* A credential that returns a function should also implement the {@link #reload()} method. *
- * + * * @return a function for testing the credential, or null if no test function is available */ Supplier* If you are using Spring Boot, do: *
- * + * ** @Bean * @ConfigurationPropertiesBinding @@ -47,7 +47,7 @@ * return new PropertyToPrivateKeyConverter(); * } *- * + * * @author Martin Lindström (martin@idsec.se) * @author Stefan Santesson (stefan@idsec.se) */ diff --git a/src/main/java/se/swedenconnect/security/credential/converters/PropertyToX509CertificateConverter.java b/src/main/java/se/swedenconnect/security/credential/converters/PropertyToX509CertificateConverter.java index 14c160c..b6be47c 100644 --- a/src/main/java/se/swedenconnect/security/credential/converters/PropertyToX509CertificateConverter.java +++ b/src/main/java/se/swedenconnect/security/credential/converters/PropertyToX509CertificateConverter.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 Sweden Connect + * Copyright 2020-2023 Sweden Connect * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -36,7 +36,7 @@ *
* If you are using Spring Boot, do: *
- * + * ** @Bean * @ConfigurationPropertiesBinding @@ -44,8 +44,8 @@ * return new PropertyToX509CertificateConverter(); * } *- * - * + * + * * @author Martin Lindström (martin@idsec.se) * @author Stefan Santesson (stefan@idsec.se) */ @@ -57,7 +57,6 @@ public class PropertyToX509CertificateConverter implements Converter
* The type of {@link KeyStore} created will be {@link KeyStore#getDefaultType()}. *
- * + * * @param resource * the keystore resource * @param password @@ -85,7 +85,7 @@ public KeyStoreFactoryBean(final Resource resource, final char[] password) { /** * Constructor that accepts a resource reference to a keystore, the password to unlock this file and the store type * ("JKS", "PKCS12", ...). - * + * * @param resource * the keystore resource * @param password @@ -101,14 +101,14 @@ public KeyStoreFactoryBean(final Resource resource, final char[] password, final /** {@inheritDoc} */ @Override - protected KeyStore createInstance() throws Exception { + protected KeyStore createInstance() throws Exception { try { if (this.type == null) { this.type = KeyStore.getDefaultType(); log.debug("KeyStore type not given, defaulting to '{}'", this.type); } - - // If this is PKCS11, configure the provider ... + + // If this is PKCS11, configure the provider ... // if ("PKCS11".equalsIgnoreCase(this.type)) { if (this.provider == null) { @@ -137,7 +137,7 @@ protected KeyStore createInstance() throws Exception { log.debug("Security provider '{}' has been statically configured", this.provider); } } - + KeyStore keystore = this.provider != null ? KeyStore.getInstance(this.type, this.provider) : KeyStore.getInstance(this.type); @@ -163,7 +163,7 @@ protected KeyStore createInstance() throws Exception { /** * Gets the resource holding the KeyStore. - * + * * @return the KeyStore resource */ public Resource getResource() { @@ -172,7 +172,7 @@ public Resource getResource() { /** * Assigns the resource holding the KeyStore. - * + * * @param resource * the KeyStore resource */ @@ -182,7 +182,7 @@ public void setResource(final Resource resource) { /** * Gets the password for unlocking the keystore. - * + * * @return the password for unlocking the keystore */ public char[] getPassword() { @@ -191,7 +191,7 @@ public char[] getPassword() { /** * Assigns the password for unlocking the keystore. - * + * * @param password * the password to set */ @@ -201,7 +201,7 @@ public void setPassword(final char[] password) { /** * Gets the type of KeyStore. If not explicitly assigned, {@link KeyStore#getDefaultType()} will be returned. - * + * * @return the type of the KeyStore */ public String getType() { @@ -210,7 +210,7 @@ public String getType() { /** * Assigns the type of KeyStore. - * + * * @param type * the type of the KeyStore */ @@ -222,7 +222,7 @@ public void setType(final String type) { * Gets the name of the security {@link Provider} to use when instantiating the {@link KeyStore}. If not explicitly * assigned {@code null} is returned. This means that the first provider that can create a {@link KeyStore} of the * given type will be used. - * + * * @return the name of the security provider to use, or null */ public String getProvider() { @@ -231,7 +231,7 @@ public String getProvider() { /** * Assigns the name of the security {@link Provider} to use when instantiating the {@link KeyStore}. - * + * * @param provider * the name of the security provider to use */ @@ -243,7 +243,7 @@ public