summaryrefslogtreecommitdiff
path: root/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtils.java
diff options
context:
space:
mode:
Diffstat (limited to 'eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtils.java')
-rw-r--r--eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtils.java107
1 files changed, 41 insertions, 66 deletions
diff --git a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtils.java b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtils.java
index 6ec56825..0d2c1815 100644
--- a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtils.java
+++ b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtils.java
@@ -70,8 +70,7 @@ public class JsonSecurityUtils implements IJoseTools {
log.info("Initialize SL2.0 authentication security constrains ... ");
try {
if (getKeyStoreFilePath() != null) {
- final KeyStore keyStore =
- KeyStoreUtils.loadKeyStore(getKeyStoreFilePath(), getKeyStorePassword());
+ final KeyStore keyStore = KeyStoreUtils.loadKeyStore(getKeyStoreFilePath(), getKeyStorePassword());
// load signing key
signPrivKey = keyStore.getKey(getSigningKeyAlias(), getSigningKeyPassword().toCharArray());
@@ -88,11 +87,9 @@ public class JsonSecurityUtils implements IJoseTools {
// load encryption key
try {
- encPrivKey =
- keyStore.getKey(getEncryptionKeyAlias(), getEncryptionKeyPassword().toCharArray());
+ encPrivKey = keyStore.getKey(getEncryptionKeyAlias(), getEncryptionKeyPassword().toCharArray());
if (encPrivKey != null) {
- final Certificate[] certChainEncryption =
- keyStore.getCertificateChain(getEncryptionKeyAlias());
+ final Certificate[] certChainEncryption = keyStore.getCertificateChain(getEncryptionKeyAlias());
encCertChain = new X509Certificate[certChainEncryption.length];
for (int i = 0; i < certChainEncryption.length; i++) {
if (certChainEncryption[i] instanceof X509Certificate) {
@@ -106,8 +103,8 @@ public class JsonSecurityUtils implements IJoseTools {
}
} catch (final Exception e) {
- log.warn("No encryption key for SL2.0 found. End-to-End encryption is not used. Reason: "
- + e.getMessage(), e);
+ log.warn("No encryption key for SL2.0 found. End-to-End encryption is not used. Reason: " + e.getMessage(),
+ e);
}
@@ -117,13 +114,13 @@ public class JsonSecurityUtils implements IJoseTools {
// some short validation
if (signPrivKey == null || !(signPrivKey instanceof PrivateKey)) {
log.info("Can NOT open privateKey for SL2.0 signing. KeyStore=" + getKeyStoreFilePath());
- throw new SL20Exception("sl20.03", new Object[] {"Can NOT open private key for signing"});
+ throw new SL20Exception("sl20.03", new Object[] { "Can NOT open private key for signing" });
}
if (signCertChain == null || signCertChain.length == 0) {
log.info("NO certificate for SL2.0 signing. KeyStore=" + getKeyStoreFilePath());
- throw new SL20Exception("sl20.03", new Object[] {"NO certificate for SL2.0 signing"});
+ throw new SL20Exception("sl20.03", new Object[] { "NO certificate for SL2.0 signing" });
}
@@ -133,9 +130,9 @@ public class JsonSecurityUtils implements IJoseTools {
log.info("NO SL2.0 authentication security configuration. Initialization was skipped");
}
- } catch (RuntimeException e) {
- throw e;
-
+ } catch (final RuntimeException e) {
+ throw e;
+
} catch (final Exception e) {
log.error("SL2.0 security constrains initialization FAILED.", e);
@@ -173,9 +170,8 @@ public class JsonSecurityUtils implements IJoseTools {
}
@Override
- public VerificationResult validateSignature(final String serializedContent,
