You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2015/10/26 17:21:21 UTC
[1/5] cxf git commit: Add support for selecting a key for decryption
using the sha-1 hash in the header
Repository: cxf
Updated Branches:
refs/heads/master a602c9df3 -> d09c4eafb
Add support for selecting a key for decryption using the sha-1 hash in the header
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/d09c4eaf
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/d09c4eaf
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/d09c4eaf
Branch: refs/heads/master
Commit: d09c4eafbb8d570c2bfd69270726511cee420645
Parents: e51a7bd
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Mon Oct 26 16:06:58 2015 +0000
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Mon Oct 26 16:21:07 2015 +0000
----------------------------------------------------------------------
.../rs/security/jose/common/KeyManagementUtils.java | 4 ++--
.../apache/cxf/rs/security/jose/jwe/JweUtils.java | 15 ++++++++++++++-
2 files changed, 16 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/d09c4eaf/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
index 57929c2..3eb4637 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
@@ -369,12 +369,12 @@ public final class KeyManagementUtils {
return props;
}
public static PrivateKey loadPrivateKey(Message m, Properties props,
- List<X509Certificate> inCerts,
+ X509Certificate inCert,
KeyOperation keyOper) {
KeyStore ks = loadPersistKeyStore(m, props);
try {
- String alias = ks.getCertificateAlias(inCerts.get(0));
+ String alias = ks.getCertificateAlias(inCert);
return loadPrivateKey(ks, m, props, keyOper, alias);
} catch (Exception ex) {
http://git-wip-us.apache.org/repos/asf/cxf/blob/d09c4eaf/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
index 4591bc3..e23f605 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
@@ -368,11 +368,24 @@ public final class JweUtils {
// Supporting loading a private key via a certificate for now
List<X509Certificate> chain = KeyManagementUtils.toX509CertificateChain(inHeaders.getX509Chain());
KeyManagementUtils.validateCertificateChain(props, chain);
+ X509Certificate cert = chain == null ? null : chain.get(0);
PrivateKey privateKey =
- KeyManagementUtils.loadPrivateKey(m, props, chain, KeyOperation.DECRYPT);
+ KeyManagementUtils.loadPrivateKey(m, props, cert, KeyOperation.DECRYPT);
contentEncryptionAlgo = inHeaders.getContentEncryptionAlgorithm().getJwaName();
keyDecryptionProvider = getPrivateKeyDecryptionProvider(privateKey,
inHeaders.getKeyEncryptionAlgorithm());
+ } else if (inHeaders != null && inHeaders.getHeader(JoseConstants.HEADER_X509_THUMBPRINT) != null) {
+ X509Certificate foundCert =
+ KeyManagementUtils.getCertificateFromThumbprint(inHeaders.getX509Thumbprint(),
+ MessageDigestUtils.ALGO_SHA_1,
+ m, props);
+ if (foundCert != null) {
+ PrivateKey privateKey =
+ KeyManagementUtils.loadPrivateKey(m, props, foundCert, KeyOperation.DECRYPT);
+ contentEncryptionAlgo = inHeaders.getContentEncryptionAlgorithm().getJwaName();
+ keyDecryptionProvider = getPrivateKeyDecryptionProvider(privateKey,
+ inHeaders.getKeyEncryptionAlgorithm());
+ }
} else {
if (JoseConstants.HEADER_JSON_WEB_KEY.equals(props.get(JoseConstants.RSSEC_KEY_STORE_TYPE))) {
JsonWebKey jwk = JwkUtils.loadJsonWebKey(m, props, KeyOperation.DECRYPT);
[4/5] cxf git commit: Another change of the "include" properties
Posted by co...@apache.org.
Another change of the "include" properties
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/e51a7bd7
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/e51a7bd7
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/e51a7bd7
Branch: refs/heads/master
Commit: e51a7bd7f3dcc120dbeeebb3e5c306941af64554
Parents: 948fd80
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Mon Oct 26 15:32:51 2015 +0000
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Mon Oct 26 16:21:07 2015 +0000
----------------------------------------------------------------------
.../rs/security/jose/common/JoseConstants.java | 32 +++-----------------
.../cxf/rs/security/jose/jwe/JweUtils.java | 20 +++++-------
.../cxf/rs/security/jose/jws/JwsUtils.java | 20 +++++-------
.../jaxrs/security/jwt/JAXRSJweJwsTest.java | 7 +++--
4 files changed, 24 insertions(+), 55 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/e51a7bd7/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java
index 66c86d9..c05b37d 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java
@@ -100,26 +100,6 @@ public final class JoseConstants {
public static final String RSSEC_KEY_PSWD_PROVIDER = "rs.security.key.password.provider";
/**
- * Include the JWK public key (for signature or encryption) in the "jwk" header.
