STAFCmdParamsList)
|
|
</script>
|
|
<call function="'runCommand'">
|
{ 'name' : 'List a Certificate',
|
'location' : location,
|
'command' : '%s/bin/keytool' % JAVA_HOME,
|
'arguments' : STAFCmdParams ,
|
'path' : dsConfigPath,
|
'expectedRC' : expectedRC
|
}
|
</call>
|
<return>STAXResult</return>
|
</sequence>
|
</function>
|
|
<!-- **************************************************** -->
|
<!-- Add certificate to an attribute -->
|
<!-- **************************************************** -->
|
<function name="addCertificate">
|
<function-prolog>
|
This function add certificate to an user attribute
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="user_cert_file_rfc" type="required" default="''">
|
<function-arg-description>
|
Path to certificate RFC file
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="userdn" type="optional" default="''">
|
<function-arg-description>
|
User DN to modify
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="ldif_path" type="required" default="''">
|
<function-arg-description>
|
Path to the ldif file
|
</function-arg-description>
|
</function-arg-def>
|
</function-map-args>
|
<sequence>
|
|
<call function="'getFile'">
|
{
|
'location' : STAF_REMOTE_HOSTNAME,
|
'filename' : user_cert_file_rfc
|
}
|
</call>
|
|
<message>
|
'Certificate contents:\n %s' % cmdResult
|
</message>
|
|
<!-- Extract BEGIN CERTIFICATE and END CERTIFICATE -->
|
<script>
|
certList=STAXResult[1].split('\n')
|
ret_str = ""
|
for line in certList:
|
index_cert = line.find("CERTIFICATE")
|
if index_cert == -1:
|
ret_str+=line.strip()
|
</script>
|
|
<script>
|
listAttr = []
|
listAttr.append('dn: %s' %userdn)
|
listAttr.append('changetype: modify')
|
listAttr.append('add: objectclass')
|
listAttr.append('objectclass:ds-certificate-user')
|
listAttr.append('-')
|
listAttr.append('add: userCertificate;binary')
|
listAttr.append('userCertificate;binary:: %s' % ret_str)
|
</script>
|
|
<message>
|
'Create %s/client.ldif' % local.temp
|
</message>
|
<script>
|
addCertificateldif='%s/client.ldif' % local.temp
|
outfile = open(addCertificateldif,"w")
|
for line in listAttr:
|
outfile.write("%s\n" % line)
|
outfile.close()
|
</script>
|
|
<message>
|
'Copy %s/client.ldif to %s' % (local.temp,ldif_path)
|
</message>
|
<call function="'copyFile'">
|
{
|
'location' : STAXServiceMachine,
|
'srcfile' : '%s/client.ldif' % local.temp,
|
'destfile' : ldif_path,
|
'remotehost' : STAF_REMOTE_HOSTNAME
|
}
|
</call>
|
|
<call function="'modifyEntry'">
|
{
|
'dsInstanceHost' : DIRECTORY_INSTANCE_HOST,
|
'dsInstancePort' : DIRECTORY_INSTANCE_PORT,
|
'dsInstanceDn' : DIRECTORY_INSTANCE_DN,
|
'dsInstancePswd' : DIRECTORY_INSTANCE_PSWD,
|
'entryToBeModified' : ldif_path,
|
'expectedRC' : 0
|
}
|
</call>
|
</sequence>
|
</function>
|
|
|
|
|
|
|
|
<!-- **************************************************** -->
|
<!-- get MD5 and SHA1 values -->
|
<!-- **************************************************** -->
|
<function name="getFingerprint">
|
<function-prolog>
|
This function returns the fingerprint MD5 or SHA1
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">
|
<function-arg-description>
|
Pathname to installation root
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="certAlias" type="optional" default="'server-cert'">
|
<function-arg-description>
|
Alias certificate
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="keystore" type="optional" default="'keystore'">
|
<function-arg-description>
|
Path for the key store file
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="storepass" type="optional" default="'servercert'">
|
<function-arg-description>
|
Password to protect the contents of the key store
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="fingerprint" type="optional" default="'MD5'">
|
<function-arg-description>
|
fingerprint. can be MD5 or SHA1
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="expectedRC" type="optional" default="0">
|
<function-arg-description>
|
Expected return code value. Default value is 0.
|
Wildcard 'noCheck' to not check the RC
|
</function-arg-description>
|
</function-arg-def>
|
</function-map-args>
|
<sequence>
|
<!-- Local variables -->
|
<script>
|
if dsPath:
|
dsConfigPath='%s/config' % (dsPath)
|
dsBinPath='%s/%s' % (dsPath,fileFolder)
|
</script>
|
<call function="'runCommand'">
|
{ 'name' : 'getFingerprint',
|
'location' : location,
|
'command' : '%s/bin/keytool' % JAVA_HOME,
|
'arguments' : ' -list -v -keystore "%s" -storepass "%s" -alias "%s"' % (keystore,storepass,certAlias),
|
'path' : dsConfigPath,
|
'expectedRC': expectedRC
|
}
|
</call>
|
<return>STAXResult</return>
|
</sequence>
|
</function>
|
|
|
<!-- ################################################## -->
|
<!-- configure SSL -->
|
<!-- ################################################## -->
|
<function name="configureSSL">
|
<function-prolog>
|
This function makes the configuration changes for SSL
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_BIN,OPENDSNAME)">
|
<function-arg-description>
|
Pathname to installation root
|
</function-arg-description>
|
<function-arg-property name="type" value="filepath"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceHost" type="optional">
|
<function-arg-description>
|
Directory server hostname or IP address
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' % DIRECTORY_INSTANCE_ADMIN_PORT">
|
<function-arg-description>
|
Directory server admin port number
|
</function-arg-description>
|
<function-arg-property name="type" value="Port number"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceDn" type="optional">
|
<function-arg-description>
|
Bind DN
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="certAlias" type="optional" default="'server-cert'">
|
<function-arg-description>
|
Alias certificate
|
</function-arg-description>
|
<function-arg-property name="type" value="DN"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstancePswd" type="optional">
|
<function-arg-description>
|
Bind password
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="keystoreFile" type="optional" default="'config/keystore'">
|
<function-arg-description>
|
Keystore File
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="keystoreType" type="optional" default="'JKS'">
|
<function-arg-description>
|
Keystore type : JKS or PKCS12
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="keystorePin" type="optional" default="'servercert'">
|
<function-arg-description>
|
Keystore pin
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="customKeyMgr" type="optional" default="''">
|
<function-arg-description>
|
Name for a new key manager
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="customTrustMgr" type="optional" default="''">
|
<function-arg-description>
|
Name for a new trust manager
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="extraParams" type="optional">
|
<function-arg-description>
|
Optional extra parameters for specific test cases
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
</function-map-args>
|
<sequence>
|
|
<!--- configure Key Manager Provider -->
|
<message>
|
'Configure Key Manager Provider'
|
</message>
|
|
<if expr="len(customKeyMgr.strip()) != 0">
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'create-key-manager-provider' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : customKeyMgr ,
|
'optionsString' : '--type file-based --set enabled:true --set key-store-file:%s --set key-store-pin:%s --set key-store-type:JKS' % (keystoreFile,keystorePin),
|
'expectedRC' : 0
|
}
|
</call>
|
<else>
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-key-manager-provider-prop' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : keystoreType,
|
'optionsString' : '--set key-store-file:config/keystore --reset key-store-pin-file --set key-store-pin:%s --set enabled:true' % keystorePin,
|
'expectedRC' : 0
|
}
|
</call>
|
</else>
|
</if>
|
|
<!--- configure Trust Manager Provider -->
|
<message>
|
'Configure Trust Manager Provider'
|
</message>
|
|
<if expr="len(customTrustMgr.strip()) != 0">
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'create-trust-manager-provider' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : customTrustMgr ,
|
'optionsString' : '--type blind --set enabled:true --set java-class:org.opends.server.extensions.BlindTrustManagerProvider' ,
|
'expectedRC' : 0
|
}
|
</call>
|
<else>
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-trust-manager-provider-prop' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : 'Blind Trust',
|
'optionsString' : '--set enabled:true' ,
|
'expectedRC' : 0
|
}
|
</call>
|
</else>
|
</if>
|
|
|
<!--- Enable LDAPS Connection Handler -->
|
<message>
|
'Enabling LDAPS Connection Handler - Keystore type'
|
</message>
|
|
<script>
|
option1='--set ssl-cert-nickname:%s' % certAlias
|
if customTrustMgr:
|
option2='--set trust-manager-provider:"%s"' % (customTrustMgr)
|
else:
|
option2='--set trust-manager-provider:"Blind Trust"'
|
if customKeyMgr:
|
option3='--set key-manager-provider:"%s"' % (customKeyMgr)
|
else:
|
option3='--set key-manager-provider:"%s"' % (keystoreType)
|
option4='--set listen-port:%s' % DIRECTORY_INSTANCE_SSL_PORT
|
option5='--set enabled:true --set use-ssl:true'
|
optionsString='%s %s %s %s %s' % (option1,option2,option3,option4,option5)
|
</script>
|
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-connection-handler-prop',
|
'objectType' : 'handler-name' ,
|
'objectName' : 'LDAPS Connection Handler',
|
'optionsString' : optionsString,
|
'expectedRC' : 0
|
}
|
</call>
|
</sequence>
|
</function>
|
|
|
<!-- ################################################## -->
|
<!-- configureTLS -->
|
<!-- ################################################## -->
|
<function name="configureTLS">
|
<function-prolog>
|
This function makes the configuration changes for startTLS
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_BIN,OPENDSNAME)">
|
<function-arg-description>
|
Pathname to installation root
|
</function-arg-description>
|
<function-arg-property name="type" value="filepath"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceHost" type="optional">
|
<function-arg-description>
|
Directory server hostname or IP address
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' % DIRECTORY_INSTANCE_ADMIN_PORT">
|
<function-arg-description>
|
Directory server admin port number
|
</function-arg-description>
|
<function-arg-property name="type" value="Port number"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceDn" type="optional">
|
<function-arg-description>
|
Bind DN
|
</function-arg-description>
|
<function-arg-property name="type" value="DN"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstancePswd" type="optional">
|
<function-arg-description>
|
Bind password
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="keystorePin" type="optional" default="'servercert'">
|
<function-arg-description>
|
Keystore pin
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="keystoreFile" type="optional" default="'config/keystore'">
|
<function-arg-description>
|
Keystore file path
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="customKeyMgr" type="optional" default="''">
|
<function-arg-description>
|
Name for a new key manager
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="certAlias" type="optional" default="'server-cert'">
|
<function-arg-description>
|
Alias certificate
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="keystoreType" type="optional" default="'JKS'">
|
<function-arg-description>
|
Keystore type : JKS or PKCS12
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="extraParams" type="optional">
|
<function-arg-description>
|
Optional extra parameters for specific test cases
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
</function-map-args>
|
<sequence>
|
<!--- configure Key Manager Provider -->
|
<message>
|
'Configure Key Manager Provider'
|
</message>
|
|
<if expr="len(customKeyMgr.strip()) != 0">
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'create-key-manager-provider' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : customKeyMgr ,
|
'optionsString' : '--type file-based --set enabled:true --set key-store-file:%s --set key-store-pin:%s --set key-store-type:JKS' % (keystoreFile,keystorePin),
|
'expectedRC' : 0
|
}
|
</call>
|
<else>
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort,
|
'dsInstanceDn' : dsInstanceDn,
|
'dsInstancePswd' : dsInstancePswd,
|
'subcommand' : 'set-key-manager-provider-prop',
|
'objectType' : 'provider-name',
|
'objectName' : keystoreType,
|
'optionsString' : '--set key-store-file:%s --reset key-store-pin-file --set key-store-pin:%s --set enabled:true' % (keystoreFile,keystorePin),
|
'expectedRC' : 0
|
}
|
</call>
|
</else>
|
</if>
|
|
<!--- configure Trust Manager Provider -->
|
<message>
|
'Configure Trust Manager Provider'
|
</message>
|
|
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort,
|
'dsInstanceDn' : dsInstanceDn,
|
'dsInstancePswd' : dsInstancePswd,
|
'subcommand' : 'set-trust-manager-provider-prop',
|
'objectType' : 'provider-name',
|
'objectName' : 'Blind Trust',
|
'optionsString' : '--set enabled:true',
|
'expectedRC' : 0
|
}
|
</call>
|
|
<!--- Enable StartTLS -->
|
<message>
|
'Enabling StartTLS'
|
</message>
|
|
<script>
|
option1='--set ssl-cert-nickname:%s' % certAlias
|
option2='--set trust-manager-provider:"Blind Trust" '
|
if customKeyMgr:
|
option3='--set key-manager-provider:"%s"' % (customKeyMgr)
|
else:
|
option3='--set key-manager-provider:"%s"' % (keystoreType)
|
option4='--set allow-start-tls:true'
|
optionsString='%s %s %s %s' % (option1,option2,option3,option4)
|
</script>
|
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort,
|
'dsInstanceDn' : dsInstanceDn,
|
'dsInstancePswd' : dsInstancePswd,
|
'subcommand' : 'set-connection-handler-prop',
|
'objectType' : 'handler-name',
|
'objectName' : 'LDAP Connection Handler',
|
'optionsString' : optionsString,
|
'expectedRC' : 0
|
}
|
</call>
|
</sequence>
|
</function>
|
|
|
<!-- ################################################## -->
|
<!-- configure SASL-->
|
<!-- ################################################## -->
|
<function name="configureSASL">
|
<function-prolog>
|
This function makes the configuration changes for SASL
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">
|
<function-arg-description>
|
Pathname to installation root
|
</function-arg-description>
|
<function-arg-property name="type" value="filepath"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceHost" type="optional">
|
<function-arg-description>
|
Directory server hostname or IP address
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' % DIRECTORY_INSTANCE_ADMIN_PORT">
|
<function-arg-description>
|
Directory server admin port number
|
</function-arg-description>
|
<function-arg-property name="type" value="Port number"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceDn" type="optional">
|
<function-arg-description>
|
Bind DN
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="certAlias" type="optional" default="''">
|
<function-arg-description>
|
Alias certificate
|
</function-arg-description>
|
<function-arg-property name="type" value="DN"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstancePswd" type="optional">
|
<function-arg-description>
|
Bind password
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="keystoreFile" type="optional" default="'config/keystore'">
|
<function-arg-description>
|
Keystore File
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="keystorePin" type="optional" default="'keystorepass'">
|
<function-arg-description>
|
Keystore pin
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="keystoreType" type="optional" default="'JKS'">
|
<function-arg-description>
|
Keystore type : JKS or PKCS12
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="createTrustMgr" type="optional" default="False">
|
<function-arg-description>
|
Create or enable custom key Manager.
