Changeset 7303

Timestamp:

09/08/10 11:53:20 (11 years ago)

Author:

pjkersha

Message:

Incomplete - task 12: ESG Yadis identity service discovery

• Found an e.g. for Overloading default X.509 trust manager:  http://download.oracle.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html. Use this extend for DN whitelisting.

File:

• TI12-security/trunk/EsgYadisParser/src/org/earthsystemgrid/security/yadis/YadisTrustManager.java (modified) (3 diffs)

TI12-security/trunk/EsgYadisParser/src/org/earthsystemgrid/security/yadis/YadisTrustManager.java

@@ -1 +1 @@
 package org.earthsystemgrid.security.yadis;
 
+import java.io.FileInputStream;
 import java.io.FileNotFoundException;
 import java.io.IOException;
@@ -11 +12 @@
 import java.util.Enumeration;
 
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.X509TrustManager;
 
 
-public class YadisTrustManager implements X509TrustManager 
-{
+class YadisTrustManager implements X509TrustManager {
+
         protected Principal [] certificateDnWhiteList;
-        protected KeyStore keyStore;
         
-        YadisTrustManager(String keyStoreFilePath, char [] keyStorePassword,
-                        Principal [] certificateDnWhiteList) throws 
-                NoSuchAlgorithmException, CertificateException, IOException, 
-                KeyStoreException 
-        { 
+    /*
+     * The default PKIX X509TrustManager9.  We'll delegate
+     * decisions to it, and fall back to the logic in this class if the
+     * default X509TrustManager doesn't trust it.
+     */
+    X509TrustManager pkixTrustManager;
+
+    YadisTrustManager(Principal[] certificateDnWhiteList) throws Exception {
+
                 this.certificateDnWhiteList = certificateDnWhiteList;
                 
-                if (keyStoreFilePath == null)
-                {
-                        return;
-                }
-                
-                // Create/load keystore
-                keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+                // create a "default" JSSE X509TrustManager.
 
-            java.io.FileInputStream fis = null;
-            try 
-            {
-                fis = new java.io.FileInputStream(keyStoreFilePath);
-                keyStore.load(fis, keyStorePassword);
-            } 
-            finally 
-            {
-                if (fis != null) 
-                {
-                    fis.close();
-                }
-            }
-        }
+        KeyStore ks = KeyStore.getInstance("JKS");
+        ks.load(new FileInputStream("trustedCerts"),
+            "passphrase".toCharArray());
 
-        public X509Certificate[] getAcceptedIssuers()
-        {
-                X509Certificate [] certList = {};
-                return certList;
-                
-                Enumeration aliases;
-                try 
-                {
-                        aliases = keyStore.aliases();
-                } 
-                catch (KeyStoreException e) 
-                {
-                        // TODO Auto-generated catch block
-                        e.printStackTrace();
-                        return null;
-                }
-                
-                String alias;
-                try
-                {
-                        int i=0;
-                        while ((alias = (String) aliases.nextElement()) != null)
-                        {
-                                certList[i] = (X509Certificate)keyStore.getCertificate(alias);
-                                i++;
-                        }
-                }
-                catch (KeyStoreException e)
-                {
-                        return null;
-                }
+        TrustManagerFactory tmf =
+               TrustManagerFactory.getInstance("PKIX");
+        tmf.init(ks);
 
-                return certList;
-        }
+        TrustManager tms [] = tmf.getTrustManagers();
 
-        @Override
-        public void checkClientTrusted(X509Certificate[] arg0, String arg1)
-                        throws CertificateException {
-                // TODO Auto-generated method stub
-                
-        }
+        /*
+         * Iterate over the returned trustmanagers, look
+         * for an instance of X509TrustManager.  If found,
+         * use that as our "default" trust manager.
+         */
+        for (int i = 0; i < tms.length; i++) {
+            if (tms[i] instanceof X509TrustManager) {
+                pkixTrustManager = (X509TrustManager) tms[i];
+                return;
+            }
+        }
 
-        @Override
-        public void checkServerTrusted(X509Certificate[] certList, String arg1)
-                        throws CertificateException 
-        {
-                // TODO Auto-generated method stub
+        /*
+         * Find some other way to initialize, or else we have to fail the
+         * constructor.
+         */
+        throw new Exception("Couldn't initialize");
+    }
+
+    /*
+     * Delegate to the default trust manager.
+     */
+    @Override
+    public void checkClientTrusted(X509Certificate[] chain, String authType)
+                throws CertificateException {
+        try {
+            pkixTrustManager.checkClientTrusted(chain, authType);
+        } catch (CertificateException excep) {
+            // do any special handling here, or rethrow exception.
+        }
+    }
+
+    /*
+     * Delegate to the default trust manager but append DN whitelist checking
+     */
+    @Override
+    public void checkServerTrusted(X509Certificate[] certList, String authType)
+                throws CertificateException {
+        try {
+            pkixTrustManager.checkServerTrusted(certList, authType);
+        } catch (CertificateException excep) {
+            /*
+             * Possibly pop up a dialog box asking whether to trust the
+             * cert chain.
+             */
+        }
+        
+                // Whitelisting of DNs
                 Principal subject = null;
                 
@@ -118 +114 @@
                                 "against Certificate DN whitelist");
         }
+
+
+    /*
+     * Merely pass this through.
+     */
+    @Override
+    public X509Certificate[] getAcceptedIssuers() {
+        return pkixTrustManager.getAcceptedIssuers();
+    }
 }
-