1 files changed, 655 insertions, 0 deletions
diff --git a/eaaf_core_utils/src/test/java/at/gv/egiz/eaaf/core/test/credentials/EaafKeyStoreFactoryTest.java b/eaaf_core_utils/src/test/java/at/gv/egiz/eaaf/core/test/credentials/EaafKeyStoreFactoryTest.java
new file mode 100644
index 00000000..ed2e159b
--- /dev/null
+++ b/eaaf_core_utils/src/test/java/at/gv/egiz/eaaf/core/test/credentials/EaafKeyStoreFactoryTest.java
@@ -0,0 +1,655 @@
+package at.gv.egiz.eaaf.core.test.credentials;
+
+import java.security.Key;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.Provider;
+import java.security.cert.X509Certificate;
+import java.util.List;
+
+import at.gv.egiz.eaaf.core.exception.EaafKeyAccessException;
+import at.gv.egiz.eaaf.core.exceptions.EaafConfigurationException;
+import at.gv.egiz.eaaf.core.exceptions.EaafException;
+import at.gv.egiz.eaaf.core.exceptions.EaafFactoryException;
+import at.gv.egiz.eaaf.core.impl.credential.EaafKeyStoreFactory;
+import at.gv.egiz.eaaf.core.impl.credential.EaafKeyStoreUtils;
+import at.gv.egiz.eaaf.core.impl.credential.KeyStoreConfiguration;
+import at.gv.egiz.eaaf.core.impl.credential.KeyStoreConfiguration.KeyStoreType;
+import at.gv.egiz.eaaf.core.impl.data.Pair;
+import at.gv.egiz.eaaf.core.test.dummy.DummyAuthConfigMap;
+
+import org.apache.commons.lang3.RandomStringUtils;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.beans.BeansException;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
+import org.springframework.test.annotation.DirtiesContext;
+import org.springframework.test.annotation.DirtiesContext.MethodMode;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+
+import com.google.common.base.Optional;
+import com.google.common.base.Predicates;
+import com.google.common.base.Throwables;
+import com.google.common.collect.FluentIterable;
+import io.grpc.StatusRuntimeException;
+
+@RunWith(SpringJUnit4ClassRunner.class)
+@ContextConfiguration("/spring/test_eaaf_pvp_lazy.beans.xml")
+@DirtiesContext(methodMode = MethodMode.BEFORE_METHOD)
+public class EaafKeyStoreFactoryTest {
+
+  private static final String HSM_FACASE_HOST = "eid.a-sit.at";
+  private static final String HSM_FACASE_PORT = "9050";
+  private static final String HSM_FACASE_SSL_TRUST = "src/test/resources/data/hsm_facade_trust_root.crt";
+  private static final String HSM_FACASE_USERNAME = "authhandler-junit";
+  private static final String HSM_FACASE_PASSWORD = "supersecret123";
+  private static final String PATH_TO_SOFTWARE_KEYSTORE_JKS_WITH_TRUSTED_CERTS =
+      "src/test/resources/data/junit.jks";
+  private static final String PATH_TO_SOFTWARE_KEYSTORE_JKS =
+      "src/test/resources/data/junit_without_trustcerts.jks";
+  private static final String PATH_TO_SOFTWARE_KEYSTORE_PKCS12 =
+      "src/test/resources/data/junit_without_trustcerts.p12";
+  private static final String PATH_TO_HSM_FACADE_TRUST_CERT = "src/test/resources/data/hsm_facade_trust_root.crt";
+  private static final String SOFTWARE_KEYSTORE_PASSWORD = "password";
+
+  private static final String HSM_FACADE_KEY_ALIAS = "authhandler-sign";
+
+  @Autowired
+  private DummyAuthConfigMap mapConfig;
+  @Autowired
+  private ApplicationContext context;
+
+  /**
+   * jUnit test set-up.
