<?xml version="1.0" encoding="UTF-8" standalone="no"?>

<!DOCTYPE stax SYSTEM "/stax.dtd">

<stax>

<!-- **************************************************** -->

<!-- generate a certificate -->

<!-- **************************************************** -->

<function name="genCertificate">

<function-prolog>

This function generates a server certificate

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

</function-arg-def>

<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">

<function-arg-description>

Pathname to installation root

</function-arg-description>

</function-arg-def>

<function-arg-def name="certAlias" type="optional" default="'server-cert'">

<function-arg-description>

Alias certificate

</function-arg-description>

</function-arg-def>

<function-arg-def name="dname" type="optional" default="'cn=server,O=Sun Microsystems,C=US'">

<function-arg-description>

Certificate subject

</function-arg-description>

</function-arg-def>

<function-arg-def name="keystore" type="optional" default="'keystore'">

<function-arg-description>

Path for the key store file

</function-arg-description>

</function-arg-def>

<function-arg-def name="storepass" type="optional" default="'servercert'">

<function-arg-description>

Password to protect the contents of the key store

</function-arg-description>

</function-arg-def>

<function-arg-def name="keypass" type="optional" default="'servercert'">

<function-arg-description>

Password to protect the private key on the key store: keypass

</function-arg-description>

</function-arg-def>

<function-arg-def name="storetype" type="optional" default="'JKS'">

<function-arg-description>

The storetype. can be JKS or PKCS12

</function-arg-description>

</function-arg-def>

<function-arg-def name="expectedRC" type="optional" default="0">

<function-arg-description>

Expected return code value. Default value is 0.

Wildcard 'noCheck' to not check the RC

</function-arg-description>

</function-arg-def>

</function-map-args>

<sequence>

<!-- Local variables -->

<script>

if dsPath:

dsConfigPath='%s/config' % (dsPath)

dsBinPath='%s/%s' % (dsPath,fileFolder)

</script>

<call function="'runCommand'">

{ 'name' : 'Generate a Certificate',

'location' : location,

'command' : '%s/bin/keytool' % JAVA_HOME,

'arguments' : '-genkey -alias %s -keyalg rsa -dname "%s" -keystore %s -storepass %s -keypass %s -storetype %s ' % (certAlias,dname,keystore,storepass,keypass,storetype),

'path' : dsConfigPath,

'expectedRC': expectedRC

}

</call>

<return>STAXResult</return>

</sequence>

</function>

<!-- **************************************************** -->

<!-- Self signed a certificate -->

<!-- **************************************************** -->

<function name="SelfSignCertificate">

<function-prolog>

This function self-signs a certificate

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

</function-arg-def>

<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">

<function-arg-description>

Pathname to installation root

</function-arg-description>

</function-arg-def>

<function-arg-def name="certAlias" type="optional" default="'server-cert'">

<function-arg-description>

Alias certificate

</function-arg-description>

</function-arg-def>

<function-arg-def name="keystore" type="optional" default="'keystore'">

<function-arg-description>

Path for the key store file

</function-arg-description>

</function-arg-def>

<function-arg-def name="storepass" type="optional" default="'servercert'">

<function-arg-description>

Password to protect the contents of the key store

</function-arg-description>

</function-arg-def>

<function-arg-def name="keypass" type="optional" default="'servercert'">

<function-arg-description>

Password to protect the private key on the key store: keypass

</function-arg-description>

</function-arg-def>

<function-arg-def name="storetype" type="optional" default="'JKS'">

<function-arg-description>

The storetype. can be JKS or PKCS12

</function-arg-description>

</function-arg-def>

<function-arg-def name="expectedRC" type="optional" default="0">

<function-arg-description>

Expected return code value. Default value is 0.

Wildcard 'noCheck' to not check the RC

</function-arg-description>

</function-arg-def>

</function-map-args>

<sequence>

<!-- Local variables -->

<script>

if dsPath:

dsConfigPath='%s/config' % (dsPath)

dsBinPath='%s/%s' % (dsPath,fileFolder)

</script>

<call function="'runCommand'" >

{ 'name' : 'Generate a Self-Signed Server Certificate',

'location' : location,

'command' : '%s/bin/keytool' % JAVA_HOME,

'arguments' : '-selfcert -alias %s -keystore "%s" -keypass "%s" -storepass "%s" -storetype "%s" ' % (certAlias,keystore,keypass,storepass,storetype),

'path' : dsConfigPath,

'expectedRC': expectedRC

}

</call>

<return>STAXResult</return>

</sequence>

</function>

<!-- **************************************************** -->

<!-- Export a certificate -->

<!-- **************************************************** -->

<function name="ExportCertificate">

<function-prolog>

This function exports a certificate

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

</function-arg-def>

<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">

<function-arg-description>

Pathname to installation root

</function-arg-description>

</function-arg-def>

<function-arg-def name="certAlias" type="optional" default="'server-cert'">

<function-arg-description>

Alias certificate

</function-arg-description>

</function-arg-def>

<function-arg-def name="keystore" type="optional" default="'keystore'">

<function-arg-description>

Path for the key store file

</function-arg-description>

</function-arg-def>

<function-arg-def name="storepass" type="optional" default="'servercert'">

<function-arg-description>

Password to protect the contents of the key store

</function-arg-description>

</function-arg-def>

<function-arg-def name="format" type="optional">

<function-arg-description>

Format of the certificate. By default, it's in binary encoding

</function-arg-description>

</function-arg-def>

<function-arg-def name="storetype" type="optional" default="'JKS'">

<function-arg-description>

The storetype. can be JKS or PKCS12

</function-arg-description>

</function-arg-def>

<function-arg-def name="outputfile" type="required">

<function-arg-description>

Output file to store certificate

</function-arg-description>

</function-arg-def>

<function-arg-def name="expectedRC" type="optional" default="0">

<function-arg-description>

Expected return code value. Default value is 0.