|
</function-arg-description>
|
<function-arg-property name="type" value="enum">
|
<function-arg-property-description>
|
This argument can only have boolean values
|
</function-arg-property-description>
|
<function-arg-property-data type="choice" value="True"/>
|
<function-arg-property-data type="choice" value="False"/>
|
</function-arg-property>
|
</function-arg-def>
|
<function-arg-def name="createKeyMgr" type="optional" default="False">
|
<function-arg-description>
|
Create or enable custom key Manager.
|
</function-arg-description>
|
<function-arg-property name="type" value="enum">
|
<function-arg-property-description>
|
This argument can only have boolean values
|
</function-arg-property-description>
|
<function-arg-property-data type="choice" value="True"/>
|
<function-arg-property-data type="choice" value="False"/>
|
</function-arg-property>
|
</function-arg-def>
|
<function-arg-def name="KeyMgr" type="optional" default="''">
|
<function-arg-description>
|
Name for a new key manager
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="trustMgr" type="optional" default="''">
|
<function-arg-description>
|
Name for a new trust manager
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="truststoreFile" type="optional" default="'config/truststore'">
|
<function-arg-description>
|
Truststore File
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="truststoreType" type="optional" default="'JKS'">
|
<function-arg-description>
|
Truststore type : JKS or PKCS12
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="truststorePin" type="optional" default="'truststorepass'">
|
<function-arg-description>
|
Truststore pin
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="certMapper" type="optional" default="'Subject Equals DN'">
|
<function-arg-description>
|
Certificate mapper name
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="handlerName" type="optional" default="'EXTERNAL'">
|
<function-arg-description>
|
SASL mechanism handler name
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="optionSaSL" type="optional" default="''">
|
<function-arg-description>
|
SASL mechanism handler options
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="optionMapper" type="optional" default="''">
|
<function-arg-description>
|
Mapping options
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="extraParams" type="optional">
|
<function-arg-description>
|
Optional extra parameters for specific test cases
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
</function-map-args>
|
|
<sequence>
|
|
<!--- configure Key Manager Provider -->
|
<message>
|
'Configure Key Manager Provider'
|
</message>
|
|
<if expr="createKeyMgr == True">
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'create-key-manager-provider' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : KeyMgr ,
|
'optionsString' : '--set key-store-file:%s --set key-store-pin:%s --set key-store-type:%s --type file-based --set enabled:true --no-prompt ' % (keystoreFile,keystorePin,truststoreType),
|
'expectedRC' : 0
|
}
|
</call>
|
<else>
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-key-manager-provider-prop' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : KeyMgr,
|
'optionsString' : '--set key-store-file:%s --reset key-store-pin-file --set key-store-pin:%s --set enabled:true' % (keystoreFile,keystorePin),
|
'expectedRC' : 0
|
}
|
</call>
|
</else>
|
</if>
|
|
<!--- configure Trust Manager Provider -->
|
<message>
|
'Configure Trust Manager Provider'
|
</message>
|
|
<if expr="len(trustMgr.strip()) != 0">
|
<if expr="createTrustMgr == True">
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'create-trust-manager-provider' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : trustMgr ,
|
'optionsString' : '--set trust-store-file:%s --set trust-store-pin:%s --type file-based --set trust-store-type:%s --set enabled:true ' %(truststoreFile,truststorePin,truststoreType),
|
'expectedRC' : 0
|
}
|
</call>
|
<else>
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-trust-manager-provider-prop' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : trustMgr ,
|
'optionsString' : '--set trust-store-file:%s --set trust-store-pin:%s --set enabled:true' %(truststoreFile,truststorePin),
|
'expectedRC' : 0
|
}
|
</call>
|
</else>
|
</if>
|
<else>
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-trust-manager-provider-prop' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : 'Blind Trust',
|
'optionsString' : '--set enabled:true' ,
|
'expectedRC' : 0
|
}
|
</call>
|
</else>
|
</if>
|
|
|
<!--- Enable LDAPS Connection Handler -->
|
<message>
|
'Enabling LDAPS Connection Handler - Keystore type'
|
</message>
|
|
<script>
|
option1='--set ssl-cert-nickname:%s' % certAlias
|
if trustMgr:
|
option2='--set trust-manager-provider:"%s"' % (trustMgr)
|
else:
|
option2='--set trust-manager-provider:"Blind Trust"'
|
option3='--set key-manager-provider:"%s"' % (KeyMgr)
|
option4='--set listen-port:%s' % DIRECTORY_INSTANCE_SSL_PORT
|