void setProvider(final String provider) { * Gets the complete path to the PKCS#11 configuration file to use to configure the provider in the cases the type is * "PKCS11". If no configuration file is supplied the supplied provider ({@link #setProvider(String)}) must already * have been configured for use with a specific PKCS#11 configuration. - * + * * @return a complete path to a PKCS#11 configuration file, or null */ public String getPkcs11Configuration() { @@ -254,7 +254,7 @@ public String getPkcs11Configuration() { * Sets the complete path to the PKCS#11 configuration file to use to configure the provider in the cases the type is * "PKCS11". If no configuration file is supplied the supplied provider ({@link #setProvider(String)}) must already * have been configured for use with a specific PKCS#11 configuration. - * + * * @param pkcs11Configuration * a complete path to a PKCS#11 configuration file */ diff --git a/src/main/java/se/swedenconnect/security/credential/factory/PkiCredentialConfigurationProperties.java b/src/main/java/se/swedenconnect/security/credential/factory/PkiCredentialConfigurationProperties.java index 8def059..c447a79 100644 --- a/src/main/java/se/swedenconnect/security/credential/factory/PkiCredentialConfigurationProperties.java +++ b/src/main/java/se/swedenconnect/security/credential/factory/PkiCredentialConfigurationProperties.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2022 Sweden Connect + * Copyright 2020-2023 Sweden Connect * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -25,7 +25,7 @@ /** * A utility class that can be used as a configuration properties object for representing a credential (for Spring * Boot). - * + * * @author Martin Lindström (martin@idsec.se) */ @Data @@ -41,7 +41,7 @@ public class PkiCredentialConfigurationProperties { * keystore). */ private Resource certificate; - + /** * A list of resources holding the certificate chain that part of the credential (optional since the certificate may be part of a * keystore). If used, the entity certificate must be the first element. @@ -90,7 +90,7 @@ public class PkiCredentialConfigurationProperties { /** * Assigns the PIN (which is the same as {@code keyPassword}. Used mainly for PKCS#11. - * + * * @param pin * the PIN */ @@ -100,7 +100,7 @@ public void setPin(final char[] pin) { /** * Gets the PIN (which is the same as {@code keyPassword}). Used mainly for PKCS#11. - * + * * @return the PIN */ public char[] getPin() { @@ -109,11 +109,11 @@ public char[] getPin() { /** * Predicate that returns {@code true} if this object is "empty", meaning that no settings have been applied. - * + * * @return true if empty and false otherwise */ public boolean isEmpty() { - return !StringUtils.hasText(this.name) + return !StringUtils.hasText(this.name) && this.certificate == null && (this.certificates == null || this.certificates.isEmpty()) && this.privateKey == null diff --git a/src/main/java/se/swedenconnect/security/credential/factory/X509CertificateFactoryBean.java b/src/main/java/se/swedenconnect/security/credential/factory/X509CertificateFactoryBean.java index dd06208..b9eaa71 100644 --- a/src/main/java/se/swedenconnect/security/credential/factory/X509CertificateFactoryBean.java +++ b/src/main/java/se/swedenconnect/security/credential/factory/X509CertificateFactoryBean.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 Sweden Connect + * Copyright 2020-2023 Sweden Connect * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -31,7 +31,7 @@ * Basically this class is the same as {@code net.shibboleth.ext.spring.factory.X509CertificateFactoryBean} residing in the * {@code net.shibboleth.ext:spring-extensions}. * - * + * * @author Martin Lindström (martin@idsec.se) */ public class X509CertificateFactoryBean extends AbstractFactoryBean* Note: If the object has been configured with an external configuration file this call will have no effect. *
- * + * * @param library * path to PKCS#11 library */ @@ -190,7 +190,7 @@ public void setLibrary(final String library) { * If the configuration has been configured by assigning a configuration file ({@link #setConfigurationFile(String)} * or {@link #AbstractPkcs11Configuration(String)}) this method will return {@code null}. * - * + * * @return the name of the HSM slot */ public String getName() { @@ -202,7 +202,7 @@ public String getName() { ** Note: If the object has been configured with an external configuration file this call will have no effect. *
- * + * * @param name * the name of the HSM slot */ @@ -221,7 +221,7 @@ public void setName(final String name) { * If the configuration has been configured by assigning a configuration file ({@link #setConfigurationFile(String)} * or {@link #AbstractPkcs11Configuration(String)}) this method will return {@code null}. * - * + * * @return slot number/id, or null */ public String getSlot() { @@ -233,7 +233,7 @@ public String getSlot() { ** Note: If the object has been configured with an external configuration file this call will have no effect. *
- * + * * @param slot * slot number/id */ @@ -252,7 +252,7 @@ public void setSlot(final String slot) { * If the configuration has been configured by assigning a configuration file ({@link #setConfigurationFile(String)} * or {@link #AbstractPkcs11Configuration(String)}) this method will return {@code null}. * - * + * * @return the slot list index, or null */ public Integer getSlotListIndex() { @@ -264,7 +264,7 @@ public Integer getSlotListIndex() { ** Note: If the object has been configured with an external configuration file this call will have no effect. *
- * + * * @param slotListIndex * slot list index */ @@ -282,7 +282,7 @@ public void setSlotListIndex(final Integer slotListIndex) { /** * Validates that the supplied configuration file exists. - * + * * @param configurationFile * the file to check * @return the absolute path of the file diff --git a/src/main/java/se/swedenconnect/security/credential/pkcs11conf/DefaultPkcs11Configuration.java b/src/main/java/se/swedenconnect/security/credential/pkcs11conf/DefaultPkcs11Configuration.java index fb7b749..f8ec0fa 100644 --- a/src/main/java/se/swedenconnect/security/credential/pkcs11conf/DefaultPkcs11Configuration.java +++ b/src/main/java/se/swedenconnect/security/credential/pkcs11conf/DefaultPkcs11Configuration.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2022 Sweden Connect + * Copyright 2020-2023 Sweden Connect * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. diff --git a/src/main/java/se/swedenconnect/security/credential/pkcs11conf/Pkcs11Configuration.java b/src/main/java/se/swedenconnect/security/credential/pkcs11conf/Pkcs11Configuration.java index 6221b41..c92977e 100644 --- a/src/main/java/se/swedenconnect/security/credential/pkcs11conf/Pkcs11Configuration.java +++ b/src/main/java/se/swedenconnect/security/credential/pkcs11conf/Pkcs11Configuration.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2022 Sweden Connect + * Copyright 2020-2023 Sweden Connect * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -22,7 +22,7 @@ /** * Interface for a PKCS#11 configuration. - * + * * @author Martin Lindström (martin@idsec.se) * @author Stefan Santesson (stefan@idsec.se) */ @@ -30,10 +30,9 @@ public interface Pkcs11Configuration { /** * Gets the Java security {@link Provider} to use when setting up a PKCS#11 credential. - * + * * @return a Provider instance - * @throws Pkcs11ConfigurationException - * if the configuration is incorrect + * @throws Pkcs11ConfigurationException if the configuration is incorrect */ Provider getProvider() throws Pkcs11ConfigurationException; @@ -46,7 +45,7 @@ public interface Pkcs11Configuration { * Note: If both the private key and the certificate should be obtained from the device, use * {@link #getCredentialProvider()} instead. * - * + * * @return a Pkcs11ObjectProvider instance */ Pkcs11ObjectProvider- * In some HSM-deployments the certificate is not kept on the device, only the private key. The - * {@link PkiCredential} object returned from the provider will then return {@code null} for a - * {@link PkiCredential#getCertificate()} call. + * In some HSM-deployments the certificate is not kept on the device, only the private key. The {@link PkiCredential} + * object returned from the provider will then return {@code null} for a {@link PkiCredential#getCertificate()} call. *
- * + * * @return a Pkcs11ObjectProvider instance */ Pkcs11ObjectProvider* The method does not close the input stream. *
- * - * @param stream - * the input stream + * + * @param stream the input stream * @return the decoded private key - * @throws KeyException - * for decoding errors + * @throws KeyException for decoding errors */ public static PrivateKey decodePrivateKey(final InputStream stream) throws KeyException { try { @@ -67,12 +63,10 @@ public static PrivateKey decodePrivateKey(final InputStream stream) throws KeyEx /** * Decodes a private key in DER, PEM, and unencrypted PKCS#8 formats. - * - * @param resource - * the resource + * + * @param resource the resource * @return the decoded private key - * @throws KeyException - * for decoding errors + * @throws KeyException for decoding errors */ public static PrivateKey decodePrivateKey(final Resource resource) throws KeyException { try (final InputStream is = resource.getInputStream()) { diff --git a/src/main/java/se/swedenconnect/security/credential/utils/X509Utils.java b/src/main/java/se/swedenconnect/security/credential/utils/X509Utils.java index d237dd7..b32571a 100644 --- a/src/main/java/se/swedenconnect/security/credential/utils/X509Utils.java +++ b/src/main/java/se/swedenconnect/security/credential/utils/X509Utils.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2022 Sweden Connect + * Copyright 2020-2023 Sweden Connect * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -28,7 +28,7 @@ /** * Utility methods for working with X.509 certificates and CRL:s. - * + * * @author Martin Lindström (martin@idsec.se) * @author Stefan Santesson (stefan@idsec.se) */ @@ -48,12 +48,10 @@ public class X509Utils { /** * Decodes a {@link X509Certificate} from its encoding. - * - * @param encoding - * the certificate encoding + * + * @param encoding the certificate encoding * @return a X509Certificate object - * @throws CertificateException - * for decoding errors + * @throws CertificateException for decoding errors */ public static X509Certificate decodeCertificate(final byte[] encoding) throws CertificateException { try (final ByteArrayInputStream bis = new ByteArrayInputStream(encoding)) { @@ -69,12 +67,10 @@ public static X509Certificate decodeCertificate(final byte[] encoding) throws Ce ** The method does not close the input stream. *
- * - * @param stream - * the stream to read + * + * @param stream the stream to read * @return a X509Certificate object - * @throws CertificateException - * for decoding errors + * @throws CertificateException for decoding errors */ public static X509Certificate decodeCertificate(final InputStream stream) throws CertificateException { return (X509Certificate) factory.generateCertificate(stream); @@ -82,12 +78,10 @@ public static X509Certificate decodeCertificate(final InputStream stream) throws /** * Decodes a {@link X509Certificate} from a resource. - * - * @param resource - * the resource to read + * + * @param resource the resource to read * @return a X509Certificate object - * @throws CertificateException - * for decoding errors + * @throws CertificateException for decoding errors */ public static X509Certificate decodeCertificate(final Resource resource) throws CertificateException { try (final InputStream is = resource.getInputStream()) { @@ -100,12 +94,10 @@ public static X509Certificate decodeCertificate(final Resource resource) throws /** * Decodes a {@link X509CRL} from its encoding. - * - * @param encoding - * the CRL encoding + * + * @param encoding the CRL encoding * @return a X509CRL object - * @throws CRLException - * for decoding errors + * @throws CRLException for decoding errors */ public static X509CRL decodeCrl(final byte[] encoding) throws CRLException { try (final ByteArrayInputStream bis = new ByteArrayInputStream(encoding)) { @@ -121,12 +113,10 @@ public static X509CRL decodeCrl(final byte[] encoding) throws CRLException { ** The method does not close the input stream. *
- * - * @param stream - * the stream to read + * + * @param stream the stream to read * @return a X509CRL object - * @throws CRLException - * for decoding errors + * @throws CRLException for decoding errors */ public static X509CRL decodeCrl(final InputStream stream) throws CRLException { return (X509CRL) factory.generateCRL(stream); @@ -134,12 +124,10 @@ public static X509CRL decodeCrl(final InputStream stream) throws CRLException { /** * Decodes a {@link X509CRL} from a resource. - * - * @param resource - * the resource to read + * + * @param resource the resource to read * @return a X509CRL object - * @throws CRLException - * for decoding errors + * @throws CRLException for decoding errors */ public static X509CRL decodeCrl(final Resource resource) throws CRLException { try (final InputStream is = resource.getInputStream()) { @@ -153,9 +141,8 @@ public static X509CRL decodeCrl(final Resource resource) throws CRLException { /** * The {@link X509Certificate#toString()} prints way too much for a normal log entry. This method displays the * subject, issuer and serial number. - * - * @param certificate - * the certificate to log + * + * @param certificate the certificate to log * @return a log string */ public static String toLogString(final X509Certificate certificate) { diff --git a/src/test/java/se/swedenconnect/security/credential/converters/PropertyToX509CertificateConverterTest.java b/src/test/java/se/swedenconnect/security/credential/converters/PropertyToX509CertificateConverterTest.java index 737a27a..f07b135 100644 --- a/src/test/java/se/swedenconnect/security/credential/converters/PropertyToX509CertificateConverterTest.java +++ b/src/test/java/se/swedenconnect/security/credential/converters/PropertyToX509CertificateConverterTest.