ejbca-develop — Development discussions

Re: [Ejbca-develop] CMP and subjectAltName

[Michael S. <mi...@st...>]

Michael Ströder wrote:
> Tomas Gustavsson wrote:
>> In that case altName is taken from the CertTemplate->SubjectAltName 
>> extension.
> 
> Looking at (badly written) RFC 4211 I'm confused:

Sorry, found CertTemplate::extensions right now...

Ciao, Michael.

Re: [Ejbca-develop] CMP and subjectAltName

[Tomas G. <to...@pr...>]

Th CertTemplate is basically a certificate (CRMF request message). The 
CertTemplate contains the naming values requested by the client/RA.

/Tomas

On 2014-11-11 10:39, Michael Ströder wrote:
> Tomas Gustavsson wrote:
>>
>> Using CMP in RA mode?
>
> Yes.
>
>> In that case altName is taken from the CertTemplate->SubjectAltName
>> extension.
>
> Looking at (badly written) RFC 4211 I'm confused:
>
> I don't see SubjectAltName used or defined therein.
>
> I see CertTemplate::Subject of type Name (I assume Name definition is taken
> from PKIX).
>
> Or do you mean RegInfo::utf8Pairs?
>
> Ciao, Michael.
>
>> On 2014-11-11 10:10, Michael Ströder wrote:
>>> HI!
>>>
>>> I'm currently testing CMP with cmpforopenssl.
>>>
>>> But my EE profiles mandate the use of certain subjectAltName values.
>>>
>>> I wonder whether EJBCA supports subject name in RegInfo as detailed in
>>>
>>> http://tools.ietf.org/html/rfc4211#appendix-A.2
>>>
>>> How is that tied into the EE profile?
>>>
>>> Ciao, Michael.
>
>
>
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
>
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

Re: [Ejbca-develop] CMP and subjectAltName

[Michael S. <mi...@st...>]

Tomas Gustavsson wrote:
> 
> Using CMP in RA mode?

Yes.

> In that case altName is taken from the CertTemplate->SubjectAltName 
> extension.

Looking at (badly written) RFC 4211 I'm confused:

I don't see SubjectAltName used or defined therein.

I see CertTemplate::Subject of type Name (I assume Name definition is taken
from PKIX).

Or do you mean RegInfo::utf8Pairs?

Ciao, Michael.

> On 2014-11-11 10:10, Michael Ströder wrote:
>> HI!
>>
>> I'm currently testing CMP with cmpforopenssl.
>>
>> But my EE profiles mandate the use of certain subjectAltName values.
>>
>> I wonder whether EJBCA supports subject name in RegInfo as detailed in
>>
>> http://tools.ietf.org/html/rfc4211#appendix-A.2
>>
>> How is that tied into the EE profile?
>>
>> Ciao, Michael.

Re: [Ejbca-develop] CMP and subjectAltName

[Tomas G. <to...@pr...>]

Using CMP in RA mode?

In that case altName is taken from the CertTemplate->SubjectAltName 
extension.

Cheers,
Tomas

On 2014-11-11 10:10, Michael Ströder wrote:
> HI!
>
> I'm currently testing CMP with cmpforopenssl.
>
> But my EE profiles mandate the use of certain subjectAltName values.
>
> I wonder whether EJBCA supports subject name in RegInfo as detailed in
>
> http://tools.ietf.org/html/rfc4211#appendix-A.2
>
> How is that tied into the EE profile?
>
> Ciao, Michael.
>
>
>
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
>
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

[Ejbca-develop] CMP and subjectAltName

[Michael S. <mi...@st...>]

HI!

I'm currently testing CMP with cmpforopenssl.

But my EE profiles mandate the use of certain subjectAltName values.

I wonder whether EJBCA supports subject name in RegInfo as detailed in

http://tools.ietf.org/html/rfc4211#appendix-A.2

How is that tied into the EE profile?

Ciao, Michael.

Re: [Ejbca-develop] Delegation with Administrator Roles

[Michael S. <mi...@st...>]

Tomas Gustavsson wrote:
> One important thing in profiles are how "available CAs" and "available 
> profiles" are selected. An administrator does not have access to a 
> profile if he/she does not have access to all selected "available" CAs 
> and profiles.

Now the interesting question is what "have access" really means (see my own
follow-up). Obviously the RA admin of another sub CA should not be able to let
the admin CA issue arbitrary certs.

Ciao, Michael.