- */
- public static final String RSSEC_INCLUDE_PUBLIC_KEY = "rs.security.include.public.key";
-
- /**
- * Include the X.509 certificate (for signature or encryption) in the "x5c" header.
- */
- public static final String RSSEC_INCLUDE_CERT = "rs.security.include.cert";
-
- /**
- * Include the JWK key id (for signature or encryption) in the "kid" header.
- */
- public static final String RSSEC_INCLUDE_KEY_ID = "rs.security.include.key.id";
-
- /**
- * Include the X.509 certificate SHA-1 digest (for signature or encryption) in the "x5t" header.
- */
- public static final String RSSEC_INCLUDE_CERT_SHA1 = "rs.security.include.cert.sha1";
-
- /**
* Whether to allow using a JWK received in the header for signature validation. The default
* is "false".
*/
@@ -187,26 +167,22 @@ public final class JoseConstants {
public static final String RSSEC_SIGNATURE_LIST_PROPS = "rs.security.signature.list.properties";
/**
- * Include the JWK public key for signature in the "jwk" header. If not configured then it
- * falls back to RSSEC_INCLUDE_PUBLIC_KEY.
+ * Include the JWK public key for signature in the "jwk" header.
*/
public static final String RSSEC_SIGNATURE_INCLUDE_PUBLIC_KEY = "rs.security.signature.include.public.key";
/**
- * Include the X.509 certificate for signature in the "x5c" header. If not configured then it
- * falls back to RSSEC_INCLUDE_CERT.
+ * Include the X.509 certificate for signature in the "x5c" header.
*/
public static final String RSSEC_SIGNATURE_INCLUDE_CERT = "rs.security.signature.include.cert";
/**
- * Include the JWK key id for signature in the "kid" header. If not configured then it
- * falls back to RSSEC_INCLUDE_KEY_ID.
+ * Include the JWK key id for signature in the "kid" header.
*/
public static final String RSSEC_SIGNATURE_INCLUDE_KEY_ID = "rs.security.signature.include.key.id";
/**
- * Include the X.509 certificate SHA-1 digest for signature in the "x5t" header. If not configured then it
- * falls back to RSSEC_INCLUDE_CERT_SHA1.
+ * Include the X.509 certificate SHA-1 digest for signature in the "x5t" header.
*/
public static final String RSSEC_SIGNATURE_INCLUDE_CERT_SHA1 = "rs.security.signature.include.cert.sha1";
http://git-wip-us.apache.org/repos/asf/cxf/blob/e51a7bd7/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
index ad9b137..4591bc3 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
@@ -282,12 +282,10 @@ public final class JweUtils {
}
boolean includeCert =
- headers != null && MessageUtils.isTrue(
- MessageUtils.getContextualProperty(m, JoseConstants.RSSEC_ENCRYPTION_INCLUDE_CERT,
- JoseConstants.RSSEC_INCLUDE_CERT));
- boolean includeCertSha1 = headers != null && MessageUtils.isTrue(
- MessageUtils.getContextualProperty(m, JoseConstants.RSSEC_ENCRYPTION_INCLUDE_CERT_SHA1,
- JoseConstants.RSSEC_INCLUDE_CERT_SHA1));
+ headers != null && MessageUtils.getContextualBoolean(
+ m, JoseConstants.RSSEC_ENCRYPTION_INCLUDE_CERT, false);
+ boolean includeCertSha1 = headers != null && MessageUtils.getContextualBoolean(
+ m, JoseConstants.RSSEC_ENCRYPTION_INCLUDE_CERT_SHA1, false);
KeyEncryptionProvider keyEncryptionProvider = null;
String keyEncryptionAlgo = getKeyEncryptionAlgo(m, props, null, null);
@@ -304,12 +302,10 @@ public final class JweUtils {
getDefaultKeyAlgo(jwk));
keyEncryptionProvider = getKeyEncryptionProvider(jwk, keyAlgo);
- boolean includePublicKey = headers != null && MessageUtils.isTrue(
- MessageUtils.getContextualProperty(m, JoseConstants.RSSEC_ENCRYPTION_INCLUDE_PUBLIC_KEY,
- JoseConstants.RSSEC_INCLUDE_PUBLIC_KEY));
- boolean includeKeyId = headers != null && MessageUtils.isTrue(
- MessageUtils.getContextualProperty(m, JoseConstants.RSSEC_ENCRYPTION_INCLUDE_KEY_ID,
- JoseConstants.RSSEC_INCLUDE_KEY_ID));
+ boolean includePublicKey = headers != null && MessageUtils.getContextualBoolean(
+ m, JoseConstants.RSSEC_ENCRYPTION_INCLUDE_PUBLIC_KEY, false);
