#
How to Setup and Configure "mod_tps" and "mod_tokendb" on Apache

## Overview

This document describes how to install and configure the "mod_tps" and "mod_tokendb" modules required by CoolKey.

## Dependencies

"mod_tps" is dependent upon the following components:

- Fedora Certificate System (FCS) 1.0.0 Certificate Authority (CA)
- FCS 1.0.0 Token Key Service (TKS)
- FCS 1.0.0 Data Recovery Manager (DRM) [optional]
- FCS 1.0.0 Token Processing System (TPS)
- Fedora Directory Server (FDS) 1.0 (TPS internaldb instance)
- Apache 2.0.52
- "mod_nss" module installed and available from this Apache 2.0.52 (Fortitude)

"mod_tokendb" is dependent upon the following components:

- FCS 1.0.0 TPS
- FDS 1.0 TPS internaldb instance
- Apache 2.0.52
- "mod_nss" module installed and available from this Apache 2.0.52 (Fortitude)
- "mod_tps" module installed and available from this Apache 2.0.52 (Fortitude)

## Supported Platforms

- Fedora Core 6 (32-bit),
- Fedora Core 6 (64-bit), and
- Solaris 9 (64-bit)

## Installing and Configuring "mod_tps" and "mod_tokendb"

1. Insure that a pre-installed version 1.0.0 of the FCS common subsystems area exists on the desired machine running on the desired platform
   (e. g. - <pki_server_root>/<common_subsystems_area>)
2. Insure that a pre-installed version 1.0.0 of the FCS CA exists on the desired machine running on the desired platform
   (e. g. - <pki_server_root>/<common_subsystems_area>/<common_ca_subsystems> and <pki_server_root>/<ca_instance>)
3. Insure that a pre-installed version 1.0.0 of the FCS TKS exists on the desired machine running on the desired platform
   (e. g. - <pki_server_root>/<common_subsystems_area>/<common_tks_subsystems> and <pki_server_root>/<tks_instance>)
4. Optionally, insure that a pre-installed version 1.0.0 of the FCS DRM exists on the desired machine running on the desired platform
   (e. g. - <pki_server_root>/<common_subsystems_area>/<common_drm_subsystems> and <pki_server_root>/<drm_instance>)
5. Insure that a pre-installed version 1.0 of the FDS exists on the desired machine running on the desired platform.
   This is needed to create a TPS internaldb instance
   (e. g. - <rhds_server_root>/<tps_internaldb>)
6. Insure that a pre-installed threaded version 2.0.52 of the Apache server exists on the desired machine running on the desired platform
   (e. g. - <apache_server_root>)
7. Insure that this Apache server has "mod_nss" (Fortitude) installed and available from its <apache_server_root>
8. Download and unpack the entire contents of the TPS package into the <pki_server_root>/<common_subsystems_area>, the <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>, and the <pki_server_root>/<tps_instance>
9. Change directory to <pki_server_root>/<common_subsystems_area>/bin
10. Execute <pki_server_root>/<common_subsystems_area>/bin/setup_tps:
    1. Creates a wrapper script called <pki_server_root>/<common_subsystems_area>/bin/tpsclient for <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/bin/tpsclient
    2. Creates an empty <pki_server_root>/<tps_instance>/bin directory (instance-specific binaries)
    3. Creates an empty <pki_server_root>/<tps_instance>/cgi-bin directory (user customization)
    4. Creates an empty <pki_server_root>/<tps_instance>/docroot directory (user customization)
    5. Creates an empty <pki_server_root>/<tps_instance>/lib directory (instance-specific libraries)
    6. Creates an empty <pki_server_root>/<tps_instance>/logs directory (instance-specific logs)
    7. Sets up the CA connector in <pki_server_root>/<tps_instance>/config/CS.cfg
    8. Optionally, sets up the DRM connector in <pki_server_root>/<tps_instance>/config/CS.cfg
    9. Creates a cert8.db in <pki_server_root>/<tps_instance>/config/cert8.db
    10. Creates a key3.db in <pki_server_root>/<tps_instance>/config/key3.db
    11. Populates the cert8.db and key3.db security databases located in the <pki_server_root>/<tps_instance>/config directory with the ServerCert
    12. Populates the TPS internaldb located in the <rhds_server_root>/<tps_internaldb> directory by executing the LDIF scripts located in the <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/setup directory
    13. Generates the <pki_server_root>/<common_subsystems_area>/config/httpd.conf Apache Configuration file:

            #
            # Dynamic Shared Object (DSO) Support
            #
            # To be able to use the functionality of a module which was built as a DSO you
            # have to place corresponding `LoadModule' lines at this location so the
            # directives contained in it are actually available _before_ they are used.
            # Statically compiled modules (those listed by `httpd -l') do not need
            # to be loaded here.
            #
            # Example:
            # LoadModule foo_module modules/mod_foo.so
            #
            LoadModule nss_module         <apache_server_root>/modules/libmodnss.so

            #
            # Bring in additional module-specific configurations
            #
            Include <apache_server_root>/conf/nss.conf
            Include <pki_server_root>/<tps_instance>/config/tps.conf

    14. Generates the <pki_server_root>/<tps_instance>/config/tps.conf Apache TPS Module Configuration file:

            #
            # Dynamic Shared Object (DSO) Support
            #
            # To be able to use the functionality of a module which was built as a DSO you
            # have to place corresponding `LoadModule' lines at this location so the
            # directives contained in it are actually available _before_ they are used.
            # Statically compiled modules (those listed by `httpd -l') do not need
            # to be loaded here.
            #
            # Example:
            # LoadModule foo_module modules/mod_foo.so
            #
            LoadModule tps_module         <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/lib/mod_tps.so
            LoadModule tokendb_module     <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/lib/mod_tokendb.so

            <Location /nk_service>
                SetHandler nk_service
            </Location>

            <Location /tus>
                SetHandler tus
            </Location>

            #
            # DocumentRoot: The directory out of which you will serve your
            # documents. By default, all requests are taken from this directory, but
            # symbolic links and aliases may be used to point to other locations.
            #
            DocumentRoot "<pki_server_root>/<common_subsystems_area>/docroot"

            #
            # ScriptAlias: This controls which directories contain server scripts.
            # ScriptAliases are essentially the same as Aliases, except that
            # documents in the realname directory are treated as applications and
            # run by the server when requested rather than as documents sent to the client.
            # The same rules about trailing "/" apply to ScriptAlias directives as to
            # Alias.
            #
            ScriptAlias /cgi-bin/ "<pki_server_root>/<common_subsystems_area>/cgi-bin/"

            #
            # Bring in additional module-specific configurations
            #
            TPSConfigPathFile <pki_server_root>/<tps_instance>/config/CS.cfg

11. Assume "root" privilege
12. Execute <apache_server_root>/bin/apachectl -f <pki_server_root>/<common_subsystems_area>/config/httpd.conf start

## Inventory of cs-tps-{version} Package

Packaged File | Unpackaged File
--- | ---
applets/ | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/applets/
applets/1.3.427BDDB8.ijc | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/applets/1.3.427BDDB8.ijc
bin/ | <pki_server_root>/<common_subsystems_area>/bin/
bin/setup_tps | <pki_server_root>/<common_subsystems_area>/bin/setup_tps
bin/setup_tps | <pki_server_root>/<common_subsystems_area>/bin/uninstall_tps
bin/ | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/bin/
bin/tpsclient | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/bin/tpsclient
cgi-bin/ | <pki_server_root>/<common_subsystems_area>/cgi-bin/
cgi-bin/AdminEsc.html | <pki_server_root>/<common_subsystems_area>/cgi-bin/AdminEsc.html
cgi-bin/AdvancePopup.html | <pki_server_root>/<common_subsystems_area>/cgi-bin/AdvancePopup.html
cgi-bin/EnrollPopup.html | <pki_server_root>/<common_subsystems_area>/cgi-bin/EnrollPopup.html
cgi-bin/SettingsEsc.html | <pki_server_root>/<common_subsystems_area>/cgi-bin/SettingsEsc.html
cgi-bin/TokenManager.html | <pki_server_root>/<common_subsystems_area>/cgi-bin/TokenManager.html
cgi-bin/TokenPin.html | <pki_server_root>/<common_subsystems_area>/cgi-bin/TokenPin.html
cgi-bin/esc.cgi | <pki_server_root>/<common_subsystems_area>/cgi-bin/esc.cgi
cgi-bin/style.css | <pki_server_root>/<common_subsystems_area>/cgi-bin/style.css
config/ | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/config/
config/CS.cfg | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/config/CS.cfg
config/enroll.test | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/config/enroll.test
config/format.test | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/config/format.test
config/reset_pin.test | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/config/reset_pin.test
docroot/ | <pki_server_root>/<common_subsystems_area>/docroot/
docroot/GenericAuth.html | <pki_server_root>/<common_subsystems_area>/docroot/GenericAuth.html
docroot/images/ | <pki_server_root>/<common_subsystems_area>/docroot/images/
docroot/images/BannerBackground.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/BannerBackground.gif
docroot/images/BindSettingsPrototype.jpg | <pki_server_root>/<common_subsystems_area>/docroot/images/BindSettingsPrototype.jpg
docroot/images/CancelButton.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/CancelButton.gif
docroot/images/CloseButton.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/CloseButton.gif
docroot/images/ContinueButton.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/ContinueButton.gif
docroot/images/HelpButton.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/HelpButton.gif
docroot/images/NetKey-Small.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/NetKey-Small.gif
docroot/images/NetKeyInsert.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/NetKeyInsert.gif
docroot/images/NetKeyLogo.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/NetKeyLogo.gif
docroot/images/NetKeyPair.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/NetKeyPair.gif
docroot/images/NetKeyProgress.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/NetKeyProgress.gif
docroot/images/NetKeyQuestionMark.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/NetKeyQuestionMark.gif
docroot/images/OKButton.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/OKButton.gif
docroot/images/PadLock.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/PadLock.gif
docroot/images/PurchaseButton.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/PurchaseButton.gif
docroot/images/ReactivateButton.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/ReactivateButton.gif
docroot/images/ReleaseButton.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/ReleaseButton.gif
docroot/images/SecureButton.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/SecureButton.gif
docroot/images/SuspendButton.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/SuspendButton.gif
docroot/images/TryAgainButton.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/TryAgainButton.gif
docroot/images/bg.jpg | <pki_server_root>/<common_subsystems_area>/docroot/images/bg.jpg
docroot/images/logo.gif | <pki_server_root>/<common_subsystems_area>/docroot/images/logo.gif
docroot/style.css | <pki_server_root>/<common_subsystems_area>/docroot/style.css
docroot/tus/ | <pki_server_root>/<common_subsystems_area>/docroot/tus/
docroot/tus/addResults.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/addResults.template
docroot/tus/delete.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/delete.template
docroot/tus/deleteResults.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/deleteResults.template
docroot/tus/doToken.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/doToken.template
docroot/tus/doTokenConfirm.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/doTokenConfirm.template
docroot/tus/edit.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/edit.template
docroot/tus/editAdmin.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/editAdmin.template
docroot/tus/editAdminResults.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/editAdminResults.template
docroot/tus/editResults.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/editResults.template
docroot/tus/error.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/error.template
docroot/tus/index.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/index.template
docroot/tus/indexAdmin.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/indexAdmin.template
docroot/tus/new.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/new.template
docroot/tus/revoke.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/revoke.template
docroot/tus/search.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/search.template
docroot/tus/searchActivity.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/searchActivity.template
docroot/tus/searchActivityResults.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/searchActivityResults.template
docroot/tus/searchAdmin.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/searchAdmin.template
docroot/tus/searchAdminResults.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/searchAdminResults.template
docroot/tus/searchCertificateResults.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/searchCertificateResults.template
docroot/tus/searchResults.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/searchResults.template
docroot/tus/show.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/show.template
docroot/tus/showAdmin.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/showAdmin.template
docroot/tus/showCert.template | <pki_server_root>/<common_subsystems_area>/docroot/tus/showCert.template
lib/ | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/lib/
lib/libldapauth.so | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/lib/libldapauth.so
lib/libtokendb.so | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/lib/libtokendb.so
lib/libtps.so | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/lib/libtps.so
lib/mod_tokendb.so | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/lib/mod_tokendb.so
lib/mod_tps.so | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/lib/mod_tps.so
setup/ | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/setup/
setup/addAgents.ldif | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/setup/addAgents.ldif
setup/addIndexes.ldif | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/setup/addIndexes.ldif
setup/addTokens.ldif | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/setup/addTokens.ldif
setup/addVLVIndexes.ldif | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/setup/addVLVIndexes.ldif
setup/schemaMods.ldif | <pki_server_root>/<common_subsystems_area>/<common_tps_subsystems>/setup/schemaMods.ldif