Re: [Ejbca-develop] Delegation with Administrator Roles

[Tomas G. <to...@pr...>]

On 2014-11-11 09:52, Michael Ströder wrote:
> Michael Ströder wrote:
>> (using 6.2)
>>
>> I'd like to delegated control (approval, revocation, etc.) for some specific EE
>> profiles of sub CAs to groups of RA admins.
>
> I have it somewhat working with detailed access rights for EE profiles
> "EEP_Admin" and "EEP_Server" (see details below). Mainly
> "EEP_Admin/view_end_entity ACCEPT" is the solution.
>
> Is this the officially supported way to do it?
>
> BTW:
> Why does it take two minutes to list the access rights for a single role?

Hmm, not for me...goes in a jiffy...


>
> Ciao, Michael.
>
> # /opt/ejbca/bin/ejbca.sh roles listrules ROLE_ServerApprovers
> No database integrity protection available in this version of EJBCA.
> /administrator ACCEPT
> /ca/CA_Test-Server-CA-1-2014-10 ACCEPT
> /ca/CA_Test-Admin-CA-1-2014-10 ACCEPT
> /ca_functionality/create_certificate ACCEPT
> /ca_functionality/store_certificate ACCEPT
> /ca_functionality/view_certificate ACCEPT
> /endentityprofilesrules/EEP_Server/approve_end_entity ACCEPT
> /endentityprofilesrules/EEP_Server/create_end_entity ACCEPT
> /endentityprofilesrules/EEP_Server/delete_end_entity DECLINE
> /endentityprofilesrules/EEP_Server/edit_end_entity ACCEPT
> /endentityprofilesrules/EEP_Server/revoke_end_entity ACCEPT
> /endentityprofilesrules/EEP_Server/view_end_entity ACCEPT
> /endentityprofilesrules/EEP_Server/view_end_entity_history ACCEPT
> /endentityprofilesrules/EEP_Admin/approve_end_entity DECLINE
> /endentityprofilesrules/EEP_Admin/create_end_entity DECLINE
> /endentityprofilesrules/EEP_Admin/delete_end_entity DECLINE
> /endentityprofilesrules/EEP_Admin/edit_end_entity DECLINE
> /endentityprofilesrules/EEP_Admin/revoke_end_entity DECLINE
> /endentityprofilesrules/EEP_Admin/view_end_entity ACCEPT
> /endentityprofilesrules/EEP_Admin/view_end_entity_history DECLINE
> /ra_functionality/approve_end_entity ACCEPT
> /ra_functionality/create_end_entity ACCEPT
> /ra_functionality/edit_end_entity ACCEPT
> /ra_functionality/revoke_end_entity ACCEPT
> /ra_functionality/view_end_entity ACCEPT
> /ra_functionality/view_end_entity_history ACCEPT
>
>
>
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
>
>
>
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

Re: [Ejbca-develop] Delegation with Administrator Roles

[Michael S. <mi...@st...>]

Michael Ströder wrote:
> (using 6.2)
> 
> I'd like to delegated control (approval, revocation, etc.) for some specific EE
> profiles of sub CAs to groups of RA admins.

I have it somewhat working with detailed access rights for EE profiles
"EEP_Admin" and "EEP_Server" (see details below). Mainly
"EEP_Admin/view_end_entity ACCEPT" is the solution.

Is this the officially supported way to do it?

BTW:
Why does it take two minutes to list the access rights for a single role?

Ciao, Michael.

# /opt/ejbca/bin/ejbca.sh roles listrules ROLE_ServerApprovers
No database integrity protection available in this version of EJBCA.
/administrator ACCEPT
/ca/CA_Test-Server-CA-1-2014-10 ACCEPT
/ca/CA_Test-Admin-CA-1-2014-10 ACCEPT
/ca_functionality/create_certificate ACCEPT
/ca_functionality/store_certificate ACCEPT
/ca_functionality/view_certificate ACCEPT
/endentityprofilesrules/EEP_Server/approve_end_entity ACCEPT
/endentityprofilesrules/EEP_Server/create_end_entity ACCEPT
/endentityprofilesrules/EEP_Server/delete_end_entity DECLINE
/endentityprofilesrules/EEP_Server/edit_end_entity ACCEPT
/endentityprofilesrules/EEP_Server/revoke_end_entity ACCEPT
/endentityprofilesrules/EEP_Server/view_end_entity ACCEPT
/endentityprofilesrules/EEP_Server/view_end_entity_history ACCEPT
/endentityprofilesrules/EEP_Admin/approve_end_entity DECLINE
/endentityprofilesrules/EEP_Admin/create_end_entity DECLINE
/endentityprofilesrules/EEP_Admin/delete_end_entity DECLINE
/endentityprofilesrules/EEP_Admin/edit_end_entity DECLINE
/endentityprofilesrules/EEP_Admin/revoke_end_entity DECLINE
/endentityprofilesrules/EEP_Admin/view_end_entity ACCEPT
/endentityprofilesrules/EEP_Admin/view_end_entity_history DECLINE
/ra_functionality/approve_end_entity ACCEPT
/ra_functionality/create_end_entity ACCEPT
/ra_functionality/edit_end_entity ACCEPT
/ra_functionality/revoke_end_entity ACCEPT
/ra_functionality/view_end_entity ACCEPT
/ra_functionality/view_end_entity_history ACCEPT