+ boolean includeKeyId = headers != null && MessageUtils.getContextualBoolean(
+ m, JoseConstants.RSSEC_ENCRYPTION_INCLUDE_KEY_ID, false);
if (includeCert) {
JwkUtils.includeCertChain(jwk, headers, keyEncryptionAlgo);
http://git-wip-us.apache.org/repos/asf/cxf/blob/e51a7bd7/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/JwsUtils.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/JwsUtils.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/JwsUtils.java
index 747d53b..13badcb 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/JwsUtils.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jws/JwsUtils.java
@@ -267,12 +267,10 @@ public final class JwsUtils {
boolean ignoreNullProvider) {
JwsSignatureProvider theSigProvider = null;
- boolean includeCert = headers != null && MessageUtils.isTrue(
- MessageUtils.getContextualProperty(m, JoseConstants.RSSEC_SIGNATURE_INCLUDE_CERT,
- JoseConstants.RSSEC_INCLUDE_CERT));
- boolean includeCertSha1 = headers != null && MessageUtils.isTrue(
- MessageUtils.getContextualProperty(m, JoseConstants.RSSEC_SIGNATURE_INCLUDE_CERT_SHA1,
- JoseConstants.RSSEC_INCLUDE_CERT_SHA1));
+ boolean includeCert = headers != null && MessageUtils.getContextualBoolean(
+ m, JoseConstants.RSSEC_SIGNATURE_INCLUDE_CERT, false);
+ boolean includeCertSha1 = headers != null && MessageUtils.getContextualBoolean(
+ m, JoseConstants.RSSEC_SIGNATURE_INCLUDE_CERT_SHA1, false);
if (JoseConstants.HEADER_JSON_WEB_KEY.equals(props.get(JoseConstants.RSSEC_KEY_STORE_TYPE))) {
JsonWebKey jwk = JwkUtils.loadJsonWebKey(m, props, KeyOperation.SIGN);
@@ -280,12 +278,10 @@ public final class JwsUtils {
String signatureAlgo = getSignatureAlgo(m, props, jwk.getAlgorithm(), getDefaultKeyAlgo(jwk));
theSigProvider = JwsUtils.getSignatureProvider(jwk, SignatureAlgorithm.getAlgorithm(signatureAlgo));
- boolean includePublicKey = headers != null && MessageUtils.isTrue(
- MessageUtils.getContextualProperty(m, JoseConstants.RSSEC_SIGNATURE_INCLUDE_PUBLIC_KEY,
- JoseConstants.RSSEC_INCLUDE_PUBLIC_KEY));
- boolean includeKeyId = headers != null && MessageUtils.isTrue(
- MessageUtils.getContextualProperty(m, JoseConstants.RSSEC_SIGNATURE_INCLUDE_KEY_ID,
- JoseConstants.RSSEC_INCLUDE_KEY_ID));
+ boolean includePublicKey = headers != null && MessageUtils.getContextualBoolean(
+ m, JoseConstants.RSSEC_SIGNATURE_INCLUDE_PUBLIC_KEY, false);
+ boolean includeKeyId = headers != null && MessageUtils.getContextualBoolean(
+ m, JoseConstants.RSSEC_SIGNATURE_INCLUDE_KEY_ID, false);
if (includeCert) {
JwkUtils.includeCertChain(jwk, headers, signatureAlgo);
http://git-wip-us.apache.org/repos/asf/cxf/blob/e51a7bd7/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/JAXRSJweJwsTest.java
----------------------------------------------------------------------
diff --git a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/JAXRSJweJwsTest.java b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/JAXRSJweJwsTest.java
index cfdfa43..8a8bd74 100644
--- a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/JAXRSJweJwsTest.java
+++ b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/JAXRSJweJwsTest.java
@@ -218,7 +218,8 @@ public class JAXRSJweJwsTest extends AbstractBusClientServerTestBase {
public void testJweRsaJwsRsaCertInHeaders() throws Exception {
String address = "https://localhost:" + PORT + "/jwejwsrsaCertInHeaders";
BookStore bs = createJweJwsBookStore(address, null, null);
- WebClient.getConfig(bs).getRequestContext().put("rs.security.include.cert", "true");
+ WebClient.getConfig(bs).getRequestContext().put("rs.security.signature.include.cert", "true");
+ WebClient.getConfig(bs).getRequestContext().put("rs.security.encryption.include.cert", "true");
String text = bs.echoText("book");
assertEquals("book", text);
}
@@ -338,10 +339,10 @@ public class JAXRSJweJwsTest extends AbstractBusClientServerTestBase {
