| | |
| | | */ |
| | | package org.opends.server.util.cli; |
| | | |
| | | import static com.forgerock.opendj.cli.Utils.isDN; |
| | | import static com.forgerock.opendj.cli.Utils.getAdministratorDN; |
| | | import static com.forgerock.opendj.cli.Utils.getThrowableMsg; |
| | | import static com.forgerock.opendj.cli.CliMessages.*; |
| | | |
| | | import java.io.File; |
| | | import java.io.FileInputStream; |
| | | import java.io.FileNotFoundException; |
| | |
| | | |
| | | import org.forgerock.i18n.LocalizableMessage; |
| | | import org.forgerock.i18n.slf4j.LocalizedLogger; |
| | | import org.opends.admin.ads.ADSContext; |
| | | import org.opends.admin.ads.util.ApplicationKeyManager; |
| | | import org.opends.admin.ads.util.ApplicationTrustManager; |
| | | import org.opends.quicksetup.Step; |
| | | import org.opends.quicksetup.UserDataCertificateException; |
| | | import org.opends.quicksetup.util.Utils; |
| | | import org.opends.server.admin.client.cli.SecureConnectionCliArgs; |
| | | import org.opends.server.tools.LDAPConnectionOptions; |
| | | import org.opends.server.tools.SSLConnectionException; |
| | | import org.opends.server.tools.SSLConnectionFactory; |
| | | import org.opends.server.tools.dsconfig.ArgumentExceptionFactory; |
| | | import org.opends.server.util.SelectableCertificateKeyManager; |
| | | |
| | | import com.forgerock.opendj.cli.*; |
| | | |
| | | import static org.opends.messages.QuickSetupMessages.*; |
| | | import static org.opends.messages.ToolMessages.*; |
| | | import static org.opends.messages.UtilityMessages.*; |
| | | import com.forgerock.opendj.cli.ArgumentException; |
| | | import com.forgerock.opendj.cli.ClientException; |
| | | import com.forgerock.opendj.cli.CommandBuilder; |
| | | import com.forgerock.opendj.cli.ConsoleApplication; |
| | | import com.forgerock.opendj.cli.Menu; |
| | | import com.forgerock.opendj.cli.MenuBuilder; |
| | | import com.forgerock.opendj.cli.MenuResult; |
| | | import com.forgerock.opendj.cli.ValidationCallback; |
| | | |
| | | /** |
| | | * Supports interacting with a user through the command line to prompt for |
| | |
| | | } |
| | | catch (ClientException e) |
| | | { |
| | | throw ArgumentExceptionFactory.unableToReadConnectionParameters(e); |
| | | cannotReadConnectionParameters(e); |
| | | } |
| | | } |
| | | |
| | |
| | | } |
| | | catch (ClientException e) |
| | | { |
| | | throw ArgumentExceptionFactory.unableToReadConnectionParameters(e); |
| | | cannotReadConnectionParameters(e); |
| | | } |
| | | } |
| | | |
| | |
| | | app.println(); |
| | | if (useAdminOrBindDn) |
| | | { |
| | | String def = (adminUID != null ? adminUID : bindDN); |
| | | String def = adminUID != null ? adminUID : bindDN; |
| | | String v = |
| | | app.readValidatedInput( |
| | | INFO_LDAP_CONN_GLOBAL_ADMINISTRATOR_OR_BINDDN_PROMPT |
| | | .get(def), callback); |
| | | if (Utils.isDn(v)) |
| | | if (isDN(v)) |
| | | { |
| | | bindDN = v; |
| | | providedBindDN = v; |
| | |
| | | } |
| | | catch (ClientException e) |
| | | { |
| | | throw ArgumentExceptionFactory.unableToReadConnectionParameters(e); |
| | | cannotReadConnectionParameters(e); |
| | | } |
| | | } |
| | | if (useAdminOrBindDn) |
| | |
| | | { |
| | | if (useAdmin) |
| | | { |
| | | throw ArgumentExceptionFactory.missingBindPassword(adminUID); |
| | | throw new ArgumentException(ERR_ERROR_NO_ADMIN_PASSWORD.get(adminUID)); |
| | | } |
| | | else |
| | | { |
| | | throw ArgumentExceptionFactory.missingBindPassword(bindDN); |
| | | throw new ArgumentException(ERR_ERROR_NO_ADMIN_PASSWORD.get(bindDN)); |
| | | } |
| | | } |
| | | copySecureArgsList.bindPasswordFileArg.clearValues(); |
| | |
| | | // Read the password from the stdin. |
| | | if (!app.isInteractive()) |
| | | { |
| | | throw ArgumentExceptionFactory |
| | | .unableToReadBindPasswordInteractively(); |
| | | throw new ArgumentException(ERR_ERROR_BIND_PASSWORD_NONINTERACTIVE.get()); |