+   */
+  @Before
+  public void testSetup() {
+    mapConfig.clearAllConfig();
+
+  }
+
+  @Test
+  @DirtiesContext
+  public void startWithoutConfigHsmFacadeConfig() {
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertFalse("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+  }
+
+  @Test
+  @DirtiesContext
+  public void buildyStoreWithOutConfig() {
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertFalse("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    try {
+      keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+      Assert.fail("Wrong config not detected");
+
+    } catch (final EaafException e) {
+      org.springframework.util.Assert.isInstanceOf(EaafConfigurationException.class, e, "Wong ExceptionType");
+      Assert.assertEquals("wrong errorCode", "internal.keystore.01", e.getErrorId());
+
+    }
+  }
+
+  @Test
+  @DirtiesContext
+  public void buildyStoreWithPkcs11() {
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertFalse("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.PKCS11);
+    try {
+      keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+      Assert.fail("Wrong config not detected");
+
+    } catch (final EaafException e) {
+      org.springframework.util.Assert.isInstanceOf(EaafConfigurationException.class, e, "Wong ExceptionType");
+      Assert.assertEquals("wrong errorCode", "internal.keystore.02", e.getErrorId());
+
+    }
+  }
+
+  @Test
+  @DirtiesContext
+  public void softwareKeyStoreWithoutConfig() {
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertFalse("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.JKS);
+    try {
+      keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+      Assert.fail("Wrong config not detected");
+
+    } catch (final EaafException e) {
+      org.springframework.util.Assert.isInstanceOf(EaafConfigurationException.class, e, "Wong ExceptionType");
+      Assert.assertEquals("wrong errorCode", "internal.keystore.06", e.getErrorId());
+
+    }
+  }
+
+  @Test
+  @DirtiesContext
+  public void softwareKeyStoreWithoutConfigSecond() {
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertFalse("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.PKCS12);
+    try {
+      keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+      Assert.fail("Wrong config not detected");
+
+    } catch (final EaafException e) {
+      org.springframework.util.Assert.isInstanceOf(EaafConfigurationException.class, e, "Wong ExceptionType");
+      Assert.assertEquals("wrong errorCode", "internal.keystore.06", e.getErrorId());
+
+    }
+  }
+
+  @Test
+  @DirtiesContext
+  public void softwareKeyStoreWithoutPassword() {
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertFalse("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.JKS);
+    keyStoreConfig.setSoftKeyStoreFilePath(PATH_TO_SOFTWARE_KEYSTORE_JKS);
+
+    try {
+      keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+      Assert.fail("Wrong config not detected");
+
+    } catch (final EaafException e) {
+      org.springframework.util.Assert.isInstanceOf(EaafConfigurationException.class, e, "Wong ExceptionType");
+      Assert.assertEquals("wrong errorCode", "internal.keystore.06", e.getErrorId());
+
+    }
+  }
+
+  @Test
+  @DirtiesContext
+  public void softwareKeyStoreWithoutPath() {
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertFalse("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.JKS);
+    keyStoreConfig.setSoftKeyStorePassword(SOFTWARE_KEYSTORE_PASSWORD);
+
+
+    try {
+      keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+      Assert.fail("Wrong config not detected");
+
+    } catch (final EaafException e) {
+      org.springframework.util.Assert.isInstanceOf(EaafConfigurationException.class, e, "Wong ExceptionType");
+      Assert.assertEquals("wrong errorCode", "internal.keystore.06", e.getErrorId());
+
+    }
+  }
+
+  @Test
+  @DirtiesContext
+  public void softwareKeyStoreWithoutType() throws EaafException {
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertFalse("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.JKS);