Re: [Ejbca-develop] Delegation with Administrator Roles

[Tomas G. <to...@pr...>]

One important thing in profiles are how "available CAs" and "available 
profiles" are selected. An administrator does not have access to a 
profile if he/she does not have access to all selected "available" CAs 
and profiles.

Cheers,
Tomas
**********
PrimeKey Solutions AB
Anderstorpsvägen 16, 171 54 Solna, Sweden
Mob: +46 (0)707421096
Internet: www.primekey.se
Twitter: twitter.com/primekeyPKI
**********

On 2014-11-07 10:46, Michael Ströder wrote:
> HI!
>
> (using 6.2)
>
> I'd like to delegated control (approval, revocation, etc.) for some specific EE
> profiles of sub CAs to groups of RA admins.
>
> Therefore I've created a special sub CA for issuing RA admin certs, let's call
> it "CA_RA-Admins" and a EE profile "EE_RA-Admin".
>
> After that a administrator role was created and certs issued based on
> "EE_RA-Admin" were added.
>
> Access rules were defined granting rights for "Other-Sub-CA" with EE profile
> "EE_Others".
>
> But it does not work. I have to grant rights to "CA_RA-Admins" and the EE
> profile "EE_RA-Admin" to make it work. But obviously that's not right.
>
> Even when issuing certs based EE profile "EE_RA-Admin" with "Other-Sub-CA" it
> does not work.
>
> How do others delegate control to certain administrator roles?
>
> Ciao, Michael.
>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

[Ejbca-develop] Publisher lost in Cert Profile when accessing adminweb as CA Administrator

[Liliana C. <lil...@bu...>]

Hello,

I'm working with ejbca_ce_6_0_3 and jboss-as-7.1.1.Final.

I've created a CA Administrator. I can connect to webadmin with my CA Administrator certificate, but when I try to create a certificate profile:

1.       I cannot take ENDUSER as a template

2.       Even if I have created a publisher, it doesn't appear in the Publisher list (which is empty)



Is this the normal operation ?



Thanks for your help.



Best regards,

Liliana Cabalantti
Bull, Architect of an Open World(tm)
BSS/TrustWay
Tél : +33 1 30 80 63 95
Fax : +33 1 30 80 63 40
lil...@bu...<mailto:lil...@bu...>
[BULL_logo]

[Ejbca-develop] Delegation with Administrator Roles

[Michael S. <mi...@st...>]

HI!

(using 6.2)

I'd like to delegated control (approval, revocation, etc.) for some specific EE
profiles of sub CAs to groups of RA admins.

Therefore I've created a special sub CA for issuing RA admin certs, let's call
it "CA_RA-Admins" and a EE profile "EE_RA-Admin".

After that a administrator role was created and certs issued based on
"EE_RA-Admin" were added.

Access rules were defined granting rights for "Other-Sub-CA" with EE profile
"EE_Others".

But it does not work. I have to grant rights to "CA_RA-Admins" and the EE
profile "EE_RA-Admin" to make it work. But obviously that's not right.

Even when issuing certs based EE profile "EE_RA-Admin" with "Other-Sub-CA" it
does not work.

How do others delegate control to certain administrator roles?

Ciao, Michael.

Re: [Ejbca-develop] Invalid DN chars

[Tomas G. <to...@pr...>]

Ah, another function then...didn't test that one.

On 2014-11-06 16:39, Michael Ströder wrote:
> Tomas Gustavsson <to...@pr...> wrote
>> What version are you using? I could add O=S&M in EJBCA 6.2 from the
>> admin GUI.
>
> I'm always using 6.2.0 and SVN.
>
> I was testing subject DN in web interface for defining roles groups.
>
> Ciao, Michael.
>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

Re: [Ejbca-develop] Invalid DN chars

[Michael S. <mi...@st...>]

Tomas Gustavsson <to...@pr...> wrote
> What version are you using? I could add O=S&M in EJBCA 6.2 from the 
> admin GUI.

I'm always using 6.2.0 and SVN.

