summaryrefslogtreecommitdiff
path: root/eaaf_core_utils
diff options
context:
space:
mode:
Diffstat (limited to 'eaaf_core_utils')
-rw-r--r--eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/credential/EaafKeyStoreFactory.java203
1 files changed, 102 insertions, 101 deletions
diff --git a/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/credential/EaafKeyStoreFactory.java b/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/credential/EaafKeyStoreFactory.java
index 743a7318..bd2b3cab 100644
--- a/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/credential/EaafKeyStoreFactory.java
+++ b/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/credential/EaafKeyStoreFactory.java
@@ -27,11 +27,6 @@ import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
-import org.apache.commons.lang3.StringUtils;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.core.io.Resource;
-import org.springframework.core.io.ResourceLoader;
-
import at.gv.egiz.eaaf.core.api.idp.IConfiguration;
import at.gv.egiz.eaaf.core.exception.EaafKeyAccessException;
import at.gv.egiz.eaaf.core.exceptions.EaafConfigurationException;
@@ -42,6 +37,12 @@ import at.gv.egiz.eaaf.core.impl.credential.SymmetricKeyConfiguration.SymmetricK
import at.gv.egiz.eaaf.core.impl.data.Pair;
import at.gv.egiz.eaaf.core.impl.utils.FileUtils;
import at.gv.egiz.eaaf.core.impl.utils.KeyStoreUtils;
+
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.core.io.Resource;
+import org.springframework.core.io.ResourceLoader;
+
import lombok.extern.slf4j.Slf4j;
@Slf4j
@@ -62,16 +63,16 @@ public class EaafKeyStoreFactory {
public static final String ERRORCODE_06 = "internal.keystore.06";
public static final String ERRORCODE_07 = "internal.keystore.07";
public static final String ERRORCODE_10 = "internal.keystore.10";
-
+
public static final String ERRORCODE_KEY_00 = "internal.key.00";
private static final String HSM_FACADE_PROVIDER_CLASS = "at.asitplus.hsmfacade.provider.HsmFacadeProvider";
- private static final String HSM_FACADE_KEYSTORELOADPARAMETERS_CLASS
+ private static final String HSM_FACADE_KEYSTORELOADPARAMETERS_CLASS
= "at.asitplus.hsmfacade.provider.RemoteKeyStoreLoadParameter";
private static final String HSM_FACADE_PROVIDER_METHOD_CONSTRUCT = "getInstance";
private static final String HSM_FACADE_PROVIDER_METHOD_INIT = "init";
private static final String HSM_FACADE_PROVIDER_METHOD_ISINITIALIZED = "isInitialized";
- private static final String HSM_FACADE_PROVIDER_INIT_ERROR_MSG
+ private static final String HSM_FACADE_PROVIDER_INIT_ERROR_MSG
= "Has HSM-Facade class supported '{}' method: {}";
private static final String HSM_FACADE_PROVIDER = "HsmFacade";
private static final String HSM_FACADE_KEYSTORE_TYPE = "RemoteKeyStore";
@@ -94,10 +95,10 @@ public class EaafKeyStoreFactory {
*/
@Nonnull
public Pair<SecretKey, Provider> buildNewSymmetricKey(SymmetricKeyConfiguration config) throws EaafException {
- log.trace("Starting symmetric-key generation based on configuration object ... ");
+ log.trace("Starting symmetric-key generation based on configuration object ... ");
if (SymmetricKeyType.PASSPHRASE.equals(config.getKeyType())) {
return generatePassPhraseBasedSymmetricKey(config);
-
+
} else if (SymmetricKeyType.HSMFACADE.equals(config.getKeyType())) {
if (isHsmFacadeInitialized) {
return getSymmetricKeyFromHsmFacade(config);
@@ -109,17 +110,17 @@ public class EaafKeyStoreFactory {
new Object[] { config.getFriendlyName() });
}
-
+
} else {
log.warn("Symmetric KeyType: {} is unrecognized", config.getKeyType());
throw new EaafConfigurationException(ERRORCODE_01,
new Object[] { config.getFriendlyName() });
}
-
-
+
+
}
-
+
/**
* Get a new KeyStore based on a KeyStore configuration-object.
