Package net.shibboleth.idp.installer.plugin.impl

Class TrustStore

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.idp.installer.plugin.impl.TrustStore

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent

@NotThreadSafe
public final class TrustStore
extends AbstractInitializableComponent

Code to handle (load, update, check) the trust store for an individual plugin. a thin shim on BC.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	TrustStore.Signature	An opaque handle around a PGPSignature.

Field Summary

Fields

Modifier and Type	Field	Description
private Path	backup	The key store backup.
private String	explicitTrustStore	Explicit path to trust store.
private Path	idpHome	Where the IdP is installed.
private org.bouncycastle.openpgp.PGPPublicKeyRingCollection	keyRings	KeyRing.
private final org.slf4j.Logger	log	logger.
private String	pluginId	The plugin this is the trust store for.
private Path	store	The key store.

Constructor Summary

Constructors

Constructor	Description
TrustStore()

Method Summary

Modifier and Type	Method	Description
boolean	checkSignature(InputStream input, TrustStore.Signature signature)	Run a signature check over the streams.
boolean	contains(TrustStore.Signature signature)	Does the key that made this signature exist in our keyrings?
protected void	createNewStore()	Create an empty store and save to new location.
protected void	doInitialize()
void	importKeyFromStream(TrustStore.Signature sigForKey, InputStream keyStream, Predicate<String> accept)	Load up the provided store and if the key is found and the Predicate allows it add it to the store which we will then save.
protected void	loadStore()	Load the store from its designated location.
private static org.bouncycastle.openpgp.PGPPublicKeyRingCollection	loadStoreFrom(InputStream in)	Return a store loaded from the supplied stream.
void	saveStore()	Save the store to its designated location.
void	saveStoreInternal()	Save the store to its designated location.
void	setIdpHome(Path what)	Set IdPHome.
void	setPluginId(String what)	Set the pluginId.
void	setTrustStore(String what)	Set explicitTrustStore.
static TrustStore.Signature	signatureOf(InputStream stream)	Provide an opaque signature object from an input stream.

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

log

@Nonnull
private final org.slf4j.Logger log

logger.

idpHome

@NonnullAfterInit
private Path idpHome

Where the IdP is installed.

explicitTrustStore

@NonnullAfterInit
private String explicitTrustStore

Explicit path to trust store.

pluginId

@NonnullAfterInit
private String pluginId

The plugin this is the trust store for.

store

@NonnullAfterInit
private Path store

The key store.

backup

@NonnullAfterInit
private Path backup

The key store backup.

keyRings

@NonnullAfterInit
private org.bouncycastle.openpgp.PGPPublicKeyRingCollection keyRings

KeyRing.

Constructor Details

TrustStore

public TrustStore()

Method Details

setPluginId

public void setPluginId(String what)

Set the pluginId.

Parameters:

what - to set.

setIdpHome

public void setIdpHome(@Nonnull
 Path what)

Set IdPHome.

Parameters:

what - The idpHome to set.

setTrustStore

public void setTrustStore(@Nullable
 String what)

Set explicitTrustStore.

Parameters:

what - The value to set.

loadStoreFrom

private static org.bouncycastle.openpgp.PGPPublicKeyRingCollection loadStoreFrom(@Nonnull
 InputStream in)
                                                                          throws IOException

Return a store loaded from the supplied stream.

Parameters:

in - the stream

Returns:

a suitable store

Throws:

IOException - from Files.newInputStream(Path, java.nio.file.OpenOption...) and from PGPPublicKeyRingCollection(InputStream, org.bouncycastle.openpgp.operator.KeyFingerPrintCalculator)

loadStore

protected void loadStore()
                  throws IOException

Load the store from its designated location.

Throws:

IOException - from Files.newInputStream(Path, java.nio.file.OpenOption...) and from PGPPublicKeyRingCollection(InputStream, org.bouncycastle.openpgp.operator.KeyFingerPrintCalculator)

createNewStore

protected void createNewStore()
                       throws IOException

Create an empty store and save to new location.

Throws:

IOException - from saveStore() and in the unlikely event that PGPPublicKeyRingCollection(java.util.Collection) has problems.

saveStore

public void saveStore()
               throws IOException

Save the store to its designated location.

Throws:

IOException - from Files.newOutputStream(Path, java.nio.file.OpenOption...) and from PGPPublicKeyRingCollection.encode(OutputStream)

saveStoreInternal

public void saveStoreInternal()
                       throws IOException

Save the store to its designated location.

Throws:

IOException - from Files.newOutputStream(Path, java.nio.file.OpenOption...) and from PGPPublicKeyRingCollection.encode(OutputStream)

importKeyFromStream

public void importKeyFromStream(TrustStore.Signature sigForKey,
 @Nonnull
 InputStream keyStream,
 @Nonnull
 Predicate<String> accept)
                         throws IOException

Load up the provided store and if the key is found and the Predicate allows it add it to the store which we will then save.

Parameters:

sigForKey - the signature we are looking for a key for.

keyStream - where to load the key from

accept - whether we actually want to install this key

Throws:

IOException - if the load or save fails

signatureOf

@Nonnull
public static TrustStore.Signature signatureOf(@Nonnull
 InputStream stream)
                                        throws IOException

Provide an opaque signature object from an input stream.

Parameters:

stream - what to read.

Returns:

the Signature.

Throws:

IOException - if there is a problem reading the file of it it doesn't represent a signature

contains

public boolean contains(@Nonnull
 TrustStore.Signature signature)

Does the key that made this signature exist in our keyrings?

Parameters:

signature - what to ask about

Returns:

whether it is there

checkSignature

public boolean checkSignature(@Nonnull
 InputStream input,
 @Nonnull
 TrustStore.Signature signature)
                       throws IOException

Run a signature check over the streams.

Parameters:

input - what to check

signature - what to check with

Returns:

whether it passed or not

Throws:

IOException - if we get an error reading the stream

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException