org.apache.ws.security.components.crypto
Class CryptoBase

java.lang.Object
  extended byorg.apache.ws.security.components.crypto.CryptoBase
All Implemented Interfaces:
Crypto
Direct Known Subclasses:
AbstractCrypto

public abstract class CryptoBase
extends java.lang.Object
implements Crypto

Created by IntelliJ IDEA. User: dims Date: Sep 15, 2005 Time: 9:50:40 AM To change this template use File | Settings | File Templates.


Field Summary
protected  java.security.KeyStore cacerts
           
protected static java.security.cert.CertificateFactory certFact
           
protected  java.security.KeyStore keystore
           
 
Constructor Summary
protected CryptoBase()
          Constructor
 
Method Summary
 java.lang.String[] getAliasesForDN(java.lang.String subjectDN)
          Lookup X509 Certificates in the keystore according to a given DN of the subject of the certificate

The search gets all alias names of the keystore and gets the certificate (chain) for each alias.

 java.lang.String getAliasForX509Cert(byte[] skiBytes)
          Lookup a X509 Certificate in the keystore according to a given SubjectKeyIdentifier.
 java.lang.String getAliasForX509Cert(java.security.cert.Certificate cert)
          Return a X509 Certificate alias in the keystore according to a given Certificate

 java.lang.String getAliasForX509Cert(java.lang.String issuer)
          Lookup a X509 Certificate in the keystore according to a given the issuer of a Certificate.
 java.lang.String getAliasForX509Cert(java.lang.String issuer, java.math.BigInteger serialNumber)
          Lookup a X509 Certificate in the keystore according to a given serial number and the issuer of a Certificate.
 java.lang.String getAliasForX509CertThumb(byte[] thumb)
          Lookup a X509 Certificate in the keystore according to a given Thumbprint.
 byte[] getCertificateData(boolean reverse, java.security.cert.X509Certificate[] certs)
          get a byte array given an array of X509 certificates.
 java.security.cert.CertificateFactory getCertificateFactory()
          Singleton certificate factory for this Crypto instance.
 java.security.cert.X509Certificate[] getCertificates(java.lang.String alias)
          Gets the list of certificates for a given alias.
protected abstract  java.lang.String getCryptoProvider()
           
 java.security.KeyStore getKeyStore()
          Gets the Keystore that was loaded by the underlying implementation
 java.security.PrivateKey getPrivateKey(java.lang.String alias, java.lang.String password)
          Gets the private key identified by alias and password.
 byte[] getSKIBytesFromCert(java.security.cert.X509Certificate cert)
          Reads the SubjectKeyIdentifier information from the certificate.
 java.security.cert.X509Certificate[] getX509Certificates(byte[] data, boolean reverse)
          Construct an array of X509Certificate's from the byte array.
 java.security.cert.X509Certificate loadCertificate(java.io.InputStream in)
          load a X509Certificate from the input stream.
 void setKeyStore(java.security.KeyStore ks)
          A Hook for subclasses to set the keystore without having to load it from an InputStream.
protected  java.util.Vector splitAndTrim(java.lang.String inString)
           
 boolean validateCertPath(java.security.cert.X509Certificate[] certs)
          Overridden because there's a bug in the base class where they don't use the provider variant for the certificate validator.
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 
Methods inherited from interface org.apache.ws.security.components.crypto.Crypto
getDefaultX509Alias
 

Field Detail

certFact

protected static java.security.cert.CertificateFactory certFact

keystore

protected java.security.KeyStore keystore

cacerts

protected java.security.KeyStore cacerts
Constructor Detail

CryptoBase

protected CryptoBase()
Constructor

Method Detail

getCryptoProvider

protected abstract java.lang.String getCryptoProvider()
Returns:
a crypto provider name. This operation should return null if the default crypto provider should be used.

getCertificateFactory

public java.security.cert.CertificateFactory getCertificateFactory()
                                                            throws WSSecurityException
Singleton certificate factory for this Crypto instance.

Specified by:
getCertificateFactory in interface Crypto
Returns:
Returns a CertificateFactory to construct X509 certficates
Throws:
WSSecurityException

loadCertificate

public java.security.cert.X509Certificate loadCertificate(java.io.InputStream in)
                                                   throws WSSecurityException
load a X509Certificate from the input stream.

Specified by:
loadCertificate in interface Crypto
Parameters:
in - The InputStream array containing the X509 data
Returns:
Returns a X509 certificate
Throws:
WSSecurityException

getPrivateKey

public java.security.PrivateKey getPrivateKey(java.lang.String alias,
                                              java.lang.String password)
                                       throws java.lang.Exception
Gets the private key identified by alias and password.

Specified by:
getPrivateKey in interface Crypto
Parameters:
alias - The alias (KeyStore) of the key owner
password - The password needed to access the private key
Returns:
The private key
Throws:
java.lang.Exception

splitAndTrim

protected java.util.Vector splitAndTrim(java.lang.String inString)

getAliasForX509Cert

public java.lang.String getAliasForX509Cert(java.lang.String issuer)
                                     throws WSSecurityException
Lookup a X509 Certificate in the keystore according to a given the issuer of a Certificate.

The search gets all alias names of the keystore and gets the certificate chain for each alias. Then the Issuer for each certificate of the chain is compared with the parameters.

Specified by:
getAliasForX509Cert in interface Crypto
Parameters:
issuer - The issuer's name for the certificate
Returns:
alias name of the certificate that matches the issuer name or null if no such certificate was found.
Throws:
WSSecurityException

getAliasForX509Cert

public java.lang.String getAliasForX509Cert(java.lang.String issuer,
                                            java.math.BigInteger serialNumber)
                                     throws WSSecurityException
Lookup a X509 Certificate in the keystore according to a given serial number and the issuer of a Certificate.

