Missing/Additional fields in the RestAPI

[AbdouMechraoui]

Hello,

I am trying to migrate our API from SOAP to REST. I have come across multiple fields that are not included in the RestAPI. I am not sure how can one include these fields in the request body of the RestAPI.

For instance, in the case of adding an end entity:
SOAP:

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ws="http://ws.protocol.core.ejbca.org/">
   <soapenv:Header/>
   <soapenv:Body>
      <ws:editUser>
         <arg0>
            <caName>NewUI</caName>
            <certificateProfileName>ENDUSER</certificateProfileName>
            <email>[email protected]</email>
            <endEntityProfileName>EMPTY</endEntityProfileName>
            <password>foo123</password>
            <subjectDN>cn=Demo</subjectDN>
            <tokenType>P12</tokenType>
            <username>demo</username>
            <clearPwd>true</clearPwd>
            <sendNotification>false</sendNotification>
            <keyRecoverable>true</keyRecoverable>
            <status>10</status>
         </arg0>
      </ws:editUser>
   </soapenv:Body>
</soapenv:Envelope>

RestAPI documentation details the following fields:

{
username:	                 string Username
password:	                 string Password
subject_dn:	                 string Subject Distinguished Name
subject_alt_name:	         string Subject Alternative Name (SAN)
email:                           string Email
ca_name:                         string Certificate Authority (CA) name
certificate_profile_name:        string Certificate profile name
end_entity_profile_name:         string End Entity profile name
token:	                         string Token type property  Enum: USERGENERATED, P12, JKS, PEM
account_binding_id:	         string Account Binding ID
extension_data:	
     [ {
        name:	 string Certificate Extension Object Identifier (OID)
        value:	 string OID value
     }]
}

How can one map the following fields:

• clearPwd
• sendNotification
• keyRecoverable
• status

Which one of the two if any is valid?

1. Included in the request body as keys

{
"ca_name":"NewUI",
"certificate_profile_name": "ENDUSER",
"email": "[email protected]",
"end_entity_profile_name": "EMPTY",
"password": "foo123",
"subject_dn": "cn=Demo",
"token": "P12",
"username": "demo",
"clearPwd": true,
"sendNotification": false,
"keyRecoverable": true,
"status": 10
}

2. Included under custom_data

{
"ca_name":"NewUI",
"certificate_profile_name": "ENDUSER",
"email": "[email protected]",
"end_entity_profile_name": "EMPTY",
"password": "foo123",
"subject_dn": "cn=Demo",
"token": "P12",
"username": "demo",
"custom_data": [
    {"clearPwd": true},
    {"sendNotification": false},
    {"keyRecoverable": true},
    {"status": 10}
]
}

[primetomas]

Assuming this is the endentity/add REST API. The swagger-ui of the latest release says:

{
  "username": "JohnDoe",
  "password": "foo123",
  "subject_dn": "CN=John Doe,SURNAME=Doe,GIVENNAME=John,C=SE",
  "subject_alt_name": "[email protected]",
  "email": "[email protected]",
  "extension_data": [
    {
      "name": "1.3.6.1.5.5.7.1.24/customdata_STARTTIME",
      "value": "3003020105/2022-12-13 00:00:00"
    }
  ],
  "custom_data": [
    {
      "name": "1.3.6.1.5.5.7.1.24/customdata_STARTTIME",
      "value": "3003020105/2022-12-13 00:00:00"
    }
  ],
  "ca_name": "ExampleCA",
  "certificate_profile_name": "ENDUSER",
  "end_entity_profile_name": "ExampleEEP",
  "token": "P12",
  "account_binding_id": "1234567890",
  "key_recoverable": false
}

So you can use key_recoverable. Status will be set to new/10 by default. There is another REST API call for setstatus.

Set your installation to dev mode and hit the swagger-ui. https://localhost:8443/ejbca/swagger-ui

Clear password is not supported, you should try to avoid clear passwords. It was really only (mostly) used for the 'bin/ejbca batch' CLI command.

I think sendnotification has been up somewhere, let me check that.

[AbdouMechraoui]

Hi @primetomas,

Thank you so much for taking the time to reply.
Is there a default value for clearPwd? Is it false by default, or would one need to set that through CLI?

[primetomas]

clearPwd is false by default.

[primetomas]

Ah, since quite some time, if your end entity profile have "Notification - Use", and you add an email when adding the end entity through REST, then sendNotification is set automatically.

[gilles380]

Hi @primetomas
now I have my (native install) EJBCA working perfectly and REST API activated, it there something else to activate to have the swagger URL https://localhost:8443/ejbca/swagger-ui working (it is 404 currently)
Thanks

[primetomas]

If it is a deployment built from source, you need to set "ejbca.productionmode=false" in conf/ejbca.properties (and rebuild + redeploy the ear file).