- final KeyStore trustStore, final AlgorithmConstraints algconstraints)
- throws JoseException, IOException, KeyStoreException {
+ public VerificationResult validateSignature(final String serializedContent, final KeyStore trustStore,
+ final AlgorithmConstraints algconstraints) throws JoseException, IOException, KeyStoreException {
final List<X509Certificate> trustedCertificates = readCertsFromKeyStore(trustStore);
return validateSignature(serializedContent, trustedCertificates, algconstraints);
@@ -184,8 +180,8 @@ public class JsonSecurityUtils implements IJoseTools {
@Override
@NonNull
public VerificationResult validateSignature(@Nonnull final String serializedContent,
- @Nonnull final List<X509Certificate> trustedCerts,
- @Nonnull final AlgorithmConstraints constraints) throws JoseException, IOException {
+ @Nonnull final List<X509Certificate> trustedCerts, @Nonnull final AlgorithmConstraints constraints)
+ throws JoseException, IOException {
final JsonWebSignature jws = new JsonWebSignature();
// set payload
jws.setCompactSerialization(serializedContent);
@@ -219,20 +215,16 @@ public class JsonSecurityUtils implements IJoseTools {
} else if (StringUtils.isNotEmpty(x5t256)) {
log.debug("Found x5t256 fingerprint in JOSE header .... ");
- final X509VerificationKeyResolver x509VerificationKeyResolver =
- new X509VerificationKeyResolver(trustedCerts);
- selectedKey =
- x509VerificationKeyResolver.resolveKey(jws, Collections.<JsonWebStructure>emptyList());
+ final X509VerificationKeyResolver x509VerificationKeyResolver = new X509VerificationKeyResolver(trustedCerts);
+ selectedKey = x509VerificationKeyResolver.resolveKey(jws, Collections.<JsonWebStructure>emptyList());
} else {
- throw new JoseException(
- "JWS contains NO signature certificate or NO certificate fingerprint");
+ throw new JoseException("JWS contains NO signature certificate or NO certificate fingerprint");
}
if (selectedKey == null) {
- throw new JoseException(
- "Can NOT select verification key for JWS. Signature verification FAILED");
+ throw new JoseException("Can NOT select verification key for JWS. Signature verification FAILED");
}
@@ -240,23 +232,19 @@ public class JsonSecurityUtils implements IJoseTools {
jws.setKey(selectedKey);
// load payLoad
- return new VerificationResult(mapper.getMapper().readTree(jws.getPayload()), null,
- jws.verifySignature());
-
+ return new VerificationResult(mapper.getMapper().readTree(jws.getPayload()), null, jws.verifySignature());
}
@Override
@Nonnull
- public VerificationResult validateSignature(@Nonnull final String serializedContent)
- throws SL20Exception {
+ public VerificationResult validateSignature(@Nonnull final String serializedContent) throws SL20Exception {
try {
final AlgorithmConstraints algConstraints = new AlgorithmConstraints(ConstraintType.WHITELIST,
SL20Constants.SL20_ALGORITHM_WHITELIST_SIGNING
.toArray(new String[SL20Constants.SL20_ALGORITHM_WHITELIST_SIGNING.size()]));
- final VerificationResult result =
- validateSignature(serializedContent, trustedCerts, algConstraints);
+ final VerificationResult result = validateSignature(serializedContent, trustedCerts, algConstraints);
if (!result.isValidSigned()) {
log.info("JWS signature invalide. Stopping authentication process ...");
@@ -270,7 +258,7 @@ public class JsonSecurityUtils implements IJoseTools {
} catch (JoseException | JsonParseException e) {
log.warn("SL2.0 commando signature validation FAILED", e);
- throw new SL20SecurityException(new Object[] {e.getMessage()}, e);
+ throw new SL20SecurityException(new Object[] { e.getMessage() }, e);