I was testing subject DN in web interface for defining roles groups.

Ciao, Michael.

Re: [Ejbca-develop] Invalid DN chars

[Tomas G. <to...@pr...>]

What version are you using? I could add O=S&M in EJBCA 6.2 from the 
admin GUI.

Cheers,
Tomas

On 2014-11-06 16:11, Michael Ströder wrote:
> Tomas Gustavsson <to...@pr...> wrote
>> It's just some legacy input validation for usability.
>
> Something related to special XML / HTML character entities? ;-]
>
>> One at a time
>> every character has been needed to be allowed, but not & so far
>> (assuming you are using the latest version) :)
>
> "&" is very common in legal company names.
>
> Example: Foo GmbH & Co. KG
>
> And how about the "#"?
>
> Ciao, Michael.
>
>

Re: [Ejbca-develop] Invalid DN chars

[Michael S. <mi...@st...>]

Tomas Gustavsson <to...@pr...> wrote
> It's just some legacy input validation for usability.

Something related to special XML / HTML character entities? ;-]

> One at a time 
> every character has been needed to be allowed, but not & so far 
> (assuming you are using the latest version) :)

"&" is very common in legal company names.

Example: Foo GmbH & Co. KG

And how about the "#"?

Ciao, Michael.

Re: [Ejbca-develop] Invalid DN chars

[Tomas G. <to...@pr...>]

It's just some legacy input validation for usability. One at a time 
every character has been needed to be allowed, but not & so far 
(assuming you are using the latest version) :)

Cheers,
Tomas

On 2014-11-06 13:47, Michael Ströder wrote:
> HI!
>
> What's the reason for character "&" being rejected by adminweb as input value
> for a cert DN?
>
> ejbca.sh accepts all characters.
>
> Ciao, Michael.
>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

[Ejbca-develop] Invalid DN chars

[Michael S. <mi...@st...>]

HI!

What's the reason for character "&" being rejected by adminweb as input value
for a cert DN?

ejbca.sh accepts all characters.

Ciao, Michael.

[Ejbca-develop] Customize admin-gui

[Liliana C. <lil...@bu...>]

Hello,

I'm working with ejbca_ce_6_0_3 and jboss-as-7.1.1.Final.

Everything was correctly installed and operational.

I've tried to customize the admin-gui. For this, I modified the following files:

·         languagefile.en.properties -> I've only added a line after MADEBYPRIMEKEY line to change the line Made by PrimeKey by another one: Customized by ...

·         head_banner.jsp -> I've only change the image

·         foot_banner.jsp

After changing these files I run ant deployear and the result is the following:

The banner with my image banner_ejbca -admin is OK.

The last line (Customized by ...) is OK

But the list of functions in the left displays:

·         NAV_CRYPTOTOKENS instead of Crypto Tokens

·         NAV_AUDIT

·         NAV_ROLES

·         NAV_CMPCONFIGURATION

·         NAV_KEYBINDINGS

Can you help me with this ? Is there any way to arrange this without a new install ?

Thanks in advance for your help.

Best regards,

Liliana Cabalantti
Bull, Architect of an Open World(tm)
BSS/TrustWay
Tél : +33 1 30 80 63 95
Fax : +33 1 30 80 63 40
lil...@bu...<mailto:lil...@bu...>
[BULL_logo]

[Ejbca-develop] Customize admin-gui

[Liliana C. <lil...@bu...>]

Hello,

I'm working with ejbca_ce_6_0_3 and jboss-as-7.1.1.Final.

Everything was correctly installed and operational.

I've tried to customize the admin-gui. For this, I modified the following files:

·         languagefile.en.properties -> I've only added a line after MADEBYPRIMEKEY line to change the line Made by PrimeKey by another one: Customized by ...

·         head_banner.jsp -> I've only change the image

·         foot_banner.jsp

After changing these files I run ant deployear and the result is the following:

The banner with my image banner_ejbca -admin is OK.

The last line (Customized by ...) is OK

But the list of functions in the left displays:

·         NAV_CRYPTOTOKENS instead of Crypto Tokens

·         NAV_AUDIT

·         NAV_ROLES

·         NAV_CMPCONFIGURATION

·         NAV_KEYBINDINGS

Can you help me with this ? Is there any way to arrange this without a new install ?

Thanks in advance for your help.