bean.getProperties(true).put("rs.security.signature.in.properties",
"org/apache/cxf/systest/jaxrs/security/bob.jwk.properties");
if (includePublicKey) {
- bean.getProperties(true).put("rs.security.include.public.key", true);
+ bean.getProperties(true).put("rs.security.signature.include.public.key", true);
}
if (includeKeyId) {
- bean.getProperties(true).put("rs.security.include.key.id", true);
+ bean.getProperties(true).put("rs.security.signature.include.key.id", true);
}
BookStore bs = bean.create(BookStore.class);
String text = bs.echoText("book");
[2/5] cxf git commit: Add an "alias" to the password provider so that
we can provide passwords for multiple aliases/certs
Posted by co...@apache.org.
Add an "alias" to the password provider so that we can provide passwords for multiple aliases/certs
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/948fd800
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/948fd800
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/948fd800
Branch: refs/heads/master
Commit: 948fd8001e710e5c42924324d8dc00cf41aa4ebd
Parents: 95bf2ad
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Mon Oct 26 15:20:13 2015 +0000
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Mon Oct 26 16:21:07 2015 +0000
----------------------------------------------------------------------
.../apache/cxf/rs/security/jose/common/KeyManagementUtils.java | 2 +-
.../cxf/rs/security/jose/common/PrivateKeyPasswordProvider.java | 2 +-
.../main/java/org/apache/cxf/rs/security/jose/jwk/JwkUtils.java | 3 ++-
.../apache/cxf/systest/jaxrs/security/jwt/JAXRSJweJwsTest.java | 2 +-
.../jaxrs/security/jwt/PrivateKeyPasswordProviderImpl.java | 2 +-
5 files changed, 6 insertions(+), 5 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/948fd800/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
index 9207e65..57929c2 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
@@ -146,7 +146,7 @@ public final class KeyManagementUtils {
String keyPswd = props.getProperty(JoseConstants.RSSEC_KEY_PSWD);
String theAlias = alias != null ? alias : getKeyId(m, props, JoseConstants.RSSEC_KEY_STORE_ALIAS, keyOper);
- char[] keyPswdChars = provider != null ? provider.getPassword(props)
+ char[] keyPswdChars = provider != null ? provider.getPassword(theAlias, props)
: keyPswd != null ? keyPswd.toCharArray() : null;
return CryptoUtils.loadPrivateKey(keyStore, keyPswdChars, theAlias);
}
http://git-wip-us.apache.org/repos/asf/cxf/blob/948fd800/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/PrivateKeyPasswordProvider.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/PrivateKeyPasswordProvider.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/PrivateKeyPasswordProvider.java
index fc58ee5..86fb0e5 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/PrivateKeyPasswordProvider.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/PrivateKeyPasswordProvider.java
@@ -21,5 +21,5 @@ package org.apache.cxf.rs.security.jose.common;
import java.util.Properties;
public interface PrivateKeyPasswordProvider {
- char[] getPassword(Properties storeProperties);
+ char[] getPassword(String alias, Properties storeProperties);
}
http://git-wip-us.apache.org/repos/asf/cxf/blob/948fd800/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwk/JwkUtils.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwk/JwkUtils.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwk/JwkUtils.java
index 60d3c83..b45b4bc 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwk/JwkUtils.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwk/JwkUtils.java
@@ -266,7 +266,8 @@ public final class JwkUtils {
public static JsonWebKeys loadJwkSet(Properties props, Bus bus, PrivateKeyPasswordProvider cb,
JwkReaderWriter reader) {
JweDecryptionProvider decryption = cb != null
- ? new AesCbcHmacJweDecryption(new PbesHmacAesWrapKeyDecryptionAlgorithm(cb.getPassword(props))) : null;
