dogtagpki

#1508 Missing token prefix for connectors in TPS Installation with HSM
Closed: Fixed Opened by rpattath.

Closed: Fixed
Reopen Issue

Token enrollment and format using tpsclient fails with instances configured
with HSM

Steps to Reproduce:

1. Create CA, KRA, TKS and TPS instances on separated tomcat instances with
certs/keys stored on HSM
2. sharedSecret key between TKS and TPS is stored on internal nss DB
3. format/enroll using tpsclient

Actual results:

format/enroll fails

Expected results:

format/enroll should be successful

Additional info:

Attaching tks and tps debug logs (to associated Bugzilla Bug)
ldif of ldap user:
dn: uid=pkiuser1,ou=People,dc=pki-tps1
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: top
objectClass: extensibleobject
cn: pkiuser1
sn: pkiuser1
uid: pkiuser1
givenName: pkiuser1
mail: pkiuser1@example.org
firstname: pkiuser1
userPassword: redhat
tpsclient enrollment script:
op=var_set name=ra_host value=localhost
op=var_set name=ra_port value=30617
op=var_set name=ra_uri value=/tps/tps
op=token_set cuid=10000000000000222229 msn=01020304 app_ver=6FBBC105
key_info=0101 major_ver=0 minor_ver=0
op=token_set auth_key=404142434445464748494a4b4c4d4e4f
op=token_set mac_key=404142434445464748494a4b4c4d4e4f
op=token_set kek_key=404142434445464748494a4b4c4d4e4f
op=ra_enroll uid=pkiuser1 pwd=redhat new_pin=Secret123 num_threads=1
op=exit

Putting this to 10.2.7 for now. It PROBABLY is simple. It will take some work in the installer. It ends up being a rat hole, we should reserve the right to move it out to 10.3

Per CS/DS Meeting of 07/27/2015: 10.2.7

Per CS/DS Meeting of 08/03/2015: 10.3

I'll take this one then, since I ran into this myself doing HSM and worked around it.

committed to master

commit c5d9d3ac288045045aa387dfc53f1157c3a7e4b5

Metadata Update from @rpattath:
- Issue assigned to cfu
- Issue set to the milestone: 10.3.1

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2067

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Normal
None
None
None
None
None
defect
TPS
None
QE
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.