|
|
@ -1440,8 +1440,8 @@ TQString klistDateTimeToRFCDateTime(TQString datetime) {
|
|
|
|
// HACK HACK HACK
|
|
|
|
// HACK HACK HACK
|
|
|
|
// FIXME
|
|
|
|
// FIXME
|
|
|
|
TQString ret;
|
|
|
|
TQString ret;
|
|
|
|
TQString command = TQString("date -R -d \"%1\"").arg(datetime);
|
|
|
|
TQCString command = TQString("date -R -d \"%1\"").arg(datetime).local8Bit();
|
|
|
|
FILE *output = popen(command.ascii(), "r");
|
|
|
|
FILE *output = popen(command, "r");
|
|
|
|
TQFile f;
|
|
|
|
TQFile f;
|
|
|
|
f.open(IO_ReadOnly, output);
|
|
|
|
f.open(IO_ReadOnly, output);
|
|
|
|
TQTextStream stream(&f);
|
|
|
|
TQTextStream stream(&f);
|
|
|
@ -1733,7 +1733,7 @@ int LDAPManager::obtainKerberosTicket(LDAPCredentials creds, TQString principal,
|
|
|
|
if (pkcs11_login_card_slot != 0) {
|
|
|
|
if (pkcs11_login_card_slot != 0) {
|
|
|
|
pkcsProviderString.append(TQString(",slot=%1").arg(pkcs11_login_card_slot));
|
|
|
|
pkcsProviderString.append(TQString(",slot=%1").arg(pkcs11_login_card_slot));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
args << TQCString("-C") << TQCString(pkcsProviderString);
|
|
|
|
args << TQCString("-C") << pkcsProviderString.local8Bit();
|
|
|
|
|
|
|
|
|
|
|
|
// Find certificate on card and set credentials to match
|
|
|
|
// Find certificate on card and set credentials to match
|
|
|
|
TDEGenericDevice *hwdevice;
|
|
|
|
TDEGenericDevice *hwdevice;
|
|
|
@ -1775,10 +1775,10 @@ int LDAPManager::obtainKerberosTicket(LDAPCredentials creds, TQString principal,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (principal == "") {
|
|
|
|
if (principal == "") {
|
|
|
|
args << TQCString(creds.username + "@" + creds.realm.upper());
|
|
|
|
args << TQString("%1@%2").arg(creds.username).arg(creds.realm.upper()).local8Bit();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
else {
|
|
|
|
args << TQCString("-S") << TQCString(principal) << TQCString(creds.username + "@" + creds.realm.upper());
|
|
|
|
args << TQCString("-S") << principal.local8Bit() << TQString("%1@%2").arg(creds.username).arg(creds.realm.upper()).local8Bit();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
TQString prompt;
|
|
|
|
TQString prompt;
|
|
|
@ -1816,8 +1816,8 @@ int LDAPManager::obtainKerberosTicket(LDAPCredentials creds, TQString principal,
|
|
|
|
|
|
|
|
|
|
|
|
int LDAPManager::obtainKerberosServiceTicket(TQString principal, TQString *errstr) {
|
|
|
|
int LDAPManager::obtainKerberosServiceTicket(TQString principal, TQString *errstr) {
|
|
|
|
TQString ret;
|
|
|
|
TQString ret;
|
|
|
|
TQString command = TQString("kgetcred \"%1\"").arg(principal);
|
|
|
|
TQCString command = TQString("kgetcred \"%1\"").arg(principal).local8Bit();
|
|
|
|
FILE *output = popen(command.ascii(), "r");
|
|
|
|
FILE *output = popen(command, "r");
|
|
|
|
TQFile f;
|
|
|
|
TQFile f;
|
|
|
|
f.open(IO_ReadOnly, output);
|
|
|
|
f.open(IO_ReadOnly, output);
|
|
|
|
TQTextStream stream(&f);
|
|
|
|
TQTextStream stream(&f);
|
|
|
@ -1834,8 +1834,8 @@ int LDAPManager::obtainKerberosServiceTicket(TQString principal, TQString *errst
|
|
|
|
|
|
|
|
|
|
|
|
int LDAPManager::destroyKerberosTicket(TQString principal, TQString *errstr) {
|
|
|
|
int LDAPManager::destroyKerberosTicket(TQString principal, TQString *errstr) {
|
|
|
|
TQString ret;
|
|
|
|
TQString ret;
|
|
|
|