The search gets all alias names of the keystore and gets the certificate chain for each alias. Then the SerialNumber and Issuer for each certificate of the chain is compared with the parameters.

Specified by:
getAliasForX509Cert in interface Crypto
Parameters:
issuer - The issuer's name for the certificate
serialNumber - The serial number of the certificate from the named issuer
Returns:
alias name of the certificate that matches serialNumber and issuer name or null if no such certificate was found.
Throws:
WSSecurityException

getAliasForX509Cert

public java.lang.String getAliasForX509Cert(byte[] skiBytes)
                                     throws WSSecurityException
Lookup a X509 Certificate in the keystore according to a given SubjectKeyIdentifier.

The search gets all alias names of the keystore and gets the certificate chain or certificate for each alias. Then the SKI for each user certificate is compared with the SKI parameter.

Specified by:
getAliasForX509Cert in interface Crypto
Parameters:
skiBytes - The SKI info bytes
Returns:
alias name of the certificate that matches serialNumber and issuer name or null if no such certificate was found.
Throws:
WSSecurityException - if problems during keystore handling or wrong certificate (no SKI data)

getAliasForX509Cert

public java.lang.String getAliasForX509Cert(java.security.cert.Certificate cert)
                                     throws WSSecurityException
Return a X509 Certificate alias in the keystore according to a given Certificate

Specified by:
getAliasForX509Cert in interface Crypto
Parameters:
cert - The certificate to lookup
Returns:
alias name of the certificate that matches the given certificate or null if no such certificate was found.
Throws:
WSSecurityException

getCertificates

public java.security.cert.X509Certificate[] getCertificates(java.lang.String alias)
                                                     throws WSSecurityException
Gets the list of certificates for a given alias.

Specified by:
getCertificates in interface Crypto
Parameters:
alias - Lookup certificate chain for this alias
Returns:
Array of X509 certificates for this alias name, or null if this alias does not exist in the keystore
Throws:
WSSecurityException

getAliasForX509CertThumb

public java.lang.String getAliasForX509CertThumb(byte[] thumb)
                                          throws WSSecurityException
Lookup a X509 Certificate in the keystore according to a given Thumbprint.

The search gets all alias names of the keystore, then reads the certificate chain or certificate for each alias. Then the thumbprint for each user certificate is compared with the thumbprint parameter.

Specified by:
getAliasForX509CertThumb in interface Crypto
Parameters:
thumb - The SHA1 thumbprint info bytes
Returns:
alias name of the certificate that matches the thumbprint or null if no such certificate was found.
Throws:
WSSecurityException - if problems during keystore handling or wrong certificate

setKeyStore

public void setKeyStore(java.security.KeyStore ks)
A Hook for subclasses to set the keystore without having to load it from an InputStream.

Parameters:
ks - existing keystore

getSKIBytesFromCert

public byte[] getSKIBytesFromCert(java.security.cert.X509Certificate cert)
                           throws WSSecurityException
Reads the SubjectKeyIdentifier information from the certificate.

If the the certificate does not contain a SKI extension then try to compute the SKI according to RFC3280 using the SHA-1 hash value of the public key. The second method described in RFC3280 is not support. Also only RSA public keys are supported. If we cannot compute the SKI throw a WSSecurityException.

Specified by:
getSKIBytesFromCert in interface Crypto
Parameters:
cert - The certificate to read SKI
Returns:
The byte array containing the binary SKI data
Throws:
WSSecurityException

getKeyStore

public java.security.KeyStore getKeyStore()
Description copied from interface: Crypto
Gets the Keystore that was loaded by the underlying implementation

Specified by:
getKeyStore in interface Crypto
Returns:
the Keystore

getAliasesForDN

public java.lang.String[] getAliasesForDN(java.lang.String subjectDN)
                                   throws WSSecurityException
Lookup X509 Certificates in the keystore according to a given DN of the subject of the certificate

The search gets all alias names of the keystore and gets the certificate (chain) for each alias. Then the DN of the certificate is compared with the parameters.

Specified by:
getAliasesForDN in interface Crypto
Parameters:
subjectDN - The DN of subject to look for in the keystore
Returns:
Vector with all alias of certificates with the same DN as given in the parameters
Throws:
WSSecurityException

getCertificateData

public byte[] getCertificateData(boolean reverse,
                                 java.security.cert.X509Certificate[] certs)
                          throws WSSecurityException
get a byte array given an array of X509 certificates.

Specified by:
getCertificateData in interface Crypto
Parameters:
reverse - If set the first certificate in the array data will the last in the byte array
certs - The certificates to convert
Returns:
The byte array for the certificates ordered according to the reverse flag
Throws:
WSSecurityException

getX509Certificates

public java.security.cert.X509Certificate[] getX509Certificates(byte[] data,
                                                                boolean reverse)
                                                         throws WSSecurityException
Construct an array of X509Certificate's from the byte array.

Specified by:
getX509Certificates in interface Crypto
Parameters:
data - The byte array containing the X509 data
reverse - If set the first certificate in input data will the last in the array
Returns:
An array of X509 certificates, ordered according to the reverse flag
Throws:
WSSecurityException

validateCertPath

public boolean validateCertPath(java.security.cert.X509Certificate[] certs)
                         throws WSSecurityException
Overridden because there's a bug in the base class where they don't use the provider variant for the certificate validator.

Specified by:
validateCertPath in interface Crypto
Parameters:
certs - Certificate chain to validate
Returns:
true if the certificate chain is valid, false otherwise
Throws:
WSSecurityException


Copyright © 2004-2008 The Apache Software Foundation. All Rights Reserved.