option5='--set enabled:true --set use-ssl:true --set ssl-client-auth-policy:required'
|
optionsString='%s %s %s %s %s' % (option1,option2,option3,option4,option5)
|
</script>
|
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-connection-handler-prop',
|
'objectType' : 'handler-name' ,
|
'objectName' : 'LDAPS Connection Handler',
|
'optionsString' : optionsString,
|
'expectedRC' : 0
|
}
|
</call>
|
|
<!--- Setting the mapper -->
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-certificate-mapper-prop',
|
'objectType' : 'mapper-name' ,
|
'objectName' : certMapper,
|
'optionsString' : '--set enabled:true --no-prompt %s'%optionMapper,
|
'expectedRC' : 0
|
}
|
</call>
|
|
<!--- Setting the sasl mechanism -->
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-sasl-mechanism-handler-prop',
|
'objectType' : 'handler-name' ,
|
'objectName' : handlerName,
|
'optionsString' : '--set certificate-mapper:"%s" --set enabled:true --no-prompt %s'%(certMapper,optionSaSL),
|
'expectedRC' : 0
|
}
|
</call>
|
</sequence>
|
</function>
|
|
<!-- ################################################## -->
|
<!-- configure SSL and TLS -->
|
<!-- ################################################## -->
|
<function name="configureSSL_TLS">
|
<function-prolog>
|
This function makes the configuration changes for SSL and TLS
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_BIN,OPENDSNAME)">
|
<function-arg-description>
|
Pathname to installation root
|
</function-arg-description>
|
<function-arg-property name="type" value="filepath"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceHost" type="optional">
|
<function-arg-description>
|
Directory server hostname or IP address
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' % DIRECTORY_INSTANCE_ADMIN_PORT">
|
<function-arg-description>
|
Directory server admin port number
|
</function-arg-description>
|
<function-arg-property name="type" value="Port number"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceDn" type="optional">
|
<function-arg-description>
|
Bind DN
|
</function-arg-description>
|
<function-arg-property name="type" value="DN"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstancePswd" type="optional">
|
<function-arg-description>
|
Bind password
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="keystoreType" type="optional" default="'JKS'">
|
<function-arg-description>
|
Keystore type : JKS or PKCS12
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="certAlias" type="optional" default="'server-cert'">
|
<function-arg-description>
|
Alias certificate
|
</function-arg-description>
|
</function-arg-def>
|
<function-arg-def name="keystorePin" type="optional" default="'servercert'">
|
<function-arg-description>
|
Keystore pin
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="extraParams" type="optional">
|
<function-arg-description>
|
Optional extra parameters for specific test cases
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
</function-map-args>
|
<sequence>
|
<!--- configure Key Manager Provider -->
|
<message>
|
'Configure Key Manager Provider'
|
</message>
|
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-key-manager-provider-prop' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : keystoreType,
|
'optionsString' : '--set key-store-file:config/keystore --reset key-store-pin-file --set key-store-pin:%s --set enabled:true' % keystorePin,
|
'expectedRC' : 0
|
}
|
</call>
|
|
<!--- configure Trust Manager Provider -->
|
<message>
|
'Configure Trust Manager Provider'
|
</message>
|
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-trust-manager-provider-prop' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : 'Blind Trust',
|
'optionsString' : '--set enabled:true' ,
|
'expectedRC' : 0
|
}
|
</call>
|
|
|
<!--- Enable LDAPS Connection Handler -->
|
<message>
|
'Enabling LDAPS Connection Handler - Keystore type'
|
</message>
|
|
<script>
|
option1='--set ssl-cert-nickname:%s' % certAlias
|
option2='--set trust-manager-provider:"Blind Trust"'
|
option3='--set key-manager-provider:"%s"' % (keystoreType)
|
option4='--set listen-port:%s' % DIRECTORY_INSTANCE_SSL_PORT
|
option5='--set enabled:true --set use-ssl:true'
|
optionsString='%s %s %s %s %s' % (option1,option2,option3,option4,option5)
|
</script>
|
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort,
|
'dsInstanceDn' : dsInstanceDn,
|
'dsInstancePswd' : dsInstancePswd,
|
'subcommand' : 'set-connection-handler-prop',
|
'objectType' : 'handler-name',
|
'objectName' : 'LDAPS Connection Handler',
|
'optionsString' : optionsString,
|
'expectedRC' : 0
|
}
|
</call>
|
|
<!--- Enable StartTLS -->
|
<message>
|
'Enabling StartTLS'
|
</message>
|
|
<script>
|
option1='--set ssl-cert-nickname:%s' % certAlias
|
option2='--set trust-manager-provider:"Blind Trust" '
|
option3='--set key-manager-provider:"%s"' % (keystoreType)
|
option4='--set allow-start-tls:true'
|
optionsString='%s %s %s %s' % (option1,option2,option3,option4)
|
</script>
|
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort,