} catch (final IOException e) {
log.warn("Decrypted SL2.0 result can not be parsed.", e);
@@ -280,24 +268,22 @@ public class JsonSecurityUtils implements IJoseTools {
}
-
@Override
public JsonNode decryptPayload(final String compactSerialization) throws SL20Exception {
try {
final JsonWebEncryption receiverJwe = new JsonWebEncryption();
// set security constrains
- receiverJwe.setAlgorithmConstraints(new AlgorithmConstraints(ConstraintType.WHITELIST,
- SL20Constants.SL20_ALGORITHM_WHITELIST_KEYENCRYPTION
+ receiverJwe.setAlgorithmConstraints(
+ new AlgorithmConstraints(ConstraintType.WHITELIST, SL20Constants.SL20_ALGORITHM_WHITELIST_KEYENCRYPTION
.toArray(new String[SL20Constants.SL20_ALGORITHM_WHITELIST_KEYENCRYPTION.size()])));
- receiverJwe.setContentEncryptionAlgorithmConstraints(new AlgorithmConstraints(
- ConstraintType.WHITELIST, SL20Constants.SL20_ALGORITHM_WHITELIST_ENCRYPTION
+ receiverJwe.setContentEncryptionAlgorithmConstraints(
+ new AlgorithmConstraints(ConstraintType.WHITELIST, SL20Constants.SL20_ALGORITHM_WHITELIST_ENCRYPTION
.toArray(new String[SL20Constants.SL20_ALGORITHM_WHITELIST_ENCRYPTION.size()])));
// set payload
receiverJwe.setCompactSerialization(compactSerialization);
-
// validate key from header against key from config
final List<X509Certificate> x5cCerts = receiverJwe.getCertificateChainHeaderValue();
final String x5t256 = receiverJwe.getX509CertSha256ThumbprintHeaderValue();
@@ -307,16 +293,16 @@ public class JsonSecurityUtils implements IJoseTools {
final List<X509Certificate> sortedX5cCerts = X509Utils.sortCertificates(x5cCerts);
if (!sortedX5cCerts.get(0).equals(encCertChain[0])) {
- log.info("Certificate from JOSE header does NOT match encryption certificate");
+ log.info("Certificate from JOSE header does NOT match encryption certificate");
try {
-
+
log.debug("JOSE certificate: {}", Base64Utils.encode(sortedX5cCerts.get(0).getEncoded()));
} catch (final CertificateEncodingException e) {
e.printStackTrace();
}
throw new SL20Exception("sl20.05",
- new Object[] {"Certificate from JOSE header does NOT match encryption certificate"});
+ new Object[] { "Certificate from JOSE header does NOT match encryption certificate" });
}
} else if (StringUtils.isNotEmpty(x5t256)) {
@@ -326,13 +312,12 @@ public class JsonSecurityUtils implements IJoseTools {
log.info("X5t256 from JOSE header does NOT match encryption certificate");
log.debug("X5t256 from JOSE header: " + x5t256 + " Encrytption cert: " + certFingerPrint);
throw new SL20Exception("sl20.05",
- new Object[] {"X5t256 from JOSE header does NOT match encryption certificate"});
+ new Object[] { "X5t256 from JOSE header does NOT match encryption certificate" });
}
} else {
- log.info(
- "Signed SL2.0 response contains NO signature certificate or NO certificate fingerprint");
+ log.info("Signed SL2.0 response contains NO signature certificate or NO certificate fingerprint");
throw new SlCommandoParserException(
"Signed SL2.0 response contains NO signature certificate or NO certificate fingerprint");
@@ -341,13 +326,12 @@ public class JsonSecurityUtils implements IJoseTools {
// set key
receiverJwe.setKey(encPrivKey);
-
// decrypt payload
return mapper.getMapper().readTree(receiverJwe.getPlaintextString());
} catch (final JoseException e) {
log.warn("SL2.0 result decryption FAILED", e);
- throw new SL20SecurityException(new Object[] {e.getMessage()}, e);
+ throw new SL20SecurityException(new Object[] { e.getMessage() }, e);
} catch (final JsonParseException e) {
