org.apache.servicemix.soap.handlers.security

Class BaseCrypto

java.lang.Object

org.apache.servicemix.soap.handlers.security.BaseCrypto

All Implemented Interfaces:

org.apache.ws.security.components.crypto.Crypto

Direct Known Subclasses:

KeystoreInstanceCrypto, StandaloneCrypto

public abstract class BaseCrypto
extends java.lang.Object
implements org.apache.ws.security.components.crypto.Crypto

Constructor Summary

Constructors

Constructor and Description
BaseCrypto()

Method Summary

Methods

Modifier and Type	Method and Description
protected abstract java.lang.String[]	getAliases()
java.lang.String[]	getAliasesForDN(java.lang.String subjectDN) Lookup X509 Certificates in the keystore according to a given DN of the subject of the certificate The search gets all alias names of the keystore and gets the certificate (chain) for each alias.
java.lang.String	getAliasForX509Cert(byte[] skiBytes) Lookup a X509 Certificate in the keystore according to a given SubjectKeyIdentifier.
java.lang.String	getAliasForX509Cert(java.security.cert.Certificate cert) Return a X509 Certificate alias in the keystore according to a given Certificate
java.lang.String	getAliasForX509Cert(java.lang.String issuer) Lookup a X509 Certificate in the keystore according to a given the issuer of a Certficate.
java.lang.String	getAliasForX509Cert(java.lang.String issuer, java.math.BigInteger serialNumber) Lookup a X509 Certificate in the keystore according to a given serial number and the issuer of a Certficate.
java.lang.String	getAliasForX509CertThumb(byte[] thumb) Lookup a X509 Certificate in the keystore according to a given Thumbprint.
protected abstract java.security.cert.Certificate	getCertificate(java.lang.String alias)
protected abstract java.lang.String	getCertificateAlias(java.security.cert.Certificate cert)
protected abstract java.security.cert.Certificate[]	getCertificateChain(java.lang.String alias)
protected java.security.cert.Certificate	getCertificateChainOrCertificate(java.lang.String alias)
byte[]	getCertificateData(boolean reverse, java.security.cert.X509Certificate[] certs) get a byte array given an array of X509 certificates.
java.security.cert.CertificateFactory	getCertificateFactory() Singleton certificate factory for this Crypto instance.
java.security.cert.X509Certificate[]	getCertificates(java.lang.String alias) Gets the list of certificates for a given alias.
java.lang.String	getDefaultX509Alias()
java.security.KeyStore	getKeyStore()
abstract java.security.PrivateKey	getPrivateKey(java.lang.String alias, java.lang.String password) Gets the private key identified by alias and password.
java.lang.String	getProvider()
byte[]	getSKIBytesFromCert(java.security.cert.X509Certificate cert) Reads the SubjectKeyIdentifier information from the certificate.
protected abstract java.lang.String[]	getTrustCertificates()
java.security.cert.X509Certificate[]	getX509Certificates(byte[] data, boolean reverse)
java.security.cert.X509Certificate	loadCertificate(java.io.InputStream in) load a X509Certificate from the input stream.
void	setDefaultX509Alias(java.lang.String defaultX509Alias)
void	setProvider(java.lang.String provider)
protected java.util.Vector	splitAndTrim(java.lang.String inString)
boolean	validateCertPath(java.security.cert.X509Certificate[] certs) Uses the CertPath API to validate a given certificate chain

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.ws.security.components.crypto.Crypto

getBytesFromCertificates, getCertificatesFromBytes, getCryptoProvider, getDefaultX509Identifier, getPrivateKey, getX509Certificates, getX509Identifier, setCertificateFactory, setCryptoProvider, setDefaultX509Identifier, verifyTrust, verifyTrust, verifyTrust

Constructor Detail

BaseCrypto

public BaseCrypto()

Method Detail

setDefaultX509Alias

public void setDefaultX509Alias(java.lang.String defaultX509Alias)

Parameters:

defaultX509Alias - the defaultX509Alias to set

getProvider

public java.lang.String getProvider()

Returns:

the provider

setProvider

public void setProvider(java.lang.String provider)

Parameters:

provider - the provider to set

getAliasForX509Cert

public java.lang.String getAliasForX509Cert(java.security.cert.Certificate cert)
                                     throws org.apache.ws.security.WSSecurityException

Return a X509 Certificate alias in the keystore according to a given Certificate

Parameters:

cert - The certificate to lookup

Returns:

alias name of the certificate that matches the given certificate or null if no such certificate was found.