TQString command = TQString("kdestroy --credential=\"%1\"").arg(principal);
|
|
|
|
TQCString command = TQString("kdestroy --credential=\"%1\"").arg(principal).local8Bit();
|
|
|
|
FILE *output = popen(command.ascii(), "r");
|
|
|
|
FILE *output = popen(command, "r");
|
|
|
|
TQFile f;
|
|
|
|
TQFile f;
|
|
|
|
f.open(IO_ReadOnly, output);
|
|
|
|
f.open(IO_ReadOnly, output);
|
|
|
|
TQTextStream stream(&f);
|
|
|
|
TQTextStream stream(&f);
|
|
|
@ -3274,7 +3274,7 @@ int LDAPManager::moveKerberosEntries(TQString newSuffix, TQString* errstr) {
|
|
|
|
if((dn = ldap_get_dn(m_ldap, entry)) != NULL) {
|
|
|
|
if((dn = ldap_get_dn(m_ldap, entry)) != NULL) {
|
|
|
|
TQStringList dnParts = TQStringList::split(",", dn);
|
|
|
|
TQStringList dnParts = TQStringList::split(",", dn);
|
|
|
|
TQString id = dnParts[0];
|
|
|
|
TQString id = dnParts[0];
|
|
|
|
retcode = ldap_rename_s(m_ldap, dn, id, newSuffix, 0, NULL, NULL);
|
|
|
|
retcode = ldap_rename_s(m_ldap, dn, id.utf8(), newSuffix.utf8(), 0, NULL, NULL);
|
|
|
|
if (retcode != LDAP_SUCCESS) {
|
|
|
|
if (retcode != LDAP_SUCCESS) {
|
|
|
|
if (errstr) *errstr = i18n("LDAP rename failure<p>Reason: [%3] %4").arg(retcode).arg(ldap_err2string(retcode));
|
|
|
|
if (errstr) *errstr = i18n("LDAP rename failure<p>Reason: [%3] %4").arg(retcode).arg(ldap_err2string(retcode));
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
@ -3300,7 +3300,7 @@ int LDAPManager::writeLDAPConfFile(LDAPRealmConfig realmcfg, LDAPMachineRole mac
|
|
|
|
int m_ldapBindTimeout;
|
|
|
|
int m_ldapBindTimeout;
|
|
|
|
TQString m_passwordHash;
|
|
|
|
TQString m_passwordHash;
|
|
|
|
TQString m_ignoredUsers;
|
|
|
|
TQString m_ignoredUsers;
|
|
|
|
TQString command;
|
|
|
|
TQCString command;
|
|
|
|
|
|
|
|
|
|
|
|
systemconfig = new KSimpleConfig( TQString::fromLatin1( KDE_CONFDIR "/ldap/ldapconfigrc" ));
|
|
|
|
systemconfig = new KSimpleConfig( TQString::fromLatin1( KDE_CONFDIR "/ldap/ldapconfigrc" ));
|
|
|
|
systemconfig->setGroup(NULL);
|
|
|
|
systemconfig->setGroup(NULL);
|
|
|
@ -3354,9 +3354,9 @@ int LDAPManager::writeLDAPConfFile(LDAPRealmConfig realmcfg, LDAPMachineRole mac
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
command = TQString("ln -s %1 %2").arg(LDAP_FILE).arg(LDAP_SECONDARY_FILE);
|
|
|
|
command = TQString("ln -s %1 %2").arg(LDAP_FILE).arg(LDAP_SECONDARY_FILE).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command.ascii());
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
@ -3367,9 +3367,9 @@ int LDAPManager::writeLDAPConfFile(LDAPRealmConfig realmcfg, LDAPMachineRole mac
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
command = TQString("ln -s %1 %2").arg(LDAP_FILE).arg(LDAP_TERTIARY_FILE);
|
|
|
|
command = TQString("ln -s %1 %2").arg(LDAP_FILE).arg(LDAP_TERTIARY_FILE).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command.ascii());
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
@ -4261,10 +4261,10 @@ int LDAPManager::writePrimaryRealmCertificateUpdateCronFile(TQString *errstr) {
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
int LDAPManager::installCACertificateInHostCAStore(TQString *errstr) {
|
|
|
|
int LDAPManager::installCACertificateInHostCAStore(TQString *errstr) {
|
|
|
|
TQString command;
|
|
|
|
TQCString command;
|
|
|
|
|
|
|
|
|
|
|
|