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2022 Sweden Connect + * Copyright 2020-2023 Sweden Connect * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -15,9 +15,11 @@ */ package se.swedenconnect.security.credential.converters; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertThrows; + import java.security.cert.X509Certificate; -import static org.junit.jupiter.api.Assertions.*; import org.junit.jupiter.api.Test; import org.junit.jupiter.api.extension.ExtendWith; import org.springframework.beans.factory.annotation.Autowired; @@ -35,7 +37,7 @@ /** * Test cases for PropertyToX509CertificateConverter. - * + * * @author Martin Lindström (martin@idsec.se) * @author Stefan Santesson (stefan@idsec.se) */ @@ -45,23 +47,23 @@ public class PropertyToX509CertificateConverterTest { @Autowired - ApplicationContext context; - + ApplicationContext context; + @Autowired(required = false) PropertyToX509CertificateConverter propertyToX509CertificateConverter; - + @Autowired(required = false) X509Certificate testCert; - + @Test public void testConvert() throws Exception { PropertyToX509CertificateConverter converter = new PropertyToX509CertificateConverter(); converter.setApplicationContext(this.context); - + X509Certificate cert = converter.convert("classpath:rsa1.crt"); assertNotNull(cert); } - + @Test public void testConvertFailed() throws Exception { assertThrows(IllegalArgumentException.class, () -> { @@ -71,21 +73,21 @@ public void testConvertFailed() throws Exception { converter.convert("classpath:not-found.crt"); }); } - + @Test public void testConverterBean() throws Exception { assertNotNull(this.propertyToX509CertificateConverter, "PropertyToX509CertificateConverter bean is not present"); assertNotNull(this.propertyToX509CertificateConverter.convert("classpath:rsa1.crt")); } - + @Test public void testSpringContextCertSet() throws Exception { assertNotNull(this.testCert); } - @Configuration + @Configuration public static class Config { - + @Bean @ConfigurationPropertiesBinding public PropertyToX509CertificateConverter propertyToX509CertificateConverter() { @@ -98,12 +100,12 @@ public PropertyToX509CertificateConverter propertyToX509CertificateConverter() { public static class CertConfig { @Setter private X509Certificate testcert; - + @Bean public X509Certificate testCert() { return this.testcert; } - } + } } diff --git a/src/test/java/se/swedenconnect/security/credential/opensaml/OpenSamlCredentialTest.java b/src/test/java/se/swedenconnect/security/credential/opensaml/OpenSamlCredentialTest.java index 0122da0..d275f14 100644 --- a/src/test/java/se/swedenconnect/security/credential/opensaml/OpenSamlCredentialTest.java +++ b/src/test/java/se/swedenconnect/security/credential/opensaml/OpenSamlCredentialTest.java @@ -15,9 +15,12 @@ */ package se.swedenconnect.security.credential.opensaml; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertThrows; +import static org.junit.jupiter.api.Assertions.assertTrue; + import java.security.KeyStore; -import static org.junit.jupiter.api.Assertions.*; import org.junit.jupiter.api.Test; import org.springframework.core.io.ClassPathResource; @@ -27,53 +30,41 @@ /** * Test cases for X509Credential. - * + * * @author Martin Lindström (martin@idsec.se) * @author Stefan Santesson (stefan@idsec.se) */ public class OpenSamlCredentialTest { - + private KeyStore keyStore; - + public OpenSamlCredentialTest() throws Exception { KeyStoreFactoryBean factory = new KeyStoreFactoryBean(new ClassPathResource("rsa1.jks"), "secret".toCharArray()); factory.afterPropertiesSet(); this.keyStore = factory.getObject(); } - + @Test public void testInitKeyAndCertificate() throws Exception { - PkiCredential _cred = new KeyStoreCredential(this.keyStore, "test", "secret".toCharArray()); - + PkiCredential _cred = new KeyStoreCredential(this.keyStore, "test", "secret".toCharArray()); + final OpenSamlCredential cred = new OpenSamlCredential(_cred.getCertificate(), _cred.getPrivateKey()); assertNotNull(cred.getEntityCertificate()); assertNotNull(cred.getPrivateKey()); assertNotNull(cred.getPublicKey()); } - + @Test public void testInitKeyPairCredential() throws Exception { KeyStoreCredential _cred = new KeyStoreCredential(this.keyStore, "test", "secret".toCharArray()); _cred.init(); - + final OpenSamlCredential cred = new OpenSamlCredential(_cred); assertNotNull(cred.getEntityCertificate()); assertNotNull(cred.getPrivateKey()); assertNotNull(cred.getPublicKey()); } - - @Test - public void testInitDefaultAndSetter() throws Exception { - KeyStoreCredential _cred = new KeyStoreCredential(this.keyStore, "test", "secret".toCharArray()); - _cred.init(); - - final OpenSamlCredential cred = new OpenSamlCredential(); - cred.setCredential(_cred); - assertNotNull(cred.getEntityCertificate()); - assertNotNull(cred.getPrivateKey()); - assertNotNull(cred.getPublicKey()); - } - + @Test public void testMixedInit() throws Exception { assertThrows(IllegalArgumentException.class, () -> { @@ -84,23 +75,23 @@ public void testMixedInit() throws Exception { cred.setPrivateKey(_cred.getPrivateKey()); }); } - + @Test public void testSetChain() throws Exception { PkiCredential _cred = new KeyStoreCredential(this.keyStore, "test", "secret".toCharArray()); _cred.init(); - - final OpenSamlCredential cred = new OpenSamlCredential(_cred); + + final OpenSamlCredential cred = new OpenSamlCredential(_cred); assertTrue(cred.getEntityCertificateChain().size() == 1); } - + @Test public void testGetChain() throws Exception { PkiCredential _cred = new KeyStoreCredential(this.keyStore, "test", "secret".toCharArray()); _cred.init(); - - final OpenSamlCredential cred = new OpenSamlCredential(_cred); + + final OpenSamlCredential cred = new OpenSamlCredential(_cred); assertTrue(cred.getEntityCertificateChain().size() == 1); } - + } diff --git a/src/test/java/se/swedenconnect/security/credential/pkcs11conf/MockSunPkcs11Provider.java b/src/test/java/se/swedenconnect/security/credential/pkcs11conf/MockSunPkcs11Provider.java index 6f31b04..30c812b 100644 --- a/src/test/java/se/swedenconnect/security/credential/pkcs11conf/MockSunPkcs11Provider.java +++ b/src/test/java/se/swedenconnect/security/credential/pkcs11conf/MockSunPkcs11Provider.java @@ -1,5 +1,5 @@ /* - * Copyright 2020-2021 Sweden Connect + * Copyright 2020-2023 Sweden Connect * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -19,12 +19,11 @@ import java.io.IOException; import java.io.InputStream; import java.io.OutputStream; -import java.lang.reflect.Constructor; -import java.lang.reflect.InvocationTargetException; import java.nio.file.Files; import java.nio.file.Path; import java.security.InvalidParameterException; import java.security.Key; +import java.security.KeyStore; import java.security.KeyStoreException; import java.security.KeyStoreSpi; import java.security.NoSuchAlgorithmException; @@ -40,16 +39,16 @@ import org.springframework.core.io.Resource; /** - * A mocked provider implementation that mocks a PKCS#11 provider but really is the same as the SUN and SunRsaSign providers (except for - * supporting PKCS#11 keystores). - * + * A mocked provider implementation that mocks a PKCS#11 provider but really is the same as the SUN and SunRsaSign + * providers (except for supporting PKCS#11 keystores). + * * @author Martin Lindström (martin@idsec.se) * @author Stefan Santesson (stefan@idsec.se) */ public class MockSunPkcs11Provider extends Provider { public static final String PROVIDER_BASE_NAME = "MockSunPKCS11"; - + private boolean configured = false; private static final long serialVersionUID = -135457117436927350L; @@ -62,7 +61,7 @@ protected MockSunPkcs11Provider(final String name) { this(name, "1.0.0", "Mock provider"); } - protected MockSunPkcs11Provider(String name, String versionStr, String info) { + protected MockSunPkcs11Provider(final String name, final String versionStr, final String info) { super(name, "1.0.0", "Mock provider"); final Provider sunProvider = Security.getProvider("SUN"); @@ -89,7 +88,7 @@ public static MockSunPkcs11Provider createStaticallyConfigured() { p.configured = true; return p; } - + /** {@inheritDoc} */ @Override public Provider configure(final String configArg) { @@ -111,7 +110,7 @@ public Provider configure(final String configArg) { boolean librarySet = false; try (Scanner scanner = new Scanner(new ByteArrayInputStream(configData.getBytes()))) { while (scanner.hasNextLine()) { - String line = scanner.nextLine().trim(); + final String line = scanner.nextLine().trim(); if (line.startsWith("#")) { continue; } @@ -119,7 +118,7 @@ public Provider configure(final String configArg) { librarySet = true; } else if (line.startsWith("name")) { - String[] tokens = line.split("=", 2); + final String[] tokens = line.split("=", 