From 86515d118a6eb99306dbfe30dc40335c19dbb498 Mon Sep 17 00:00:00 2001 From: Juan Carlos Luciani Date: Wed, 18 Oct 2006 23:26:16 +0000 Subject: [PATCH] Created the ATS daemon and made necessary RPM install changes to allow for its deployment. --- CASA-auth-token/java/configure.in | 6 + .../package/linux/CASA_auth_token_svc.changes | 9 + .../package/linux/CASA_auth_token_svc.spec.in | 169 ++- CASA-auth-token/java/server/Jaas/Makefile.am | 3 +- CASA-auth-token/java/server/Jaas/README | 22 +- .../java/server/Jaas/linux/Makefile.am | 38 + .../Jaas/linux/client_keystore_setup.sh | 51 + .../java/server/Jaas/linux/crypto.properties | 6 + .../java/server/Jaas/make_and_run_test.sh | 17 - CASA-auth-token/java/server/Jaas/make_test.sh | 2 +- CASA-auth-token/java/server/Jaas/run_test.sh | 4 +- CASA-auth-token/java/server/Svc/Makefile.am | 8 +- CASA-auth-token/java/server/Svc/README | 14 +- .../java/server/Svc/crypto.properties | 6 - .../java/server/Svc/linux/CasaAuthtokenSvcD | 174 ++++ .../java/server/Svc/linux/Makefile.am | 40 + .../java/server/Svc/linux/crypto.properties | 6 + CASA-auth-token/java/server/Svc/linux/envvars | 14 + .../server/Svc/linux/server_keystore_setup.sh | 65 ++ .../com/novell/casa/authtoksvc/SvcConfig.java | 28 +- .../novell/casa/authtoksvc/WSSecurity.java | 4 +- CASA-auth-token/java/server/Svc/svc.settings | 2 +- .../java/server/Svc/tomcat5/Makefile.am | 37 + .../Svc/tomcat5/conf/Catalina/Makefile.am | 37 + .../conf/Catalina/localhost/Makefile.am | 39 + .../tomcat5/conf/Catalina/localhost/admin.xml | 30 + .../conf/Catalina/localhost/balancer.xml | 14 + .../conf/Catalina/localhost/manager.xml | 17 + .../java/server/Svc/tomcat5/conf/Makefile.am | 43 + .../server/Svc/tomcat5/conf/catalina.policy | 162 +++ .../Svc/tomcat5/conf/catalina.properties | 57 ++ .../server/Svc/tomcat5/conf/jk2.properties | 26 + .../Svc/tomcat5/conf/server-minimal.xml | 35 + .../java/server/Svc/tomcat5/conf/server.xml | 383 +++++++ .../server/Svc/tomcat5/conf/tomcat-users.xml | 3 + .../java/server/Svc/tomcat5/conf/web.xml | 964 ++++++++++++++++++ 36 files changed, 2446 insertions(+), 89 deletions(-) create mode 100644 CASA-auth-token/java/server/Jaas/linux/Makefile.am create mode 100755 CASA-auth-token/java/server/Jaas/linux/client_keystore_setup.sh create mode 100644 CASA-auth-token/java/server/Jaas/linux/crypto.properties delete mode 100755 CASA-auth-token/java/server/Jaas/make_and_run_test.sh delete mode 100644 CASA-auth-token/java/server/Svc/crypto.properties create mode 100644 CASA-auth-token/java/server/Svc/linux/CasaAuthtokenSvcD create mode 100644 CASA-auth-token/java/server/Svc/linux/Makefile.am create mode 100644 CASA-auth-token/java/server/Svc/linux/crypto.properties create mode 100644 CASA-auth-token/java/server/Svc/linux/envvars create mode 100755 CASA-auth-token/java/server/Svc/linux/server_keystore_setup.sh create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/Makefile.am create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/Makefile.am create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/Makefile.am create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/admin.xml create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/balancer.xml create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/manager.xml create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/conf/Makefile.am create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/conf/catalina.policy create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/conf/catalina.properties create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/conf/jk2.properties create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/conf/server-minimal.xml create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/conf/server.xml create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/conf/tomcat-users.xml create mode 100644 CASA-auth-token/java/server/Svc/tomcat5/conf/web.xml diff --git a/CASA-auth-token/java/configure.in b/CASA-auth-token/java/configure.in index 0974e23a..53a1c85e 100644 --- a/CASA-auth-token/java/configure.in +++ b/CASA-auth-token/java/configure.in @@ -273,6 +273,11 @@ server/Svc/src/com/Makefile server/Svc/src/com/novell/Makefile server/Svc/src/com/novell/casa/Makefile server/Svc/src/com/novell/casa/authtoksvc/Makefile +server/Svc/tomcat5/Makefile +server/Svc/tomcat5/conf/Makefile +server/Svc/tomcat5/conf/Catalina/Makefile +server/Svc/tomcat5/conf/Catalina/localhost/Makefile +server/Svc/linux/Makefile server/Jaas/Makefile server/Jaas/src/Makefile server/Jaas/src/com/Makefile @@ -280,5 +285,6 @@ server/Jaas/src/com/novell/Makefile server/Jaas/src/com/novell/casa/Makefile server/Jaas/src/com/novell/casa/jaas/Makefile server/Jaas/src/com/novell/casa/jaas/sample/Makefile +server/Jaas/linux/Makefile ]) diff --git a/CASA-auth-token/java/package/linux/CASA_auth_token_svc.changes b/CASA-auth-token/java/package/linux/CASA_auth_token_svc.changes index 9814e631..ad9bf548 100644 --- a/CASA-auth-token/java/package/linux/CASA_auth_token_svc.changes +++ b/CASA-auth-token/java/package/linux/CASA_auth_token_svc.changes @@ -1,3 +1,12 @@ +------------------------------------------------------------------- +Wed Oct 18 17:22:01 MDT 2006 - jluciani@novell.com + +- Updated the RPM install of the ATS to install it as a service + and create the necessary signing keys. + +- Made changes to other components to integrate with the new + RPM install changes. + ------------------------------------------------------------------- Tue Oct 10 08:45:22 MDT 2006 - jluciani@novell.com diff --git a/CASA-auth-token/java/package/linux/CASA_auth_token_svc.spec.in b/CASA-auth-token/java/package/linux/CASA_auth_token_svc.spec.in index 7c3d31b3..ab624920 100644 --- a/CASA-auth-token/java/package/linux/CASA_auth_token_svc.spec.in +++ b/CASA-auth-token/java/package/linux/CASA_auth_token_svc.spec.in @@ -17,7 +17,7 @@ Name: @PACKAGE@ URL: http://www.novell.com/products -BuildRequires: libstdc++ gcc-c++ glib2-devel libstdc++-devel pkgconfig java-1_5_0-ibm java-1_5_0-ibm-devel java-1_5_0-ibm-alsa update-alternatives mono-devel servletapi5 identity-abstraction +BuildRequires: libstdc++ gcc-c++ glib2-devel libstdc++-devel pkgconfig java-1_5_0-ibm java-1_5_0-ibm-devel java-1_5_0-ibm-alsa update-alternatives mono-devel servletapi5 identity-abstraction sysvinit insserv %define prefix /usr License: LGPL Group: Applications/System @@ -28,8 +28,10 @@ Release: 0 Summary: Novell Common Authentication Services Adapter Authentication Token Infrastructure "Java" (CASA_auth_token) Source: %{name}-%{version}.tar.bz2 BuildRoot: %{_tmppath}/%{name}-%{version}-build -Requires: java-1_5_0-ibm servletapi5 tomcat5 +Requires: java-1_5_0-ibm servletapi5 tomcat5 sysvinit insserv PreReq: %fillup_prereq %insserv_prereq +PreReq: /usr/bin/awk, /usr/bin/test, /bin/grep, /bin/cat, /usr/bin/install, /bin/pwd +PreReq: /usr/sbin/groupadd, /usr/sbin/useradd, /usr/sbin/userdel, /usr/bin/getent BuildArchitectures: noarch %description @@ -97,24 +99,64 @@ install -d %{buildroot}%{prefix}/share install -d %{buildroot}%{prefix}/share/java install -d %{buildroot}%{prefix}/share/java/CASA install -d %{buildroot}%{prefix}/share/java/CASA/authtoken +install -d %{buildroot}%{prefix}/share/java/CASA/authtoken/bin +install -d %{buildroot}/srv +install -d %{buildroot}/srv/www +install -d %{buildroot}/srv/www/casaats +install -d -m 700 %{buildroot}/srv/www/casaats +install -d -m 700 %{buildroot}/srv/www/casaats/conf +install -d -m 700 %{buildroot}/srv/www/casaats/conf/Catalina +install -d -m 700 %{buildroot}/srv/www/casaats/conf/Catalina/localhost +install -d -m 700 %{buildroot}/srv/www/casaats/shared +install -d -m 700 %{buildroot}/srv/www/casaats/shared/classes +install -d -m 700 %{buildroot}/srv/www/casaats/shared/libs +install -d -m 700 %{buildroot}/srv/www/casaats/webapps +install -d -m 700 %{buildroot}/srv/www/casaats/logs +install -d -m 700 %{buildroot}/srv/www/casaats/work +install -d -m 700 %{buildroot}/srv/www/casaats/temp install -d %{buildroot}%{prefix}/share/java/CASA/authtoken/external install -d %{buildroot}/etc +install -d %{buildroot}/etc/init.d install -d -m 755 %{buildroot}/var/lib/CASA install -d -m 755 %{buildroot}/var/lib/CASA/authtoken -install -d -m 755 %{buildroot}/var/lib/CASA/authtoken/svc +install -d -m 700 %{buildroot}/var/lib/CASA/authtoken/svc install -d -m 755 %{buildroot}/etc/CASA -install -d -m 755 %{buildroot}/etc/CASA/authtoken.d -install -d -m 755 %{buildroot}/etc/CASA/authtoken.d -install -d -m 755 %{buildroot}/etc/CASA/authtoken.d/svc.d -install -d -m 755 %{buildroot}/etc/CASA/authtoken.d/java-keys +install -d -m 755 %{buildroot}/etc/CASA/authtoken +install -d -m 755 %{buildroot}/etc/CASA/authtoken +install -d -m 700 %{buildroot}/etc/CASA/authtoken/svc +install -d -m 700 %{buildroot}/etc/CASA/authtoken/svc/auth_mechanisms +install -d -m 700 %{buildroot}/etc/CASA/authtoken/svc/auth_mechanisms/Krb5Authenticate +install -d -m 700 %{buildroot}/etc/CASA/authtoken/svc/auth_mechanisms/PwdAuthenticate +install -d -m 700 %{buildroot}/etc/CASA/authtoken/svc/enabled_services +install -d -m 700 %{buildroot}/etc/CASA/authtoken/svc/enabled_services/localhost +install -d -m 755 %{buildroot}/etc/CASA/authtoken/keys +install -d -m 700 %{buildroot}/etc/CASA/authtoken/keys/server +install -d -m 755 %{buildroot}/etc/CASA/authtoken/keys/client ## CASA_auth_token_svc ## # Libs install -m 755 %{_lib}/java/CasaAuthTokenSvc.war %{buildroot}%{prefix}/share/java/CASA/authtoken/CasaAuthTokenSvc-%{bldno}.war +install -m 700 %{_lib}/java/CasaAuthTokenSvc.war %{buildroot}/srv/www/casaats/webapps/CasaAuthTokenSvc.war -# Lib Symbolic Links -ln -sf CasaAuthTokenSvc-%{bldno}.war %{buildroot}%{prefix}/share/java/CASA/authtoken/CasaAuthTokenSvc.war -ln -sf CasaAuthTokenSvc-%{bldno}.war %{buildroot}%{prefix}/share/java/CASA/authtoken/CasaAuthTokenSvc.war.1 +# Settings and configuration files +install -m 600 server/Svc/svc.settings %{buildroot}/etc/CASA/authtoken/svc/svc.settings +install -m 600 server/Svc/authtoken.settings %{buildroot}/etc/CASA/authtoken/svc/authtoken.settings +install -m 600 server/Svc/identoken.settings %{buildroot}/etc/CASA/authtoken/svc/identoken.settings +install -m 600 server/Svc/src/com/novell/casa/authtoksvc/Krb5_mechanism.settings %{buildroot}/etc/CASA/authtoken/svc/auth_mechanisms/Krb5Authenticate/mechanism.settings +install -m 600 server/Svc/src/com/novell/casa/authtoksvc/Pwd_mechanism.settings %{buildroot}/etc/CASA/authtoken/svc/auth_mechanisms/PwdAuthenticate/mechanism.settings + +# Others +install -m 700 server/Svc/linux/server_keystore_setup.sh %{buildroot}%{prefix}/share/java/CASA/authtoken/bin/server_keystore_setup.sh +install -m 755 server/Svc/linux/CasaAuthtokenSvcD %{buildroot}/etc/init.d/casa_atsd +install -m 700 server/Svc/linux/envvars %{buildroot}/etc/CASA/authtoken/svc/envvars + +# Tomcat Base files +install -m 600 server/Svc/tomcat5/conf/catalina.policy %{buildroot}/srv/www/casaats/conf/catalina.policy +install -m 600 server/Svc/tomcat5/conf/catalina.properties %{buildroot}/srv/www/casaats/conf/catalina.properties +install -m 600 server/Svc/tomcat5/conf/jk2.properties %{buildroot}/srv/www/casaats/conf/jk2.properties +install -m 600 server/Svc/tomcat5/conf/server.xml %{buildroot}/srv/www/casaats/conf/server.xml +install -m 600 server/Svc/tomcat5/conf/tomcat-users.xml %{buildroot}/srv/www/casaats/conf/tomcat-users.xml +install -m 600 server/Svc/tomcat5/conf/web.xml %{buildroot}/srv/www/casaats/conf/web.xml ## CASA_auth_token_jaas_support ## # Libs @@ -135,14 +177,11 @@ install -m 755 server/Svc/external/xalan.jar %{buildroot}%{prefix}/share/java/CA install -m 755 server/Svc/external/xercesImpl.jar %{buildroot}%{prefix}/share/java/CASA/authtoken/external/xercesImpl.jar install -m 755 server/Svc/external/xml-apis.jar %{buildroot}%{prefix}/share/java/CASA/authtoken/external/xml-apis.jar install -m 755 server/Svc/external/xmlsec-1.2.1.jar %{buildroot}%{prefix}/share/java/CASA/authtoken/external/xmlsec-1.2.1.jar -install -m 644 server/Svc/crypto.properties %{buildroot}/etc/CASA/authtoken.d/crypto.properties -install -m 644 server/Svc/jaas.conf %{buildroot}/etc/CASA/authtoken.d/svc.d/jaas.conf +install -m 644 server/Jaas/linux/crypto.properties %{buildroot}/etc/CASA/authtoken/keys/client/crypto.properties + +# Others +install -m 700 server/Jaas/linux/client_keystore_setup.sh %{buildroot}%{prefix}/share/java/CASA/authtoken/bin/client_keystore_setup.sh -# Lib Symbolic Links -ln -sf CasaJaasSupport-%{bldno}.jar %{buildroot}%{prefix}/share/java/CASA/authtoken/CasaJaasSupport.jar -ln -sf CasaJaasSupport-%{bldno}.jar %{buildroot}%{prefix}/share/java/CASA/authtoken/CasaJaasSupport.jar.1 -ln -sf CasaAuthToken-%{bldno}.jar %{buildroot}%{prefix}/share/java/CASA/authtoken/CasaAuthToken.jar -ln -sf CasaAuthToken-%{bldno}.jar %{buildroot}%{prefix}/share/java/CASA/authtoken/CasaAuthToken.jar.1 %clean rm -rf $RPM_BUILD_ROOT @@ -150,31 +189,90 @@ rm -rf $RPM_BUILD_ROOT ## CASA_auth_token_svc ## %pre -# Nothing to do in this pre script + +# Do necessary user and group administration +group_present=`getent group | grep ^casaauth` +if [ -z "$group_present" ] ; then + /usr/sbin/groupadd -r casaauth +fi + +user_present=`getent passwd | grep ^casaatsd` +if [ -z "$user_present" ] ; then + /usr/sbin/useradd -c "casaatsd System User" -s /bin/false -r -d /var/lib/CASA/authtoken/validate -g casaauth casaatsd 2> /dev/null || : +fi + %post -/sbin/ldconfig +# Install casa_atsd init script, set it to start by default. +%{fillup_and_insserv casa_atsd} + +# Setup the keystore for the service +%{prefix}/share/java/CASA/authtoken/bin/server_keystore_setup.sh %preun -# Nothing to do in this preun script +%stop_on_removal casa_atsd %postun -# Nothing to do in this postun script +#Undeploy our webapp +rm -drf %{prefix}/share/java/CASA/authtoken/svc/webapps/CasaAuthTokenSvc + +%restart_on_update casa_atsd +%insserv_cleanup +# Do not do anything else if this is an upgrade +if test "$1" == 1; then + exit 0 +fi + +# Delete the casaatsd user +userdel casaatsd + %files %defattr(-,root,root) %dir %{prefix}/share/java/CASA %dir %{prefix}/share/java/CASA/authtoken +%dir %{prefix}/share/java/CASA/authtoken/bin %dir /var/lib/CASA %dir /var/lib/CASA/authtoken %dir /var/lib/CASA/authtoken/svc %dir /etc/CASA -%dir /etc/CASA/authtoken.d -%dir /etc/CASA/authtoken.d/svc.d -%dir /etc/CASA/authtoken.d/java-keys +%dir /etc/CASA/authtoken +%dir /etc/CASA/authtoken/keys %{prefix}/share/java/CASA/authtoken/CasaAuthTokenSvc-%{bldno}.war -%{prefix}/share/java/CASA/authtoken/CasaAuthTokenSvc.war -%{prefix}/share/java/CASA/authtoken/CasaAuthTokenSvc.war.1 +%{prefix}/share/java/CASA/authtoken/bin/server_keystore_setup.sh +/etc/init.d/casa_atsd +%defattr(-,casaatsd,casaauth) +%dir /srv/www/casaats +%dir /srv/www/casaats/conf +%dir /srv/www/casaats/conf/Catalina +%dir /srv/www/casaats/conf/Catalina/localhost +%dir /srv/www/casaats/shared +%dir /srv/www/casaats/shared/classes +%dir /srv/www/casaats/shared/libs +%dir /srv/www/casaats/webapps +%dir /srv/www/casaats/logs +%dir /srv/www/casaats/work +%dir /srv/www/casaats/temp +%dir /etc/CASA/authtoken/svc +%dir /etc/CASA/authtoken/svc/auth_mechanisms +%dir /etc/CASA/authtoken/svc/auth_mechanisms/Krb5Authenticate +%dir /etc/CASA/authtoken/svc/auth_mechanisms/PwdAuthenticate +%dir /etc/CASA/authtoken/svc/enabled_services +%dir /etc/CASA/authtoken/svc/enabled_services/localhost +%dir /etc/CASA/authtoken/keys/server +/srv/www/casaats/webapps/CasaAuthTokenSvc.war +%config /srv/www/casaats/conf/catalina.policy +%config /srv/www/casaats/conf/catalina.properties +%config /srv/www/casaats/conf/jk2.properties +%config /srv/www/casaats/conf/server.xml +%config /srv/www/casaats/conf/tomcat-users.xml +%config /srv/www/casaats/conf/web.xml +%config /etc/CASA/authtoken/svc/envvars +%config /etc/CASA/authtoken/svc/svc.settings +%config /etc/CASA/authtoken/svc/authtoken.settings +%config /etc/CASA/authtoken/svc/identoken.settings +%config /etc/CASA/authtoken/svc/auth_mechanisms/Krb5Authenticate/mechanism.settings +%config /etc/CASA/authtoken/svc/auth_mechanisms/PwdAuthenticate/mechanism.settings ## CASA_auth_token_jaas_support ## @@ -184,26 +282,28 @@ rm -rf $RPM_BUILD_ROOT %post -n CASA_auth_token_jaas_support /sbin/ldconfig +# Setup the keystore for the clients +%{prefix}/share/java/CASA/authtoken/bin/client_keystore_setup.sh + %preun -n CASA_auth_token_jaas_support # Nothing to do in this preun script %postun -n CASA_auth_token_jaas_support -# Nothing to do in this postun script +# Nothing to do in this preun script %files -n CASA_auth_token_jaas_support %defattr(-,root,root) %dir %{prefix}/share/java/CASA %dir %{prefix}/share/java/CASA/authtoken +%dir %{prefix}/share/java/CASA/authtoken/bin %dir %{prefix}/share/java/CASA/authtoken/external %dir /etc/CASA -%dir /etc/CASA/authtoken.d -%dir /etc/CASA/authtoken.d/java-keys +%dir /etc/CASA/authtoken +%dir /etc/CASA/authtoken/keys +%dir /etc/CASA/authtoken/keys/client %{prefix}/share/java/CASA/authtoken/CasaJaasSupport-%{bldno}.jar -%{prefix}/share/java/CASA/authtoken/CasaJaasSupport.jar -%{prefix}/share/java/CASA/authtoken/CasaJaasSupport.jar.1 %{prefix}/share/java/CASA/authtoken/CasaAuthToken-%{bldno}.jar -%{prefix}/share/java/CASA/authtoken/CasaAuthToken.jar -%{prefix}/share/java/CASA/authtoken/CasaAuthToken.jar.1 +%{prefix}/share/java/CASA/authtoken/bin/client_keystore_setup.sh %{prefix}/share/java/CASA/authtoken/external/axis.jar %{prefix}/share/java/CASA/authtoken/external/axis-ant.jar %{prefix}/share/java/CASA/authtoken/external/commons-discovery-0.2.jar @@ -219,8 +319,7 @@ rm -rf $RPM_BUILD_ROOT %{prefix}/share/java/CASA/authtoken/external/xercesImpl.jar %{prefix}/share/java/CASA/authtoken/external/xml-apis.jar %{prefix}/share/java/CASA/authtoken/external/xmlsec-1.2.1.jar -/etc/CASA/authtoken.d/crypto.properties -/etc/CASA/authtoken.d/svc.d/jaas.conf +%config /etc/CASA/authtoken/keys/client/crypto.properties %changelog -n CASA_auth_token_svc diff --git a/CASA-auth-token/java/server/Jaas/Makefile.am b/CASA-auth-token/java/server/Jaas/Makefile.am index 30e595b6..aa8f58d0 100644 --- a/CASA-auth-token/java/server/Jaas/Makefile.am +++ b/CASA-auth-token/java/server/Jaas/Makefile.am @@ -20,10 +20,9 @@ ####################################################################### SUBDIRS = src -DIST_SUBDIRS = src +DIST_SUBDIRS = src linux EXTRA_DIST = $(JAVAFILES) \ - make_and_run_test.sh \ make_test.sh \ run_test.sh diff --git a/CASA-auth-token/java/server/Jaas/README b/CASA-auth-token/java/server/Jaas/README index a35e9033..78127335 100644 --- a/CASA-auth-token/java/server/Jaas/README +++ b/CASA-auth-token/java/server/Jaas/README @@ -34,10 +34,21 @@ to validate credentials consisting of CASA Authentication Tokens. CONFIGURATION -To use CasaLoginModule for your service, set the java.security.auth.login.config -property to point to the JAAS configuration file for your application. You must -also set the org.xml.sax.driver property to point to an appropriate SAX Parser. -The Xerces SAX Parser is a good option (org.apache.xerces.parsers.SAXParser). +To configure the CasaLoginModule for your service follow the following +steps: + + - Set the java.security.auth.login.config property to point to the JAAS + configuration file for your application. + - Set the org.xml.sax.driver property to point to an appropriate SAX Parser. + The Xerces SAX Parser is a good option (org.apache.xerces.parsers.SAXParser). + - Include the "/etc/CASA/authtoken/keys/client" path in the applications + CLASSPATH. This is the location of the crypto.properties file used by the + module to access the keystore with the ATS's signing certificate. + - Add the "/usr/share/java/CASA/authtoken/CasaJaasSupport.jar" and the + "/usr/share/java/CASA/authtoken/CasaAuthToken.jar" paths to the applications + CLASSPATH. + - Add the jar files in the /usr/share/java/CASA/authtoken/external folder + to the applications CLASSPATH. The JAAS configuration file should include the following line: @@ -84,9 +95,6 @@ SampleApp { com.novell.casa.jaas.CasaLoginModule Required debug=true; }; -You must also include the CasaJaasSupport.jar and CasaAuthToken.jar files in the -CLASSPATH of the application. - SECURITY CONSIDERATIONS CASA Authenticatication Tokens when compromised can be used to either impersonate diff --git a/CASA-auth-token/java/server/Jaas/linux/Makefile.am b/CASA-auth-token/java/server/Jaas/linux/Makefile.am new file mode 100644 index 00000000..aa089734 --- /dev/null +++ b/CASA-auth-token/java/server/Jaas/linux/Makefile.am @@ -0,0 +1,38 @@ +####################################################################### +# +# Copyright (C) 2006 Novell, Inc. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public +# License as published by the Free Software Foundation; either +# version 2 of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +# +# Author: Juan Carlos Luciani +# +####################################################################### + +SUBDIRS = + +DIST_SUBDIRS = + +CFILES = + +EXTRA_DIST = client_keystore_setup.sh \ + crypto.properties + +.PHONY: package package-clean package-install package-uninstall +package package-clean package-install package-uninstall: + $(MAKE) -C $(TARGET_OS) $@ + +maintainer-clean-local: + rm -f Makefile.in + diff --git a/CASA-auth-token/java/server/Jaas/linux/client_keystore_setup.sh b/CASA-auth-token/java/server/Jaas/linux/client_keystore_setup.sh new file mode 100755 index 00000000..a509d605 --- /dev/null +++ b/CASA-auth-token/java/server/Jaas/linux/client_keystore_setup.sh @@ -0,0 +1,51 @@ +#!/bin/sh +######################################################################## +# +# Copyright (C) 2006 Novell, Inc. All Rights Reserved. +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; version 2.1 +# of the License. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Library Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, Novell, Inc. +# +# To contact Novell about this file by physical or electronic mail, +# you may find current contact information at www.novell.com. +# +# Author: Juan Carlos Luciani +# +######################################################################## + +############################################################# +# # +# CASA Authentication Token Keystore Setup Script for # +# auththentication token validating clients. # +# # +# This script sets up the certificate associated with the # +# keys used by the ATS to sign authentication tokens in the # +# keystore utilized by token validating clients. # +# # +############################################################# + +# Do not do anything if the client keystore has already been created +if [ -f /etc/CASA/authtoken/keys/client/jks-store ]; then + echo "The client keystore is already setup" +else + if [ -f /etc/CASA/authtoken/keys/casaatsdSigningCert ]; then + echo "Setting up the clients's keystore" + # Import the certificate to the client's keystore + /usr/lib/jvm/java-1.5.0-ibm/bin/keytool -import -noprompt -keystore /etc/CASA/authtoken/keys/client/jks-store -alias signingCert -storepass secret -keypass secret -file /etc/CASA/authtoken/keys/casaatsdSigningCert + + # List the content's of the client's keystore + #/usr/lib/jvm/java-1.5.0-ibm/bin/keytool -list -rfc -keystore client/jks-store -alias signingCert -storepass secret + else + echo "File /etc/CASA/authtoken/keys/casaatsdSigningCert not found" + fi +fi diff --git a/CASA-auth-token/java/server/Jaas/linux/crypto.properties b/CASA-auth-token/java/server/Jaas/linux/crypto.properties new file mode 100644 index 00000000..a491feb3 --- /dev/null +++ b/CASA-auth-token/java/server/Jaas/linux/crypto.properties @@ -0,0 +1,6 @@ +org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin +org.apache.ws.security.crypto.merlin.keystore.type=jks +org.apache.ws.security.crypto.merlin.keystore.password=secret +org.apache.ws.security.crypto.merlin.keystore.alias=signingCert +org.apache.ws.security.crypto.merlin.alias.password=secret +org.apache.ws.security.crypto.merlin.file=/etc/CASA/authtoken/keys/client/jks-store diff --git a/CASA-auth-token/java/server/Jaas/make_and_run_test.sh b/CASA-auth-token/java/server/Jaas/make_and_run_test.sh deleted file mode 100755 index 67a740d5..00000000 --- a/CASA-auth-token/java/server/Jaas/make_and_run_test.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/bin/bash -if [ ! -d build-test ]; then - mkdir build-test - mkdir build-test/classes -else - if [ ! -d build-test/classes ]; then - mkdir build-test/classes - fi -fi -echo "*** Compiling the test application ***" -javac -g -sourcepath src -classpath ../../lib/java/CasaJaasSupport.jar:../../lib/java/CasaAuthToken.jar -d build-test/classes src/com/novell/casa/jaas/sample/SampleApp.java src/com/novell/casa/jaas/sample/SampleAppCallbackHandler.java -echo "*** Done compiling ***" -echo "" -echo "*** Starting the test application ***" -java -classpath build-test/classes:../../lib/java/CasaJaasSupport.jar:../../lib/java/CasaAuthToken.jar:/usr/share/java/xerces-j2.jar -Dorg.xml.sax.driver=org.apache.xerces.parsers.SAXParser -Djava.security.auth.login.config=src/com/novell/casa/jaas/sample/SampleApp.conf com.novell.casa.jaas.sample.SampleApp -#jdb -sourcepath src:../AuthTokenSvc/src -classpath build-test/classes:../../lib/java/CasaJaasSupport.jar:../../lib/java/CasaAuthToken.jar:/usr/share/java/xerces-j2.jar -Dorg.xml.sax.driver=org.apache.xerces.parsers.SAXParser -Djava.security.auth.login.config=src/com/novell/casa/jaas/sample/SampleApp.conf com.novell.casa.jaas.sample.SampleApp - diff --git a/CASA-auth-token/java/server/Jaas/make_test.sh b/CASA-auth-token/java/server/Jaas/make_test.sh index c46b15b1..f301a5b6 100755 --- a/CASA-auth-token/java/server/Jaas/make_test.sh +++ b/CASA-auth-token/java/server/Jaas/make_test.sh @@ -8,6 +8,6 @@ else fi fi echo "*** Compiling the test application ***" -javac -g -sourcepath src -classpath ../../lib/java/CasaJaasSupport.jar:../../lib/java/CasaAuthToken.jar -d build-test/classes src/com/novell/casa/jaas/sample/SampleApp.java src/com/novell/casa/jaas/sample/SampleAppCallbackHandler.java +/usr/lib/jvm/java-1.5.0-ibm/bin/javac -g -sourcepath src -classpath /usr/share/java/CASA/authtoken/CasaJaasSupport.jar:/usr/share/java/CASA/authtoken/CasaAuthToken.jar -d build-test/classes src/com/novell/casa/jaas/sample/SampleApp.java src/com/novell/casa/jaas/sample/SampleAppCallbackHandler.java echo "*** Done compiling ***" diff --git a/CASA-auth-token/java/server/Jaas/run_test.sh b/CASA-auth-token/java/server/Jaas/run_test.sh index ab55dea7..48ae2d14 100755 --- a/CASA-auth-token/java/server/Jaas/run_test.sh +++ b/CASA-auth-token/java/server/Jaas/run_test.sh @@ -1,4 +1,4 @@ echo "*** Starting the test application ***" -java -classpath build-test/classes:../../lib/java/CasaJaasSupport.jar:../../lib/java/CasaAuthToken.jar:/usr/share/java/xerces-j2.jar -Dorg.xml.sax.driver=org.apache.xerces.parsers.SAXParser -Djava.security.auth.login.config=src/com/novell/casa/jaas/sample/SampleApp.conf -Xrunjdwp:transport=dt_socket,address=5005,server=y,suspend=n com.novell.casa.jaas.sample.SampleApp -#jdb -sourcepath src:../AuthTokenSvc/src -classpath build-test/classes:../../lib/java/CasaJaasSupport.jar:../../lib/java/CasaAuthToken.jar:/usr/share/java/xerces-j2.jar -Dorg.xml.sax.driver=org.apache.xerces.parsers.SAXParser -Djava.security.auth.login.config=src/com/novell/casa/jaas/sample/SampleApp.conf com.novell.casa.jaas.sample.SampleApp +export JAVA_HOME=/usr/lib/jvm/java-1.5.0-ibm +/usr/lib/jvm/java-1.5.0-ibm/bin/java -classpath build-test/classes:/usr/share/java/CASA/authtoken/CasaJaasSupport.jar:/usr/share/java/CASA/authtoken/CasaAuthToken.jar:/usr/share/java/CASA/authtoken/external/axis-ant.jar:/usr/share/java/CASA/authtoken/external/axis.jar:/usr/share/java/CASA/authtoken/external/commons-discovery-0.2.jar:/usr/share/java/CASA/authtoken/external/commons-logging-1.0.4.jar:/usr/share/java/CASA/authtoken/external/commons-logging-api.jar:/usr/share/java/CASA/authtoken/external/jaxrpc.jar:/usr/share/java/CASA/authtoken/external/log4j-1.2.8.jar:/usr/share/java/CASA/authtoken/external/saaj.jar:/usr/share/java/CASA/authtoken/external/wsdl4j-1.5.1.jar:/usr/share/java/CASA/authtoken/external/wss4j-1.5.0.jar:/usr/share/java/CASA/authtoken/external/xalan.jar:/usr/share/java/CASA/authtoken/external/xercesImpl.jar:/usr/share/java/CASA/authtoken/external/xml-apis.jar:/usr/share/java/CASA/authtoken/external/xmlsec-1.2.1.jar:/usr/share/java/xerces-j2.jar:/etc/CASA/authtoken/keys/client -Dorg.xml.sax.driver=org.apache.xerces.parsers.SAXParser -Djava.security.auth.login.config=src/com/novell/casa/jaas/sample/SampleApp.conf -Xrunjdwp:transport=dt_socket,address=5005,server=y,suspend=n com.novell.casa.jaas.sample.SampleApp diff --git a/CASA-auth-token/java/server/Svc/Makefile.am b/CASA-auth-token/java/server/Svc/Makefile.am index 86d6161b..a2a110b4 100644 --- a/CASA-auth-token/java/server/Svc/Makefile.am +++ b/CASA-auth-token/java/server/Svc/Makefile.am @@ -20,16 +20,14 @@ ####################################################################### SUBDIRS = src -DIST_SUBDIRS = src external +DIST_SUBDIRS = src external tomcat5 linux EXTRA_DIST = authtoken.settings \ identoken.settings \ README \ svc.settings \ TODO \ - web.xml \ - crypto.properties \ - jaas.conf + web.xml ROOT = ../.. @@ -102,7 +100,7 @@ $(BUILDDIR)/$(WEBAPP): $(BUILDDIR) $(CLASSES) cp svc.settings $(BUILDDIR)/webapp/WEB-INF/conf/svc.settings cp authtoken.settings $(BUILDDIR)/webapp/WEB-INF/conf/authtoken.settings cp identoken.settings $(BUILDDIR)/webapp/WEB-INF/conf/identoken.settings - cp crypto.properties $(BUILDDIR)/webapp/WEB-INF/classes/crypto.properties + cp linux/crypto.properties $(BUILDDIR)/webapp/WEB-INF/classes/crypto.properties cp src/com/novell/casa/authtoksvc/Krb5_mechanism.settings $(BUILDDIR)/webapp/WEB-INF/conf/installed_auth_mechanisms/Krb5Authenticate/mechanism.settings cp src/com/novell/casa/authtoksvc/Pwd_mechanism.settings $(BUILDDIR)/webapp/WEB-INF/conf/installed_auth_mechanisms/PwdAuthenticate/mechanism.settings cp $(IDENT_ABSTRACTION_DIR)/*.jar $(BUILDDIR)/webapp/WEB-INF/lib/ diff --git a/CASA-auth-token/java/server/Svc/README b/CASA-auth-token/java/server/Svc/README index 262b8a80..80edf14e 100644 --- a/CASA-auth-token/java/server/Svc/README +++ b/CASA-auth-token/java/server/Svc/README @@ -99,7 +99,7 @@ The following is an example svc.settings file: /home/jluciani/jakarta-tomcat-5.0.28/webapps/CasaAuthTokenSvc/WEB-INF/conf/iaRealms.xml 60 o=novell - privKey + signingKey foobar @@ -135,18 +135,20 @@ Note the following about the sample svc.settings file: to the identity abstraction configuration file where it belongs. Once this is done, the setting will no longer be recognized within the svc.settings file. -- The KeyStoreUses setting specifies the user's alias name in the keystore that identifies - the private key that is to be used to sign tokens. +- The SigningKeyAliasName setting specifies the alias name of the entry in the keystore + with the private key utilized to sign tokens. The value of this setting defaults to + "signingKey". -- The KeyStorePwd setting specifies the password of the user specified by KeyStoreUser to get - the private signing key from the keystore. +- The SigningKeyPassword setting specifies the password utilized to protect the private key + used for signing tokens that is stored in the keystore. The value of this setting defaults to + "secret". ATSs digitally sign tokens, for this purpose it is necessary that keys be generated and installed in a keystore whose location and properties are configured in the crypto.properties file present in the "classes" folder under the WEB-INF folder of the AuthTokenSvc application ($CATALINA_HOME/webapps/CasaAuthTokenSvc/WEB-INF/classes). Please note that you must edit the crypto.properties file with the appropriate information once the AuthTokenSvc is deployed to -a Tomcat server. +a Tomcat server to deal with your configuration requirements. CONFIGURING SERVICES TO CONSUME CASA AUTHENTICATION TOKENS diff --git a/CASA-auth-token/java/server/Svc/crypto.properties b/CASA-auth-token/java/server/Svc/crypto.properties deleted file mode 100644 index a927242a..00000000 --- a/CASA-auth-token/java/server/Svc/crypto.properties +++ /dev/null @@ -1,6 +0,0 @@ -org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin -org.apache.ws.security.crypto.merlin.keystore.type=jks -org.apache.ws.security.crypto.merlin.keystore.password=foobar -org.apache.ws.security.crypto.merlin.keystore.alias=privkey -org.apache.ws.security.crypto.merlin.alias.password=foobar -org.apache.ws.security.crypto.merlin.file=/etc/CASA/authtoken.d/java-keys/privkeystore diff --git a/CASA-auth-token/java/server/Svc/linux/CasaAuthtokenSvcD b/CASA-auth-token/java/server/Svc/linux/CasaAuthtokenSvcD new file mode 100644 index 00000000..de4e539c --- /dev/null +++ b/CASA-auth-token/java/server/Svc/linux/CasaAuthtokenSvcD @@ -0,0 +1,174 @@ +#!/bin/sh +# +# Startup script for the Casa Authtoken Service Daemon (casa_atsd) +# +# /etc/init.d/casa_atsd +# +# description: casa_atsd is the CASA Authentication Token Service +# (ATS). CASA Client utilize this service to obtain CASA authentication +# tokens to authenticate to other services. The ATS executes as a +# tomcat webapp. casa_atsd is the tomcat process which contains +# the ATS. +# +# Note that some of the content from this file was copied from +# /etc/init.d/tomcat5 whose author was Petr Mladek. +# /etc/init.d/tomcat5 has the following copyrights: +# +# Copyright (c) 1995-2001 SuSE GmbH Nuernberg, Germany. +# Copyright (c) 2002 SuSE Linux AG Nuernberg, Germany. +# +# processname: casa_atsd +# pidfile: None +# config utility: None + + +### BEGIN INIT INFO +# Provides: casa_atsd +# Required-Start: $local_fs $remote_fs +# X-UnitedLinux-Should-Start: $named $syslog $time +# Required-Stop: $local_fs $remote_fs $network +# X-UnitedLinux-Should-Stop: $named $syslog $time +# Default-Start: 1 2 3 5 +# Default-Stop: +# Short-Description: Casa Authtoken Service Daemon +# Description: Start Casa Authtoken Service Daemon +### END INIT INFO + +. /etc/rc.status + +# Shell functions sourced from /etc/rc.status: +# rc_check check and set local and overall rc status +# rc_status check and set local and overall rc status +# rc_status -v ditto but be verbose in local rc status +# rc_status -v -r ditto and clear the local rc status +# rc_failed set local and overall rc status to failed +# rc_reset clear local rc status (overall remains) +# rc_exit exit appropriate to overall rc status + +# First reset status of this service +rc_reset + +DAEMON_USER=casaatsd +DAEMON_GROUP=casaauth + +atsIsRunning() +{ + ats_ps_log=`mktemp /var/tmp/ats-ps.log.XXXXXX` + ps aux --cols 1024 >"$ats_ps_log" + ats_is_running="false" + if grep " -Dcatalina.base=$CATALINA_BASE.*-Dcatalina.home=$CATALINA_HOME.*org.apache.catalina.startup.Bootstrap" "$ats_ps_log" >/dev/null 2>/dev/null ; then + ats_is_running="true" + fi + rm -f "$ats_ps_log" + test "$ats_is_running" = "true" +} + +StartDAEMON() +{ + # Start the daemon + echo -n "Starting casa_atsd" + ## Start daemon with startproc(8). If this fails + ## the echo return value is set appropriate. + + # NOTE: startproc return 0, even if service is + # already running to match LSB spec. + if atsIsRunning ; then + rc_failed 0 + else + # try to fix permissions + chown --dereference $DAEMON_USER:$DAEMON_GROUP "$CATALINA_BASE" + for dir in "$CATALINA_BASE/conf" \ + "$CATALINA_BASE/logs" \ + "$CATALINA_BASE/temp" \ + "$CATALINA_BASE/webapps" \ + "$CATALINA_BASE/work" ; do + # the command true is used because of for example conf directory may be mounted read-only + test -d "$dir" && chown -R --dereference $DAEMON_USER:$DAEMON_GROUP "$dir" 2>/dev/null || true + done + su $DAEMON_USER -s /bin/bash -c "$CATALINA_HOME/bin/startup.sh" >"$CATALINA_BASE/logs//start.log" 2>&1 + sleep 1 + if atsIsRunning ; then + rc_failed 0 + else + rc_failed 7 + fi + fi + rc_status -v +} + + +StopDAEMON() +{ + # Stop the daemon + echo -n "Shutting casa_atsd" + ## Stop daemon with killproc(8) and if this fails + ## set echo the echo return value. + if atsIsRunning ; then + su $DAEMON_USER -s /bin/bash -c "$CATALINA_HOME/bin/shutdown.sh" >"$CATALINA_BASE/logs/stop.log" 2>&1 + # wait 60 sec for stop at maximum + wait_sec=60 + while [ "$wait_sec" != "0" ] ; do + sleep 1 + if ! atsIsRunning ; then + # the server is stoped, end the loop + wait_sec=0 + break + fi + wait_sec=$((wait_sec -1)) + done + # check the final status + if atsIsRunning ; then + rc_failed 1 + else + rc_failed 0 + fi + else + rc_failed 0 + fi + # Remember status and be verbose + rc_status -v +} + + +# Source the environments file for our daemon +. /etc/CASA/authtoken/svc/envvars + + +case "$1" in +start) + StartDAEMON + ;; +stop) + StopDAEMON + ;; +restart|reload|force-reload) + StopDAEMON + sleep 1 + StartDAEMON + ;; +status) + echo -n "Checking for casa_atsd" + ## Check status with checkproc(8), if process is running + ## checkproc will return with exit status 0. + + # Status has a slightly different for the status command: + # 0 - service running + # 1 - service dead, but /var/run/ pid file exists + # 2 - service dead, but /var/lock/ lock file exists + # 3 - service not running + + # NOTE: checkproc returns LSB compliant status values. + if atsIsRunning ; then + rc_failed 0 + else + rc_failed 3 + fi + rc_status -v + ;; +*) + echo -n "Usage: $0 {start|stop|restart|reload|force-reload}" + exit 1 + ;; +esac +rc_exit + diff --git a/CASA-auth-token/java/server/Svc/linux/Makefile.am b/CASA-auth-token/java/server/Svc/linux/Makefile.am new file mode 100644 index 00000000..a34e9461 --- /dev/null +++ b/CASA-auth-token/java/server/Svc/linux/Makefile.am @@ -0,0 +1,40 @@ +####################################################################### +# +# Copyright (C) 2006 Novell, Inc. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public +# License as published by the Free Software Foundation; either +# version 2 of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +# +# Author: Juan Carlos Luciani +# +####################################################################### + +SUBDIRS = + +DIST_SUBDIRS = + +CFILES = + +EXTRA_DIST = CasaAuthtokenSvcD \ + envvars \ + server_keystore_setup.sh \ + crypto.properties + +.PHONY: package package-clean package-install package-uninstall +package package-clean package-install package-uninstall: + $(MAKE) -C $(TARGET_OS) $@ + +maintainer-clean-local: + rm -f Makefile.in + diff --git a/CASA-auth-token/java/server/Svc/linux/crypto.properties b/CASA-auth-token/java/server/Svc/linux/crypto.properties new file mode 100644 index 00000000..2f2e46ce --- /dev/null +++ b/CASA-auth-token/java/server/Svc/linux/crypto.properties @@ -0,0 +1,6 @@ +org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin +org.apache.ws.security.crypto.merlin.keystore.type=jks +org.apache.ws.security.crypto.merlin.keystore.password=secret +org.apache.ws.security.crypto.merlin.keystore.alias=signingKey +org.apache.ws.security.crypto.merlin.alias.password=secret +org.apache.ws.security.crypto.merlin.file=/etc/CASA/authtoken/keys/server/jks-store diff --git a/CASA-auth-token/java/server/Svc/linux/envvars b/CASA-auth-token/java/server/Svc/linux/envvars new file mode 100644 index 00000000..9991ed24 --- /dev/null +++ b/CASA-auth-token/java/server/Svc/linux/envvars @@ -0,0 +1,14 @@ +############################################################ +# # +# Environment variable file for casa_atsd. # +# # +# Note: This file is sourced by the casa_atsd rc script # +# when starting the service. # +# # +############################################################ +CATALINA_BASE="/srv/www/casaats" +CATALINA_HOME="/usr/share/tomcat5" +JAVA_HOME="/usr/lib/jvm/java-1.5.0-ibm" +JAVA_OPTS="-Dcom.novell.casa.authtoksvc.config=/etc/CASA/authtoken/svc" +export CATALINA_BASE CATALINA_HOME JAVA_HOME JAVA_OPTS + diff --git a/CASA-auth-token/java/server/Svc/linux/server_keystore_setup.sh b/CASA-auth-token/java/server/Svc/linux/server_keystore_setup.sh new file mode 100755 index 00000000..739f84af --- /dev/null +++ b/CASA-auth-token/java/server/Svc/linux/server_keystore_setup.sh @@ -0,0 +1,65 @@ +#!/bin/sh +######################################################################## +# +# Copyright (C) 2006 Novell, Inc. All Rights Reserved. +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; version 2.1 +# of the License. +# +# This library is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# Library Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public +# License along with this library; if not, Novell, Inc. +# +# To contact Novell about this file by physical or electronic mail, +# you may find current contact information at www.novell.com. +# +# Author: Juan Carlos Luciani +# +######################################################################## + +############################################################# +# # +# CASA ATS Keystore Setup Script. # +# # +# This script sets up a keystore for the ATS with a key # +# pair which the ATS will use for signing authentication # +# and session tokens. # +# # +# Ths script creates a self signed certificate that it then # +# exports. At this time it is sufficient to utilize self # +# signed certificates because they are meant to be consumed # +# by entities of the local box. # +# # +############################################################# + +# Do not do anything if the server keystore has already been created +if [ -f /etc/CASA/authtoken/keys/server/jks-store ]; then + echo "The server keystore is already setup" + # Make sure that the keystore file is owned by our service + chown casaatsd:casaauth /etc/CASA/authtoken/keys/server/jks-store +else + echo "Setting up the server's keystore" + # Create the server keystore with the key that will be used for signing tokens + host=`hostname -f` + /usr/lib/jvm/java-1.5.0-ibm/bin/keytool -genkey -alias signingKey -keystore /etc/CASA/authtoken/keys/server/jks-store -dname "cn=casaatsd@$host" -validity 3600 -keypass secret -storepass secret + + # Export self-signed certificate for the signing key + /usr/lib/jvm/java-1.5.0-ibm/bin/keytool -export -keystore /etc/CASA/authtoken/keys/server/jks-store -alias signingKey -storepass secret -keypass secret -file /etc/CASA/authtoken/keys/casaatsdSigningCert + + # List the contents of the server's keystore + #usr/lib/jvm/java-1.5.0-ibm/bin/keytool -list -rfc -keystore /etc/CASA/authtoken/keys/server/jks-store -alias signingKey -storepass secret + + # Print the exported cert + #usr/lib/jvm/java-1.5.0-ibm/bin/keytool -printcert -file /etc/CASA/authtoken/keys/casaatsdSigningCert + + # Make sure that the keystore is only accessible by the service + chown casaatsd:casaauth /etc/CASA/authtoken/keys/server/jks-store + chmod 600 /etc/CASA/authtoken/keys/server/jks-store +fi + diff --git a/CASA-auth-token/java/server/Svc/src/com/novell/casa/authtoksvc/SvcConfig.java b/CASA-auth-token/java/server/Svc/src/com/novell/casa/authtoksvc/SvcConfig.java index e5845f1a..4a1b44af 100644 --- a/CASA-auth-token/java/server/Svc/src/com/novell/casa/authtoksvc/SvcConfig.java +++ b/CASA-auth-token/java/server/Svc/src/com/novell/casa/authtoksvc/SvcConfig.java @@ -53,13 +53,15 @@ public class SvcConfig public final static String ConfigFolderPath = "ConfigFolderPath"; public final static String AppRootPath = "AppRootPath"; public final static String ReconfigureInterval = "ReconfigureInterval"; - public final static String KeyStoreUser = "KeyStoreUser"; - public final static String KeyStorePwd = "KeyStorePwd"; + public final static String SigningKeyAliasName = "SigningKeyAliasName"; + public final static String SigningKeyPassword = "SigningKeyPassword"; // Default configuration values - public final static String DefaultSessionTokenLifetimeValue = "43200"; // Seconds - public final static String DefaultLifetimeShorterValue = "5"; // Seconds - public final static String DefaultReconfigureIntervalValue = "60"; // Seconds + public final static String DefaultSessionTokenLifetimeValue = "43200"; // Seconds + public final static String DefaultLifetimeShorterValue = "5"; // Seconds + public final static String DefaultReconfigureIntervalValue = "60"; // Seconds + public final static String DefaultSigningKeyAliasNameValue = "signingKey"; + public final static String DefaultSigningKeyPasswordValue = "secret"; private static final String m_svcSettingsFileName = "svc.settings"; private Map m_svcSettingsMap; @@ -281,6 +283,22 @@ public class SvcConfig // Add the key to the map so that it can be found quicker next time m_svcSettingsMap.put(ReconfigureInterval, DefaultReconfigureIntervalValue); } + else if (settingName.equals(SigningKeyAliasName) == true) + { + value = DefaultSigningKeyAliasNameValue; + System.err.println("SvcConfig.getSetting()- Assigning default value " + value); + + // Add the key to the map so that it can be found quicker next time + m_svcSettingsMap.put(SigningKeyAliasName, DefaultSigningKeyAliasNameValue); + } + else if (settingName.equals(SigningKeyPassword) == true) + { + value = DefaultSigningKeyPasswordValue; + System.err.println("SvcConfig.getSetting()- Assigning default value " + value); + + // Add the key to the map so that it can be found quicker next time + m_svcSettingsMap.put(SigningKeyPassword, DefaultSigningKeyPasswordValue); + } else if (settingName.equals(IdentityAbstractionConfigFile) == true) { System.err.println("SvcConfig.getSetting()- Mandatory setting " + IdentityAbstractionConfigFile + " not set"); diff --git a/CASA-auth-token/java/server/Svc/src/com/novell/casa/authtoksvc/WSSecurity.java b/CASA-auth-token/java/server/Svc/src/com/novell/casa/authtoksvc/WSSecurity.java index 4e24ab58..e00133d0 100644 --- a/CASA-auth-token/java/server/Svc/src/com/novell/casa/authtoksvc/WSSecurity.java +++ b/CASA-auth-token/java/server/Svc/src/com/novell/casa/authtoksvc/WSSecurity.java @@ -244,8 +244,8 @@ public class WSSecurity boolean includeCert) throws Exception { WSSecSignature signer = new WSSecSignature(); - signer.setUserInfo(svcConfig.getSetting(SvcConfig.KeyStoreUser), - svcConfig.getSetting(SvcConfig.KeyStorePwd)); + signer.setUserInfo(svcConfig.getSetting(SvcConfig.SigningKeyAliasName), + svcConfig.getSetting(SvcConfig.SigningKeyPassword)); if (includeCert) { signer.setKeyIdentifierType(WSConstants.X509_KEY_IDENTIFIER); // Include X509 Cert in message diff --git a/CASA-auth-token/java/server/Svc/svc.settings b/CASA-auth-token/java/server/Svc/svc.settings index f028fef5..b6f34326 100644 --- a/CASA-auth-token/java/server/Svc/svc.settings +++ b/CASA-auth-token/java/server/Svc/svc.settings @@ -1,5 +1,5 @@ - Replace with path to the Identity Abstraction Realms Configuration File. + /etc/CASA/authtoken/svc/iaRealms.xml 43200 diff --git a/CASA-auth-token/java/server/Svc/tomcat5/Makefile.am b/CASA-auth-token/java/server/Svc/tomcat5/Makefile.am new file mode 100644 index 00000000..ce690393 --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/Makefile.am @@ -0,0 +1,37 @@ +####################################################################### +# +# Copyright (C) 2006 Novell, Inc. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public +# License as published by the Free Software Foundation; either +# version 2 of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +# +# Author: Juan Carlos Luciani +# +####################################################################### + +SUBDIRS = + +DIST_SUBDIRS = conf + +CFILES = + +EXTRA_DIST = + +.PHONY: package package-clean package-install package-uninstall +package package-clean package-install package-uninstall: + $(MAKE) -C $(TARGET_OS) $@ + +maintainer-clean-local: + rm -f Makefile.in + diff --git a/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/Makefile.am b/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/Makefile.am new file mode 100644 index 00000000..5c99e1ce --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/Makefile.am @@ -0,0 +1,37 @@ +####################################################################### +# +# Copyright (C) 2006 Novell, Inc. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public +# License as published by the Free Software Foundation; either +# version 2 of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +# +# Author: Juan Carlos Luciani +# +####################################################################### + +SUBDIRS = + +DIST_SUBDIRS = localhost + +CFILES = + +EXTRA_DIST = + +.PHONY: package package-clean package-install package-uninstall +package package-clean package-install package-uninstall: + $(MAKE) -C $(TARGET_OS) $@ + +maintainer-clean-local: + rm -f Makefile.in + diff --git a/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/Makefile.am b/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/Makefile.am new file mode 100644 index 00000000..9130190a --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/Makefile.am @@ -0,0 +1,39 @@ +####################################################################### +# +# Copyright (C) 2006 Novell, Inc. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public +# License as published by the Free Software Foundation; either +# version 2 of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +# +# Author: Juan Carlos Luciani +# +####################################################################### + +SUBDIRS = + +DIST_SUBDIRS = + +CFILES = + +EXTRA_DIST = admin.xml \ + balancer.xml \ + manager.xml + +.PHONY: package package-clean package-install package-uninstall +package package-clean package-install package-uninstall: + $(MAKE) -C $(TARGET_OS) $@ + +maintainer-clean-local: + rm -f Makefile.in + diff --git a/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/admin.xml b/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/admin.xml new file mode 100644 index 00000000..1b1ac779 --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/admin.xml @@ -0,0 +1,30 @@ + + + + + + + + + + + + + + + diff --git a/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/balancer.xml b/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/balancer.xml new file mode 100644 index 00000000..cd046464 --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/balancer.xml @@ -0,0 +1,14 @@ + + + + + + diff --git a/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/manager.xml b/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/manager.xml new file mode 100644 index 00000000..78620c58 --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/conf/Catalina/localhost/manager.xml @@ -0,0 +1,17 @@ + + + + + + + + + diff --git a/CASA-auth-token/java/server/Svc/tomcat5/conf/Makefile.am b/CASA-auth-token/java/server/Svc/tomcat5/conf/Makefile.am new file mode 100644 index 00000000..be7b21cd --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/conf/Makefile.am @@ -0,0 +1,43 @@ +####################################################################### +# +# Copyright (C) 2006 Novell, Inc. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public +# License as published by the Free Software Foundation; either +# version 2 of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +# +# Author: Juan Carlos Luciani +# +####################################################################### + +SUBDIRS = + +DIST_SUBDIRS = Catalina + +CFILES = + +EXTRA_DIST = catalina.policy \ + catalina.properties \ + jk2.properties \ + server.xml \ + server-minimal.xml \ + tomcat-users.xml \ + web.xml + +.PHONY: package package-clean package-install package-uninstall +package package-clean package-install package-uninstall: + $(MAKE) -C $(TARGET_OS) $@ + +maintainer-clean-local: + rm -f Makefile.in + diff --git a/CASA-auth-token/java/server/Svc/tomcat5/conf/catalina.policy b/CASA-auth-token/java/server/Svc/tomcat5/conf/catalina.policy new file mode 100644 index 00000000..345fe7a4 --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/conf/catalina.policy @@ -0,0 +1,162 @@ +// ============================================================================ +// catalina.corepolicy - Security Policy Permissions for Tomcat 5 +// +// This file contains a default set of security policies to be enforced (by the +// JVM) when Catalina is executed with the "-security" option. In addition +// to the permissions granted here, the following additional permissions are +// granted to the codebase specific to each web application: +// +// * Read access to the document root directory +// +// $Id: catalina.policy,v 1.11 2004/03/02 12:36:22 remm Exp $ +// ============================================================================ + + +// ========== SYSTEM CODE PERMISSIONS ========================================= + + +// These permissions apply to javac +grant codeBase "file:${java.home}/lib/-" { + permission java.security.AllPermission; +}; + +// These permissions apply to all shared system extensions +grant codeBase "file:${java.home}/jre/lib/ext/-" { + permission java.security.AllPermission; +}; + +// These permissions apply to javac when ${java.home] points at $JAVA_HOME/jre +grant codeBase "file:${java.home}/../lib/-" { + permission java.security.AllPermission; +}; + +// These permissions apply to all shared system extensions when +// ${java.home} points at $JAVA_HOME/jre +grant codeBase "file:${java.home}/lib/ext/-" { + permission java.security.AllPermission; +}; + + +// ========== CATALINA CODE PERMISSIONS ======================================= + + +// These permissions apply to the launcher code +grant codeBase "file:${catalina.home}/bin/commons-launcher.jar" { + permission java.security.AllPermission; +}; + +// These permissions apply to the daemon code +grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" { + permission java.security.AllPermission; +}; + +// These permissions apply to the commons-logging API +grant codeBase "file:${catalina.home}/bin/commons-logging-api.jar" { + permission java.security.AllPermission; +}; + +// These permissions apply to the server startup code +grant codeBase "file:${catalina.home}/bin/bootstrap.jar" { + permission java.security.AllPermission; +}; + +// These permissions apply to the JMX server +grant codeBase "file:${catalina.home}/bin/jmx.jar" { + permission java.security.AllPermission; +}; + +// These permissions apply to the servlet API classes +// and those that are shared across all class loaders +// located in the "common" directory +grant codeBase "file:${catalina.home}/common/-" { + permission java.security.AllPermission; +}; + +// These permissions apply to the container's core code, plus any additional +// libraries installed in the "server" directory +grant codeBase "file:${catalina.home}/server/-" { + permission java.security.AllPermission; +}; + +// ========== WEB APPLICATION PERMISSIONS ===================================== + + +// These permissions are granted by default to all web applications +// In addition, a web application will be given a read FilePermission +// and JndiPermission for all files and directories in its document root. +grant { + // Required for JNDI lookup of named JDBC DataSource's and + // javamail named MimePart DataSource used to send mail + permission java.util.PropertyPermission "java.home", "read"; + permission java.util.PropertyPermission "java.naming.*", "read"; + permission java.util.PropertyPermission "javax.sql.*", "read"; + + // OS Specific properties to allow read access + permission java.util.PropertyPermission "os.name", "read"; + permission java.util.PropertyPermission "os.version", "read"; + permission java.util.PropertyPermission "os.arch", "read"; + permission java.util.PropertyPermission "file.separator", "read"; + permission java.util.PropertyPermission "path.separator", "read"; + permission java.util.PropertyPermission "line.separator", "read"; + + // JVM properties to allow read access + permission java.util.PropertyPermission "java.version", "read"; + permission java.util.PropertyPermission "java.vendor", "read"; + permission java.util.PropertyPermission "java.vendor.url", "read"; + permission java.util.PropertyPermission "java.class.version", "read"; + permission java.util.PropertyPermission "java.specification.version", "read"; + permission java.util.PropertyPermission "java.specification.vendor", "read"; + permission java.util.PropertyPermission "java.specification.name", "read"; + + permission java.util.PropertyPermission "java.vm.specification.version", "read"; + permission java.util.PropertyPermission "java.vm.specification.vendor", "read"; + permission java.util.PropertyPermission "java.vm.specification.name", "read"; + permission java.util.PropertyPermission "java.vm.version", "read"; + permission java.util.PropertyPermission "java.vm.vendor", "read"; + permission java.util.PropertyPermission "java.vm.name", "read"; + + // Required for OpenJMX + permission java.lang.RuntimePermission "getAttribute"; + + // Allow read of JAXP compliant XML parser debug + permission java.util.PropertyPermission "jaxp.debug", "read"; + + // Precompiled JSPs need access to this package. + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime"; + permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime.*"; + +}; + + +// You can assign additional permissions to particular web applications by +// adding additional "grant" entries here, based on the code base for that +// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files. +// +// Different permissions can be granted to JSP pages, classes loaded from +// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/ +// directory, or even to individual jar files in the /WEB-INF/lib/ directory. +// +// For instance, assume that the standard "examples" application +// included a JDBC driver that needed to establish a network connection to the +// corresponding database and used the scrape taglib to get the weather from +// the NOAA web server. You might create a "grant" entries like this: +// +// The permissions granted to the context root directory apply to JSP pages. +// grant codeBase "file:${catalina.home}/webapps/examples/-" { +// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; +// permission java.net.SocketPermission "*.noaa.gov:80", "connect"; +// }; +// +// The permissions granted to the context WEB-INF/classes directory +// grant codeBase "file:${catalina.home}/webapps/examples/WEB-INF/classes/-" { +// }; +// +// The permission granted to your JDBC driver +// grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/driver.jar!/-" { +// permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect"; +// }; +// The permission granted to the scrape taglib +// grant codeBase "jar:file:${catalina.home}/webapps/examples/WEB-INF/lib/scrape.jar!/-" { +// permission java.net.SocketPermission "*.noaa.gov:80", "connect"; +// }; + diff --git a/CASA-auth-token/java/server/Svc/tomcat5/conf/catalina.properties b/CASA-auth-token/java/server/Svc/tomcat5/conf/catalina.properties new file mode 100644 index 00000000..6f6b41a3 --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/conf/catalina.properties @@ -0,0 +1,57 @@ +# +# List of comma-separated packages that start with or equal this string +# will cause a security exception to be thrown when +# passed to checkPackageAccess unless the +# corresponding RuntimePermission ("accessClassInPackage."+package) has +# been granted. +package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,org.apache.jasper.,sun.beans. +# +# List of comma-separated packages that start with or equal this string +# will cause a security exception to be thrown when +# passed to checkPackageDefinition unless the +# corresponding RuntimePermission ("defineClassInPackage."