+ ? new AesCbcHmacJweDecryption(new PbesHmacAesWrapKeyDecryptionAlgorithm(
+ cb.getPassword(null, props))) : null;
return loadJwkSet(props, bus, decryption, reader);
}
public static JsonWebKeys loadJwkSet(Properties props, Bus bus, JweDecryptionProvider jwe, JwkReaderWriter reader) {
http://git-wip-us.apache.org/repos/asf/cxf/blob/948fd800/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/JAXRSJweJwsTest.java
----------------------------------------------------------------------
diff --git a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/JAXRSJweJwsTest.java b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/JAXRSJweJwsTest.java
index 21e6634..cfdfa43 100644
--- a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/JAXRSJweJwsTest.java
+++ b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/JAXRSJweJwsTest.java
@@ -438,7 +438,7 @@ public class JAXRSJweJwsTest extends AbstractBusClientServerTestBase {
this.password = password;
}
@Override
- public char[] getPassword(Properties storeProperties) {
+ public char[] getPassword(String alias, Properties storeProperties) {
return password.toCharArray();
}
http://git-wip-us.apache.org/repos/asf/cxf/blob/948fd800/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/PrivateKeyPasswordProviderImpl.java
----------------------------------------------------------------------
diff --git a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/PrivateKeyPasswordProviderImpl.java b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/PrivateKeyPasswordProviderImpl.java
index d9d7153..f01ea93 100644
--- a/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/PrivateKeyPasswordProviderImpl.java
+++ b/systests/rs-security/src/test/java/org/apache/cxf/systest/jaxrs/security/jwt/PrivateKeyPasswordProviderImpl.java
@@ -32,7 +32,7 @@ public class PrivateKeyPasswordProviderImpl implements PrivateKeyPasswordProvide
this.password = password;
}
@Override
- public char[] getPassword(Properties storeProperties) {
+ public char[] getPassword(String alias, Properties storeProperties) {
return password.toCharArray();
}
[5/5] cxf git commit: Fixing problem with retrieving private keys
Posted by co...@apache.org.
Fixing problem with retrieving private keys
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/95bf2ad6
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/95bf2ad6
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/95bf2ad6
Branch: refs/heads/master
Commit: 95bf2ad6c0a4f42ce8c4e44409ccbfe256520a01
Parents: 2f88eea
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Mon Oct 26 15:08:50 2015 +0000
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Mon Oct 26 16:21:07 2015 +0000
----------------------------------------------------------------------
.../cxf/rs/security/jose/common/KeyManagementUtils.java | 10 ----------
.../org/apache/cxf/rs/security/jose/jwe/JweUtils.java | 1 -
.../org/apache/cxf/rt/security/crypto/CryptoUtils.java | 4 ++++
3 files changed, 4 insertions(+), 11 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/95bf2ad6/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
index c491712..9207e65 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/KeyManagementUtils.java
@@ -375,16 +375,6 @@ public final class KeyManagementUtils {
try {
String alias = ks.getCertificateAlias(inCerts.get(0));
- if (alias != null) {
- for (Enumeration<String> e = ks.aliases(); e.hasMoreElements();) {
- String currentAlias = e.nextElement();
- X509Certificate[] currentCertArray = loadX509CertificateOrChain(ks, currentAlias);
- if (currentCertArray != null) {
- alias = currentAlias;
- break;
- }
- }
- }
return loadPrivateKey(ks, m, props, keyOper, alias);
} catch (Exception ex) {
http://git-wip-us.apache.org/repos/asf/cxf/blob/95bf2ad6/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
index 0d2e50d..ad9b137 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