2); if (tokens.length == 2) { name = tokens[1].trim(); } @@ -132,11 +131,11 @@ else if (line.startsWith("name")) { if (!librarySet) { throw new InvalidParameterException("Invalid configuration data - Missing library"); } - MockSunPkcs11Provider newProv = new MockSunPkcs11Provider(PROVIDER_BASE_NAME + "-" + name); + final MockSunPkcs11Provider newProv = new MockSunPkcs11Provider(PROVIDER_BASE_NAME + "-" + name); newProv.configured = true; return newProv; } - catch (IOException e) { + catch (final IOException e) { throw new InvalidParameterException("Invalid configuration data - " + e.getMessage()); } } @@ -144,14 +143,14 @@ else if (line.startsWith("name")) { @Override public boolean isConfigured() { return this.configured; - } - + } + public static class MockedPkcs11ResourceHolder { private static final MockedPkcs11ResourceHolder INSTANCE = new MockedPkcs11ResourceHolder(); private Resource resource; - + private boolean mockNoCertificate = false; public static MockedPkcs11ResourceHolder getInstance() { @@ -165,12 +164,12 @@ public Resource getResource() { public void setResource(final Resource resource) { this.resource = resource; } - + public boolean isMockNoCertificate() { return this.mockNoCertificate; } - public void setMockNoCertificate(boolean mockNoCertificate) { + public void setMockNoCertificate(final boolean mockNoCertificate) { this.mockNoCertificate = mockNoCertificate; } @@ -180,114 +179,166 @@ private MockedPkcs11ResourceHolder() { public static class MockKeyStoreSpi extends KeyStoreSpi { - private KeyStoreSpi spi; + private KeyStore ks; public MockKeyStoreSpi() { try { - Class spiClass = Class.forName("sun.security.provider.JavaKeyStore$JKS"); - Constructor ctor = spiClass.getConstructor(); - this.spi = (KeyStoreSpi) ctor.newInstance(); + this.ks = KeyStore.getInstance("JKS"); } - catch (ClassNotFoundException | NoSuchMethodException | InstantiationException | IllegalAccessException | IllegalArgumentException - | InvocationTargetException e) { + catch (final KeyStoreException e) { throw new RuntimeException(e); } } @Override - public void engineLoad(InputStream stream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException { + public void engineLoad(final InputStream stream, final char[] password) + throws IOException, NoSuchAlgorithmException, CertificateException { if (stream != null) { - this.spi.engineLoad(stream, password); + this.ks.load(stream, password); } else { - Resource resource = MockedPkcs11ResourceHolder.getInstance().getResource(); + final Resource resource = MockedPkcs11ResourceHolder.getInstance().getResource(); if (resource == null) { throw new IOException("No resource available"); } try (InputStream is = resource.getInputStream()) { - this.spi.engineLoad(is, password); + this.ks.load(is, password); } } } @Override - public Key engineGetKey(String alias, char[] password) throws NoSuchAlgorithmException, UnrecoverableKeyException { - return this.spi.engineGetKey(alias, password); + public Key engineGetKey(final String alias, final char[] password) + throws NoSuchAlgorithmException, UnrecoverableKeyException { + try { + return this.ks.getKey(alias, password); + } + catch (final KeyStoreException e) { + throw new RuntimeException(e); + } } @Override - public Certificate[] engineGetCertificateChain(String alias) { + public Certificate[] engineGetCertificateChain(final String alias) { if (MockedPkcs11ResourceHolder.getInstance().isMockNoCertificate()) { return null; - } - return this.spi.engineGetCertificateChain(alias); + } + try { + return this.ks.getCertificateChain(alias); + } + catch (final KeyStoreException e) { + return null; + } } @Override - public Certificate engineGetCertificate(String alias) { + public Certificate engineGetCertificate(final String alias) { if (MockedPkcs11ResourceHolder.getInstance().isMockNoCertificate()) { return null; } - return this.spi.engineGetCertificate(alias); + try { + return this.ks.getCertificate(alias); + } + catch (final KeyStoreException e) { + return null; + } } @Override - public Date engineGetCreationDate(String alias) { - return this.spi.engineGetCreationDate(alias); + public Date engineGetCreationDate(final String alias) { + try { + return this.ks.getCreationDate(alias); + } + catch (final KeyStoreException e) { + return null; + } } @Override - public void engineSetKeyEntry(String alias, Key key, char[] password, Certificate[] chain) throws KeyStoreException { + public void engineSetKeyEntry(final String alias, final Key key, final char[] password, final Certificate[] chain) + throws