+package) has +# been granted. +# +# by default, no packages are restricted for definition, and none of +# the class loaders supplied with the JDK call checkPackageDefinition. +# +package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,org.apache.jasper. + +# +# +# List of comma-separated paths defining the contents of the "common" +# classloader. Prefixes should be used to define what is the repository type. +# Path may be relative to the CATALINA_HOME or CATALINA_BASE path or absolute. +# If left as blank,the JVM system loader will be used as Catalina's "common" +# loader. +# Examples: +# "foo": Add this folder as a class repository +# "foo/*.jar": Add all the JARs of the specified folder as class +# repositories +# "foo/bar.jar": Add bar.jar as a class repository +common.loader=${catalina.home}/common/classes,${catalina.home}/common/endorsed/*.jar,${catalina.home}/common/lib/*.jar + +# +# List of comma-separated paths defining the contents of the "server" +# classloader. Prefixes should be used to define what is the repository type. +# Path may be relative to the CATALINA_HOME or CATALINA_BASE path or absolute. +# If left as blank, the "common" loader will be used as Catalina's "server" +# loader. +# Examples: +# "foo": Add this folder as a class repository +# "foo/*.jar": Add all the JARs of the specified folder as class +# repositories +# "foo/bar.jar": Add bar.jar as a class repository +server.loader=${catalina.home}/server/classes,${catalina.home}/server/lib/*.jar + +# +# List of comma-separated paths defining the contents of the "shared" +# classloader. Prefixes should be used to define what is the repository type. +# Path may be relative to the CATALINA_BASE path or absolute. If left as blank, +# the "common" loader will be used as Catalina's "shared" loader. +# Examples: +# "foo": Add this folder as a class repository +# "foo/*.jar": Add all the JARs of the specified folder as class +# repositories +# "foo/bar.jar": Add bar.jar as a class repository +shared.loader=${catalina.base}/shared/classes,${catalina.base}/shared/lib/*.jar diff --git a/CASA-auth-token/java/server/Svc/tomcat5/conf/jk2.properties b/CASA-auth-token/java/server/Svc/tomcat5/conf/jk2.properties new file mode 100644 index 00000000..093bae80 --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/conf/jk2.properties @@ -0,0 +1,26 @@ +## THIS FILE MAY BE OVERRIDEN AT RUNTIME. MAKE SURE TOMCAT IS STOPED +## WHEN YOU EDIT THE FILE. + +## COMMENTS WILL BE _LOST_ + +## DOCUMENTATION OF THE FORMAT IN JkMain javadoc. + +# Set the desired handler list +# handler.list=apr,request,channelJni +# +# Override the default port for the socketChannel +# channelSocket.port=8019 +# Default: +# channelUnix.file=${jkHome}/work/jk2.socket +# Just to check if the the config is working +# shm.file=${jkHome}/work/jk2.shm + +# In order to enable jni use any channelJni directive +# channelJni.disabled = 0 +# And one of the following directives: + +# apr.jniModeSo=/opt/apache2/modules/mod_jk2.so + +# If set to inprocess the mod_jk2 will Register natives itself +# This will enable the starting of the Tomcat from mod_jk2 +# apr.jniModeSo=inprocess diff --git a/CASA-auth-token/java/server/Svc/tomcat5/conf/server-minimal.xml b/CASA-auth-token/java/server/Svc/tomcat5/conf/server-minimal.xml new file mode 100644 index 00000000..5d1cd3b9 --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/conf/server-minimal.xml @@ -0,0 +1,35 @@ + + + + + + + + factory + org.apache.catalina.users.MemoryUserDatabaseFactory + + + pathname + conf/tomcat-users.xml + + + + + + + + + + + + + + + + + + + diff --git a/CASA-auth-token/java/server/Svc/tomcat5/conf/server.xml b/CASA-auth-token/java/server/Svc/tomcat5/conf/server.xml new file mode 100644 index 00000000..1fe20c7a --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/conf/server.xml @@ -0,0 +1,383 @@ + + + + + + + + + + + + + + + + + + + + + + + + + factory + org.apache.catalina.users.MemoryUserDatabaseFactory + + + pathname + conf/tomcat-users.xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/CASA-auth-token/java/server/Svc/tomcat5/conf/tomcat-users.xml b/CASA-auth-token/java/server/Svc/tomcat5/conf/tomcat-users.xml new file mode 100644 index 00000000..6c9f2173 --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/conf/tomcat-users.xml @@ -0,0 +1,3 @@ + + + diff --git a/CASA-auth-token/java/server/Svc/tomcat5/conf/web.xml b/CASA-auth-token/java/server/Svc/tomcat5/conf/web.xml new file mode 100644 index 00000000..c41fb027 --- /dev/null +++ b/CASA-auth-token/java/server/Svc/tomcat5/conf/web.xml @@ -0,0 +1,964 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + default + + org.apache.catalina.servlets.DefaultServlet + + + debug + 0 + + + listings + true + + 1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + jsp + org.apache.jasper.servlet.JspServlet + + fork + false + + + xpoweredBy + false + + 3 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + default + / + + + + + + + + jsp + *.jsp + + + + jsp + *.jspx + + + + + + + + + + + + + + + + 30 + + + + + + + + + + + + abs + audio/x-mpeg + + + ai + application/postscript + + + aif + audio/x-aiff + + + aifc + audio/x-aiff + + + aiff + audio/x-aiff + + + aim + application/x-aim + + + art + image/x-jg + + + asf + video/x-ms-asf + + + asx + video/x-ms-asf + + + au + audio/basic + + + avi + video/x-msvideo + + + avx + video/x-rad-screenplay + + + bcpio + application/x-bcpio + + + bin + application/octet-stream + + + bmp + image/bmp + + + body + text/html + + + cdf + application/x-cdf + + + cer + application/x-x509-ca-cert + + + class + application/java + + + cpio + application/x-cpio + + + csh + application/x-csh + + + css + text/css + + + dib + image/bmp + + + doc + application/msword + + + dtd + application/xml-dtd + + + dv + video/x-dv + + + dvi + application/x-dvi + + + eps + application/postscript + + + etx + text/x-setext + + + exe + application/octet-stream + + + gif + image/gif + + + gtar + application/x-gtar + + + gz + application/x-gzip + + + hdf + application/x-hdf + + + hqx + application/mac-binhex40 + + + htc + text/x-component + + + htm + text/html + + + html + text/html + + + hqx + application/mac-binhex40 + + + ief + image/ief + + + jad + text/vnd.sun.j2me.app-descriptor + + + jar + application/java-archive + + + java + text/plain + + + jnlp + application/x-java-jnlp-file + + + jpe + image/jpeg + + + jpeg + image/jpeg + + + jpg + image/jpeg + + + js + text/javascript + + + jsf + text/plain + + + jspf + text/plain + + + kar + audio/x-midi + + + latex + application/x-latex + + + m3u + audio/x-mpegurl + + + mac + image/x-macpaint + + + man + application/x-troff-man + + + mathml + application/mathml+xml + + + me + application/x-troff-me + + + mid + audio/x-midi + + + midi + audio/x-midi + + + mif + application/x-mif + + + mov + video/quicktime + + + movie + video/x-sgi-movie + + + mp1 + audio/x-mpeg + + + mp2 + audio/x-mpeg + + + mp3 + audio/x-mpeg + + + mpa + audio/x-mpeg + + + mpe + video/mpeg + + + mpeg + video/mpeg + + + mpega + audio/x-mpeg + + + mpg + video/mpeg + + + mpv2 + video/mpeg2 + + + ms + application/x-wais-source + + + nc + application/x-netcdf + + + oda + application/oda + + + ogg + application/ogg + + + pbm + image/x-portable-bitmap + + + pct + image/pict + + + pdf + application/pdf + + + pgm + image/x-portable-graymap + + + pic + image/pict + + + pict + image/pict + + + pls + audio/x-scpls + + + png + image/png + + + pnm + image/x-portable-anymap + + + pnt + image/x-macpaint + + + ppm + image/x-portable-pixmap + + + ppt + application/powerpoint + + + ps + application/postscript + + + psd + image/x-photoshop + + + qt + video/quicktime + + + qti + image/x-quicktime + + + qtif + image/x-quicktime + + + ras + image/x-cmu-raster + + + rdf + application/rdf+xml + + + rgb + image/x-rgb + + + rm + application/vnd.rn-realmedia + + + roff + application/x-troff + + + rtf + application/rtf + + + rtx + text/richtext + + + sh + application/x-sh + + + shar + application/x-shar + + + smf + audio/x-midi + + + sit + application/x-stuffit + + + snd + audio/basic + + + src + application/x-wais-source + + + sv4cpio + application/x-sv4cpio + + + sv4crc + application/x-sv4crc + + + svg + image/svg+xml + + + swf + application/x-shockwave-flash + + + t + application/x-troff + + + tar + application/x-tar + + + tcl + application/x-tcl + + + tex + application/x-tex + + + texi + application/x-texinfo + + + texinfo + application/x-texinfo + + + tif + image/tiff + + + tiff + image/tiff + + + tr + application/x-troff + + + tsv + text/tab-separated-values + + + txt + text/plain + + + ulw + audio/basic + + + ustar + application/x-ustar + + + vxml + application/voicexml+xml + + + xbm + image/x-xbitmap + + + xht + application/xhtml+xml + + + xhtml + application/xhtml+xml + + + xml + application/xml + + + xpm + image/x-xpixmap + + + xsl + application/xml + + + xslt + application/xslt+xml + + + xul + application/vnd.mozilla.xul+xml + + + xwd + image/x-xwindowdump + + + wav + audio/x-wav + + + svg + image/svg+xml + + + svgz + image/svg+xml + + + vsd + application/x-visio + + + + wbmp + image/vnd.wap.wbmp + + + + wml + text/vnd.wap.wml + + + + wmlc + application/vnd.wap.wmlc + + + + wmls + text/vnd.wap.wmlscript + + + + wmlscriptc + application/vnd.wap.wmlscriptc + + + wrl + x-world/x-vrml + + + Z + application/x-compress + + + z + application/x-compress + + + zip + application/zip + + + + + + + + + + + + + + + + + index.html + index.htm + index.jsp + + +