Wildcard 'noCheck' to not check the RC

</function-arg-description>

</function-arg-def>

</function-map-args>

<sequence>

<!-- Local variables -->

<script>

if dsPath:

dsConfigPath='%s/config' % (dsPath)

dsBinPath='%s/%s' % (dsPath,fileFolder)

STAFCmdParams=''

if format:

STAFCmdParams='-%s' % (format)

</script>

<call function="'runCommand'">

{ 'name' : 'Export a Certificate',

'location' : location,

'command' : '%s/bin/keytool' % JAVA_HOME,

'arguments' : '-export -alias %s -file %s -keystore "%s" -storepass "%s" -storetype %s %s' % (certAlias,outputfile,keystore,storepass,storetype,STAFCmdParams),

'path' : dsConfigPath,

'expectedRC' : expectedRC

}

</call>

<return>STAXResult</return>

</sequence>

</function>

<!-- **************************************************** -->

<!-- Import a certificate -->

<!-- **************************************************** -->

<function name="ImportCertificate">

<function-prolog>

This function imports a certificate

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

</function-arg-def>

<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">

<function-arg-description>

Pathname to installation root

</function-arg-description>

</function-arg-def>

<function-arg-def name="certAlias" type="optional" default="'server-cert'">

<function-arg-description>

Alias certificate

</function-arg-description>

</function-arg-def>

<function-arg-def name="keystore" type="optional" default="'keystore'">

<function-arg-description>

Path for the key store file

</function-arg-description>

</function-arg-def>

<function-arg-def name="storepass" type="optional" default="'servercert'">

<function-arg-description>

Password to protect the contents of the key store

</function-arg-description>

</function-arg-def>

<function-arg-def name="storetype" type="optional" default="'JKS'">

<function-arg-description>

The storetype. can be JKS or PKCS12

</function-arg-description>

</function-arg-def>

<function-arg-def name="inputfile" type="required">

<function-arg-description>

Certificate to import

</function-arg-description>

</function-arg-def>

<function-arg-def name="expectedRC" type="optional" default="0">

<function-arg-description>

Expected return code value. Default value is 0.

Wildcard 'noCheck' to not check the RC

</function-arg-description>

</function-arg-def>

</function-map-args>

<sequence>

<!-- Local variables -->

<script>

if dsPath:

dsConfigPath='%s/config' % (dsPath)

dsBinPath='%s/%s' % (dsPath,fileFolder)

</script>

<call function="'runCommand'">

{ 'name' : 'Import a Certificate',

'location' : location,

'command' : '%s/bin/keytool' % JAVA_HOME,

'arguments' : '-import -alias %s -file %s -keystore "%s" -storepass "%s" -storetype %s -noprompt' % (certAlias,inputfile,keystore,storepass,storetype),

'path' : dsConfigPath,

'expectedRC' : expectedRC

}

</call>

<return>STAXResult</return>

</sequence>

</function>

<!-- **************************************************** -->

<!-- List a certificate -->

<!-- **************************************************** -->

<function name="ListCertificate">

<function-prolog>

This function lists a certificate

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

</function-arg-def>

<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">

<function-arg-description>

Pathname to installation root

</function-arg-description>

</function-arg-def>

<function-arg-def name="certAlias" type="optional" default="'server-cert'">

<function-arg-description>

Alias certificate

</function-arg-description>

</function-arg-def>

<function-arg-def name="keystore" type="optional" default="'keystore'">

<function-arg-description>

Path for the key store file

</function-arg-description>

</function-arg-def>

<function-arg-def name="storepass" type="optional" default="'servercert'">

<function-arg-description>

Password to protect the contents of the key store

</function-arg-description>

</function-arg-def>

<function-arg-def name="expectedRC" type="optional" default="0">

<function-arg-description>

Expected return code value. Default value is 0.

Wildcard 'noCheck' to not check the RC

</function-arg-description>

</function-arg-def>

</function-map-args>

<sequence>

<!-- Local variables -->

<script>

if dsPath:

dsConfigPath='%s/config' % (dsPath)

dsBinPath='%s/%s' % (dsPath,fileFolder)

STAFCmdParamsList=[]

STAFCmdParams=''

STAFCmdParamsList.append('-list')

STAFCmdParamsList.append('-v')

if certAlias:

STAFCmdParamsList.append('-alias %s' % certAlias)

if keystore:

STAFCmdParamsList.append('-keystore %s' % keystore)

if storepass:

STAFCmdParamsList.append('-storepass %s' % storepass)

STAFCmdParams=' '.join(STAFCmdParamsList)

</script>

<call function="'runCommand'">

{ 'name' : 'List a Certificate',

'location' : location,

'command' : '%s/bin/keytool' % JAVA_HOME,

'arguments' : STAFCmdParams ,

'path' : dsConfigPath,

'expectedRC' : expectedRC

}

</call>

<return>STAXResult</return>

</sequence>

</function>

<!-- **************************************************** -->

<!-- Add certificate to an attribute -->

<!-- **************************************************** -->

<function name="addCertificate">

<function-prolog>

This function add certificate to an user attribute

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

</function-arg-def>

<function-arg-def name="user_cert_file_rfc" type="required" default="''">

<function-arg-description>

Path to certificate RFC file

</function-arg-description>

</function-arg-def>

<function-arg-def name="userdn" type="optional" default="''">

<function-arg-description>

User DN to modify

</function-arg-description>

</function-arg-def>

<function-arg-def name="ldif_path" type="required" default="''">

<function-arg-description>

Path to the ldif file

</function-arg-description>

</function-arg-def>

</function-map-args>

<sequence>

<call function="'getFile'">

{

'location' : STAF_REMOTE_HOSTNAME,

'filename' : user_cert_file_rfc

}

</call>

<message>

'Certificate contents:\n %s' % cmdResult

</message>

<!-- Extract BEGIN CERTIFICATE and END CERTIFICATE -->

<script>

certList=STAXResult[1].split('\n')

ret_str = ""

for line in certList:

index_cert = line.find("CERTIFICATE")

if index_cert == -1:

ret_str+=line.strip()