@@ -368,7 +368,6 @@ public final class JweUtils {
SecretKey ctDecryptionKey = null;
String keyEncryptionAlgo = getKeyEncryptionAlgo(m, props, null, null);
if (inHeaders != null && inHeaders.getHeader(JoseConstants.HEADER_X509_CHAIN) != null) {
- //TODO: validate incoming public keys or certificates
//TODO: optionally validate inHeaders.getAlgorithm against a property in props
// Supporting loading a private key via a certificate for now
List<X509Certificate> chain = KeyManagementUtils.toX509CertificateChain(inHeaders.getX509Chain());
http://git-wip-us.apache.org/repos/asf/cxf/blob/95bf2ad6/rt/security/src/main/java/org/apache/cxf/rt/security/crypto/CryptoUtils.java
----------------------------------------------------------------------
diff --git a/rt/security/src/main/java/org/apache/cxf/rt/security/crypto/CryptoUtils.java b/rt/security/src/main/java/org/apache/cxf/rt/security/crypto/CryptoUtils.java
index fdf62a2..0c80fb4 100644
--- a/rt/security/src/main/java/org/apache/cxf/rt/security/crypto/CryptoUtils.java
+++ b/rt/security/src/main/java/org/apache/cxf/rt/security/crypto/CryptoUtils.java
@@ -711,6 +711,10 @@ public final class CryptoUtils {
if (!keyStore.containsAlias(alias)) {
throw new SecurityException("No alias exists in the keystore for: " + alias);
}
+ if (!keyStore.isKeyEntry(alias)) {
+ throw new SecurityException("The given alias " + alias
+ + " is not a private key in the keystore.");
+ }
KeyStore.PrivateKeyEntry pkEntry = (KeyStore.PrivateKeyEntry)
keyStore.getEntry(alias, new KeyStore.PasswordProtection(keyPassword));
return pkEntry.getPrivateKey();
[3/5] cxf git commit: Minor doc update
Posted by co...@apache.org.
Minor doc update
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/2f88eea2
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/2f88eea2
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/2f88eea2
Branch: refs/heads/master
Commit: 2f88eea2ae0d079fe0f8fd9e0c895e6efc54abaa
Parents: a602c9d
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Mon Oct 26 14:31:59 2015 +0000
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Mon Oct 26 16:21:07 2015 +0000
----------------------------------------------------------------------
.../cxf/rs/security/jose/common/JoseConstants.java | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/2f88eea2/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java
index b05fdd6..66c86d9 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java
@@ -187,22 +187,26 @@ public final class JoseConstants {
public static final String RSSEC_SIGNATURE_LIST_PROPS = "rs.security.signature.list.properties";
/**
- * Include the JWK public key for signature in the "jwk" header.
+ * Include the JWK public key for signature in the "jwk" header. If not configured then it
+ * falls back to RSSEC_INCLUDE_PUBLIC_KEY.
*/
public static final String RSSEC_SIGNATURE_INCLUDE_PUBLIC_KEY = "rs.security.signature.include.public.key";
/**
- * Include the X.509 certificate for signature in the "x5c" header.
+ * Include the X.509 certificate for signature in the "x5c" header. If not configured then it
+ * falls back to RSSEC_INCLUDE_CERT.
*/
public static final String RSSEC_SIGNATURE_INCLUDE_CERT = "rs.security.signature.include.cert";
/**
- * Include the JWK key id for signature in the "kid" header.
+ * Include the JWK key id for signature in the "kid" header. If not configured then it
+ * falls back to RSSEC_INCLUDE_KEY_ID.
*/
public static final String RSSEC_SIGNATURE_INCLUDE_KEY_ID = "rs.security.signature.include.key.id";
/**
- * Include the X.509 certificate SHA-1 digest for signature in the "x5t" header.
+ * Include the X.509 certificate SHA-1 digest for signature in the "x5t" header. If not configured then it
+ * falls back to RSSEC_INCLUDE_CERT_SHA1.
*/
public static final String RSSEC_SIGNATURE_INCLUDE_CERT_SHA1 = "rs.security.signature.include.cert.sha1";