log.warn("Decrypted SL2.0 result is NOT a valid JSON.", e);
@@ -360,8 +344,6 @@ public class JsonSecurityUtils implements IJoseTools {
}
-
-
@Override
public X509Certificate getEncryptionCertificate() {
// TODO: maybe update after SL2.0 update on encryption certificate parts
@@ -373,14 +355,12 @@ public class JsonSecurityUtils implements IJoseTools {
}
private String getKeyStoreFilePath() throws EaafConfigurationException, MalformedURLException {
- return FileUtils.makeAbsoluteUrl(
- authConfig.getBasicConfiguration(Constants.CONFIG_PROP_SECURITY_KEYSTORE_PATH),
+ return FileUtils.makeAbsoluteUrl(authConfig.getBasicConfiguration(Constants.CONFIG_PROP_SECURITY_KEYSTORE_PATH),
authConfig.getConfigurationRootDirectory());
}
private String getKeyStorePassword() {
- String value =
- authConfig.getBasicConfiguration(Constants.CONFIG_PROP_SECURITY_KEYSTORE_PASSWORD);
+ String value = authConfig.getBasicConfiguration(Constants.CONFIG_PROP_SECURITY_KEYSTORE_PASSWORD);
if (value != null) {
value = value.trim();
}
@@ -390,8 +370,7 @@ public class JsonSecurityUtils implements IJoseTools {
}
private String getSigningKeyAlias() {
- String value = authConfig
- .getBasicConfiguration(Constants.CONFIG_PROP_SECURITY_KEYSTORE_KEY_SIGN_ALIAS).trim();
+ String value = authConfig.getBasicConfiguration(Constants.CONFIG_PROP_SECURITY_KEYSTORE_KEY_SIGN_ALIAS).trim();
if (value != null) {
value = value.trim();
}
@@ -400,8 +379,7 @@ public class JsonSecurityUtils implements IJoseTools {
}
private String getSigningKeyPassword() {
- String value = authConfig
- .getBasicConfiguration(Constants.CONFIG_PROP_SECURITY_KEYSTORE_KEY_SIGN_PASSWORD).trim();
+ String value = authConfig.getBasicConfiguration(Constants.CONFIG_PROP_SECURITY_KEYSTORE_KEY_SIGN_PASSWORD).trim();
if (value != null) {
value = value.trim();
}
@@ -410,8 +388,8 @@ public class JsonSecurityUtils implements IJoseTools {
}
private String getEncryptionKeyAlias() {
- String value = authConfig
- .getBasicConfiguration(Constants.CONFIG_PROP_SECURITY_KEYSTORE_KEY_ENCRYPTION_ALIAS).trim();
+ String value = authConfig.getBasicConfiguration(Constants.CONFIG_PROP_SECURITY_KEYSTORE_KEY_ENCRYPTION_ALIAS)
+ .trim();
if (value != null) {
value = value.trim();
}
@@ -420,8 +398,7 @@ public class JsonSecurityUtils implements IJoseTools {
}
private String getEncryptionKeyPassword() {
- String value = authConfig
- .getBasicConfiguration(Constants.CONFIG_PROP_SECURITY_KEYSTORE_KEY_ENCRYPTION_PASSWORD)
+ String value = authConfig.getBasicConfiguration(Constants.CONFIG_PROP_SECURITY_KEYSTORE_KEY_ENCRYPTION_PASSWORD)
.trim();
if (value != null) {
value = value.trim();
@@ -431,8 +408,7 @@ public class JsonSecurityUtils implements IJoseTools {
}
@Nonnull
- private List<X509Certificate> readCertsFromKeyStore(@Nonnull final KeyStore keyStore)
- throws KeyStoreException {
+ private List<X509Certificate> readCertsFromKeyStore(@Nonnull final KeyStore keyStore) throws KeyStoreException {
final List<X509Certificate> result = new ArrayList<>();
final Enumeration<String> aliases = keyStore.aliases();
@@ -444,8 +420,7 @@ public class JsonSecurityUtils implements IJoseTools {
if (cert != null && cert instanceof X509Certificate) {
result.add((X509Certificate) cert);
} else {
- log.info("Can not process entry: {}. Reason: {}", el,
- cert != null ? cert.getType() : "cert is null");
+ log.info("Can not process entry: {}. Reason: {}", el, cert != null ? cert.getType() : "cert is null");
}
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-13 12:28:15 +0000