+    keyStoreConfig.setSoftKeyStoreFilePath(PATH_TO_SOFTWARE_KEYSTORE_JKS);
+    keyStoreConfig.setSoftKeyStorePassword(SOFTWARE_KEYSTORE_PASSWORD);
+
+    final Pair<KeyStore, Provider> keyStore = keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+    Assert.assertNotNull("KeyStore is null", keyStore);
+    Assert.assertNotNull("KeyStore is null", keyStore.getFirst());
+    Assert.assertNull("KeyStore is null", keyStore.getSecond());
+
+  }
+
+  @Test
+  @DirtiesContext
+  public void softwareKeyStoreWithWrongPath() {
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertFalse("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.JKS);
+    keyStoreConfig.setSoftKeyStoreFilePath("src/test/resources/notexist.jks");
+    keyStoreConfig.setSoftKeyStorePassword(SOFTWARE_KEYSTORE_PASSWORD);
+
+
+    try {
+      keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+      Assert.fail("Wrong config not detected");
+
+    } catch (final EaafException e) {
+      org.springframework.util.Assert.isInstanceOf(EaafConfigurationException.class, e, "Wong ExceptionType");
+      Assert.assertEquals("wrong errorCode", "internal.keystore.05", e.getErrorId());
+
+    }
+  }
+
+  @Test
+  @DirtiesContext
+  public void softwareKeyStoreWithWrongPassword() {
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertFalse("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.JKS);
+    keyStoreConfig.setSoftKeyStoreFilePath(PATH_TO_SOFTWARE_KEYSTORE_JKS);
+    keyStoreConfig.setSoftKeyStorePassword("wrong password");
+
+
+    try {
+      keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+      Assert.fail("Wrong config not detected");
+
+    } catch (final EaafException e) {
+      org.springframework.util.Assert.isInstanceOf(EaafFactoryException.class, e, "Wong ExceptionType");
+      Assert.assertEquals("wrong errorCode", "internal.keystore.06", e.getErrorId());
+
+    }
+  }
+
+  @Test
+  @DirtiesContext
+  public void softwareKeyStoreSuccessJks() throws EaafException {
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertFalse("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.JKS);
+    keyStoreConfig.setSoftKeyStoreFilePath(PATH_TO_SOFTWARE_KEYSTORE_JKS);
+    keyStoreConfig.setSoftKeyStorePassword(SOFTWARE_KEYSTORE_PASSWORD);
+
+    keyStoreConfig.validate();
+
+    final Pair<KeyStore, Provider> keyStore = keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+    Assert.assertNotNull("KeyStore is null", keyStore);
+    Assert.assertNotNull("KeyStore is null", keyStore.getFirst());
+    Assert.assertNull("KeyStore is null", keyStore.getSecond());
+
+  }
+
+  @Test
+  @DirtiesContext
+  public void softwareKeyStoreAccessOperations() throws EaafException, KeyStoreException {
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertFalse("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.JKS);
+    keyStoreConfig.setSoftKeyStoreFilePath(PATH_TO_SOFTWARE_KEYSTORE_JKS_WITH_TRUSTED_CERTS);
+    keyStoreConfig.setSoftKeyStorePassword(SOFTWARE_KEYSTORE_PASSWORD);
+
+    keyStoreConfig.validate();
+
+    final Pair<KeyStore, Provider> keyStore = keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+    Assert.assertNotNull("KeyStore is null", keyStore);
+    Assert.assertNotNull("KeyStore is null", keyStore.getFirst());
+    Assert.assertNull("KeyStore is null", keyStore.getSecond());
+
+    //read trusted certs
+    final List<X509Certificate> trustedCerts = EaafKeyStoreUtils.readCertsFromKeyStore(keyStore.getFirst());
+    Assert.assertNotNull("Trusted certs", trustedCerts);
+    Assert.assertEquals("Trusted certs size", 2, trustedCerts.size());
+
+    //read priv. key
+    final Pair<Key, X509Certificate[]> privCred1 = EaafKeyStoreUtils.getPrivateKeyAndCertificates(
+        keyStore.getFirst(), "meta", "password".toCharArray(), true, "jUnit test");
+    Assert.assertNotNull("Credential 1", privCred1);
+    Assert.assertNotNull("Credential 1 priv. key", privCred1.getFirst());
+    Assert.assertNotNull("Credential 1 certificate", privCred1.getSecond());
+
+    //read priv. key
+    final Pair<Key, X509Certificate[]> privCred2 = EaafKeyStoreUtils.getPrivateKeyAndCertificates(