## Inventory of cs-tps-devel-{version} Package

Packaged File | Unpackaged File
--- | ---
include/ |
include/apdu/ |
include/apdu/APDU.h |
include/apdu/APDU_Response.h |
include/apdu/Create_Object_APDU.h |
include/apdu/Create_Pin_APDU.h |
include/apdu/Delete_File_APDU.h |
include/apdu/External_Authenticate_APDU.h |
include/apdu/Format_Muscle_Applet_APDU.h |
include/apdu/Generate_Key_APDU.h |
include/apdu/Get_Data_APDU.h |
include/apdu/Get_Status_APDU.h |
include/apdu/Get_Version_APDU.h |
include/apdu/Import_Key_APDU.h |
include/apdu/Import_Key_Enc_APDU.h |
include/apdu/Initialize_Update_APDU.h |
include/apdu/Install_Applet_APDU.h |
include/apdu/Install_Load_APDU.h |
include/apdu/Lifecycle_APDU.h |
include/apdu/List_Objects_APDU.h |
include/apdu/List_Pins_APDU.h |
include/apdu/Load_File_APDU.h |
include/apdu/Put_Key_APDU.h |
include/apdu/Read_Buffer_APDU.h |
include/apdu/Read_Object_APDU.h |
include/apdu/Select_APDU.h |
include/apdu/Set_Pin_APDU.h |
include/apdu/Unblock_Pin_APDU.h |
include/apdu/Write_Object_APDU.h |
include/authentication/ |
include/authentication/AuthParams.h |
include/authentication/Authentication.h |
include/authentication/LDAP_Authentication.h |
include/channel/ |
include/channel/Channel.h |
include/channel/Secure_Channel.h |
include/cms/ |
include/cms/CertEnroll.h |
include/cms/ConnectionInfo.h |
include/cms/HttpConnection.h |
include/engine/ |
include/engine/RA.h |
include/httpClient/ |
include/httpClient/httpc/ |
include/httpClient/httpc/AccessLogger.h |
include/httpClient/httpc/Auth.h |
include/httpClient/httpc/ByteBuffer.h |
include/httpClient/httpc/CERTUtil.h |
include/httpClient/httpc/Cache.h |
include/httpClient/httpc/Connection.h |
include/httpClient/httpc/ConnectionListener.h |
include/httpClient/httpc/DebugLogger.h |
include/httpClient/httpc/Defines.h |
include/httpClient/httpc/ErrorLogger.h |
include/httpClient/httpc/Iterator.h |
include/httpClient/httpc/LogRotationTask.h |
include/httpClient/httpc/Logger.h |
include/httpClient/httpc/NSPRerrs.h |
include/httpClient/httpc/PSBuddy.h |
include/httpClient/httpc/PSBuddyCache.h |
include/httpClient/httpc/PSBuddyList.h |
include/httpClient/httpc/PSBuddyListener.h |
include/httpClient/httpc/PSBuddyService.h |
include/httpClient/httpc/PSCertExtension.h |
include/httpClient/httpc/PSCommonLib.h |
include/httpClient/httpc/PSConfig.h |
include/httpClient/httpc/PSConfigManager.h |
include/httpClient/httpc/PSConfigReader.h |
include/httpClient/httpc/PSCrypt.h |
include/httpClient/httpc/PSDataSourceListener.h |
include/httpClient/httpc/PSDataSourceManager.h |
include/httpClient/httpc/PSGroup.h |
include/httpClient/httpc/PSGroupCache.h |
include/httpClient/httpc/PSHelper.h |
include/httpClient/httpc/PSListener.h |
include/httpClient/httpc/PSPRUtil.h |
include/httpClient/httpc/PSPlugin.h |
include/httpClient/httpc/PSPluginManager.h |
include/httpClient/httpc/PSServer.h |
include/httpClient/httpc/PSServerLib.h |
include/httpClient/httpc/PSServerListener.h |