KeyStoreException { throw new IllegalArgumentException("Not allowed for PKCS11"); } @Override - public void engineSetKeyEntry(String alias, byte[] key, Certificate[] chain) throws KeyStoreException { + public void engineSetKeyEntry(final String alias, final byte[] key, final Certificate[] chain) + throws KeyStoreException { throw new IllegalArgumentException("Not allowed for PKCS11"); } @Override - public void engineSetCertificateEntry(String alias, Certificate cert) throws KeyStoreException { + public void engineSetCertificateEntry(final String alias, final Certificate cert) throws KeyStoreException { throw new IllegalArgumentException("Not allowed for PKCS11"); } @Override - public void engineDeleteEntry(String alias) throws KeyStoreException { + public void engineDeleteEntry(final String alias) throws KeyStoreException { throw new IllegalArgumentException("Not allowed for PKCS11"); } @Override public Enumeration
* credential1.private-key=classpath:rsa1.pkcs8.key
* credential1.certificate=classpath:rsa1.crt
* credential1.name=Credential-1
*
- *
+ *
* @return a BasicCredential instance
*/
@Bean("credential1")
@ConfigurationProperties("credential1")
- public PkiCredential credential1() {
+ PkiCredential credential1() {
return new BasicCredential();
}
/**
* Gets a {@link KeyStoreCredential} instance based on the application properties prefixed by {@code credential2.}. In
* our example the application.properties contains:
- *
+ *
*
* credential2.resource=classpath:rsa1.jks
* credential2.password=secret
@@ -129,19 +129,19 @@ public PkiCredential credential1() {
* credential2.key-password=${credential2.password}
* credential2.type=JKS
*
- *
+ *
* @return a KeyStoreCredential instance
*/
@Bean("credential2")
@ConfigurationProperties("credential2")
- public PkiCredential credential2() {
+ PkiCredential credential2() {
return new KeyStoreCredential();
}
/**
* Gets a {@link Pkcs11Credential} instance based on the application properties prefixed by {@code credential3.}. In
* our example the application.properties contains:
- *
+ *
*
* credential3.configuration.configuration-file=
* credential3.configuration.base-provider-name=MockSunPKCS11
@@ -153,20 +153,20 @@ public PkiCredential credential2() {
* scenario (where the SunPKCS11 provider is used), the following configuration could be used (with no need for an
* explicit creation if the DefaultPkcs11Configuration bean).
*
- *
+ *
*
* credential3.configuration-file=
* credential3.alias=test
* credential3.pin=secret
*
- *
+ *
* @param pkcs11Configuration
* PKCS#11 configuration (needed since we are mocking PKCS#11)
* @return a Pkcs11Credential instance
*/
@Bean("credential3")
@ConfigurationProperties("credential3")
- public ReloadablePkiCredential credential3(final DefaultPkcs11Configuration pkcs11Configuration) {
+ ReloadablePkiCredential credential3(final DefaultPkcs11Configuration pkcs11Configuration) {
final Pkcs11Credential cred = new Pkcs11Credential();
cred.setConfiguration(pkcs11Configuration);
return cred;
@@ -174,14 +174,14 @@ public ReloadablePkiCredential credential3(final DefaultPkcs11Configuration pkcs
@Bean
@ConfigurationProperties("credential3.configuration")
- public DefaultPkcs11Configuration pkcs11Configuration() {
+ DefaultPkcs11Configuration pkcs11Configuration() {
return new DefaultPkcs11Configuration();
}
-
+
/**
- * Gets a {@link KeyStoreCredential} instance that delivers a KeyStore for a PKCS#11 device. It is based
+ * Gets a {@link KeyStoreCredential} instance that delivers a KeyStore for a PKCS#11 device. It is based
* on the application properties prefixed by {@code credential4.}. In our example the application.properties contains:
- *
+ *
*
* credential4.provider=MockSunPKCS11
* credential4.pkcs11-configuration=src/test/resources/cfg1.txt
@@ -191,17 +191,17 @@ public DefaultPkcs11Configuration pkcs11Configuration() {
* credential4.type=PKCS11
* credential4.name=Credential-4
*
- *
+ *
* @return a KeyStoreCredential instance
*/
@Bean("credential4")
@ConfigurationProperties("credential4")
- public ReloadablePkiCredential credential4() {
+ ReloadablePkiCredential credential4() {
return new KeyStoreCredential();
}
-
+
@Bean
- public CredentialMonitorBean credentialMonitorBean(final List credentials) {
+ CredentialMonitorBean credentialMonitorBean(final List credentials) {
final DefaultCredentialMonitorBean monitorBean = new DefaultCredentialMonitorBean(credentials);
monitorBean.setReloadSuccessCallback((c) -> System.out.println("Credential " + c.getName() + " was reloaded"));
monitorBean.setFailureCallback((c, e) -> {