|
'dsInstanceDn' : dsInstanceDn,
|
'dsInstancePswd' : dsInstancePswd,
|
'subcommand' : 'set-connection-handler-prop',
|
'objectType' : 'handler-name',
|
'objectName' : 'LDAP Connection Handler',
|
'optionsString' : optionsString,
|
'expectedRC' : 0
|
}
|
</call>
|
</sequence>
|
</function>
|
|
|
<!-- ################################################## -->
|
<!-- Unconfigure SSL -->
|
<!-- ################################################## -->
|
<function name="unconfigureSSL">
|
<function-prolog>
|
This function reverses the configuration changes for SSL
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_BIN,OPENDSNAME)">
|
<function-arg-description>
|
Pathname to installation root
|
</function-arg-description>
|
<function-arg-property name="type" value="filepath"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceHost" type="optional">
|
<function-arg-description>
|
Directory server hostname or IP address
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' %DIRECTORY_INSTANCE_ADMIN_PORT">
|
<function-arg-description>
|
Directory server admin port number
|
</function-arg-description>
|
<function-arg-property name="type" value="Port number"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceDn" type="optional">
|
<function-arg-description>
|
Bind DN
|
</function-arg-description>
|
<function-arg-property name="type" value="DN"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstancePswd" type="optional">
|
<function-arg-description>
|
Bind password
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="keystoreType" type="optional" default="'JKS'">
|
<function-arg-description>
|
Keystore type : JKS or PKCS12
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="customKeyMgr" type="optional" default="''">
|
<function-arg-description>
|
Name for a new key manager
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="customTrustMgr" type="optional" default="''">
|
<function-arg-description>
|
Name for a new trust manager
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="extraParams" type="optional">
|
<function-arg-description>
|
Optional extra parameters for specific test cases
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
</function-map-args>
|
<sequence>
|
<!--- Disable LDAPS Connection Handler -->
|
<message>
|
'Disabling LDAPS Connection Handler'
|
</message>
|
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-connection-handler-prop' ,
|
'objectType' : 'handler-name' ,
|
'objectName' : 'LDAPS Connection Handler',
|
'optionsString' : '--set enabled:false --set use-ssl:false',
|
'expectedRC' : 0
|
}
|
</call>
|
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-connection-handler-prop' ,
|
'objectType' : 'handler-name' ,
|
'objectName' : 'LDAPS Connection Handler',
|
'optionsString' : '--reset key-manager-provider --reset trust-manager-provider --reset ssl-cert-nickname',
|
'expectedRC' : 0
|
}
|
</call>
|
|
<!--- Disable SSL Trust Manager Provider -->
|
<message>
|
'Disabling SSL Trust Manager Provider'
|
</message>
|
<if expr="len(customTrustMgr.strip()) != 0">
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'delete-trust-manager-provider' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : customTrustMgr ,
|
'expectedRC' : 0
|
}
|
</call>
|
<else>
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort,
|
'dsInstanceDn' : dsInstanceDn,
|
'dsInstancePswd' : dsInstancePswd,
|
'subcommand' : 'set-trust-manager-provider-prop',
|
'objectType' : 'provider-name',
|
'objectName' : 'Blind Trust',
|
'optionsString' : '--set enabled:false',
|
'expectedRC' : 0
|
}
|
</call>
|
</else>
|
</if>
|
|
<!--- Disable Key Manager Provider -->
|
<message>
|
'Disabling Key Manager Provider'
|
</message>
|
|
<if expr="len(customKeyMgr.strip()) != 0">
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'delete-key-manager-provider' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : customKeyMgr ,
|
'expectedRC' : 0
|
}
|
</call>
|
<else>
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-key-manager-provider-prop' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : keystoreType,
|
'optionsString' : '--set enabled:false',
|
'expectedRC' : 0
|
}
|
</call>
|
</else>
|
</if>
|
</sequence>
|
</function>
|
|
|
<!-- ################################################## -->
|
<!-- unconfigureTLS -->
|
<!-- ################################################## -->
|
<function name="unconfigureTLS">
|
<function-prolog>
|
This function reverses the configuration changes for startTLS
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_BIN,OPENDSNAME)">
|
<function-arg-description>
|
Pathname to installation root
|
</function-arg-description>
|
<function-arg-property name="type" value="filepath"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceHost" type="optional">
|
<function-arg-description>
|
Directory server hostname or IP address
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' %DIRECTORY_INSTANCE_ADMIN_PORT">
|
<function-arg-description>
|
Directory server admin port number
|