Best regards,

Liliana Cabalantti
Bull, Architect of an Open World(tm)
BSS/TrustWay
Tél : +33 1 30 80 63 95
Fax : +33 1 30 80 63 40
lil...@bu...<mailto:lil...@bu...>
[BULL_logo]

[Ejbca-develop] unsubscribe

[Allan S. <all...@gm...>]

-- 
We live in an age when pizza gets to your home before the police.
  - Jeff Marder
------------------------------------------
Allan Swanepoel
all...@gm...
all...@un...
dra...@li...
+27 71 850 5554
Linux User #452990
Linux Machine #360914
-----------------------------------------------
IMPORTANT: This email is intended for the use of  the  individual
addressee(s)  named  above  and  may  contain information that is
confidential,  privileged  or  unsuitable  for  overly  sensitive persons
with  low  self-esteem, no sense of humour or irrational religious beliefs.
If you are not  the  intended  recipient,  any dissemination,
distribution  or copying  of  this  email is not authorised (either
explicitly or implicitly) and  constitutes  an irritating  social  faux
pas. Unless the word absquatulation has been used in its correct context
somewhere  other  than  in  this warning, it does not have any legal or
grammatical use and may be ignored. No animals were  harmed  in  the
transmission  of  this email,  although  the  yorkshire  terrier  next door
is living on borrowed time, let me tell you. Those of you with an
overwhelming fear  of  the unknown will be gratified to learn that there is
no hidden message revealed by reading  this  warning  backwards,  so just
ignore that Alert Notice from Microsoft: However, by pouring a complete
circle of salt around yourself and your  computer  you can  ensure  that
no harm befalls you and your pets.

Re: [Ejbca-develop] Failed Registering mariadb module on Jboss EAP 6.2.0

[Tomas G. <to...@pr...>]

Seems there is some mismatch between your module.xml and the command you run, or the module.xml is in the wrong place or can not be read. 