*
@@ -172,46 +173,46 @@ public class EaafKeyStoreFactory {
}
@PostConstruct
- private void initialize() throws EaafException {
- Class<?> hsmProviderClazz = getHsmProviderClass();
- if (hsmProviderClazz != null) {
+ private void initialize() throws EaafException {
+ final Class<?> hsmProviderClazz = getHsmProviderClass();
+ if (hsmProviderClazz != null) {
final String hsmFacadeHost = basicConfig.getBasicConfiguration(CONFIG_PROP_HSM_FACADE_HOST);
- Provider alreadyLoadedProvider = Security.getProvider(HSM_FACADE_PROVIDER);
- if (alreadyLoadedProvider != null
- && alreadyLoadedProvider.getClass().isAssignableFrom(hsmProviderClazz)) {
+ final Provider alreadyLoadedProvider = Security.getProvider(HSM_FACADE_PROVIDER);
+ if (alreadyLoadedProvider != null
+ && alreadyLoadedProvider.getClass().isAssignableFrom(hsmProviderClazz)) {
log.info("Find already initialized Java SecurityProvider: {}", alreadyLoadedProvider.getName());
- //mark it as initialized if the state can not be determined
+ //mark it as initialized if the state can not be determined
boolean isAlreadyInitialized = true;
try {
- Method initializeCheck =
+ final Method initializeCheck =
alreadyLoadedProvider.getClass().getMethod(HSM_FACADE_PROVIDER_METHOD_ISINITIALIZED, new Class[]{});
isAlreadyInitialized = (boolean) initializeCheck.invoke(alreadyLoadedProvider);
-
- } catch (Exception e) {
+
+ } catch (final Exception e) {
log.warn("Can not determine state of alreay loaded HSM Facade. Mark it as 'initialized'");
log.debug("HSM Facade check error: {}", e.getMessage());
-
+
}
isHsmFacadeInitialized = isAlreadyInitialized;
-
+
if (isHsmFacadeInitialized) {
log.info("HSM Facade is already initialized. {} can provide KeyStores based on remote HSM",
EaafKeyStoreFactory.class.getSimpleName());
-
+
} else {
log.info("HSM Facade is already loaded but not initialized. {} can NOT provide KeyStores based on remote HSM",
EaafKeyStoreFactory.class.getSimpleName());
-
+
}
-
- } else if (StringUtils.isNotEmpty(hsmFacadeHost)) {
+
+ } else if (StringUtils.isNotEmpty(hsmFacadeHost)) {
log.debug("Find host for HSMFacade. Starting crypto provider initialization ... ");
initializeHsmFacadeSecurityProvider(hsmProviderClazz, hsmFacadeHost);
-
+
} else {
log.info("HSM Facade is on ClassPath but not configurated. {} can only provide software keystores",
EaafKeyStoreFactory.class.getSimpleName());
-
+
}
} else {
@@ -222,7 +223,7 @@ public class EaafKeyStoreFactory {
}
- private void initializeHsmFacadeSecurityProvider(Class<?> hsmProviderClazz, String hsmFacadeHost)
+ private void initializeHsmFacadeSecurityProvider(Class<?> hsmProviderClazz, String hsmFacadeHost)
throws EaafException {
try {
final int port = Integer.parseUnsignedInt(
@@ -231,40 +232,40 @@ public class EaafKeyStoreFactory {
getConfigurationParameter(CONFIG_PROP_HSM_FACADE_CLIENT_USERNAME);
final String clientPassword =
getConfigurationParameter(CONFIG_PROP_HSM_FACADE_CLIENT_PASSWORD);
-
- //initialize HSM-Facade by using JAVA Reflection, because in that case HSM-Facade
+
+ //initialize HSM-Facade by using JAVA Reflection, because in that case HSM-Facade
//has not be in ClassPath on every project
- Method constructor = hsmProviderClazz.getMethod(HSM_FACADE_PROVIDER_METHOD_CONSTRUCT, new Class[]{});
- Method initMethod = hsmProviderClazz.getMethod(HSM_FACADE_PROVIDER_METHOD_INIT,
+ final Method constructor = hsmProviderClazz.getMethod(HSM_FACADE_PROVIDER_METHOD_CONSTRUCT, new Class[]{});
+ final Method initMethod = hsmProviderClazz.getMethod(HSM_FACADE_PROVIDER_METHOD_INIT,
X509Certificate.class, String.class, String.class, String.class, int.class);
- if (initMethod != null && constructor != null) {
- Object rawProvider = constructor.invoke(hsmProviderClazz);
+ if (initMethod != null && constructor != null) {
+ final Object rawProvider = constructor.invoke(hsmProviderClazz);
initMethod.invoke(
- rawProvider, getHsmFacadeTrustSslCertificate(),