+        keyStore.getFirst(), "sig", "password".toCharArray(), true, "jUnit test");
+    Assert.assertNotNull("Credential 2", privCred2);
+    Assert.assertNotNull("Credential 2 priv. key", privCred2.getFirst());
+    Assert.assertNotNull("Credential 2 certificate", privCred2.getSecond());
+
+
+    //read priv. key
+    final Pair<Key, X509Certificate[]> privCred3 = EaafKeyStoreUtils.getPrivateKeyAndCertificates(
+        keyStore.getFirst(), "notexist", "password".toCharArray(), false, "jUnit test");
+    Assert.assertNull("Credential 3", privCred3);
+
+  //read priv. key
+    final Pair<Key, X509Certificate[]> privCred4 = EaafKeyStoreUtils.getPrivateKeyAndCertificates(
+        keyStore.getFirst(), "meta", "wrong".toCharArray(), false, "jUnit test");
+    Assert.assertNull("Credential 3", privCred4);
+
+    try {
+      EaafKeyStoreUtils.getPrivateKeyAndCertificates(
+          keyStore.getFirst(), "meta", "wrong".toCharArray(), true, "jUnit test");
+      Assert.fail("Wrong password not detected");
+
+    } catch (final EaafKeyAccessException e) {
+      Assert.assertEquals("wrong errorcode", "internal.keystore.09", e.getErrorId());
+    }
+
+    try {
+      EaafKeyStoreUtils.getPrivateKeyAndCertificates(
+          keyStore.getFirst(), "wrong", "password".toCharArray(), true, "jUnit test");
+      Assert.fail("Wrong alias not detected");
+
+    } catch (final EaafKeyAccessException e) {
+      Assert.assertEquals("wrong errorcode", "internal.keystore.09", e.getErrorId());
+    }
+
+
+  }
+
+  @Test
+  @DirtiesContext
+  public void softwareKeyStoreSuccessPkcs12() throws EaafException {
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertFalse("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.PKCS12);
+    keyStoreConfig.setSoftKeyStoreFilePath(PATH_TO_SOFTWARE_KEYSTORE_PKCS12);
+    keyStoreConfig.setSoftKeyStorePassword(SOFTWARE_KEYSTORE_PASSWORD);
+
+    keyStoreConfig.validate();
+
+    final Pair<KeyStore, Provider> keyStore = keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+    Assert.assertNotNull("KeyStore is null", keyStore);
+    Assert.assertNotNull("KeyStore is null", keyStore.getFirst());
+    Assert.assertNull("KeyStore is null", keyStore.getSecond());
+
+  }
+
+  @Test
+  public void hsmFacadeOnlyHostConfig() {
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_HOST,
+        RandomStringUtils.randomNumeric(10));
+    try {
+      context.getBean(EaafKeyStoreFactory.class);
+      Assert.fail("Missing HSM Facade not detected");
+
+    } catch (final BeansException e) {
+      checkMissingConfigException(e);
+
+    }
+  }
+
+  @Test
+  public void hsmFacadeMissingPort() {
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_HOST,
+        RandomStringUtils.randomNumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_USERNAME,
+        RandomStringUtils.randomAlphanumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_PASSWORD,
+        RandomStringUtils.randomNumeric(10));
+
+    try {
+      context.getBean(EaafKeyStoreFactory.class);
+      Assert.fail("Missing HSM Facade not detected");
+
+    } catch (final BeansException e) {
+      checkMissingConfigException(e);
+
+    }
+  }
+
+  @Test
+  public void hsmFacadeMissingUsername() {
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_HOST,
+        RandomStringUtils.randomNumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_PORT,
+        RandomStringUtils.randomNumeric(4));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_PASSWORD,
+        RandomStringUtils.randomNumeric(10));
+    try {
+      context.getBean(EaafKeyStoreFactory.class);
+      Assert.fail("Missing HSM Facade not detected");
+
+    } catch (final BeansException e) {
+      checkMissingConfigException(e);
+
+    }
+  }
+
+  @Test
+  public void hsmFacadeMissingPassword() {
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_HOST,
+        RandomStringUtils.randomNumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_PORT,
+        RandomStringUtils.randomNumeric(4));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_USERNAME,