Throws:

org.apache.ws.security.WSSecurityException

getAliasForX509Cert

public java.lang.String getAliasForX509Cert(java.lang.String issuer)
                                     throws org.apache.ws.security.WSSecurityException

Lookup a X509 Certificate in the keystore according to a given the issuer of a Certficate.

The search gets all alias names of the keystore and gets the certificate chain for each alias. Then the Issuer fo each certificate of the chain is compared with the parameters.

Parameters:

issuer - The issuer's name for the certificate

Returns:

alias name of the certificate that matches the issuer name or null if no such certificate was found.

Throws:

org.apache.ws.security.WSSecurityException

getAliasForX509Cert

public java.lang.String getAliasForX509Cert(byte[] skiBytes)
                                     throws org.apache.ws.security.WSSecurityException

Lookup a X509 Certificate in the keystore according to a given SubjectKeyIdentifier.

The search gets all alias names of the keystore and gets the certificate chain or certificate for each alias. Then the SKI for each user certificate is compared with the SKI parameter.

Parameters:

skiBytes - The SKI info bytes

Returns:

alias name of the certificate that matches serialNumber and issuer name or null if no such certificate was found.

Throws:

org.apache.ws.security.WSSecurityException - if problems during keystore handling or wrong certificate (no SKI data)

getAliasForX509Cert

public java.lang.String getAliasForX509Cert(java.lang.String issuer,
                                   java.math.BigInteger serialNumber)
                                     throws org.apache.ws.security.WSSecurityException

Lookup a X509 Certificate in the keystore according to a given serial number and the issuer of a Certficate.

The search gets all alias names of the keystore and gets the certificate chain for each alias. Then the SerialNumber and Issuer fo each certificate of the chain is compared with the parameters.

Parameters:

issuer - The issuer's name for the certificate

serialNumber - The serial number of the certificate from the named issuer

Returns:

alias name of the certificate that matches serialNumber and issuer name or null if no such certificate was found.

Throws:

org.apache.ws.security.WSSecurityException

getAliasForX509CertThumb

public java.lang.String getAliasForX509CertThumb(byte[] thumb)
                                          throws org.apache.ws.security.WSSecurityException

Lookup a X509 Certificate in the keystore according to a given Thumbprint.

The search gets all alias names of the keystore, then reads the certificate chain or certificate for each alias. Then the thumbprint for each user certificate is compared with the thumbprint parameter.

Parameters:

thumb - The SHA1 thumbprint info bytes

Returns:

alias name of the certificate that matches the thumbprint or null if no such certificate was found.

Throws:

org.apache.ws.security.WSSecurityException - if problems during keystore handling or wrong certificate

getAliasesForDN

public java.lang.String[] getAliasesForDN(java.lang.String subjectDN)
                                   throws org.apache.ws.security.WSSecurityException

Lookup X509 Certificates in the keystore according to a given DN of the subject of the certificate

The search gets all alias names of the keystore and gets the certificate (chain) for each alias. Then the DN of the certificate is compared with the parameters.

Parameters:

subjectDN - The DN of subject to look for in the keystore

Returns:

Vector with all alias of certificates with the same DN as given in the parameters

Throws:

org.apache.ws.security.WSSecurityException

getCertificateData

public byte[] getCertificateData(boolean reverse,
                        java.security.cert.X509Certificate[] certs)
                          throws org.apache.ws.security.WSSecurityException

get a byte array given an array of X509 certificates.

Parameters:

reverse - If set the first certificate in the array data will the last in the byte array

certs - The certificates to convert

Returns:

The byte array for the certficates ordered according to the reverse flag

Throws:

org.apache.ws.security.WSSecurityException

getCertificateFactory

public java.security.cert.CertificateFactory getCertificateFactory()
                                                            throws org.apache.ws.security.WSSecurityException

Singleton certificate factory for this Crypto instance.