| | | } |
| | | |
| | | checkHeadingDisplayed(); |
| | |
| | | } |
| | | catch (Exception e) |
| | | { |
| | | throw ArgumentExceptionFactory.unableToReadConnectionParameters(e); |
| | | throw new ArgumentException(ERR_ERROR_CANNOT_READ_CONNECTION_PARAMETERS |
| | | .get(e.getMessage()), e.getCause()); |
| | | } |
| | | } |
| | | copySecureArgsList.bindPasswordArg.clearValues(); |
| | |
| | | connectTimeout = secureArgsList.connectTimeoutArg.getIntValue(); |
| | | } |
| | | |
| | | private void cannotReadConnectionParameters(ClientException e) |
| | | throws ArgumentException |
| | | { |
| | | throw new ArgumentException(ERR_ERROR_CANNOT_READ_CONNECTION_PARAMETERS |
| | | .get(e.getMessage()), e.getCause()); |
| | | } |
| | | |
| | | private String readPassword(LocalizableMessage prompt) throws ClientException |
| | | { |
| | | final char[] pwd = app.readPassword(prompt); |
| | |
| | | } |
| | | catch (ClientException e) |
| | | { |
| | | throw ArgumentExceptionFactory.unableToReadConnectionParameters(e); |
| | | cannotReadConnectionParameters(e); |
| | | } |
| | | } |
| | | |
| | |
| | | } |
| | | catch (Exception e) |
| | | { |
| | | throw ArgumentExceptionFactory.unableToReadConnectionParameters(e); |
| | | throw new ArgumentException(ERR_ERROR_CANNOT_READ_CONNECTION_PARAMETERS |
| | | .get(e.getMessage()), e.getCause()); |
| | | } |
| | | } |
| | | } |
| | |
| | | } |
| | | catch (Exception e) |
| | | { |
| | | throw ArgumentExceptionFactory.unableToReadConnectionParameters(e); |
| | | throw new ArgumentException(ERR_ERROR_CANNOT_READ_CONNECTION_PARAMETERS |
| | | .get(e.getMessage()), e.getCause()); |
| | | } |
| | | } |
| | | |
| | |
| | | } |
| | | catch (ClientException e) |
| | | { |
| | | throw ArgumentExceptionFactory.unableToReadConnectionParameters(e); |
| | | cannotReadConnectionParameters(e); |
| | | } |
| | | } |
| | | |
| | |
| | | // KeystorePath is null. Either it's unspecified or there's a pb |
| | | // We should throw an exception here, anyway since code below will |
| | | // anyway |
| | | throw ArgumentExceptionFactory |
| | | .incompatiblePropertyModification("null keystorePath"); |
| | | throw new ArgumentException(ERR_ERROR_INCOMPATIBLE_PROPERTY_MOD |
| | | .get("null keystorePath")); |
| | | } |
| | | |
| | | // Then the keystore password. |
| | |
| | | |
| | | if (keystorePassword == null) |
| | | { |
| | | throw ArgumentExceptionFactory.missingBindPassword(keystorePassword); |
| | | throw new ArgumentException(ERR_ERROR_NO_ADMIN_PASSWORD.get(keystorePassword)); |
| | | } |
| | | } |
| | | else if (keystorePassword == null || "-".equals(keystorePassword)) |
| | |
| | | // Read the password from the stdin. |
| | | if (!app.isInteractive()) |
| | | { |
| | | throw ArgumentExceptionFactory.unableToReadBindPasswordInteractively(); |
| | | throw new ArgumentException(ERR_ERROR_BIND_PASSWORD_NONINTERACTIVE.get()); |
| | | } |
| | | |
| | | checkHeadingDisplayed(); |
| | |
| | | } |
| | | catch (Exception e) |
| | | { |
| | | throw ArgumentExceptionFactory.unableToReadConnectionParameters(e); |
| | | throw new ArgumentException(ERR_ERROR_CANNOT_READ_CONNECTION_PARAMETERS |
| | | .get(e.getMessage()), e.getCause()); |
| | | } |
| | | } |
| | | |
| | |
| | | } |
| | | catch (Exception e) |
| | | { |
| | | throw ArgumentExceptionFactory.unableToReadConnectionParameters(e); |
| | | throw new ArgumentException(ERR_ERROR_CANNOT_READ_CONNECTION_PARAMETERS |
| | | .get(e.getMessage()), e.getCause()); |
| | | } |
| | | |
| | | certifNickname = secureArgsList.certNicknameArg.getValue(); |
| | |
| | | } |
| | | catch (KeyStoreException e) |
| | | { |
| | | throw ArgumentExceptionFactory.unableToReadConnectionParameters(e); |
| | | throw new ArgumentException(ERR_ERROR_CANNOT_READ_CONNECTION_PARAMETERS |
| | | .get(e.getMessage()), e.getCause()); |
| | | } |
| | | catch (ClientException e) |
| | | { |