+        RandomStringUtils.randomAlphanumeric(10));
+
+    try {
+      context.getBean(EaafKeyStoreFactory.class);
+      Assert.fail("Missing HSM Facade not detected");
+
+    } catch (final BeansException e) {
+      checkMissingConfigException(e);
+
+    }
+  }
+
+  @Test
+  public void hsmFacadeMissingTrustedCertificate() {
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_HOST,
+        RandomStringUtils.randomNumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_PORT,
+        RandomStringUtils.randomNumeric(4));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_USERNAME,
+        RandomStringUtils.randomNumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_PASSWORD,
+        RandomStringUtils.randomAlphanumeric(10));
+
+    try {
+      context.getBean(EaafKeyStoreFactory.class);
+      Assert.fail("Missing HSM Facade not detected");
+
+    } catch (final BeansException e) {
+      checkMissingConfigException(e);
+
+    }
+  }
+
+  @Test
+  public void hsmFacadeMissingTrustedCertificateFile() {
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_HOST,
+        RandomStringUtils.randomNumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_PORT,
+        RandomStringUtils.randomNumeric(4));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_USERNAME,
+        RandomStringUtils.randomNumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_PASSWORD,
+        RandomStringUtils.randomAlphanumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_SSLTRUST,
+        "src/test/resources/data/notexist.crt");
+
+    try {
+      context.getBean(EaafKeyStoreFactory.class);
+      Assert.fail("Missing HSM Facade not detected");
+
+    } catch (final BeansException e) {
+      checkMissingConfigException(e, "internal.keystore.05");
+
+    }
+  }
+
+  @Test
+  public void hsmFacadeMissingWrongTrustedCertificate() {
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_HOST,
+        RandomStringUtils.randomNumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_PORT,
+        RandomStringUtils.randomNumeric(4));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_USERNAME,
+        RandomStringUtils.randomNumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_PASSWORD,
+        RandomStringUtils.randomAlphanumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_SSLTRUST,
+        "src/test/resources/spring/test_eaaf_pvp_lazy.beans.xml");
+
+    try {
+      context.getBean(EaafKeyStoreFactory.class);
+      Assert.fail("Missing HSM Facade not detected");
+
+    } catch (final BeansException e) {
+      checkMissingConfigException(e, "internal.keystore.05");
+
+    }
+  }
+
+  @Test
+  @DirtiesContext
+  public void hsmFacadeInitialized() {
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_HOST,
+        RandomStringUtils.randomNumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_PORT,
+        RandomStringUtils.randomNumeric(4));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_USERNAME,
+        RandomStringUtils.randomNumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_PASSWORD,
+        RandomStringUtils.randomAlphanumeric(10));
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_SSLTRUST,
+        PATH_TO_HSM_FACADE_TRUST_CERT);
+
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertTrue("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+  }
+
+  @Test
+  @DirtiesContext
+  public void hsmFacadeKeyStoreNoKeyStoreName() {
+    configureHsmFacade();
+
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertTrue("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.HSMFACADE);
+
+    try {
+      keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+      Assert.fail("Wrong config not detected");
+
+    } catch (final EaafException e) {
+      org.springframework.util.Assert.isInstanceOf(EaafConfigurationException.class, e, "Wong ExceptionType");
+      Assert.assertEquals("wrong errorCode", "internal.keystore.06", e.getErrorId());
+    }
+
+  }
+
+  @Test
+  @DirtiesContext
+  public void hsmFacadeKeyStoreSuccess() throws EaafException {
+    configureHsmFacade();
+