if (!TQDir(SYSTEM_CA_STORE_CERT_LOCATION "ldap-trinity").exists()) {
|
|
|
|
if (!TQDir(SYSTEM_CA_STORE_CERT_LOCATION "ldap-trinity").exists()) {
|
|
|
|
command = TQString("ln -s %1 %2").arg(KERBEROS_PKI_PUBLICDIR).arg(SYSTEM_CA_STORE_CERT_LOCATION "ldap-trinity");
|
|
|
|
command = TQString("ln -s %1 %2").arg(KERBEROS_PKI_PUBLICDIR).arg(SYSTEM_CA_STORE_CERT_LOCATION "ldap-trinity").local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
@ -4443,7 +4443,7 @@ TQDateTime LDAPManager::getCertificateExpiration(TQString certfile) {
|
|
|
|
|
|
|
|
|
|
|
|
int LDAPManager::generatePublicKerberosCACertificate(LDAPCertConfig certinfo, LDAPRealmConfig realmcfg) {
|
|
|
|
int LDAPManager::generatePublicKerberosCACertificate(LDAPCertConfig certinfo, LDAPRealmConfig realmcfg) {
|
|
|
|
TQString errstr;
|
|
|
|
TQString errstr;
|
|
|
|
TQString command;
|
|
|
|
TQCString command;
|
|
|
|
TQString subject;
|
|
|
|
TQString subject;
|
|
|
|
|
|
|
|
|
|
|
|
if (writeOpenSSLConfigurationFile(realmcfg, &errstr) != 0) {
|
|
|
|
if (writeOpenSSLConfigurationFile(realmcfg, &errstr) != 0) {
|
|
|
@ -4451,9 +4451,9 @@ int LDAPManager::generatePublicKerberosCACertificate(LDAPCertConfig certinfo, LD
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
subject = TQString("/C=%1/ST=%2/L=%3/O=%4/OU=%5/CN=%6/emailAddress=%7").arg(certinfo.countryName).arg(certinfo.stateOrProvinceName).arg(certinfo.localityName).arg(certinfo.organizationName).arg(certinfo.orgUnitName).arg(certinfo.commonName).arg(certinfo.emailAddress);
|
|
|
|
subject = TQString("/C=%1/ST=%2/L=%3/O=%4/OU=%5/CN=%6/emailAddress=%7").arg(certinfo.countryName).arg(certinfo.stateOrProvinceName).arg(certinfo.localityName).arg(certinfo.organizationName).arg(certinfo.orgUnitName).arg(certinfo.commonName).arg(certinfo.emailAddress);
|
|
|
|
command = TQString("openssl req -days %1 -key \"%2\" -new -x509 -out \"%3\" -config \"%4\" -subj \"%5\"").arg(certinfo.caExpiryDays).arg(KERBEROS_PKI_PEMKEY_FILE).arg(KERBEROS_PKI_PEM_FILE).arg(OPENSSL_EXTENSIONS_FILE).arg(subject);
|
|
|
|
command = TQString("openssl req -days %1 -key \"%2\" -new -x509 -out \"%3\" -config \"%4\" -subj \"%5\"").arg(certinfo.caExpiryDays).arg(KERBEROS_PKI_PEMKEY_FILE).arg(KERBEROS_PKI_PEM_FILE).arg(OPENSSL_EXTENSIONS_FILE).arg(subject).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
printf("ERROR: Execution of \"%s\" failed!\n", command.ascii());
|
|
|
|
printf("ERROR: Execution of \"%s\" failed!\n", command.data());
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (chmod(KERBEROS_PKI_PEM_FILE, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH) < 0) {
|
|
|
|
if (chmod(KERBEROS_PKI_PEM_FILE, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH) < 0) {
|
|
|
@ -4470,7 +4470,7 @@ int LDAPManager::generatePublicKerberosCACertificate(LDAPCertConfig certinfo, LD
|
|
|
|
|
|
|
|
|
|
|
|
int LDAPManager::generatePublicKerberosCertificate(LDAPCertConfig certinfo, LDAPRealmConfig realmcfg) {
|
|
|
|
int LDAPManager::generatePublicKerberosCertificate(LDAPCertConfig certinfo, LDAPRealmConfig realmcfg) {
|
|
|
|
TQString errstr;
|
|
|
|
TQString errstr;
|
|
|
|
TQString command;
|
|
|
|
TQCString command;
|
|
|
|
TQString subject;
|
|
|
|
TQString subject;
|
|
|
|
|
|
|
|
|
|
|
|
if (writeOpenSSLConfigurationFile(realmcfg, &errstr) != 0) {
|
|
|
|