Specified by:

getCertificateFactory in interface org.apache.ws.security.components.crypto.Crypto

Returns:

Returns a CertificateFactory to construct X509 certficates

Throws:

org.apache.ws.security.WSSecurityException

getCertificates

public java.security.cert.X509Certificate[] getCertificates(java.lang.String alias)
                                                     throws org.apache.ws.security.WSSecurityException

Gets the list of certificates for a given alias.

Parameters:

alias - Lookup certificate chain for this alias

Returns:

Array of X509 certificates for this alias name, or null if this alias does not exist in the keystore

Throws:

org.apache.ws.security.WSSecurityException

getDefaultX509Alias

public java.lang.String getDefaultX509Alias()

getKeyStore

public java.security.KeyStore getKeyStore()

getPrivateKey

public abstract java.security.PrivateKey getPrivateKey(java.lang.String alias,
                                     java.lang.String password)
                                                throws org.apache.ws.security.WSSecurityException

Gets the private key identified by alias and password.

Specified by:

getPrivateKey in interface org.apache.ws.security.components.crypto.Crypto

Parameters:

alias - The alias (KeyStore) of the key owner

password - The password needed to access the private key

Returns:

The private key

Throws:

java.lang.Exception

org.apache.ws.security.WSSecurityException

getSKIBytesFromCert

public byte[] getSKIBytesFromCert(java.security.cert.X509Certificate cert)
                           throws org.apache.ws.security.WSSecurityException

Reads the SubjectKeyIdentifier information from the certificate.

If the the certificate does not contain a SKI extension then try to compute the SKI according to RFC3280 using the SHA-1 hash value of the public key. The second method described in RFC3280 is not support. Also only RSA public keys are supported. If we cannot compute the SKI throw a WSSecurityException.

Specified by:

getSKIBytesFromCert in interface org.apache.ws.security.components.crypto.Crypto

Parameters:

cert - The certificate to read SKI

Returns:

The byte array conating the binary SKI data

Throws:

org.apache.ws.security.WSSecurityException

getX509Certificates

public java.security.cert.X509Certificate[] getX509Certificates(byte[] data,
                                                       boolean reverse)
                                                         throws org.apache.ws.security.WSSecurityException

Throws:

org.apache.ws.security.WSSecurityException

loadCertificate

public java.security.cert.X509Certificate loadCertificate(java.io.InputStream in)
                                                   throws org.apache.ws.security.WSSecurityException

load a X509Certificate from the input stream.

Specified by:

loadCertificate in interface org.apache.ws.security.components.crypto.Crypto

Parameters:

in - The InputStream array containg the X509 data

Returns:

An X509 certificate

Throws:

org.apache.ws.security.WSSecurityException

validateCertPath

public boolean validateCertPath(java.security.cert.X509Certificate[] certs)
                         throws org.apache.ws.security.WSSecurityException

Uses the CertPath API to validate a given certificate chain

Parameters:

certs - Certificate chain to validate

Returns:

true if the certificate chain is valid, false otherwise

Throws:

org.apache.ws.security.WSSecurityException

splitAndTrim

protected java.util.Vector splitAndTrim(java.lang.String inString)

getCertificateChainOrCertificate

protected java.security.cert.Certificate getCertificateChainOrCertificate(java.lang.String alias)
                                                                   throws java.security.KeyStoreException

Throws:

java.security.KeyStoreException

getAliases

protected abstract java.lang.String[] getAliases()
                                          throws java.security.KeyStoreException

Throws:

java.security.KeyStoreException

getCertificateChain

protected abstract java.security.cert.Certificate[] getCertificateChain(java.lang.String alias)
                                                                 throws java.security.KeyStoreException

Throws:

java.security.KeyStoreException

getCertificate

protected abstract java.security.cert.Certificate getCertificate(java.lang.String alias)
                                                          throws java.security.KeyStoreException

Throws:

java.security.KeyStoreException

getCertificateAlias

protected abstract java.lang.String getCertificateAlias(java.security.cert.Certificate cert)
                                                 throws java.security.KeyStoreException

Throws:

java.security.KeyStoreException

getTrustCertificates

protected abstract java.lang.String[] getTrustCertificates()
                                                    throws java.security.KeyStoreException

Throws:

java.security.KeyStoreException