</script>

<script>

listAttr = []

listAttr.append('dn: %s' %userdn)

listAttr.append('changetype: modify')

listAttr.append('add: objectclass')

listAttr.append('objectclass:ds-certificate-user')

listAttr.append('-')

listAttr.append('add: userCertificate;binary')

listAttr.append('userCertificate;binary:: %s' % ret_str)

</script>

<message>

'Create %s/client.ldif' % local.temp

</message>

<script>

addCertificateldif='%s/client.ldif' % local.temp

outfile = open(addCertificateldif,"w")

for line in listAttr:

outfile.write("%s\n" % line)

outfile.close()

</script>

<message>

'Copy %s/client.ldif to %s' % (local.temp,ldif_path)

</message>

<call function="'copyFile'">

{

'location' : STAXServiceMachine,

'srcfile' : '%s/client.ldif' % local.temp,

'destfile' : ldif_path,

'remotehost' : STAF_REMOTE_HOSTNAME

}

</call>

<call function="'modifyEntry'">

{

'dsInstanceHost' : DIRECTORY_INSTANCE_HOST,

'dsInstancePort' : DIRECTORY_INSTANCE_PORT,

'dsInstanceDn' : DIRECTORY_INSTANCE_DN,

'dsInstancePswd' : DIRECTORY_INSTANCE_PSWD,

'entryToBeModified' : ldif_path,

'expectedRC' : 0

}

</call>

</sequence>

</function>

<!-- **************************************************** -->

<!-- get MD5 and SHA1 values -->

<!-- **************************************************** -->

<function name="getFingerprint">

<function-prolog>

This function returns the fingerprint MD5 or SHA1

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

</function-arg-def>

<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">

<function-arg-description>

Pathname to installation root

</function-arg-description>

</function-arg-def>

<function-arg-def name="certAlias" type="optional" default="'server-cert'">

<function-arg-description>

Alias certificate

</function-arg-description>

</function-arg-def>

<function-arg-def name="keystore" type="optional" default="'keystore'">

<function-arg-description>

Path for the key store file

</function-arg-description>

</function-arg-def>

<function-arg-def name="storepass" type="optional" default="'servercert'">

<function-arg-description>

Password to protect the contents of the key store

</function-arg-description>

</function-arg-def>

<function-arg-def name="fingerprint" type="optional" default="'MD5'">

<function-arg-description>

fingerprint. can be MD5 or SHA1

</function-arg-description>

</function-arg-def>

<function-arg-def name="expectedRC" type="optional" default="0">

<function-arg-description>

Expected return code value. Default value is 0.

Wildcard 'noCheck' to not check the RC

</function-arg-description>

</function-arg-def>

</function-map-args>

<sequence>

<!-- Local variables -->

<script>

if dsPath:

dsConfigPath='%s/config' % (dsPath)

dsBinPath='%s/%s' % (dsPath,fileFolder)

</script>

<call function="'runCommand'">

{ 'name' : 'getFingerprint',

'location' : location,

'command' : '%s/bin/keytool' % JAVA_HOME,

'arguments' : ' -list -v -keystore "%s" -storepass "%s" -alias "%s"' % (keystore,storepass,certAlias),

'path' : dsConfigPath,

'expectedRC': expectedRC

}

</call>

<return>STAXResult</return>

</sequence>

</function>

<!-- ################################################## -->

<!-- configure SSL -->

<!-- ################################################## -->

<function name="configureSSL">

<function-prolog>

This function makes the configuration changes for SSL

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_BIN,OPENDSNAME)">

<function-arg-description>

Pathname to installation root

</function-arg-description>

<function-arg-property name="type" value="filepath"/>

</function-arg-def>

<function-arg-def name="dsInstanceHost" type="optional">

<function-arg-description>

Directory server hostname or IP address

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' % DIRECTORY_INSTANCE_ADMIN_PORT">

<function-arg-description>

Directory server admin port number

</function-arg-description>

<function-arg-property name="type" value="Port number"/>

</function-arg-def>

<function-arg-def name="dsInstanceDn" type="optional">

<function-arg-description>

Bind DN

</function-arg-description>

</function-arg-def>

<function-arg-def name="certAlias" type="optional" default="'server-cert'">

<function-arg-description>

Alias certificate

</function-arg-description>

<function-arg-property name="type" value="DN"/>

</function-arg-def>

<function-arg-def name="dsInstancePswd" type="optional">

<function-arg-description>

Bind password

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="keystoreFile" type="optional" default="'config/keystore'">

<function-arg-description>

Keystore File

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="keystoreType" type="optional" default="'JKS'">

<function-arg-description>

Keystore type : JKS or PKCS12

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="keystorePin" type="optional" default="'servercert'">

<function-arg-description>

Keystore pin

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="customKeyMgr" type="optional" default="''">

<function-arg-description>

Name for a new key manager

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="customTrustMgr" type="optional" default="''">

<function-arg-description>

Name for a new trust manager

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="extraParams" type="optional">

<function-arg-description>

Optional extra parameters for specific test cases

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

</function-map-args>

<sequence>

<!--- configure Key Manager Provider -->

<message>

'Configure Key Manager Provider'

</message>

<if expr="len(customKeyMgr.strip()) != 0">

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'create-key-manager-provider' ,

'objectType' : 'provider-name' ,

'objectName' : customKeyMgr ,

'optionsString' : '--type file-based --set enabled:true --set key-store-file:%s --set key-store-pin:%s --set key-store-type:JKS' % (keystoreFile,keystorePin),

'expectedRC' : 0

}

</call>

<else>

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-key-manager-provider-prop' ,

'objectType' : 'provider-name' ,

'objectName' : keystoreType,

'optionsString' : '--set key-store-file:config/keystore --reset key-store-pin-file --set key-store-pin:%s --set enabled:true' % keystorePin,

'expectedRC' : 0

}

</call>

</else>

</if>

<!--- configure Trust Manager Provider -->

<message>

'Configure Trust Manager Provider'

</message>

<if expr="len(customTrustMgr.strip()) != 0">

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'create-trust-manager-provider' ,