if (writeOpenSSLConfigurationFile(realmcfg, &errstr) != 0) {
|
|
|
@ -4491,14 +4491,14 @@ int LDAPManager::generatePublicKerberosCertificate(LDAPCertConfig certinfo, LDAP
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
subject = TQString("/C=%1/ST=%2/L=%3/O=%4/OU=%5%6%7").arg(certinfo.countryName).arg(certinfo.stateOrProvinceName).arg(certinfo.localityName).arg(certinfo.organizationName).arg(certinfo.orgUnitName).arg(openssldcForRealm(realmcfg.name)).arg(common_name);
|
|
|
|
subject = TQString("/C=%1/ST=%2/L=%3/O=%4/OU=%5%6%7").arg(certinfo.countryName).arg(certinfo.stateOrProvinceName).arg(certinfo.localityName).arg(certinfo.organizationName).arg(certinfo.orgUnitName).arg(openssldcForRealm(realmcfg.name)).arg(common_name);
|
|
|
|
command = TQString("openssl req -days %1 -new -out \"%2\" -key \"%3\" -config \"%4\" -subj \"%5\"").arg(certinfo.kerberosExpiryDays).arg(kdc_reqfile).arg(kdc_keyfile).arg(OPENSSL_EXTENSIONS_FILE).arg(subject);
|
|
|
|
command = TQString("openssl req -days %1 -new -out \"%2\" -key \"%3\" -config \"%4\" -subj \"%5\"").arg(certinfo.kerberosExpiryDays).arg(kdc_reqfile).arg(kdc_keyfile).arg(OPENSSL_EXTENSIONS_FILE).arg(subject).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
printf("ERROR: Execution of \"%s\" failed!\n", command.ascii());
|
|
|
|
printf("ERROR: Execution of \"%s\" failed!\n", command.data());
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
command = TQString("openssl x509 -req -days %1 -in \"%2\" -CAkey \"%3\" -CA \"%4\" -out \"%5\" -extfile \"%6\" -extensions pkinit_kdc_cert -CAcreateserial").arg(certinfo.kerberosExpiryDays).arg(kdc_reqfile).arg(KERBEROS_PKI_PEMKEY_FILE).arg(KERBEROS_PKI_PEM_FILE).arg(kdc_certfile).arg(OPENSSL_EXTENSIONS_FILE);
|
|
|
|
command = TQString("openssl x509 -req -days %1 -in \"%2\" -CAkey \"%3\" -CA \"%4\" -out \"%5\" -extfile \"%6\" -extensions pkinit_kdc_cert -CAcreateserial").arg(certinfo.kerberosExpiryDays).arg(kdc_reqfile).arg(KERBEROS_PKI_PEMKEY_FILE).arg(KERBEROS_PKI_PEM_FILE).arg(kdc_certfile).arg(OPENSSL_EXTENSIONS_FILE).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
printf("ERROR: Execution of \"%s\" failed!\n", command.ascii());
|
|
|
|
printf("ERROR: Execution of \"%s\" failed!\n", command.data());
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (chmod(kdc_certfile.ascii(), S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH) < 0) {
|
|
|
|
if (chmod(kdc_certfile.ascii(), S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH) < 0) {
|
|
|
@ -4521,7 +4521,7 @@ int LDAPManager::generatePublicKerberosCertificate(LDAPCertConfig certinfo, LDAP
|
|
|
|
|
|
|
|
|
|
|
|
int LDAPManager::generatePublicLDAPCertificate(LDAPCertConfig certinfo, LDAPRealmConfig realmcfg, uid_t ldap_uid, gid_t ldap_gid) {
|
|
|
|
int LDAPManager::generatePublicLDAPCertificate(LDAPCertConfig certinfo, LDAPRealmConfig realmcfg, uid_t ldap_uid, gid_t ldap_gid) {
|
|
|
|
TQString errstr;
|
|
|
|
TQString errstr;
|
|
|
|
TQString command;
|
|
|
|
TQCString command;
|
|
|
|
TQString subject;
|
|
|
|
TQString subject;
|
|
|
|
|
|
|
|
|
|
|
|
if (writeOpenSSLConfigurationFile(realmcfg, &errstr) != 0) {
|
|
|
|
if (writeOpenSSLConfigurationFile(realmcfg, &errstr) != 0) {
|
|
|
@ -4542,14 +4542,14 @@ int LDAPManager::generatePublicLDAPCertificate(LDAPCertConfig certinfo, LDAPReal
