Checkin:

commit 7185c0d70293b950fda437401d9b613b4a0b2fcb
Author: Jack Magne jmagne@dhcp-16-206.sjc.redhat.com
Date: Mon Oct 2 14:01:46 2017 -0700

 TPS new configuration to allow the protocol of the to determine applet loaded.
This addreses #2824 TPS new configuration to allow the protocol of the to determine applet loaded : https://pagure.io/dogtagpki/issue/2824
To test this is very simple:
For a given applet update config param, add something similiar to this to allow for an scp03 token to specifiy a different applet:
op.enroll.userKey.update.applet.requiredVersion.prot.3=1.5.558cdcff
The original config param for some scp01 card will be left unchanges such as this:
op.enroll.userKey.update.applet.requiredVersion=1.4.58768072
Note this works for format, enoll, and pinReset.
Restart server and perform desired token operation with the smart card client.
Clean up suggested by cfu added.
Change-Id: I2e100255c498c5bf67fbfec82a46e9c64bcc98d2

Testing instructions:

It's simple to test this fix with scp01 and scp03 tokens and the two applets that service each kind of token:

In the CS.cfg for a TPS instance we have the following type of setting for each supported token profile:

op.enroll.userKey.update.applet.requiredVersion=1.4.58768072

This is the current setting that handles the selection of an applet automatically when an scp01 token such as the gemalto sc 650 is used. Leave this setting as is, since the fix still adheres to this setting for the default or scp01 case:

Now for testing the scp03 case, we need of course an scp03 token such as the g&d 6.0.

Also we need to add something to the following setting for each token profile and operation as below:

op.enroll.userKey.update.applet.requiredVersion.prot.3=1.5.558cdcff

Note that if we want to cover all the profiles and operations in the CS.cfg we would have to add a line similar to the one above. Here the "enroll" and "userKey" settings are key. If we ant to add this to do "format" and or to use the "externalRegAddToToken" Profiles, we add a similar line in those sections of the file. The part that tells the system to use the given applet for the scp03 token is here: "requiredVersion.prot.3=1.5.558cdcff" . In the future if we have a protocol 10 it would be "requiredVersion.prot.10=1.88888xxxxx" or some such. Since the tps system can detect automatically the protocol of the current token in use, TPS will select the correct applet to load.

The formal test to verify this fix is to have two tokens in use with esc, one scp01 and on scp01. For each token, attempt each operation "enroll,format, pin reset" for the desired token profiles we want to test. Of course for each profile tested to work properly, we have to add the given config line, telling the system what applet to use for protocol 3.

For each operation attempted, check the TPS debug log and make sure that the desired applet is selected and installed on the token.

The original config param for some scp01 card will be left unchanges such as this:

Checkin to fix small regression caused by this original fix:

commit e48374cd8a744fad5a03f64e8685ec3b3c465553 (HEAD -> master, origin/master, origin/HEAD, externalRegFix)
Author: Jack Magne jmagne@redhat.com
Date: Fri Nov 10 15:55:36 2017 -0800

ReFix for  #2824 TPS new configuration to allow the protocol of the to determine applet loaded.
The problem discovered was that in only the external registration case, there was a problem obtaining the protocol
information for the token being enrolled. This simple fix makes sure the protocol info is obtained correctly for external
reg and non external reg enrollment cases.
Change-Id: Iccd40adbdafd5e94e04cbb8c391bd2706e483a1f

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/2944

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.