This is very important. It is a good candidate for 10.2, if time.

Proposed Milestone: 10.2.2 (per CS Meeting of 09/17/2014)

Per 10.2.2 Triage meeting of 02/24/2015: 10.2.3

Attempted interactive and autoconfig of TPS when CA KRA, TKS and TPS are on different tomcat instances. TPS installation was successful.

Christina, please confirm if there is anything more that needs to be tested for this ticket.

Moving to 10.2.4 per CS team meeting.

Per Dogtag 10.2.x TRIAGE meeting of 04/28/2015: (seems like a foundational issue -- assign to cfu to verify whether or not this is still an issue)

Here is the result of trying out 10.2.4 (that's 15 months since the initial ticket report, so it's way better, as expected):

• TPS on independent Tomcat instance installed (note: running pkispawn for TPS will run out of memory if your memory is 1 G. I had to increased it to 2G to install successfully). Other subsystems don't seem to have the same need.
• found and filed: https://fedorahosted.org/pki/ticket/1393
• found extra spaces at the end of a couple CS.cfg params such as below and cause simple op to fail:
  op.format.soCleanSOToken.validateCardKeyInfoAgainstTokenDB=true
• although sharedSecret is set up on TKS when TPS is setup, TPS itself does not have the sharedSecret imported.
  I tried adding the following param thinking it might help but it didn't:
  pki_import_shared_secret=True
  I had to manually set up new sharedSecret between TKS and TPS
• Once manually get around issue ticket 1393 by resetting password, and then manually setup sharedSecret, a simple format cause the following:

[29/May/2015:10:49:55]http-bio-26080-exec-1: TPSProcessor.getSharedSecretTransportKey: calculated key name: sharedSecret2
It seemed to blow up at the following call:
TPSProcessor.getSharedSecretTransportKey:
symmKeys = SessionKey.ListSymmetricKeys("internal");
As there was no more debug messages printed after that.

Further investigation will be needed, possibly in pki-symkey.

The sharedSecret not imported into TPS issue will be covered by the following ticket:
https://fedorahosted.org/pki/ticket/758

I found the symkey function blew up issue to be the result of missing symkey.jar symlink. Which will be addressed in this ticket.

pushed to master:

commit f9b461b78032e1b232037ae7420828f90935b51a
Author: Christina Fu cfu@redhat.com
Date: Fri May 29 15:47:02 2015 -0700

Ticket 867 Need to support TPS as a separate tomcat instance.
 This patch addressed the issue that TPS on independent Tomcat is mi
 symlink to symkey.jar and causes all symkey method reference to fai

for 10.2.4, workaround can be done without this fix:

After installing TPS (on a separate Tomcat instance), shut it down,
cd /var/lib/pki/<tps instance>/common/lib/
ln -s /usr/lib/java/symkey.jar symkey.jar

Note, due to #758, you want to set up the sharedSecret while TPS is still down.

start TPS.

Turns out that even though the symlink to JNI in per instance directory does not work in shared instance.
Revert back to original patch with adjustment to create symlink as long as symkey lib exists, regardless of subsystem.
It was tested to work in both shared and non-shared tomcat instances.

commit 311650625be0c8e5f42c71c7d5020e5a11ecf034

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1434

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.