Created attachment 1766002 [details]
customer script to set TokenPolicy

Description of problem:
Issue 1)  TPS version 8 set a tokenPolicy: entry into the database for each token when it was created by the system, but TPS 9 does not appear to do so.  

Issue 2)  TPS Version 8 would reset the PIN_RESET=YES value back to PIN_RESET=NO after a Pin reset was executed (Or I believe that it did as the TPS 8 is no longer connected so can't confirm)  The Comments in the CS.cfg State "If Present and agent changes PIN_RESET from NO to YES, User is allowed to do pin reset.  This policy will be changed back to NO after pin reset" so would expect the system to set it back, but based on looking at the dogtag source code did not see anything setting the tokenPolicy, and based on testing different values of PIN_RESET and PIN_RESET_TO_NO have not found a combination that results in the PIN_RESET=YES being set back to PIN_RESET=NO.  Only location in the source where I found PIN_RESET_TO_NO being exercised looked to be in the tps-client.

Issue 3)  Even if I add tokenPolicy: to tokens by adjusting the tokenAdmin.py script to set the policy, when a token goes through its lifecycle of use from new -> formated -> enrolled -> terminated -> reuse the tokenPolicy is cleared when the token is marked for reuse removing the tokenPolicy.

Our TPS does not appear to be applying the tokendb.defaultPolicy to tokens, and the op.enroll.x.pinReset.enable=true or op.enroll.x.pinReset.enable=false do not appear to be updating the policy.


Version-Release number of selected component (if applicable):
RHCS 9.x

How reproducible:
Very

Steps to Reproduce:
1. Issue token
2. Also after formatting token


Actual results:
No default tokenpolicy is set.

Expected results:
 TPS Version 8 would reset the PIN_RESET=YES value back to PIN_RESET=NO after a Pin reset was executed (Or I believe that it did as the TPS 8 is no longer connected so can't confirm)  The Comments in the CS.cfg State "If Present and agent changes PIN_RESET from NO to YES, User is allowed to do pin reset.  This policy will be changed back to NO after pin reset" so would expect the system to set it back

Additional info:
Attached is the Python script that we use to automate the Token Addition process to the TPS.  It is a pretty much a pexpect wrapper to enter HSM, and nssdb passwords. around the pki cli to execute pki tps-token-add commands with a formatted Feed file.   The feed file used by this version is similar to the following


534E065011112222333,3,4
First part of CUID up to where the CUID becomes unique, rest of first CUID in Range, rest of last CUID in range.

This Line would add tokens 524E-0650-1111-2222-3333 through 534E-0650-1111-2222-3334

 

Based on looking at the pki cli I can add --policy "PIN_RESET=NO;RE_ENROLL=NO;PIN_RESET_TO_NO=YES " to my tokenAdmin.py script to set the Policy by Default.