| | | throw ArgumentExceptionFactory.unableToReadConnectionParameters(e); |
| | | cannotReadConnectionParameters(e); |
| | | } |
| | | } |
| | | |
| | |
| | | } |
| | | else if (providedAdminUID != null) |
| | | { |
| | | dn = ADSContext.getAdministratorDN(providedAdminUID); |
| | | dn = getAdministratorDN(providedAdminUID); |
| | | } |
| | | else if (this.bindDN != null) |
| | | else if (bindDN != null) |
| | | { |
| | | dn = this.bindDN; |
| | | dn = bindDN; |
| | | } |
| | | else if (this.adminUID != null) |
| | | else if (adminUID != null) |
| | | { |
| | | dn = ADSContext.getAdministratorDN(this.adminUID); |
| | | dn = getAdministratorDN(adminUID); |
| | | } |
| | | else |
| | | { |
| | |
| | | } |
| | | else if (secureArgsList.useAdminUID()) |
| | | { |
| | | dn = ADSContext.getAdministratorDN(this.adminUID); |
| | | dn = getAdministratorDN(adminUID); |
| | | } |
| | | else |
| | | { |
| | | dn = this.bindDN; |
| | | dn = bindDN; |
| | | } |
| | | return dn; |
| | | } |
| | |
| | | */ |
| | | public String getAdministratorUID() |
| | | { |
| | | return this.adminUID; |
| | | return adminUID; |
| | | } |
| | | |
| | | /** |
| | |
| | | */ |
| | | public String getBindPassword() |
| | | { |
| | | return this.bindPassword; |
| | | return bindPassword; |
| | | } |
| | | |
| | | /** |
| | |
| | | */ |
| | | public ApplicationTrustManager getTrustManager() |
| | | { |
| | | return this.trustManager; |
| | | return trustManager; |
| | | } |
| | | |
| | | /** |
| | |
| | | */ |
| | | public KeyStore getKeyStore() |
| | | { |
| | | return this.truststore; |
| | | return truststore; |
| | | } |
| | | |
| | | /** |
| | |
| | | */ |
| | | public KeyManager getKeyManager() |
| | | { |
| | | return this.keyManager; |
| | | return keyManager; |
| | | } |
| | | |
| | | /** |
| | |
| | | */ |
| | | public boolean isTrustStoreInMemory() |
| | | { |
| | | return this.trustStoreInMemory; |
| | | return trustStoreInMemory; |
| | | } |
| | | |
| | | /** |
| | |
| | | */ |
| | | public boolean isTrustAll() |
| | | { |
| | | return this.trustAll; |
| | | return trustAll; |
| | | } |
| | | |
| | | /** |
| | |
| | | * the trustManager used when trying to establish the connection. |
| | | * @param usedUrl |
| | | * the LDAP URL used to connect to the server. |
| | | * @param displayErrorMessage |
| | | * whether to display an error message before asking to accept the |
| | | * certificate or not. |
| | | * @param logger |
| | | * the Logger used to log messages. |
| | | * @return <CODE>true</CODE> if the user accepted the certificate and |
| | | * <CODE>false</CODE> otherwise. |
| | | * @return {@code true} if the user accepted the certificate and |
| | | * {@code false} otherwise. |
| | | */ |
| | | public boolean promptForCertificateConfirmation(Throwable t, |
| | | ApplicationTrustManager usedTrustManager, String usedUrl, |
| | | boolean displayErrorMessage, LocalizedLogger logger) |
| | | LocalizedLogger logger) |
| | | { |
| | | ApplicationTrustManager.Cause cause; |
| | | if (usedTrustManager != null) |
| | |
| | | logger.debug(LocalizableMessage.raw("Certificate exception cause: " |
| | | + cause)); |
| | | } |
| | | UserDataCertificateException.Type excType = null; |
| | | if (cause == ApplicationTrustManager.Cause.NOT_TRUSTED) |
| | | { |
| | | excType = UserDataCertificateException.Type.NOT_TRUSTED; |
| | | } |
| | | else if (cause == ApplicationTrustManager.Cause.HOST_NAME_MISMATCH) |
| | | { |
| | | excType = UserDataCertificateException.Type.HOST_NAME_MISMATCH; |
| | | } |
| | | else |
| | | { |
| | | app.println(Utils |
| | | .getThrowableMsg(INFO_ERROR_CONNECTING_TO_LOCAL.get(), t)); |
| | | } |
| | | |
| | | if (excType != null) |
| | | if (cause != null) |
| | | { |
| | | String h; |
| | | int p; |
| | |
| | | } |
| | | catch (Throwable t1) |
| | | { |
| | | if (logger != null) |
| | | { |
| | | logger.warn(LocalizableMessage.raw( |
| | | "Error parsing ldap url of ldap url.", t1)); |