'objectType' : 'provider-name' ,

'objectName' : customTrustMgr ,

'optionsString' : '--type blind --set enabled:true --set java-class:org.opends.server.extensions.BlindTrustManagerProvider' ,

'expectedRC' : 0

}

</call>

<else>

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-trust-manager-provider-prop' ,

'objectType' : 'provider-name' ,

'objectName' : 'Blind Trust',

'optionsString' : '--set enabled:true' ,

'expectedRC' : 0

}

</call>

</else>

</if>

<!--- Enable LDAPS Connection Handler -->

<message>

'Enabling LDAPS Connection Handler - Keystore type'

</message>

<script>

option1='--set ssl-cert-nickname:%s' % certAlias

if customTrustMgr:

option2='--set trust-manager-provider:"%s"' % (customTrustMgr)

else:

option2='--set trust-manager-provider:"Blind Trust"'

if customKeyMgr:

option3='--set key-manager-provider:"%s"' % (customKeyMgr)

else:

option3='--set key-manager-provider:"%s"' % (keystoreType)

option4='--set listen-port:%s' % DIRECTORY_INSTANCE_SSL_PORT

option5='--set enabled:true --set use-ssl:true'

optionsString='%s %s %s %s %s' % (option1,option2,option3,option4,option5)

</script>

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-connection-handler-prop',

'objectType' : 'handler-name' ,

'objectName' : 'LDAPS Connection Handler',

'optionsString' : optionsString,

'expectedRC' : 0

}

</call>

</sequence>

</function>

<!-- ################################################## -->

<!-- configureTLS -->

<!-- ################################################## -->

<function name="configureTLS">

<function-prolog>

This function makes the configuration changes for startTLS

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_BIN,OPENDSNAME)">

<function-arg-description>

Pathname to installation root

</function-arg-description>

<function-arg-property name="type" value="filepath"/>

</function-arg-def>

<function-arg-def name="dsInstanceHost" type="optional">

<function-arg-description>

Directory server hostname or IP address

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' % DIRECTORY_INSTANCE_ADMIN_PORT">

<function-arg-description>

Directory server admin port number

</function-arg-description>

<function-arg-property name="type" value="Port number"/>

</function-arg-def>

<function-arg-def name="dsInstanceDn" type="optional">

<function-arg-description>

Bind DN

</function-arg-description>

<function-arg-property name="type" value="DN"/>

</function-arg-def>

<function-arg-def name="dsInstancePswd" type="optional">

<function-arg-description>

Bind password

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="keystorePin" type="optional" default="'servercert'">

<function-arg-description>

Keystore pin

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="keystoreFile" type="optional" default="'config/keystore'">

<function-arg-description>

Keystore file path

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="customKeyMgr" type="optional" default="''">

<function-arg-description>

Name for a new key manager

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="certAlias" type="optional" default="'server-cert'">

<function-arg-description>

Alias certificate

</function-arg-description>

</function-arg-def>

<function-arg-def name="keystoreType" type="optional" default="'JKS'">

<function-arg-description>

Keystore type : JKS or PKCS12

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="extraParams" type="optional">

<function-arg-description>

Optional extra parameters for specific test cases

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

</function-map-args>

<sequence>

<!--- configure Key Manager Provider -->

<message>

'Configure Key Manager Provider'

</message>

<if expr="len(customKeyMgr.strip()) != 0">

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'create-key-manager-provider' ,

'objectType' : 'provider-name' ,

'objectName' : customKeyMgr ,

'optionsString' : '--type file-based --set enabled:true --set key-store-file:%s --set key-store-pin:%s --set key-store-type:JKS' % (keystoreFile,keystorePin),

'expectedRC' : 0

}

</call>

<else>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort,

'dsInstanceDn' : dsInstanceDn,

'dsInstancePswd' : dsInstancePswd,

'subcommand' : 'set-key-manager-provider-prop',

'objectType' : 'provider-name',

'objectName' : keystoreType,

'optionsString' : '--set key-store-file:%s --reset key-store-pin-file --set key-store-pin:%s --set enabled:true' % (keystoreFile,keystorePin),

'expectedRC' : 0

}

</call>

</else>

</if>

<!--- configure Trust Manager Provider -->

<message>

'Configure Trust Manager Provider'

</message>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort,

'dsInstanceDn' : dsInstanceDn,

'dsInstancePswd' : dsInstancePswd,

'subcommand' : 'set-trust-manager-provider-prop',

'objectType' : 'provider-name',

'objectName' : 'Blind Trust',

'optionsString' : '--set enabled:true',

'expectedRC' : 0

}

</call>

<!--- Enable StartTLS -->

<message>

'Enabling StartTLS'

</message>

<script>

option1='--set ssl-cert-nickname:%s' % certAlias

option2='--set trust-manager-provider:"Blind Trust" '

if customKeyMgr:

option3='--set key-manager-provider:"%s"' % (customKeyMgr)

else:

option3='--set key-manager-provider:"%s"' % (keystoreType)

option4='--set allow-start-tls:true'

optionsString='%s %s %s %s' % (option1,option2,option3,option4)

</script>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort,

'dsInstanceDn' : dsInstanceDn,

'dsInstancePswd' : dsInstancePswd,

'subcommand' : 'set-connection-handler-prop',

'objectType' : 'handler-name',

'objectName' : 'LDAP Connection Handler',

'optionsString' : optionsString,

'expectedRC' : 0

}

</call>

</sequence>

</function>

<!-- ################################################## -->

<!-- configure SASL-->

<!-- ################################################## -->

<function name="configureSASL">

<function-prolog>

This function makes the configuration changes for SASL

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_DIR,OPENDSNAME)">

<function-arg-description>

Pathname to installation root

</function-arg-description>

<function-arg-property name="type" value="filepath"/>

</function-arg-def>

<function-arg-def name="dsInstanceHost" type="optional">

<function-arg-description>

Directory server hostname or IP address

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' % DIRECTORY_INSTANCE_ADMIN_PORT">