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertTrue("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.HSMFACADE);
+    keyStoreConfig.setKeyStoreName("authhandler");
+
+    keyStoreConfig.validate();
+
+    try {
+      final Pair<KeyStore, Provider> keyStore = keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+      Assert.assertNotNull("KeyStore is null", keyStore);
+      Assert.assertNotNull("KeyStore is null", keyStore.getFirst());
+      Assert.assertNotNull("KeyStore is null", keyStore.getSecond());
+
+    } catch (final StatusRuntimeException e) {
+      // because there is no mockup of HSM facade available
+      // Assert.assertTrue("Wrong exception", e.getMessage().contains("io
+      // exception"));
+
+    }
+  }
+
+  @Test
+  @DirtiesContext
+  public void hsmFacadeKeyStoreSuccessASitTestFacade() throws EaafException, KeyStoreException {
+    configureHsmFacade();
+
+    final EaafKeyStoreFactory keyStoreFactory = context.getBean(EaafKeyStoreFactory.class);
+    Assert.assertTrue("HSM Facade state wrong", keyStoreFactory.isHsmFacadeInitialized());
+
+    final KeyStoreConfiguration keyStoreConfig = new KeyStoreConfiguration();
+    keyStoreConfig.setKeyStoreType(KeyStoreType.HSMFACADE);
+    keyStoreConfig.setKeyStoreName("authhandler");
+
+    keyStoreConfig.validate();
+
+    final Pair<KeyStore, Provider> keyStore = keyStoreFactory.buildNewKeyStore(keyStoreConfig);
+    Assert.assertNotNull("KeyStore is null", keyStore);
+    Assert.assertNotNull("KeyStore is null", keyStore.getFirst());
+    Assert.assertNotNull("KeyStore is null", keyStore.getSecond());
+
+    //read trusted certs
+    final List<X509Certificate> trustedCerts = EaafKeyStoreUtils.readCertsFromKeyStore(
+        keyStore.getFirst());
+    Assert.assertNotNull("Trusted certs", trustedCerts);
+    Assert.assertEquals("Trusted certs size", 0, trustedCerts.size());
+
+    //read priv. key
+    final Pair<Key, X509Certificate[]> privCred1 = EaafKeyStoreUtils.getPrivateKeyAndCertificates(
+        keyStore.getFirst(), HSM_FACADE_KEY_ALIAS, null, true, "jUnit test");
+    Assert.assertNotNull("Credential 1", privCred1);
+    Assert.assertNotNull("Credential 1 priv. key", privCred1.getFirst());
+    Assert.assertNotNull("Credential 1 certificate", privCred1.getSecond());
+
+    //read priv. key
+    final Pair<Key, X509Certificate[]> privCred2 = EaafKeyStoreUtils.getPrivateKeyAndCertificates(
+        keyStore.getFirst(), HSM_FACADE_KEY_ALIAS, "shouldBeIgnord".toCharArray(), true, "jUnit test");
+    Assert.assertNotNull("Credential 2", privCred2);
+    Assert.assertNotNull("Credential 2 priv. key", privCred2.getFirst());
+    Assert.assertNotNull("Credential 2 certificate", privCred2.getSecond());
+
+    try {
+      EaafKeyStoreUtils.getPrivateKeyAndCertificates(
+          keyStore.getFirst(), "notExist", "wrong".toCharArray(), true, "jUnit test");
+      Assert.fail("Wrong password not detected");
+
+    } catch (final EaafKeyAccessException e) {
+      Assert.assertEquals("wrong errorcode", "internal.keystore.09", e.getErrorId());
+    }
+
+  }
+
+  private void configureHsmFacade() {
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_HOST, HSM_FACASE_HOST);
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_PORT, HSM_FACASE_PORT);
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_SSLTRUST, HSM_FACASE_SSL_TRUST);
+
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_USERNAME, HSM_FACASE_USERNAME);
+    mapConfig.putConfigValue(EaafKeyStoreFactory.CONFIG_PROP_HSM_FACADE_CLIENT_PASSWORD, HSM_FACASE_PASSWORD);
+
+  }
+
+  private void checkMissingConfigException(Exception e) {
+    checkMissingConfigException(e, "internal.keystore.04");
+
+  }
+
+  private void checkMissingConfigException(Exception e, String errorCode) {
+    final Optional<Throwable> eaafException = FluentIterable.from(
+        Throwables.getCausalChain(e)).filter(
+            Predicates.instanceOf(EaafConfigurationException.class)).first();
+    Assert.assertTrue("Wrong exception", eaafException.isPresent());
+    Assert.assertEquals("Wrong errorCode",
+        errorCode, ((EaafException) eaafException.get()).getErrorId());
+
+  }
+
+}