| | | } |
| | | printLogger(logger, "Error parsing ldap url of ldap url. " + t1); |
| | | h = INFO_NOT_AVAILABLE_LABEL.get().toString(); |
| | | p = -1; |
| | | } |
| | | |
| | | UserDataCertificateException udce = |
| | | new UserDataCertificateException(Step.REPLICATION_OPTIONS, |
| | | INFO_CERTIFICATE_EXCEPTION.get(h, p), t, h, p, usedTrustManager |
| | | .getLastRefusedChain(), usedTrustManager |
| | | .getLastRefusedAuthType(), excType); |
| | | |
| | | String authType = usedTrustManager.getLastRefusedAuthType(); |
| | | LocalizableMessage msg; |
| | | if (udce.getType() == UserDataCertificateException.Type.NOT_TRUSTED) |
| | | if (authType.equals(ApplicationTrustManager.Cause.NOT_TRUSTED)) |
| | | { |
| | | msg = |
| | | INFO_CERTIFICATE_NOT_TRUSTED_TEXT_CLI.get(udce.getHost(), udce |
| | | .getPort()); |
| | | msg = INFO_CERTIFICATE_NOT_TRUSTED_TEXT_CLI.get(h, p); |
| | | } |
| | | else |
| | | { |
| | | msg = |
| | | INFO_CERTIFICATE_NAME_MISMATCH_TEXT_CLI.get(udce.getHost(), udce |
| | | .getPort(), udce.getHost(), udce.getHost(), udce.getPort()); |
| | | msg = INFO_CERTIFICATE_NAME_MISMATCH_TEXT_CLI.get(h, p, h, h, p); |
| | | } |
| | | if (displayErrorMessage) |
| | | { |
| | | app.println(msg); |
| | | } |
| | | X509Certificate[] chain = udce.getChain(); |
| | | String authType = udce.getAuthType(); |
| | | String host = udce.getHost(); |
| | | if (logger != null) |
| | | { |
| | | |
| | | X509Certificate[] chain = usedTrustManager.getLastRefusedChain(); |
| | | if (chain == null) |
| | | { |
| | | logger.warn(LocalizableMessage |
| | | .raw("The chain is null for the UserDataCertificateException")); |
| | | printLogger(logger, "Null chain for this certificate exception."); |
| | | return false; |
| | | } |
| | | if (authType == null) |
| | | { |
| | | logger |
| | | .warn(LocalizableMessage |
| | | .raw("The auth type is null for the UserDataCertificateException")); |
| | | printLogger(logger, "Null auth type for this certificate exception."); |
| | | } |
| | | if (host == null) |
| | | if (h == null) |
| | | { |
| | | logger.warn(LocalizableMessage |
| | | .raw("The host is null for the UserDataCertificateException")); |
| | | printLogger(logger, "Null host name for this certificate exception."); |
| | | } |
| | | return checkServerCertificate(chain, authType, h); |
| | | } |
| | | if (chain != null) |
| | | else |
| | | { |
| | | return checkServerCertificate(chain, authType, host); |
| | | } |
| | | app.println(getThrowableMsg(INFO_ERROR_CONNECTING_TO_LOCAL.get(), t)); |
| | | } |
| | | return false; |
| | | } |
| | | |
| | | private void printLogger(final LocalizedLogger logger, |
| | | final String msg) |
| | | { |
| | | if (logger != null) |
| | | { |
| | | logger.warn(LocalizableMessage.raw(msg)); |
| | | } |
| | | } |
| | | |
| | | /** |
| | | * Sets the heading that is displayed in interactive mode. |
| | | * |
| | |
| | | * Tells whether during interaction we can ask for both the DN or the admin |
| | | * UID. |
| | | * |
| | | * @return <CODE>true</CODE> if during interaction we can ask for both the DN |
| | | * and the admin UID and <CODE>false</CODE> otherwise. |
| | | * @return {@code true} if during interaction we can ask for both the DN |
| | | * and the admin UID and {@code false} otherwise. |
| | | */ |
| | | public boolean isUseAdminOrBindDn() |
| | | { |
| | |
| | | try |
| | | { |
| | | // If remote host, return |
| | | if (!InetAddress.getLocalHost().getHostName().equals(hostName)) |
| | | if (!InetAddress.getLocalHost().getHostName().equals(hostName) |
| | | || secureArgsList.getAdminPortFromConfig() != portNumber) |
| | | { |
| | | return false; |
| | | } |
| | |
| | | secureArgsList.trustStorePathArg.addValue(truststoreFileAbsolute); |
| | | return true; |
| | | } |
| | | else |
| | | { |
| | | return false; |
| | | } |
| | | } |
| | | catch (Exception ex) |
| | | { |
| | | // do nothing |