/* * Copyright 2003 Federal Chancellery Austria * MOA-ID has been developed in a cooperation between BRZ, the Federal * Chancellery Austria - ICT staff unit, and Graz University of Technology. * * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by * the European Commission - subsequent versions of the EUPL (the "Licence"); * You may not use this work except in compliance with the Licence. * You may obtain a copy of the Licence at: * http://www.osor.eu/eupl/ * * Unless required by applicable law or agreed to in writing, software * distributed under the Licence is distributed on an "AS IS" basis, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the Licence for the specific language governing permissions and * limitations under the Licence. * * This product combines work with different licenses. See the "NOTICE" text * file for details on the various modules and licenses. * The "NOTICE" text file is part of the distribution. Any derivative works * that you distribute must include a readable copy of the "NOTICE" text file. */ package at.gv.egovernment.moa.id.auth; import iaik.pki.PKIException; import iaik.pki.jsse.IAIKX509TrustManager; import java.io.IOException; import java.io.PrintWriter; import java.security.GeneralSecurityException; import java.util.Properties; import javax.activation.CommandMap; import javax.activation.MailcapCommandMap; import javax.mail.Session; import javax.net.ssl.SSLSocketFactory; import org.apache.commons.logging.impl.SLF4JLog; import org.apache.log4j.config.PropertyPrinter; import at.gv.egovernment.moa.id.config.ConfigurationException; import at.gv.egovernment.moa.id.config.ConnectionParameter; import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider; import at.gv.egovernment.moa.id.iaik.config.LoggerConfigImpl; import at.gv.egovernment.moa.id.util.AxisSecureSocketFactory; import at.gv.egovernment.moa.id.util.MOAIDMessageProvider; import at.gv.egovernment.moa.id.util.SSLUtils; import at.gv.egovernment.moa.logging.Logger; import at.gv.egovernment.moa.logging.LoggingContext; import at.gv.egovernment.moa.logging.LoggingContextManager; import at.gv.egovernment.moa.spss.server.config.ConfigurationProvider; import at.gv.egovernment.moa.spss.server.iaik.config.IaikConfigurator; import at.gv.egovernment.moa.util.Constants; /** * Web application initializer * * @author Paul Ivancsics * @version $Id$ */ public class MOAIDAuthInitializer { /** a boolean identifying if the MOAIDAuthInitializer has been startet */ public static boolean initialized = false; /** * Initializes the web application components which need initialization: * logging, JSSE, MOA-ID Auth configuration, Axis, session cleaner. */ public static void initialize() throws ConfigurationException, PKIException, IOException, GeneralSecurityException { if (initialized) return; initialized = true; Logger.setHierarchy("moa.id.auth"); Logger.info("Default java file.encoding: " + System.getProperty("file.encoding")); //JDK bug workaround according to: // http://jce.iaik.tugraz.at/products/03_cms/faq/index.php#JarVerifier // register content data handlers for S/MIME types MailcapCommandMap mc = new MailcapCommandMap(); CommandMap.setDefaultCommandMap(mc); // create some properties and get the default Session Properties props = new Properties(); props.put("mail.smtp.host", "localhost"); Session session = Session.getDefaultInstance(props, null); // Restricts TLS cipher suites // System.setProperty( // "https.cipherSuites", // "SSL_RSA_WITH_RC4_128_SHA,SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_3DES_EDE_CBC_SHA"); // // actual HIGH cipher suites from OpenSSL // Mapping OpenSSL - Java // OpenSSL Java // http://www.openssl.org/docs/apps/ciphers.html http://docs.oracle.com/javase/6/docs/technotes/guides/security/SunProviders.html // via !openssl ciphers -tls1 HIGH !v! // // ADH-AES256-SHA TLS_DH_anon_WITH_AES_256_CBC_SHA // DHE-RSA-AES256-SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA // DHE-DSS-AES256-SHA TLS_DHE_DSS_WITH_AES_256_CBC_SHA // AES256-SHA TLS_RSA_WITH_AES_256_CBC_SHA // ADH-AES128-SHA TLS_DH_anon_WITH_AES_128_CBC_SHA // DHE-RSA-AES128-SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA // DHE-DSS-AES128-SHA TLS_DHE_DSS_WITH_AES_128_CBC_SHA // AES128-SHA TLS_RSA_WITH_AES_128_CBC_SHA // ADH-DES-CBC3-SHA SSL_DH_anon_WITH_3DES_EDE_CBC_SHA // EDH-RSA-DES-CBC3-SHA - // EDH-DSS-DES-CBC3-SHA - // DES-CBC3-SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA System.setProperty( "https.cipherSuites", "TLS_DH_anon_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,SSL_DH_anon_WITH_3DES_EDE_CBC_SHA,SSL_RSA_WITH_3DES_EDE_CBC_SHA"); // load some jsse classes so that the integrity of the jars can be // verified // before the iaik jce is installed as the security provider // this workaround is only needed when sun jsse is used in conjunction // with // iaik-jce (on jdk1.3) ClassLoader cl = MOAIDAuthInitializer.class.getClassLoader(); try { cl.loadClass("javax.security.cert.Certificate"); // from jcert.jar } catch (ClassNotFoundException e) { Logger.warn(MOAIDMessageProvider.getInstance().getMessage( "init.01", null), e); } // Initializes SSLSocketFactory store SSLUtils.initialize(); // Initializes Namespace Map Constants.nSMap.put(Constants.SAML_PREFIX, Constants.SAML_NS_URI); Constants.nSMap.put(Constants.ECDSA_PREFIX, "http://www.w3.org/2001/04/xmldsig-more#"); Constants.nSMap.put(Constants.DSIG_PREFIX, Constants.DSIG_NS_URI); // Loads the configuration AuthConfigurationProvider authConf = AuthConfigurationProvider.reload(); ConnectionParameter moaSPConnParam = authConf .getMoaSpConnectionParameter(); // If MOA-SP API calls: loads MOA-SP configuration and configures IAIK if (moaSPConnParam == null) { try { LoggingContextManager.getInstance().setLoggingContext( new LoggingContext("startup")); ConfigurationProvider config = ConfigurationProvider .getInstance(); new IaikConfigurator().configure(config); } catch (at.gv.egovernment.moa.spss.server.config.ConfigurationException ex) { throw new ConfigurationException("config.10", new Object[] { ex .toString() }, ex); } } // Initializes IAIKX509TrustManager logging String log4jConfigURL = System.getProperty("log4j.configuration"); Logger.info("Log4J Configuration: " + log4jConfigURL); if (log4jConfigURL != null) { IAIKX509TrustManager.initLog(new LoggerConfigImpl(log4jConfigURL)); } // Initializes the Axis secure socket factory for use in calling the // MOA-SP web service if (moaSPConnParam != null && moaSPConnParam.isHTTPSURL()) { SSLSocketFactory ssf = SSLUtils.getSSLSocketFactory(authConf, moaSPConnParam); AxisSecureSocketFactory.initialize(ssf); } //TODO: Set TimeOuts!!! // sets the authentication session and authentication data time outs String param = authConf .getGenericConfigurationParameter(AuthConfigurationProvider.AUTH_SESSION_TIMEOUT_PROPERTY); if (param != null) { long sessionTimeOut = 0; try { sessionTimeOut = new Long(param).longValue(); } catch (NumberFormatException ex) { Logger .error(MOAIDMessageProvider .getInstance() .getMessage( "config.05", new Object[] { AuthConfigurationProvider.AUTH_SESSION_TIMEOUT_PROPERTY })); } if (sessionTimeOut > 0) AuthenticationServer.getInstance() .setSecondsSessionTimeOut(sessionTimeOut); } param = authConf .getGenericConfigurationParameter(AuthConfigurationProvider.AUTH_DATA_TIMEOUT_PROPERTY); if (param != null) { long authDataTimeOut = 0; try { authDataTimeOut = new Long(param).longValue(); } catch (NumberFormatException ex) { Logger .error(MOAIDMessageProvider .getInstance() .getMessage( "config.05", new Object[] { AuthConfigurationProvider.AUTH_DATA_TIMEOUT_PROPERTY })); } if (authDataTimeOut > 0) AuthenticationServer.getInstance() .setSecondsAuthDataTimeOut(authDataTimeOut); } // Starts the session cleaner thread to remove unpicked authentication data AuthenticationSessionCleaner.start(); } }