+ rawProvider, getHsmFacadeTrustSslCertificate(),
clientUsername, clientPassword, hsmFacadeHost, port);
-
- if (rawProvider instanceof Provider) {
+
+ if (rawProvider instanceof Provider) {
Security.insertProviderAt((Provider) rawProvider, 0);
isHsmFacadeInitialized = true;
log.info("HSM Facade is initialized. {} can provide KeyStores based on remote HSM",
EaafKeyStoreFactory.class.getSimpleName());
-
+
} else {
- log.warn("Is HSM-Facade class type of 'java.security.Provider': {}",
- rawProvider instanceof Provider);
+ log.warn("Is HSM-Facade class type of 'java.security.Provider': {}",
+ rawProvider instanceof Provider);
throw new EaafException(ERRORCODE_10, new Object[] {HSM_FACADE_PROVIDER_CLASS});
-
+
}
-
- } else {
- log.warn(HSM_FACADE_PROVIDER_INIT_ERROR_MSG,
+
+ } else {
+ log.warn(HSM_FACADE_PROVIDER_INIT_ERROR_MSG,
HSM_FACADE_PROVIDER_METHOD_CONSTRUCT, constructor != null);
- log.warn(HSM_FACADE_PROVIDER_INIT_ERROR_MSG,
+ log.warn(HSM_FACADE_PROVIDER_INIT_ERROR_MSG,
HSM_FACADE_PROVIDER_METHOD_INIT, initMethod != null);
throw new EaafException(ERRORCODE_10, new Object[] {HSM_FACADE_PROVIDER_CLASS});
-
+
}
-
+
//final HsmFacadeProvider provider = HsmFacadeProvider.Companion.getInstance();
//provider.init(getHsmFacadeTrustSslCertificate(), clientUsername, clientPassword, hsmFacadeHost, port);
@@ -274,19 +275,19 @@ public class EaafKeyStoreFactory {
} catch (final Exception e) {
log.error("HSM Facade initialization FAILED with an generic error.", e);
throw new EaafConfigurationException(ERRORCODE_03, new Object[] { e.getMessage() }, e);
-
+
}
-
+
}
private Class<?> getHsmProviderClass() {
try {
return Class.forName(HSM_FACADE_PROVIDER_CLASS);
-
- } catch (ClassNotFoundException e1) {
+
+ } catch (final ClassNotFoundException e1) {
log.debug("No HSM-Facade implemenation in ClassPath. HSM-Facade will not be available");
return null;
-
+
}
}
@@ -304,16 +305,16 @@ public class EaafKeyStoreFactory {
if (config.isSkipMakeAbsolutPaths()) {
log.debug("Use filepath from config: {}", keyStorePath);
ressource = resourceLoader.getResource(keyStorePath);
-
+
} else {
final String absKeyStorePath = FileUtils.makeAbsoluteUrl(keyStorePath, basicConfig
- .getConfigurationRootDirectory());
+ .getConfigurationRootDirectory());
log.debug("Use filepath from config: {}", absKeyStorePath);
-
+
ressource = resourceLoader.getResource(absKeyStorePath);
-
+
}
-
+
if (!ressource.exists()) {
throw new EaafConfigurationException(ERRORCODE_05,
new Object[] { config.getFriendlyName(),
@@ -326,15 +327,15 @@ public class EaafKeyStoreFactory {
is.close();
return Pair.newInstance(keyStore, null);
-
- } catch (EaafException e) {
+
+ } catch (final EaafException e) {
throw e;
-
- } catch (IOException e) {
+
+ } catch (final IOException e) {
throw new EaafFactoryException(ERRORCODE_06,
new Object[] { config.getFriendlyName(), "KeyStore not valid or password wrong" });
-
- } catch (Exception e) {
+
+ } catch (final Exception e) {
log.error("Software KeyStore initialization FAILED with an generic error.", e);
throw new EaafConfigurationException(ERRORCODE_03, new Object[] { e.getMessage() }, e);
@@ -345,14 +346,14 @@ public class EaafKeyStoreFactory {
private Pair<KeyStore, Provider> getKeyStoreFromHsmFacade(KeyStoreConfiguration config)
throws EaafFactoryException, EaafConfigurationException {
return getKeyStoreFromHsmFacade(config.getKeyStoreName(), config.getFriendlyName());
-
+
}
@Nonnull
private Pair<KeyStore, Provider> getKeyStoreFromHsmFacade(String keyStoreName, String friendlyName)
throws EaafFactoryException, EaafConfigurationException {
final String validatedKeyStoreName = checkConfigurationParameter(keyStoreName,
- ERRORCODE_06, friendlyName, "KeyStoreName missing for HSM Facade");
+ ERRORCODE_06, friendlyName, "KeyStoreName missing for HSM Facade");
try {
final KeyStore keyStore = KeyStore.getInstance(HSM_FACADE_KEYSTORE_TYPE, HSM_FACADE_PROVIDER);
