* The CGI parameters for requests are the following. *
*
*
* CertificationRequest ::= SEQUENCE {
* certificationRequestInfo CertificationRequestInfo,
* signatureAlgorithm AlgorithmIdentifier{{ SignatureAlgorithms }},
* signature BIT STRING
* }
* CertificationRequestInfo ::= SEQUENCE {
* version INTEGER { v1(0) } (v1,...),
* subject Name,
* subjectPKInfo SubjectPublicKeyInfo{{ PKInfoAlgorithms }},
* attributes [0] Attributes{{ CRIAttributes }}
* }
* SubjectPublicKeyInfo { ALGORITHM : IOSet} ::= SEQUENCE {
* algorithm AlgorithmIdentifier {{IOSet}},
* subjectPublicKey BIT STRING
* }
*
*
* PublicKey's encoded-format has to be RSA X.509.
*/
@Override
public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
ServletDebug debug = new ServletDebug(request, response);
AuthenticationToken admin = new AlwaysAllowLocalAuthenticationToken(new PublicWebPrincipal("DemoCertReqServlet", request.getRemoteAddr()));
RequestHelper.setDefaultCharacterEncoding(request);
String dn = null;
dn = request.getParameter("user");
byte[] reqBytes = null;
int type = 0;
if (request.getParameter("keygen") != null) {
reqBytes = request.getParameter("keygen").getBytes();
log.debug("Received NS request:" + new String(reqBytes));
if (reqBytes != null) {
type = 1;
}
} else if (request.getParameter("pkcs10req") != null) {
// if not firefox, check if it's IE
reqBytes = request.getParameter("pkcs10req").getBytes();
log.debug("Received IE request:" + new String(reqBytes));
if (reqBytes != null) {
type = 2;
}
}
if (reqBytes == null) {
// abort here, no request received
throw new ServletException("A certification request must be provided!");
}
String username = request.getParameter("username");
if (username == null || username.trim().length() == 0) {
username = CertTools.getPartFromDN(dn, "CN");
}
username = username + "(" + (new Date()).toString() + ")";
// Strip dangerous chars
username = StringTools.stripUsername(username);
// need null check here?
// Before doing anything else, check if the user name is unique and ok.
boolean check = checkUsername(admin, username, endEntityAccessSession);
if (check == false) {
String msg = "User '" + HTMLTools.htmlescape(username) + "' already exist.";
log.error(msg);
debug.printMessage(msg);
debug.printDebugInfo();
return;
}
// Functionality to determine the class id of ie page.
String classid = "clsid:127698e4-e730-4e5c-a2b1-21490a70c8a1\" CODEBASE=\"/CertControl/xenroll.cab#Version=5,131,3659,0";
if (request.getParameter("classid") != null && !request.getParameter("classid").equals("")) {
classid = request.getParameter("classid");
}
String includeEmail = request.getParameter("includeemail");
log.debug("includeEmail=" + includeEmail);
EndEntityInformation newuser = new EndEntityInformation();
newuser.setType(new EndEntityType(EndEntityTypes.ENDUSER));
newuser.setUsername(username);
newuser.setDN(dn);
newuser.setTokenType(SecConst.TOKEN_SOFT_BROWSERGEN);
newuser.setKeyRecoverable(false);
newuser.setSendNotification(false);
String email = request.getParameter("email");
if (email == null) {
email = CertTools.getPartFromDN(dn, "EMAILADDRESS");
}
if ((email != null) && (email.length() > 0)) {
newuser.setEmail(email);
if (includeEmail != null) {
newuser.setSubjectAltName("RFC822NAME=" + email);
}
}
String tmp = null;
int eProfileId = EndEntityConstants.EMPTY_END_ENTITY_PROFILE;
if ((tmp = request.getParameter("entityprofile")) != null) {
try {
eProfileId = endEntityProfileSession.getEndEntityProfileId(request.getParameter("entityprofile"));
} catch (EndEntityProfileNotFoundException e) {
throw new ServletException("No such end entity profile: " + tmp, e);
}
}
newuser.setEndEntityProfileId(eProfileId);
int cProfileId = CertificateProfileConstants.CERTPROFILE_FIXED_ENDUSER;
if ((tmp = request.getParameter("certificateprofile")) != null) {
cProfileId = certificateProfileSession.getCertificateProfileId(request.getParameter("certificateprofile"));
if (cProfileId == 0) {
throw new ServletException("No such certificate profile: " + tmp);
}
}
newuser.setCertificateProfileId(cProfileId);
int caid = DEFAULT_DEMOCAID;
if ((tmp = request.getParameter("ca")) != null) {
// Do NOT get requested CA to sign with from form.
// For security reasons, if there are more than one CA in the system
// we definataly want to hardwire the demo to the demo CA.
}
newuser.setCAId(caid);
String password = request.getParameter("password");
if (password == null) {
password = "demo";
}
newuser.setPassword(password);
try {
endEntityManagementSession.addUser(admin, newuser.getUsername(), newuser.getPassword(), newuser.getDN(), newuser.getSubjectAltName(),
newuser.getEmail(), false, newuser.getEndEntityProfileId(), newuser.getCertificateProfileId(), newuser.getType(),
newuser.getTokenType(), newuser.getHardTokenIssuerId(), newuser.getCAId());
} catch (Exception e) {
throw new ServletException("Error adding user: ", e);
}
RequestHelper helper = new RequestHelper(admin, debug);
try {
if (type == 1) {
byte[] certs = helper.nsCertRequest(signSession, reqBytes, username, password);
RequestHelper.sendNewCertToNSClient(certs, response);
}
if (type == 2) {
byte[] b64cert = helper.pkcs10CertRequest(signSession, caSession, reqBytes, username, password, CertificateResponseType.ENCODED_PKCS7).getEncoded();
debug.ieCertFix(b64cert);
RequestHelper.sendNewCertToIEClient(b64cert, response.getOutputStream(), getServletContext(), getInitParameter("responseTemplate"),
classid);
}
} catch (ObjectNotFoundException oe) {
log.debug("Non existens username!");
debug.printMessage("Non existent username!");
debug.printMessage("To generate a certificate a valid username and password must be entered.");
debug.printDebugInfo();
return;
} catch (AuthStatusException ase) {
log.debug("Wrong user status!");
debug.printMessage("Wrong user status!");
debug.printMessage("To generate a certificate for a user the user must have status new, failed or inprocess.");
debug.printDebugInfo();
return;
} catch (AuthLoginException ale) {
log.debug("Wrong password for user!");
debug.printMessage("Wrong username or password!");
debug.printMessage("To generate a certificate a valid username and password must be entered.");
debug.printDebugInfo();
return;
} catch (SignRequestException re) {
log.debug("Invalid request!");
debug.printMessage("Invalid request!");
debug.printMessage("Please supply a correct request.");
debug.printDebugInfo();
return;
} catch (SignRequestSignatureException se) {
log.debug("Invalid signature on certificate request!");
debug.printMessage("Invalid signature on certificate request!");
debug.printMessage("Please supply a correctly signed request.");
debug.printDebugInfo();
return;
} catch (java.lang.ArrayIndexOutOfBoundsException ae) {
log.debug("Empty or invalid request received.");
debug.printMessage("Empty or invalid request!");
debug.printMessage("Please supply a correct request.");
debug.printDebugInfo();
return;
} catch (DecoderException de) {
log.debug("Empty or invalid request received.");
debug.printMessage("Empty or invalid request!");
debug.printMessage("Please supply a correct request.");
debug.printDebugInfo();
return;
} catch (Exception e) {
log.debug(e);
debug.print("