<function-arg-description>

Directory server admin port number

</function-arg-description>

<function-arg-property name="type" value="Port number"/>

</function-arg-def>

<function-arg-def name="dsInstanceDn" type="optional">

<function-arg-description>

Bind DN

</function-arg-description>

</function-arg-def>

<function-arg-def name="certAlias" type="optional" default="''">

<function-arg-description>

Alias certificate

</function-arg-description>

<function-arg-property name="type" value="DN"/>

</function-arg-def>

<function-arg-def name="dsInstancePswd" type="optional">

<function-arg-description>

Bind password

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="keystoreFile" type="optional" default="'config/keystore'">

<function-arg-description>

Keystore File

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="keystorePin" type="optional" default="'keystorepass'">

<function-arg-description>

Keystore pin

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="keystoreType" type="optional" default="'JKS'">

<function-arg-description>

Keystore type : JKS or PKCS12

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="createTrustMgr" type="optional" default="False">

<function-arg-description>

Create or enable custom key Manager.

</function-arg-description>

<function-arg-property name="type" value="enum">

<function-arg-property-description>

This argument can only have boolean values

</function-arg-property-description>

<function-arg-property-data type="choice" value="True"/>

<function-arg-property-data type="choice" value="False"/>

</function-arg-property>

</function-arg-def>

<function-arg-def name="createKeyMgr" type="optional" default="False">

<function-arg-description>

Create or enable custom key Manager.

</function-arg-description>

<function-arg-property name="type" value="enum">

<function-arg-property-description>

This argument can only have boolean values

</function-arg-property-description>

<function-arg-property-data type="choice" value="True"/>

<function-arg-property-data type="choice" value="False"/>

</function-arg-property>

</function-arg-def>

<function-arg-def name="KeyMgr" type="optional" default="''">

<function-arg-description>

Name for a new key manager

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="trustMgr" type="optional" default="''">

<function-arg-description>

Name for a new trust manager

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="truststoreFile" type="optional" default="'config/truststore'">

<function-arg-description>

Truststore File

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="truststoreType" type="optional" default="'JKS'">

<function-arg-description>

Truststore type : JKS or PKCS12

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="truststorePin" type="optional" default="'truststorepass'">

<function-arg-description>

Truststore pin

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="certMapper" type="optional" default="'Subject Equals DN'">

<function-arg-description>

Certificate mapper name

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="handlerName" type="optional" default="'EXTERNAL'">

<function-arg-description>

SASL mechanism handler name

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="optionSaSL" type="optional" default="''">

<function-arg-description>

SASL mechanism handler options

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="optionMapper" type="optional" default="''">

<function-arg-description>

Mapping options

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="extraParams" type="optional">

<function-arg-description>

Optional extra parameters for specific test cases

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

</function-map-args>

<sequence>

<!--- configure Key Manager Provider -->

<message>

'Configure Key Manager Provider'

</message>

<if expr="createKeyMgr == True">

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'create-key-manager-provider' ,

'objectType' : 'provider-name' ,

'objectName' : KeyMgr ,

'optionsString' : '--set key-store-file:%s --set key-store-pin:%s --set key-store-type:%s --type file-based --set enabled:true --no-prompt ' % (keystoreFile,keystorePin,truststoreType),

'expectedRC' : 0

}

</call>

<else>

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-key-manager-provider-prop' ,

'objectType' : 'provider-name' ,

'objectName' : KeyMgr,

'optionsString' : '--set key-store-file:%s --reset key-store-pin-file --set key-store-pin:%s --set enabled:true' % (keystoreFile,keystorePin),

'expectedRC' : 0

}

</call>

</else>

</if>

<!--- configure Trust Manager Provider -->

<message>

'Configure Trust Manager Provider'

</message>

<if expr="len(trustMgr.strip()) != 0">

<if expr="createTrustMgr == True">

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'create-trust-manager-provider' ,

'objectType' : 'provider-name' ,

'objectName' : trustMgr ,

'optionsString' : '--set trust-store-file:%s --set trust-store-pin:%s --type file-based --set trust-store-type:%s --set enabled:true ' %(truststoreFile,truststorePin,truststoreType),

'expectedRC' : 0

}

</call>

<else>

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-trust-manager-provider-prop' ,

'objectType' : 'provider-name' ,

'objectName' : trustMgr ,

'optionsString' : '--set trust-store-file:%s --set trust-store-pin:%s --set enabled:true' %(truststoreFile,truststorePin),

'expectedRC' : 0

}

</call>

</else>

</if>

<else>

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-trust-manager-provider-prop' ,

'objectType' : 'provider-name' ,

'objectName' : 'Blind Trust',

'optionsString' : '--set enabled:true' ,

'expectedRC' : 0

}

</call>

</else>

</if>

<!--- Enable LDAPS Connection Handler -->

<message>

'Enabling LDAPS Connection Handler - Keystore type'

</message>

<script>

option1='--set ssl-cert-nickname:%s' % certAlias

if trustMgr:

option2='--set trust-manager-provider:"%s"' % (trustMgr)

else:

option2='--set trust-manager-provider:"Blind Trust"'

option3='--set key-manager-provider:"%s"' % (KeyMgr)

option4='--set listen-port:%s' % DIRECTORY_INSTANCE_SSL_PORT

option5='--set enabled:true --set use-ssl:true --set ssl-client-auth-policy:required'

optionsString='%s %s %s %s %s' % (option1,option2,option3,option4,option5)

</script>

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-connection-handler-prop',

'objectType' : 'handler-name' ,

'objectName' : 'LDAPS Connection Handler',

'optionsString' : optionsString,

'expectedRC' : 0

}

</call>

<!--- Setting the mapper -->

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-certificate-mapper-prop',

'objectType' : 'mapper-name' ,

'objectName' : certMapper,

'optionsString' : '--set enabled:true --no-prompt %s'%optionMapper,

'expectedRC' : 0

}

</call>

<!--- Setting the sasl mechanism -->

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-sasl-mechanism-handler-prop',