</function-arg-description>
|
<function-arg-property name="type" value="Port number"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceDn" type="optional">
|
<function-arg-description>
|
Bind DN
|
</function-arg-description>
|
<function-arg-property name="type" value="DN"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstancePswd" type="optional">
|
<function-arg-description>
|
Bind password
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="customKeyMgr" type="optional" default="''">
|
<function-arg-description>
|
Name for the key manager
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="keystoreType" type="optional" default="'JKS'">
|
<function-arg-description>
|
Keystore type : JKS or PKCS12
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="extraParams" type="optional">
|
<function-arg-description>
|
Optional extra parameters for specific test cases
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
</function-map-args>
|
<sequence>
|
<!--- Disable StartTLS -->
|
<message>
|
'Disabling StartTLS'
|
</message>
|
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort,
|
'dsInstanceDn' : dsInstanceDn,
|
'dsInstancePswd' : dsInstancePswd,
|
'subcommand' : 'set-connection-handler-prop',
|
'objectType' : 'handler-name',
|
'objectName' : 'LDAP Connection Handler',
|
'optionsString' : ' --set allow-start-tls:false',
|
'expectedRC' : 0
|
}
|
</call>
|
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-connection-handler-prop' ,
|
'objectType' : 'handler-name' ,
|
'objectName' : 'LDAP Connection Handler',
|
'optionsString' : '--reset key-manager-provider --reset trust-manager-provider --reset ssl-cert-nickname',
|
'expectedRC' : 0
|
}
|
</call>
|
|
<!--- Disable SSL Trust Manager Provider -->
|
<message>
|
'Disabling SSL Trust Manager Provider'
|
</message>
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort,
|
'dsInstanceDn' : dsInstanceDn,
|
'dsInstancePswd' : dsInstancePswd,
|
'subcommand' : 'set-trust-manager-provider-prop',
|
'objectType' : 'provider-name',
|
'objectName' : 'Blind Trust',
|
'optionsString' : '--set enabled:false',
|
'expectedRC' : 0
|
}
|
</call>
|
|
<!--- Disable Key Manager Provider -->
|
<message>
|
'Disabling Key Manager Provider'
|
</message>
|
|
<if expr="len(customKeyMgr.strip()) != 0">
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'delete-key-manager-provider' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : customKeyMgr ,
|
'expectedRC' : 0
|
}
|
</call>
|
<else>
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort,
|
'dsInstanceDn' : dsInstanceDn,
|
'dsInstancePswd' : dsInstancePswd,
|
'subcommand' : 'set-key-manager-provider-prop',
|
'objectType' : 'provider-name',
|
'objectName' : keystoreType,
|
'optionsString' : '--set enabled:false',
|
'expectedRC' : 0
|
}
|
</call>
|
</else>
|
</if>
|
|
</sequence>
|
</function>
|
|
|
<!-- ################################################## -->
|
<!-- Unconfigure SSL and TLS -->
|
<!-- ################################################## -->
|
<function name="unconfigureSSL_TLS">
|
<function-prolog>
|
This function reverses the configuration changes for SSL and TLS
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_BIN,OPENDSNAME)">
|
<function-arg-description>
|
Pathname to installation root
|
</function-arg-description>
|
<function-arg-property name="type" value="filepath"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceHost" type="optional">
|
<function-arg-description>
|
Directory server hostname or IP address
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' %DIRECTORY_INSTANCE_ADMIN_PORT">
|
<function-arg-description>
|
Directory server admin port number
|
</function-arg-description>
|
<function-arg-property name="type" value="Port number"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstanceDn" type="optional">
|
<function-arg-description>
|
Bind DN
|
</function-arg-description>
|
<function-arg-property name="type" value="DN"/>
|
</function-arg-def>
|
<function-arg-def name="dsInstancePswd" type="optional">
|
<function-arg-description>
|
Bind password
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="keystoreType" type="optional" default="'JKS'">
|
<function-arg-description>
|
Keystore type : JKS or PKCS12
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="extraParams" type="optional">
|
<function-arg-description>
|
Optional extra parameters for specific test cases
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
</function-map-args>
|
<sequence>
|
<!--- Disable LDAPS Connection Handler -->
|
<message>
|
'Disabling LDAPS Connection Handler'
|
</message>
|
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort,
|
'dsInstanceDn' : dsInstanceDn,
|
'dsInstancePswd' : dsInstancePswd,
|
'subcommand' : 'set-connection-handler-prop',
|
'objectType' : 'handler-name',
|
'objectName' : 'LDAPS Connection Handler',
|
'optionsString' : '--set enabled:false --set use-ssl:false',
|
'expectedRC' : 0
|
}
|
</call>
|
|
<!--- Disable StartTLS -->
|
<message>
|
'Disabling StartTLS'
|
</message>