include/httpClient/httpc/PSServerManager.h |
include/httpClient/httpc/PSServiceListener.h |
include/httpClient/httpc/PSServiceManager.h |
include/httpClient/httpc/PSUser.h |
include/httpClient/httpc/PSWaspLib.h |
include/httpClient/httpc/Pool.h |
include/httpClient/httpc/PresenceManager.h |
include/httpClient/httpc/PresenceServer.h |
include/httpClient/httpc/PresenceServerImpl.h |
include/httpClient/httpc/SECerrs.h |
include/httpClient/httpc/SSLServerSocket.h |
include/httpClient/httpc/SSLSocket.h |
include/httpClient/httpc/SSLerrs.h |
include/httpClient/httpc/ScheduledTask.h |
include/httpClient/httpc/Scheduler.h |
include/httpClient/httpc/SecurityHeaders.h |
include/httpClient/httpc/ServerConnection.h |
include/httpClient/httpc/ServerHeaderProcessor.h |
include/httpClient/httpc/ServerSocket.h |
include/httpClient/httpc/Socket.h |
include/httpClient/httpc/SocketINC.h |
include/httpClient/httpc/SocketLib.h |
include/httpClient/httpc/StringList.h |
include/httpClient/httpc/StringUtil.h |
include/httpClient/httpc/TaskList.h |
include/httpClient/httpc/ThreadPool.h |
include/httpClient/httpc/URLUtil.h |
include/httpClient/httpc/engine.h |
include/httpClient/httpc/http.h |
include/httpClient/httpc/request.h |
include/httpClient/httpc/response.h |
include/main/ |
include/main/RA_pblock.h |
include/main/AttributeSpec.h |
include/main/AuthenticationEntry.h |
include/main/Base.h |
include/main/Buffer.h |
include/main/ConfigStore.h |
include/main/Login.h |
include/main/Memory.h |
include/main/MemoryMgr.h |
include/main/NameValueSet.h |
include/main/ObjectSpec.h |
include/main/PKCS11Obj.h |
include/main/PublishEntry.h |
include/main/RA_Context.h |
include/main/RA_Msg.h |
include/main/RA_Session.h |
include/main/SecureId.h |
include/main/Util.h |
include/modules/ |
include/modules/tps/ |
include/modules/tps/AP_Context.h |
include/modules/tps/AP_Session.h |
include/msg/ |
include/msg/RA_ASQ_Request_Msg.h |
include/msg/RA_ASQ_Response_Msg.h |
include/msg/RA_Begin_Op_Msg.h |
include/msg/RA_End_Op_Msg.h |
include/msg/RA_Extended_Login_Request_Msg.h |
include/msg/RA_Extended_Login_Response_Msg.h |
include/msg/RA_Login_Request_Msg.h |
include/msg/RA_Login_Response_Msg.h |
include/msg/RA_New_Pin_Request_Msg.h |
include/msg/RA_New_Pin_Response_Msg.h |
include/msg/RA_SecureId_Request_Msg.h |
include/msg/RA_SecureId_Response_Msg.h |
include/msg/RA_Status_Update_Request_Msg.h |
include/msg/RA_Status_Update_Response_Msg.h |
include/msg/RA_Token_PDU_Request_Msg.h |
include/msg/RA_Token_PDU_Response_Msg.h |
include/processor/ |
include/processor/RA_Enroll_Processor.h |
include/processor/RA_Format_Processor.h |
include/processor/RA_Pin_Reset_Processor.h |
include/processor/RA_Processor.h |
include/processor/RA_Renew_Processor.h |
include/processor/RA_Unblock_Processor.h |
include/publisher/ |
include/publisher/IConnector.h |
include/publisher/IPublish_Data.h |
include/publisher/IPublisher.h |
include/publisher/NetkeyPublisher.h |
include/tus/ |
include/tus/tus_db.h |