'objectType' : 'handler-name' ,

'objectName' : handlerName,

'optionsString' : '--set certificate-mapper:"%s" --set enabled:true --no-prompt %s'%(certMapper,optionSaSL),

'expectedRC' : 0

}

</call>

</sequence>

</function>

<!-- ################################################## -->

<!-- configure SSL and TLS -->

<!-- ################################################## -->

<function name="configureSSL_TLS">

<function-prolog>

This function makes the configuration changes for SSL and TLS

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_BIN,OPENDSNAME)">

<function-arg-description>

Pathname to installation root

</function-arg-description>

<function-arg-property name="type" value="filepath"/>

</function-arg-def>

<function-arg-def name="dsInstanceHost" type="optional">

<function-arg-description>

Directory server hostname or IP address

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' % DIRECTORY_INSTANCE_ADMIN_PORT">

<function-arg-description>

Directory server admin port number

</function-arg-description>

<function-arg-property name="type" value="Port number"/>

</function-arg-def>

<function-arg-def name="dsInstanceDn" type="optional">

<function-arg-description>

Bind DN

</function-arg-description>

<function-arg-property name="type" value="DN"/>

</function-arg-def>

<function-arg-def name="dsInstancePswd" type="optional">

<function-arg-description>

Bind password

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="keystoreType" type="optional" default="'JKS'">

<function-arg-description>

Keystore type : JKS or PKCS12

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="certAlias" type="optional" default="'server-cert'">

<function-arg-description>

Alias certificate

</function-arg-description>

</function-arg-def>

<function-arg-def name="keystorePin" type="optional" default="'servercert'">

<function-arg-description>

Keystore pin

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="extraParams" type="optional">

<function-arg-description>

Optional extra parameters for specific test cases

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

</function-map-args>

<sequence>

<!--- configure Key Manager Provider -->

<message>

'Configure Key Manager Provider'

</message>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-key-manager-provider-prop' ,

'objectType' : 'provider-name' ,

'objectName' : keystoreType,

'optionsString' : '--set key-store-file:config/keystore --reset key-store-pin-file --set key-store-pin:%s --set enabled:true' % keystorePin,

'expectedRC' : 0

}

</call>

<!--- configure Trust Manager Provider -->

<message>

'Configure Trust Manager Provider'

</message>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-trust-manager-provider-prop' ,

'objectType' : 'provider-name' ,

'objectName' : 'Blind Trust',

'optionsString' : '--set enabled:true' ,

'expectedRC' : 0

}

</call>

<!--- Enable LDAPS Connection Handler -->

<message>

'Enabling LDAPS Connection Handler - Keystore type'

</message>

<script>

option1='--set ssl-cert-nickname:%s' % certAlias

option2='--set trust-manager-provider:"Blind Trust"'

option3='--set key-manager-provider:"%s"' % (keystoreType)

option4='--set listen-port:%s' % DIRECTORY_INSTANCE_SSL_PORT

option5='--set enabled:true --set use-ssl:true'

optionsString='%s %s %s %s %s' % (option1,option2,option3,option4,option5)

</script>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort,

'dsInstanceDn' : dsInstanceDn,

'dsInstancePswd' : dsInstancePswd,

'subcommand' : 'set-connection-handler-prop',

'objectType' : 'handler-name',

'objectName' : 'LDAPS Connection Handler',

'optionsString' : optionsString,

'expectedRC' : 0

}

</call>

<!--- Enable StartTLS -->

<message>

'Enabling StartTLS'

</message>

<script>

option1='--set ssl-cert-nickname:%s' % certAlias

option2='--set trust-manager-provider:"Blind Trust" '

option3='--set key-manager-provider:"%s"' % (keystoreType)

option4='--set allow-start-tls:true'

optionsString='%s %s %s %s' % (option1,option2,option3,option4)

</script>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort,

'dsInstanceDn' : dsInstanceDn,

'dsInstancePswd' : dsInstancePswd,

'subcommand' : 'set-connection-handler-prop',

'objectType' : 'handler-name',

'objectName' : 'LDAP Connection Handler',

'optionsString' : optionsString,

'expectedRC' : 0

}

</call>

</sequence>

</function>

<!-- ################################################## -->

<!-- Unconfigure SSL -->

<!-- ################################################## -->

<function name="unconfigureSSL">

<function-prolog>

This function reverses the configuration changes for SSL

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_BIN,OPENDSNAME)">

<function-arg-description>

Pathname to installation root

</function-arg-description>

<function-arg-property name="type" value="filepath"/>

</function-arg-def>

<function-arg-def name="dsInstanceHost" type="optional">

<function-arg-description>

Directory server hostname or IP address

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' %DIRECTORY_INSTANCE_ADMIN_PORT">

<function-arg-description>

Directory server admin port number

</function-arg-description>

<function-arg-property name="type" value="Port number"/>

</function-arg-def>

<function-arg-def name="dsInstanceDn" type="optional">

<function-arg-description>

Bind DN

</function-arg-description>

<function-arg-property name="type" value="DN"/>

</function-arg-def>

<function-arg-def name="dsInstancePswd" type="optional">

<function-arg-description>

Bind password

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="keystoreType" type="optional" default="'JKS'">

<function-arg-description>

Keystore type : JKS or PKCS12

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="customKeyMgr" type="optional" default="''">

<function-arg-description>

Name for a new key manager

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="customTrustMgr" type="optional" default="''">

<function-arg-description>

Name for a new trust manager

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="extraParams" type="optional">

<function-arg-description>

Optional extra parameters for specific test cases

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

</function-map-args>

<sequence>

<!--- Disable LDAPS Connection Handler -->

<message>

'Disabling LDAPS Connection Handler'

</message>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-connection-handler-prop' ,

'objectType' : 'handler-name' ,

'objectName' : 'LDAPS Connection Handler',

'optionsString' : '--set enabled:false --set use-ssl:false',

'expectedRC' : 0

}

</call>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-connection-handler-prop' ,