Cheers,
Tomas 

eilaf sorkatti <eil...@gm...> skrev: (5 november 2014 12:12:35 CET)
>Hello all,
>
>Thank you Tomas for your reply. This is what appear when enable
>debugging:
>
>14:09:33,587 DEBUG [org.jboss.as.controller.management-operation]
>(management-handler-thread - 4) JBAS014616: Operation ("add") failed -
>address: ([
>    ("subsystem" => "datasources"),
>    ("jdbc-driver" => "org.mariadb.jdbc.Driver")
>]) - failure description: "JBAS010441: Failed to load module for driver
>[org.mariadb]"
>14:09:54,499 DEBUG [org.apache.catalina.session]
>(ContainerBackgroundProcessor[StandardEngine[jboss.web]]) Start expire
>sessions StandardManager at 1415185794499 sessioncount 0
>
>
>
>On Mon, Nov 3, 2014 at 4:41 PM, Tomas Gustavsson <to...@pr...>
>wrote:
>
>>
>> This one seems to works for me with module.xml in:
>> jboss-eap-6.2/modules/system/layers/base/org/mariadb/main
>>
>> <?xml version="1.0" encoding="UTF-8"?>
>> <module xmlns="urn:jboss:module:1.0" name="org.mariadb">
>>    <resources>
>>      <resource-root path="mariadb-java-client-1.1.5.jar"/>
>>    </resources>
>>    <dependencies>
>>      <module name="javax.api"/>
>>      <module name="javax.transaction.api"/>
>>    </dependencies>
>> </module>
>>
>>
>>
>/subsystem=datasources/jdbc-driver=org.mariadb.jdbc.Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
>>
>>
>> You need to analyze your server.lgo to see why JBoss does not like
>your
>> driver. Perhaps you have written with root privileges?
>>
>> Cheers,
>> Tomas
>>
>> On 2014-11-03 07:08, eilaf sorkatti wrote:
>> > There is no need to edit standalone.xml am i right?, Here is my
>details
>> > "I was wrong am using JBOSS EAP 6.3":
>> > I put module.xml on
>> > /root/pki/jboss-eap-6.3/modules/system/layers/base/org/mariadb/main
>, it
>> > contains:
>> >
>> > <?xml version"1.0" encoding="UTF-8"?>
>> > <module xmlns="urn:jboss:module:1.0" name="org.mariadb">
>> >    <resources>
>> >      <resource-root path="mariadb-java-client-1.1.5.jar"/>
>> >    </resources>
>> >    <dependencies>
>> >      <module name="javax.api"/>
>> >      <module name="javax.transaction.api"/>
>> >    </dependencies>
>> > </module>
>> >
>> > I put the connector on the same directory. I run ./jboss-cli.sh
>> > then write the command
>> >   /subsystem=datasources/jdbc-
>> > driver=org.mariadb.jdbc.
>> >
>>
>Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
>> >
>> > Then I get that error!!!
>> >
>> > On Sun, Nov 2, 2014 at 1:58 PM, eilaf sorkatti
><eil...@gm...
>> > <mailto:eil...@gm...>> wrote:
>> >
>> >     sorry the urn:jboss:module:1.0
>> >
>> >     On Sun, Nov 2, 2014 at 1:58 PM, eilaf sorkatti
>> >     <eil...@gm... <mailto:eil...@gm...>> wrote:
>> >
>> >         There is no need to edit standalone.xml am i right?, Here
>is my
>> >         details "I was wrong am using JBOSS EAP 6.3":
>> >         I put module.xml on
>> >
>>  /root/pki/jboss-eap-6.3/modules/system/layers/base/org/mariadb/main
>> >         , it contains:
>> >
>> >         <?xml version"1.0" encoding="UTF-8"?>
>> >         <module xmlns="urn:jboss:module:1.9" name="org.mariadb">
>> >            <resources>
>> >              <resource-root path="mariadb-java-client-1.1.5.jar"/>
>> >            </resources>
>> >            <dependencies>
>> >              <module name="javax.api"/>
>> >              <module name="javax.transaction.api"/>
>> >            </dependencies>
>> >         </module>
>> >
>> >         I put the connector on the same directory. I run
>./jboss-cli.sh
>> >         then write the command
>> >           /subsystem=datasources/jdbc-driver=org.mariadb.jdbc.
>> >
>> 
>Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
>> >
>> >         Then I get that error!!!
>> >
>> >
>> >         On Sun, Nov 2, 2014 at 12:38 PM, EJBCA Support
>> >         <ejb...@pr...
><mailto:ejb...@pr...>>
>> >         wrote:
>> >
>> >
>> >             Seems there is something wrong in your file, or you are
>not
>> >             matching the
>> >             driver version in module.xml with the jar file you are
>> >             placing there.
>> >
>> >             You have to give full details of what you do in order
>to
>> >             figure out what
>> >             is wrong.
>> >
>> >             (it works for me ;-))
>> >
>> >             Cheers,
>> >             Tomas
>> >
>> >             On 2014-11-02 06:48, eilaf sorkatti wrote:
>> >              >
>> >              > Hi,
>> >              > Am using JBOSS EAP 6.2.0, I Create the JDBC module
>> >             configuration file
>> >              > module.xml. when I try to register driver for
>mariaDB i
>> get:
>> >              >   /subsystem=datasources/jdbc-
>> >              >
>> >
>> 
>driver=org.mariadb.jdbc.Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
>> >              > {
>> >              >      "outcome" => "failed",
>> >              >      "failure-description" => "JBAS010441: Failed to
>load
>> >             module for
>> >              > driver [org.mariadb]",
>> >              >      "rolled-back" => true
>> >              > }
>> >              >
>> >              > --
>> >              > Eilaf Hamad Elnil Mugbil
>> >              > University Of Khartoum
>> >              > School Of Mathematical science
>> >              >
>> >              >
>> >              >
>> >
>> 
>------------------------------------------------------------------------------
>> >              >
>> >              >
>> >              >
>> >              > _______________________________________________
>> >              > Ejbca-develop mailing list
>> >              > Ejb...@li...
>> >             <mailto:Ejb...@li...>
>> >              >
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>> >              >
>> >
>> >
>> >
>> >
>> 
>------------------------------------------------------------------------------
>> >             _______________________________________________
>> >             Ejbca-develop mailing list
>> >             Ejb...@li...
>> >             <mailto:Ejb...@li...>
>> >            
>https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>> >
>> >
>> >
>> >
>> >         --
>> >         Eilaf Hamad Elnil Mugbil
>> >         University Of Khartoum
>> >         School Of Mathematical science
>> >
>> >
>> >
>> >
>> >     --
>> >     Eilaf Hamad Elnil Mugbil
>> >     University Of Khartoum
>> >     School Of Mathematical science
>> >
>> >
>> >
>> >
>> > --
>> > Eilaf Hamad Elnil Mugbil
>> > University Of Khartoum
>> > School Of Mathematical science
>> >
>> >
>> >
>>
>------------------------------------------------------------------------------
>> >
>> >
>> >
>> > _______________________________________________
>> > Ejbca-develop mailing list
>> > Ejb...@li...
>> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>> >
>>
>>
>>
>------------------------------------------------------------------------------
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>

Re: [Ejbca-develop] Failed Registering mariadb module on Jboss EAP 6.2.0

[eilaf s. <eil...@gm...>]

Hello all,

Thank you Tomas for your reply. This is what appear when enable debugging:

14:09:33,587 DEBUG [org.jboss.as.controller.management-operation]
(management-handler-thread - 4) JBAS014616: Operation ("add") failed -
address: ([
    ("subsystem" => "datasources"),
    ("jdbc-driver" => "org.mariadb.jdbc.Driver")
]) - failure description: "JBAS010441: Failed to load module for driver
[org.mariadb]"
14:09:54,499 DEBUG [org.apache.catalina.session]
(ContainerBackgroundProcessor[StandardEngine[jboss.web]]) Start expire
sessions StandardManager at 1415185794499 sessioncount 0



On Mon, Nov 3, 2014 at 4:41 PM, Tomas Gustavsson <to...@pr...> wrote:

>
> This one seems to works for me with module.xml in:
> jboss-eap-6.2/modules/system/layers/base/org/mariadb/main
>
> <?xml version="1.0" encoding="UTF-8"?>
> <module xmlns="urn:jboss:module:1.0" name="org.mariadb">
>    <resources>
>      <resource-root path="mariadb-java-client-1.1.5.jar"/>
>    </resources>
>    <dependencies>
>      <module name="javax.api"/>
>      <module name="javax.transaction.api"/>
>    </dependencies>
> </module>
>
>
> /subsystem=datasources/jdbc-driver=org.mariadb.jdbc.Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
>
>
> You need to analyze your server.lgo to see why JBoss does not like your
> driver. Perhaps you have written with root privileges?
>
> Cheers,
> Tomas
>
> On 2014-11-03 07:08, eilaf sorkatti wrote:
> > There is no need to edit standalone.xml am i right?, Here is my details
> > "I was wrong am using JBOSS EAP 6.3":
> > I put module.xml on
> > /root/pki/jboss-eap-6.3/modules/system/layers/base/org/mariadb/main , it
> > contains:
> >
> > <?xml version"1.0" encoding="UTF-8"?>
> > <module xmlns="urn:jboss:module:1.0" name="org.mariadb">
> >    <resources>
> >      <resource-root path="mariadb-java-client-1.1.5.jar"/>
> >    </resources>
> >    <dependencies>
> >      <module name="javax.api"/>
> >      <module name="javax.transaction.api"/>
> >    </dependencies>
> > </module>
> >
> > I put the connector on the same directory. I run ./jboss-cli.sh
> > then write the command
> >   /subsystem=datasources/jdbc-
> > driver=org.mariadb.jdbc.
> >
> Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
> >
> > Then I get that error!!!
> >
> > On Sun, Nov 2, 2014 at 1:58 PM, eilaf sorkatti <eil...@gm...
> > <mailto:eil...@gm...>> wrote:
> >
> >     sorry the urn:jboss:module:1.0
> >
> >     On Sun, Nov 2, 2014 at 1:58 PM, eilaf sorkatti
> >     <eil...@gm... <mailto:eil...@gm...>> wrote:
> >
> >         There is no need to edit standalone.xml am i right?, Here is my
> >         details "I was wrong am using JBOSS EAP 6.3":
> >         I put module.xml on
> >
>  /root/pki/jboss-eap-6.3/modules/system/layers/base/org/mariadb/main
> >         , it contains:
> >
> >         <?xml version"1.0" encoding="UTF-8"?>
> >         <module xmlns="urn:jboss:module:1.9" name="org.mariadb">
> >            <resources>
> >              <resource-root path="mariadb-java-client-1.1.5.jar"/>
> >            </resources>
> >            <dependencies>
> >              <module name="javax.api"/>
> >              <module name="javax.transaction.api"/>
> >            </dependencies>
> >         </module>
> >
> >         I put the connector on the same directory. I run ./jboss-cli.sh
> >         then write the command
> >           /subsystem=datasources/jdbc-driver=org.mariadb.jdbc.
> >
>  Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
> >
> >         Then I get that error!!!
> >
> >
> >         On Sun, Nov 2, 2014 at 12:38 PM, EJBCA Support
> >         <ejb...@pr... <mailto:ejb...@pr...>>
> >         wrote:
> >
> >
> >             Seems there is something wrong in your file, or you are not
> >             matching the
> >             driver version in module.xml with the jar file you are
> >             placing there.
> >
> >             You have to give full details of what you do in order to
> >             figure out what
> >             is wrong.
> >
> >             (it works for me ;-))
> >
> >             Cheers,
> >             Tomas
> >
> >             On 2014-11-02 06:48, eilaf sorkatti wrote:
> >              >
> >              > Hi,
> >              > Am using JBOSS EAP 6.2.0, I Create the JDBC module
> >             configuration file
> >              > module.xml. when I try to register driver for mariaDB i
> get:
> >              >   /subsystem=datasources/jdbc-
> >              >
> >
>  driver=org.mariadb.jdbc.Driver:add(driver-name=org.mariadb.jdbc.Driver,driver-module-name=org.mariadb,driver-xa-datasource-class-name=org.mariadb.jdbc.MySQLDataSource)
> >              > {
> >              >      "outcome" => "failed",
> >              >      "failure-description" => "JBAS010441: Failed to load
> >             module for
> >              > driver [org.mariadb]",
> >              >      "rolled-back" => true
> >              > }
> >              >
> >              > --
> >              > Eilaf Hamad Elnil Mugbil
> >              > University Of Khartoum
> >              > School Of Mathematical science
> >              >
> >              >
> >              >
> >
>  ------------------------------------------------------------------------------
> >              >
> >              >
> >              >
> >              > _______________________________________________
> >              > Ejbca-develop mailing list
> >              > Ejb...@li...
> >             <mailto:Ejb...@li...>
> >              >
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> >              >
> >
> >
> >
> >
>  ------------------------------------------------------------------------------
> >             _______________________________________________
> >             Ejbca-develop mailing list
> >             Ejb...@li...
> >             <mailto:Ejb...@li...>
> >             https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> >
> >
> >
> >
> >         --
> >         Eilaf Hamad Elnil Mugbil
> >         University Of Khartoum
> >         School Of Mathematical science
> >
> >
> >
> >
> >     --
> >     Eilaf Hamad Elnil Mugbil
> >     University Of Khartoum
> >     School Of Mathematical science
> >
> >
> >
> >
> > --
> > Eilaf Hamad Elnil Mugbil
> > University Of Khartoum
> > School Of Mathematical science
> >
> >
> >
> ------------------------------------------------------------------------------
> >
> >
> >
> > _______________________________________________
> > Ejbca-develop mailing list
> > Ejb...@li...
> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> >
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>