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
subject = TQString("/C=%1/ST=%2/L=%3/O=%4/OU=%5%6%7").arg(certinfo.countryName).arg(certinfo.stateOrProvinceName).arg(certinfo.localityName).arg(certinfo.organizationName).arg(certinfo.orgUnitName).arg(openssldcForRealm(realmcfg.name)).arg(common_name);
|
|
|
|
subject = TQString("/C=%1/ST=%2/L=%3/O=%4/OU=%5%6%7").arg(certinfo.countryName).arg(certinfo.stateOrProvinceName).arg(certinfo.localityName).arg(certinfo.organizationName).arg(certinfo.orgUnitName).arg(openssldcForRealm(realmcfg.name)).arg(common_name);
|
|
|
|
command = TQString("openssl req -days %1 -new -out \"%2\" -key \"%3\" -config \"%4\" -subj \"%5\"").arg(certinfo.ldapExpiryDays).arg(ldap_reqfile).arg(ldap_keyfile).arg(OPENSSL_EXTENSIONS_FILE).arg(subject);
|
|
|
|
command = TQString("openssl req -days %1 -new -out \"%2\" -key \"%3\" -config \"%4\" -subj \"%5\"").arg(certinfo.ldapExpiryDays).arg(ldap_reqfile).arg(ldap_keyfile).arg(OPENSSL_EXTENSIONS_FILE).arg(subject).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
printf("ERROR: Execution of \"%s\" failed!\n", command.ascii());
|
|
|
|
printf("ERROR: Execution of \"%s\" failed!\n", command.data());
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
command = TQString("openssl x509 -req -days %1 -in \"%2\" -CAkey \"%3\" -CA \"%4\" -out \"%5\" -CAcreateserial").arg(certinfo.ldapExpiryDays).arg(ldap_reqfile).arg(KERBEROS_PKI_PEMKEY_FILE).arg(KERBEROS_PKI_PEM_FILE).arg(ldap_certfile);
|
|
|
|
command = TQString("openssl x509 -req -days %1 -in \"%2\" -CAkey \"%3\" -CA \"%4\" -out \"%5\" -CAcreateserial").arg(certinfo.ldapExpiryDays).arg(ldap_reqfile).arg(KERBEROS_PKI_PEMKEY_FILE).arg(KERBEROS_PKI_PEM_FILE).arg(ldap_certfile).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
printf("ERROR: Execution of \"%s\" failed!\n", command.ascii());
|
|
|
|
printf("ERROR: Execution of \"%s\" failed!\n", command.data());
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (chmod(ldap_certfile.ascii(), S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH) < 0) {
|
|
|
|
if (chmod(ldap_certfile.ascii(), S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH) < 0) {
|
|
|
@ -4582,7 +4582,7 @@ int LDAPManager::generateClientCertificatePair(int expirydays, LDAPUserInfo user
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
int LDAPManager::generateClientCertificatePrivateKey(TQString privateKeyFile, int clientKeyBitLength, TQString *errstr) {
|
|
|
|
int LDAPManager::generateClientCertificatePrivateKey(TQString privateKeyFile, int clientKeyBitLength, TQString *errstr) {
|
|
|
|
TQString command;
|
|
|
|
TQCString command;
|
|
|
|
TQString subject;
|
|
|
|
TQString subject;
|
|
|
|
|
|
|
|
|
|
|
|
TQString client_keyfile = privateKeyFile;
|
|
|
|
TQString client_keyfile = privateKeyFile;
|
|
|
@ -4590,7 +4590,7 @@ int LDAPManager::generateClientCertificatePrivateKey(TQString privateKeyFile, in
|
|
|
|
TQString client_cfgfile = privateKeyFile + ".cfg";
|
|
|
|
TQString client_cfgfile = privateKeyFile + ".cfg";
|
|
|
|
|
|
|
|
|
|
|
|
// Create private key
|
|
|
|
// Create private key
|
|
|
|
command = TQString("openssl genrsa -out \"%1\" %2").arg(client_keyfile).arg(clientKeyBitLength);
|
|
|
|
command = TQString("openssl genrsa -out \"%1\" %2").arg(client_keyfile).arg(clientKeyBitLength).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