'objectType' : 'handler-name' ,

'objectName' : 'LDAPS Connection Handler',

'optionsString' : '--reset key-manager-provider --reset trust-manager-provider --reset ssl-cert-nickname',

'expectedRC' : 0

}

</call>

<!--- Disable SSL Trust Manager Provider -->

<message>

'Disabling SSL Trust Manager Provider'

</message>

<if expr="len(customTrustMgr.strip()) != 0">

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'delete-trust-manager-provider' ,

'objectType' : 'provider-name' ,

'objectName' : customTrustMgr ,

'expectedRC' : 0

}

</call>

<else>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort,

'dsInstanceDn' : dsInstanceDn,

'dsInstancePswd' : dsInstancePswd,

'subcommand' : 'set-trust-manager-provider-prop',

'objectType' : 'provider-name',

'objectName' : 'Blind Trust',

'optionsString' : '--set enabled:false',

'expectedRC' : 0

}

</call>

</else>

</if>

<!--- Disable Key Manager Provider -->

<message>

'Disabling Key Manager Provider'

</message>

<if expr="len(customKeyMgr.strip()) != 0">

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'delete-key-manager-provider' ,

'objectType' : 'provider-name' ,

'objectName' : customKeyMgr ,

'expectedRC' : 0

}

</call>

<else>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-key-manager-provider-prop' ,

'objectType' : 'provider-name' ,

'objectName' : keystoreType,

'optionsString' : '--set enabled:false',

'expectedRC' : 0

}

</call>

</else>

</if>

</sequence>

</function>

<!-- ################################################## -->

<!-- unconfigureTLS -->

<!-- ################################################## -->

<function name="unconfigureTLS">

<function-prolog>

This function reverses the configuration changes for startTLS

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_BIN,OPENDSNAME)">

<function-arg-description>

Pathname to installation root

</function-arg-description>

<function-arg-property name="type" value="filepath"/>

</function-arg-def>

<function-arg-def name="dsInstanceHost" type="optional">

<function-arg-description>

Directory server hostname or IP address

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' %DIRECTORY_INSTANCE_ADMIN_PORT">

<function-arg-description>

Directory server admin port number

</function-arg-description>

<function-arg-property name="type" value="Port number"/>

</function-arg-def>

<function-arg-def name="dsInstanceDn" type="optional">

<function-arg-description>

Bind DN

</function-arg-description>

<function-arg-property name="type" value="DN"/>

</function-arg-def>

<function-arg-def name="dsInstancePswd" type="optional">

<function-arg-description>

Bind password

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="customKeyMgr" type="optional" default="''">

<function-arg-description>

Name for the key manager

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="keystoreType" type="optional" default="'JKS'">

<function-arg-description>

Keystore type : JKS or PKCS12

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="extraParams" type="optional">

<function-arg-description>

Optional extra parameters for specific test cases

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

</function-map-args>

<sequence>

<!--- Disable StartTLS -->

<message>

'Disabling StartTLS'

</message>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort,

'dsInstanceDn' : dsInstanceDn,

'dsInstancePswd' : dsInstancePswd,

'subcommand' : 'set-connection-handler-prop',

'objectType' : 'handler-name',

'objectName' : 'LDAP Connection Handler',

'optionsString' : ' --set allow-start-tls:false',

'expectedRC' : 0

}

</call>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-connection-handler-prop' ,

'objectType' : 'handler-name' ,

'objectName' : 'LDAP Connection Handler',

'optionsString' : '--reset key-manager-provider --reset trust-manager-provider --reset ssl-cert-nickname',

'expectedRC' : 0

}

</call>

<!--- Disable SSL Trust Manager Provider -->

<message>

'Disabling SSL Trust Manager Provider'

</message>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort,

'dsInstanceDn' : dsInstanceDn,

'dsInstancePswd' : dsInstancePswd,

'subcommand' : 'set-trust-manager-provider-prop',

'objectType' : 'provider-name',

'objectName' : 'Blind Trust',

'optionsString' : '--set enabled:false',

'expectedRC' : 0

}

</call>

<!--- Disable Key Manager Provider -->

<message>

'Disabling Key Manager Provider'

</message>

<if expr="len(customKeyMgr.strip()) != 0">

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'delete-key-manager-provider' ,

'objectType' : 'provider-name' ,

'objectName' : customKeyMgr ,

'expectedRC' : 0

}

</call>

<else>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort,

'dsInstanceDn' : dsInstanceDn,

'dsInstancePswd' : dsInstancePswd,

'subcommand' : 'set-key-manager-provider-prop',

'objectType' : 'provider-name',

'objectName' : keystoreType,

'optionsString' : '--set enabled:false',

'expectedRC' : 0

}

</call>

</else>

</if>

</sequence>

</function>

<!-- ################################################## -->

<!-- Unconfigure SSL and TLS -->

<!-- ################################################## -->

<function name="unconfigureSSL_TLS">

<function-prolog>

This function reverses the configuration changes for SSL and TLS

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="optional" default="STAF_REMOTE_HOSTNAME">

<function-arg-description>

Location of target host

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsPath" type="optional" default="'%s/%s' % (DIRECTORY_INSTANCE_BIN,OPENDSNAME)">

<function-arg-description>

Pathname to installation root

</function-arg-description>

<function-arg-property name="type" value="filepath"/>

</function-arg-def>

<function-arg-def name="dsInstanceHost" type="optional">

<function-arg-description>

Directory server hostname or IP address

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="dsInstanceAdminPort" type="optional" default="'%s' %DIRECTORY_INSTANCE_ADMIN_PORT">

<function-arg-description>

Directory server admin port number

</function-arg-description>

<function-arg-property name="type" value="Port number"/>

</function-arg-def>

<function-arg-def name="dsInstanceDn" type="optional">

<function-arg-description>

Bind DN

</function-arg-description>

<function-arg-property name="type" value="DN"/>

</function-arg-def>

<function-arg-def name="dsInstancePswd" type="optional">

<function-arg-description>

Bind password

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="keystoreType" type="optional" default="'JKS'">