-- 
Eilaf Hamad Elnil Mugbil
University Of Khartoum
School Of Mathematical science

Re: [Ejbca-develop] Error pages when generating certificates

[Branko M. <br...@ma...>]

On Tue, 4 Nov 2014 08:44:50 +0300
eilaf sorkatti <eil...@gm...> wrote:

> Hi,
> 
> I am asking about the Errors pages appears on EJBCA public web due to some
> mistakes that happens by the one who want to generate certificates. These
> errors are not specify the type of mistake happens.
> I found this product on PrimeKey Jira https://www.cesecore.eu/ , Is this
> product solve this problem?
> 

It's a bit hard to understand your question. Could you try
rephrasing/explaining in more details what you mean?

As for CESeCore, it is a library heavily relied upon by the EJBCA and
SignServer.

Best regards

-- 
Branko Majic
Jabber: br...@ma...
Please use only Free formats when sending attachments to me.

Бранко Мајић
Џабер: br...@ma...
Молим вас да додатке шаљете искључиво у слободним форматима.

Re: [Ejbca-develop] reconnect to PKCS#11 USB token

[Branko M. <br...@ma...>]

On Thu, 30 Oct 2014 19:01:51 +0100
Andreas Kuehne <ku...@tr...> wrote:

> Hi Branko, hi Michael,
> 
> I remember that we once wrote code using a separate thread to look for
> Card-Insertions to reestablish the PKCS#11 connection. Not a big deal,
> just a bit of polling and an indirection to access the (currently
> inserted) card. Our stuff is OS, I can provide a pointer to it ...
> 

Hello Andreas,

That could be an interesting feature, although I'm guessing that in the
case you described you preserve the PIN codes in-memory
(auto-activation)?

This would probably be kind of unusable in case of HSMs, I guess, where
you may wish to have a hard-token based activation of slots.

It would be interesting to see if your code could be intergrated
somehow as an external module for EJBCA, that'd mean people could use
it if they want to irrespective of whether it can be included in EJBCA
core or not.

Was your code a patch for EJBCA or...?

Best regards

-- 
Branko Majic
Jabber: br...@ma...
Please use only Free formats when sending attachments to me.

Бранко Мајић
Џабер: br...@ma...
Молим вас да додатке шаљете искључиво у слободним форматима.

[Ejbca-develop] Error pages when generating certificates

[eilaf s. <eil...@gm...>]

Hi,

I am asking about the Errors pages appears on EJBCA public web due to some
mistakes that happens by the one who want to generate certificates. These
errors are not specify the type of mistake happens.
I found this product on PrimeKey Jira https://www.cesecore.eu/ , Is this
product solve this problem?

-- 
Eilaf Hamad Elnil Mugbil
University Of Khartoum
School Of Mathematical science