@@ -368,35 +369,35 @@ public class EaafKeyStoreFactory {
}
}
-
+
private KeyStore.LoadStoreParameter getHsmFacadeKeyStoreParameter(String keyStoreName) throws EaafException {
try {
- Class<?> clazz = Class.forName(HSM_FACADE_KEYSTORELOADPARAMETERS_CLASS);
- Constructor<?> constructor = clazz.getConstructor(String.class);
- Object keyStoreParams = constructor.newInstance(keyStoreName);
+ final Class<?> clazz = Class.forName(HSM_FACADE_KEYSTORELOADPARAMETERS_CLASS);
+ final Constructor<?> constructor = clazz.getConstructor(String.class);
+ final Object keyStoreParams = constructor.newInstance(keyStoreName);
return (LoadStoreParameter) keyStoreParams;
-
- } catch (Exception e) {
+
+ } catch (final Exception e) {
log.error("Can NOT build class: {} for HSM-Facade provider", HSM_FACADE_KEYSTORELOADPARAMETERS_CLASS, e);
throw new EaafException(ERRORCODE_10, new Object[] {HSM_FACADE_PROVIDER_CLASS}, e);
-
+
}
-
+
}
-
+
@Nonnull
- private Pair<SecretKey, Provider> generatePassPhraseBasedSymmetricKey(SymmetricKeyConfiguration config)
+ private Pair<SecretKey, Provider> generatePassPhraseBasedSymmetricKey(SymmetricKeyConfiguration config)
throws EaafConfigurationException {
checkConfigurationParameter(config.getSoftKeyPassphrase(),
ERRORCODE_KEY_00, config.getFriendlyName(), "passphrase missing");
checkConfigurationParameter(config.getSoftKeySalt(),
ERRORCODE_KEY_00, config.getFriendlyName(), "salt missing");
-
+
try {
final SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("PBKDF2WITHHMACSHA256");
final KeySpec spec = new PBEKeySpec(
- config.getSoftKeyPassphrase().toCharArray(),
- config.getSoftKeySalt().getBytes("UTF-8"),
+ config.getSoftKeyPassphrase().toCharArray(),
+ config.getSoftKeySalt().getBytes("UTF-8"),
10000, 128);
return Pair.newInstance(keyFactory.generateSecret(spec), null);
@@ -408,38 +409,38 @@ public class EaafKeyStoreFactory {
}
}
-
+
@Nonnull
- private Pair<SecretKey, Provider> getSymmetricKeyFromHsmFacade(SymmetricKeyConfiguration config)
+ private Pair<SecretKey, Provider> getSymmetricKeyFromHsmFacade(SymmetricKeyConfiguration config)
throws EaafFactoryException, EaafConfigurationException, EaafKeyAccessException {
- Pair<KeyStore, Provider> keyStore = getKeyStoreFromHsmFacade(
+ final Pair<KeyStore, Provider> keyStore = getKeyStoreFromHsmFacade(
config.getKeyStoreName(), config.getFriendlyName());
-
+
checkConfigurationParameter(config.getKeyAlias(),
ERRORCODE_KEY_00, config.getFriendlyName(), "keyAlias missing");
-
+
try {
- SecretKey secretKey = (SecretKey) keyStore.getFirst().getKey(config.getKeyAlias(), null);
+ final SecretKey secretKey = (SecretKey) keyStore.getFirst().getKey(config.getKeyAlias(), null);
if (secretKey == null) {
- throw new EaafKeyAccessException(EaafKeyAccessException.ERROR_CODE_09,
+ throw new EaafKeyAccessException(EaafKeyAccessException.ERROR_CODE_09,
config.getFriendlyName(), config.getKeyAlias(), "No SecretKey with Alias ");
-
- }
-
+
+ }
+
return Pair.newInstance(secretKey, keyStore.getSecond());
-
+
} catch (UnrecoverableKeyException | KeyStoreException | NoSuchAlgorithmException e) {
- throw new EaafKeyAccessException(EaafKeyAccessException.ERROR_CODE_09, e,
+ throw new EaafKeyAccessException(EaafKeyAccessException.ERROR_CODE_09, e,
config.getFriendlyName(), config.getKeyAlias(), e.getMessage());
-
- } catch (ClassCastException e) {
- throw new EaafKeyAccessException(EaafKeyAccessException.ERROR_CODE_09,
+
+ } catch (final ClassCastException e) {
+ throw new EaafKeyAccessException(EaafKeyAccessException.ERROR_CODE_09,
config.getFriendlyName(), config.getKeyAlias(), "Wrong SecretKey type ");
-
+
}
-
+
}
-
+
private X509Certificate getHsmFacadeTrustSslCertificate() throws EaafConfigurationException {
try {
final String certFilePath = getConfigurationParameter(CONFIG_PROP_HSM_FACADE_SSLTRUST);
generated by cgit v1.2.3 (git 2.39.1) at 2025-10-25 12:45:23 +0000