|
<call function="'dsconfig'">
|
{ 'location' : location ,
|
'dsPath' : dsPath ,
|
'dsInstanceHost' : dsInstanceHost ,
|
'dsInstanceAdminPort' : dsInstanceAdminPort ,
|
'dsInstanceDn' : dsInstanceDn ,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-connection-handler-prop' ,
|
'objectType' : 'handler-name' ,
|
'objectName' : 'LDAP Connection Handler',
|
'optionsString' : ' --set allow-start-tls:false',
|
'expectedRC' : 0
|
}
|
</call>
|
|
<!--- Disable SSL Trust Manager Provider -->
|
<message>
|
'Disabling SSL Trust Manager Provider'
|
</message>
|
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort,
|
'dsInstanceDn' : dsInstanceDn,
|
'dsInstancePswd' : dsInstancePswd ,
|
'subcommand' : 'set-trust-manager-provider-prop' ,
|
'objectType' : 'provider-name' ,
|
'objectName' : 'Blind Trust',
|
'optionsString' : '--set enabled:false' ,
|
'expectedRC' : 0
|
}
|
</call>
|
|
<!--- Disable Key Manager Provider -->
|
<message>
|
'Disabling Key Manager Provider'
|
</message>
|
|
<call function="'dsconfig'">
|
{ 'location' : location,
|
'dsPath' : dsPath,
|
'dsInstanceHost' : dsInstanceHost,
|
'dsInstanceAdminPort' : dsInstanceAdminPort,
|
'dsInstanceDn' : dsInstanceDn,
|
'dsInstancePswd' : dsInstancePswd,
|
'subcommand' : 'set-key-manager-provider-prop',
|
'objectType' : 'provider-name',
|
'objectName' : keystoreType,
|
'optionsString' : '--set enabled:false',
|
'expectedRC' : 0
|
}
|
</call>
|
</sequence>
|
</function>
|
|
<function name="createStrongUserEntries" scope="local">
|
<function-prolog>
|
This creates strongAuthenticationUser entries with userCertificates
|
</function-prolog>
|
<function-map-args>
|
<function-arg-def name="location" type="required">
|
<function-arg-description>
|
Location of target host
|
</function-arg-description>
|
<function-arg-property name="type" value="hostname"/>
|
</function-arg-def>
|
<function-arg-def name="certificate" type="required">
|
<function-arg-description>
|
Certificate
|
</function-arg-description>
|
<function-arg-property name="type" value="string"/>
|
</function-arg-def>
|
<function-arg-def name="filename" type="required">
|
<function-arg-description>
|
Certificate filename
|
</function-arg-description>
|
<function-arg-property name="type" value="filename"/>
|
</function-arg-def>
|
<function-arg-def name="userdn" type="required">
|
<function-arg-description>
|
User DN
|
</function-arg-description>
|
<function-arg-property name="type" value="DN"/>
|
</function-arg-def>
|
<function-arg-def name="localLdifFile" type="required">
|
<function-arg-description>
|
Local ldif file
|
</function-arg-description>
|
<function-arg-property name="type" value="filename"/>
|
</function-arg-def>
|
<function-arg-def name="remoteLdifFile" type="required">
|
<function-arg-description>
|
Remote ldif file
|
</function-arg-description>
|
<function-arg-property name="type" value="filename"/>
|
</function-arg-def>
|
</function-map-args>
|
|
<sequence>
|
|
<!-- Get a certificate from a file in PEM format -->
|
<call function="'getFile'">
|
{ 'location' : location,
|
'filename' : filename
|
}
|
</call>
|
|
<message>
|
'Certificate contents:\n %s' % cmdResult
|
</message>
|
|
<!-- Extract BEGIN CERTIFICATE and END CERTIFICATE -->
|
<script>
|
certList=STAXResult[1].split('\n')
|
ret_str = ""
|
for line in certList:
|
index_cert = line.find("CERTIFICATE")
|
if index_cert == -1:
|
ret_str+=line.strip()
|
</script>
|
|
<!-- Create ldif for users entries and add userCertificate -->
|
<message> '---- Create User entry : %s----' % userdn</message>
|
<script>
|
listAttr = []
|
listAttr.append('dn: %s' % userdn)
|
listAttr.append('objectclass:top')
|
listAttr.append('objectclass:organizationalperson')
|
listAttr.append('objectclass:inetorgperson')
|
listAttr.append('objectclass:person')
|
listAttr.append('objectclass:ds-certificate-user')
|
listAttr.append('objectclass:strongAuthenticationUser')
|
listAttr.append('userCertificate;binary:: %s' % ret_str)
|
listAttr.append('givenname:%s' % certificate)
|
listAttr.append('sn:%s' % certificate)
|
listAttr.append('cn:%s' % certificate)
|
</script>
|
|
<!-- Write out the ldif of users entry-->
|
<script>
|
outfile = open(localLdifFile,"w")
|
for line in listAttr:
|
outfile.write("%s\n" % line)
|
outfile.close()
|
</script>
|
|
<!-- Copy the ldif file containing userCertificate to remote host -->
|
<message>
|
'Copy ldif (%s) file to user entry %s to %s' % (localLdifFile,userdn,remoteLdifFile)
|
</message>
|
|
<call function="'copyFile'">
|
{ 'location' : STAXServiceMachine,
|
'srcfile' : localLdifFile,
|
'destfile' : remoteLdifFile,
|
'remotehost' : location
|
}
|
</call>
|
|
<!-- Add the users entry into the LDAP server -->
|
<call function="'ldapModifyWithScript'">
|
{
|
'dsAdd' : 'True' ,
|
'dsInstanceHost' : DIRECTORY_INSTANCE_HOST ,
|
'dsInstancePort' : DIRECTORY_INSTANCE_PORT ,
|
'dsInstanceDn' : DIRECTORY_INSTANCE_DN ,
|
'dsInstancePswd' : DIRECTORY_INSTANCE_PSWD ,
|
'dsFilename' : remoteLdifFile
|
}
|
</call>
|
|
</sequence>
|
</function>
|
</stax>
|