@ -4617,7 +4617,7 @@ int LDAPManager::generateClientCertificatePrivateKey(TQString privateKeyFile, in
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
int LDAPManager::generateClientCertificatePublicCertificate(int expirydays, LDAPUserInfo user, LDAPRealmConfig realmcfg, TQString signingPrivateKeyFile, TQString privateKeyFile, TQString publicCertFile, TQString autoLoginPIN, TQString *errstr) {
|
|
|
|
int LDAPManager::generateClientCertificatePublicCertificate(int expirydays, LDAPUserInfo user, LDAPRealmConfig realmcfg, TQString signingPrivateKeyFile, TQString privateKeyFile, TQString publicCertFile, TQString autoLoginPIN, TQString *errstr) {
|
|
|
|
TQString command;
|
|
|
|
TQCString command;
|
|
|
|
TQString subject;
|
|
|
|
TQString subject;
|
|
|
|
|
|
|
|
|
|
|
|
TQString client_certfile = publicCertFile;
|
|
|
|
TQString client_certfile = publicCertFile;
|
|
|
@ -4645,12 +4645,12 @@ int LDAPManager::generateClientCertificatePublicCertificate(int expirydays, LDAP
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
subject = TQString("%1%2").arg(openssldcForRealm(realmcfg.name)).arg(common_name);
|
|
|
|
subject = TQString("%1%2").arg(openssldcForRealm(realmcfg.name)).arg(common_name);
|
|
|
|
command = TQString("openssl req -days %1 -new -out \"%2\" -key \"%3\" -config \"%4\" -subj \"%5\"").arg(expirydays).arg(client_reqfile).arg(client_keyfile).arg(client_cfgfile).arg(subject);
|
|
|
|
command = TQString("openssl req -days %1 -new -out \"%2\" -key \"%3\" -config \"%4\" -subj \"%5\"").arg(expirydays).arg(client_reqfile).arg(client_keyfile).arg(client_cfgfile).arg(subject).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
command = TQString("openssl x509 -req -days %1 -in \"%2\" -CAkey \"%3\" -CA \"%4\" -out \"%5\" -extfile \"%6\" -extensions pkinit_client_cert -CAcreateserial").arg(expirydays).arg(client_reqfile).arg(signingPrivateKeyFile).arg(signing_public_certfile).arg(client_certfile).arg(client_cfgfile);
|
|
|
|
command = TQString("openssl x509 -req -days %1 -in \"%2\" -CAkey \"%3\" -CA \"%4\" -out \"%5\" -extfile \"%6\" -extensions pkinit_client_cert -CAcreateserial").arg(expirydays).arg(client_reqfile).arg(signingPrivateKeyFile).arg(signing_public_certfile).arg(client_certfile).arg(client_cfgfile).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
@ -4684,7 +4684,7 @@ int LDAPManager::generateClientCertificatePublicCertificate(int expirydays, LDAP
|
|
|
|
|
|
|
|
|
|
|
|
int LDAPManager::generatePKICRL(int expirydays, LDAPRealmConfig realmcfg, TQString crlFile, TQString signingPrivateKeyFile, TQString revocationDatabaseFile, TQString *errstr) {
|
|
|
|
int LDAPManager::generatePKICRL(int expirydays, LDAPRealmConfig realmcfg, TQString crlFile, TQString signingPrivateKeyFile, TQString revocationDatabaseFile, TQString *errstr) {
|
|
|
|
int retcode;
|
|
|
|
int retcode;
|
|
|
|
TQString command;
|
|
|
|
TQCString command;
|
|
|
|
|
|
|
|
|
|
|
|
LDAPUserInfoList userList = this->users(&retcode, errstr);
|
|
|
|
LDAPUserInfoList userList = this->users(&retcode, errstr);
|
|
|
|
if (retcode == 0) {
|
|
|
|
if (retcode == 0) {
|
|
|
@ -4703,18 +4703,18 @@ int LDAPManager::generatePKICRL(int expirydays, LDAPRealmConfig realmcfg, TQStri
|
|
|
|