<function-arg-description>

Keystore type : JKS or PKCS12

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="extraParams" type="optional">

<function-arg-description>

Optional extra parameters for specific test cases

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

</function-map-args>

<sequence>

<!--- Disable LDAPS Connection Handler -->

<message>

'Disabling LDAPS Connection Handler'

</message>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort,

'dsInstanceDn' : dsInstanceDn,

'dsInstancePswd' : dsInstancePswd,

'subcommand' : 'set-connection-handler-prop',

'objectType' : 'handler-name',

'objectName' : 'LDAPS Connection Handler',

'optionsString' : '--set enabled:false --set use-ssl:false',

'expectedRC' : 0

}

</call>

<!--- Disable StartTLS -->

<message>

'Disabling StartTLS'

</message>

<call function="'dsconfig'">

{ 'location' : location ,

'dsPath' : dsPath ,

'dsInstanceHost' : dsInstanceHost ,

'dsInstanceAdminPort' : dsInstanceAdminPort ,

'dsInstanceDn' : dsInstanceDn ,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-connection-handler-prop' ,

'objectType' : 'handler-name' ,

'objectName' : 'LDAP Connection Handler',

'optionsString' : ' --set allow-start-tls:false',

'expectedRC' : 0

}

</call>

<!--- Disable SSL Trust Manager Provider -->

<message>

'Disabling SSL Trust Manager Provider'

</message>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort,

'dsInstanceDn' : dsInstanceDn,

'dsInstancePswd' : dsInstancePswd ,

'subcommand' : 'set-trust-manager-provider-prop' ,

'objectType' : 'provider-name' ,

'objectName' : 'Blind Trust',

'optionsString' : '--set enabled:false' ,

'expectedRC' : 0

}

</call>

<!--- Disable Key Manager Provider -->

<message>

'Disabling Key Manager Provider'

</message>

<call function="'dsconfig'">

{ 'location' : location,

'dsPath' : dsPath,

'dsInstanceHost' : dsInstanceHost,

'dsInstanceAdminPort' : dsInstanceAdminPort,

'dsInstanceDn' : dsInstanceDn,

'dsInstancePswd' : dsInstancePswd,

'subcommand' : 'set-key-manager-provider-prop',

'objectType' : 'provider-name',

'objectName' : keystoreType,

'optionsString' : '--set enabled:false',

'expectedRC' : 0

}

</call>

</sequence>

</function>

<function name="createStrongUserEntries" scope="local">

<function-prolog>

This creates strongAuthenticationUser entries with userCertificates

</function-prolog>

<function-map-args>

<function-arg-def name="location" type="required">

<function-arg-description>

Location of target host

</function-arg-description>

<function-arg-property name="type" value="hostname"/>

</function-arg-def>

<function-arg-def name="certificate" type="required">

<function-arg-description>

Certificate

</function-arg-description>

<function-arg-property name="type" value="string"/>

</function-arg-def>

<function-arg-def name="filename" type="required">

<function-arg-description>

Certificate filename

</function-arg-description>

<function-arg-property name="type" value="filename"/>

</function-arg-def>

<function-arg-def name="userdn" type="required">

<function-arg-description>

User DN

</function-arg-description>

<function-arg-property name="type" value="DN"/>

</function-arg-def>

<function-arg-def name="localLdifFile" type="required">

<function-arg-description>

Local ldif file

</function-arg-description>

<function-arg-property name="type" value="filename"/>

</function-arg-def>

<function-arg-def name="remoteLdifFile" type="required">

<function-arg-description>

Remote ldif file

</function-arg-description>

<function-arg-property name="type" value="filename"/>

</function-arg-def>

</function-map-args>

<sequence>

<!-- Get a certificate from a file in PEM format -->

<call function="'getFile'">

{ 'location' : location,

'filename' : filename

}

</call>

<message>

'Certificate contents:\n %s' % cmdResult

</message>

<!-- Extract BEGIN CERTIFICATE and END CERTIFICATE -->

<script>

certList=STAXResult[1].split('\n')

ret_str = ""

for line in certList:

index_cert = line.find("CERTIFICATE")

if index_cert == -1:

ret_str+=line.strip()

</script>

<!-- Create ldif for users entries and add userCertificate -->

<message> '---- Create User entry : %s----' % userdn</message>

<script>

listAttr = []

listAttr.append('dn: %s' % userdn)

listAttr.append('objectclass:top')

listAttr.append('objectclass:organizationalperson')

listAttr.append('objectclass:inetorgperson')

listAttr.append('objectclass:person')

listAttr.append('objectclass:ds-certificate-user')

listAttr.append('objectclass:strongAuthenticationUser')

listAttr.append('userCertificate;binary:: %s' % ret_str)

listAttr.append('givenname:%s' % certificate)

listAttr.append('sn:%s' % certificate)

listAttr.append('cn:%s' % certificate)

</script>

<!-- Write out the ldif of users entry-->

<script>

outfile = open(localLdifFile,"w")

for line in listAttr:

outfile.write("%s\n" % line)

outfile.close()

</script>

<!-- Copy the ldif file containing userCertificate to remote host -->

<message>

'Copy ldif (%s) file to user entry %s to %s' % (localLdifFile,userdn,remoteLdifFile)

</message>

<call function="'copyFile'">

{ 'location' : STAXServiceMachine,

'srcfile' : localLdifFile,

'destfile' : remoteLdifFile,

'remotehost' : location

}

</call>

<!-- Add the users entry into the LDAP server -->

<call function="'ldapModifyWithScript'">

{

'dsAdd' : 'True' ,

'dsInstanceHost' : DIRECTORY_INSTANCE_HOST ,

'dsInstancePort' : DIRECTORY_INSTANCE_PORT ,

'dsInstanceDn' : DIRECTORY_INSTANCE_DN ,

'dsInstancePswd' : DIRECTORY_INSTANCE_PSWD ,

'dsFilename' : remoteLdifFile

}

</call>

</sequence>

</function>

</stax>