if (writeOpenSSLConfigurationFile(realmcfg, LDAPUserInfo(), OPENSSL_EXTENSIONS_FILE, signingPrivateKeyFile, signing_public_certfile, revocationDatabaseFile, TQString::null, errstr) != 0) {
|
|
|
|
if (writeOpenSSLConfigurationFile(realmcfg, LDAPUserInfo(), OPENSSL_EXTENSIONS_FILE, signingPrivateKeyFile, signing_public_certfile, revocationDatabaseFile, TQString::null, errstr) != 0) {
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
command = TQString("rm -f %1").arg(revocationDatabaseFile);
|
|
|
|
command = TQString("rm -f %1").arg(revocationDatabaseFile).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
command = TQString("touch %1").arg(revocationDatabaseFile);
|
|
|
|
command = TQString("touch %1").arg(revocationDatabaseFile).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
command = TQString("openssl ca -days %1 -crldays %2 -gencrl -out \"%3\" -config \"%4\"").arg(expirydays).arg(expirydays).arg(crl_certfile).arg(OPENSSL_EXTENSIONS_FILE);
|
|
|
|
command = TQString("openssl ca -days %1 -crldays %2 -gencrl -out \"%3\" -config \"%4\"").arg(expirydays).arg(expirydays).arg(crl_certfile).arg(OPENSSL_EXTENSIONS_FILE).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
@ -4755,7 +4755,7 @@ int LDAPManager::generatePKICRL(int expirydays, LDAPRealmConfig realmcfg, TQStri
|
|
|
|
revokedCertFile.writeBlock(certificateData.second);
|
|
|
|
revokedCertFile.writeBlock(certificateData.second);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
command = TQString("openssl ca -revoke \"%1\" -config \"%2\"").arg(revoked_certfile).arg(OPENSSL_EXTENSIONS_FILE);
|
|
|
|
command = TQString("openssl ca -revoke \"%1\" -config \"%2\"").arg(revoked_certfile).arg(OPENSSL_EXTENSIONS_FILE).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
@ -4773,7 +4773,7 @@ int LDAPManager::generatePKICRL(int expirydays, LDAPRealmConfig realmcfg, TQStri
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Regenerate CRL certificate
|
|
|
|
// Regenerate CRL certificate
|
|
|
|
command = TQString("openssl ca -days %1 -crldays %2 -gencrl -out \"%3\" -config \"%4\"").arg(expirydays).arg(expirydays).arg(crl_certfile).arg(OPENSSL_EXTENSIONS_FILE);
|
|
|
|
command = TQString("openssl ca -days %1 -crldays %2 -gencrl -out \"%3\" -config \"%4\"").arg(expirydays).arg(expirydays).arg(crl_certfile).arg(OPENSSL_EXTENSIONS_FILE).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
if (errstr) *errstr = TQString("Execution of \"%s\" failed").arg(command);
|
|
|
|
return -1;
|
|
|
|
return -1;
|
|
|
@ -5282,7 +5282,7 @@ int LDAPManager::writeOpenSSLConfigurationFile(LDAPRealmConfig realmcfg, LDAPUse
|
|
|
|
TQString tde_cert_dir_path = tde_cert_file_info.dirPath(true);
|
|
|
|
TQString tde_cert_dir_path = tde_cert_file_info.dirPath(true);
|
|
|
|
TQDir tde_cert_dir(tde_cert_dir_path);
|
|
|
|
TQDir tde_cert_dir(tde_cert_dir_path);
|
|
|
|
if (!tde_cert_dir.exists()) {
|
|
|
|
if (!tde_cert_dir.exists()) {
|
|
|
|
TQString command = TQString("mkdir -p %1").arg(tde_cert_dir_path);
|
|
|
|
TQCString command = TQString("mkdir -p %1").arg(tde_cert_dir_path).local8Bit();
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (system(command) < 0) {
|
|
|
|
if (errstr) {
|
|
|
|
if (errstr) {
|
|
|
|
*errstr = i18n("Could not create directory '%1'").arg(tde_cert_dir_path);
|
|
|
|
*errstr = i18n("Could not create directory '%1'").arg(tde_cert_dir_path);
|
|
|
|