Examples with KeyUsageInfo ee.ria.xroad.signer.protocol.dto.KeyUsageInfo used on opensource projects

Example 6 with KeyUsageInfo

use of ee.ria.xroad.signer.protocol.dto.KeyUsageInfo in project X-Road by nordic-institute.

the class ImportCertRequestHandler method importCertificateToKey.

private void importCertificateToKey(KeyInfo keyInfo, X509Certificate cert, String initialStatus, ClientId memberId) throws Exception {
    String certHash = calculateCertHexHash(cert.getEncoded());
    CertificateInfo existingCert = TokenManager.getCertificateInfoForCertHash(certHash);
    if (existingCert != null && existingCert.isSavedToConfiguration()) {
        throw CodedException.tr(X_CERT_EXISTS, "cert_exists_under_key", "Certificate already exists under key '%s'", keyInfo.getFriendlyName() == null ? keyInfo.getId() : keyInfo.getFriendlyName());
    }
    boolean signing = CertUtils.isSigningCert(cert);
    boolean authentication = CertUtils.isAuthCert(cert);
    if (signing && authentication) {
        throw CodedException.tr(X_WRONG_CERT_USAGE, "wrong_cert_usage.both", "Both signing and authentication, " + "only one of them allowed.");
    }
    KeyUsageInfo keyUsage = getKeyUsage(keyInfo, signing);
    validateCertKeyUsage(signing, authentication, keyUsage);
    verifyCertChain(cert);
    if (existingCert != null) {
        TokenManager.removeCert(existingCert.getId());
    }
    CertificateInfo certType = new CertificateInfo(memberId, !authentication, true, initialStatus, SignerUtil.randomId(), cert.getEncoded(), null);
    TokenManager.addCert(keyInfo.getId(), certType);
    TokenManager.setKeyUsage(keyInfo.getId(), keyUsage);
    updateOcspResponse(cert);
    log.info("Imported certificate to key '{}', certificate hash:\n{}", keyInfo.getId(), certHash);
    deleteCertRequest(keyInfo.getId(), memberId);
}

Example 7 with KeyUsageInfo

use of ee.ria.xroad.signer.protocol.dto.KeyUsageInfo in project X-Road by nordic-institute.

the class CertificateAuthoritiesApiController method getApprovedCertificateAuthorities.

/**
 * Currently returns partial CertificateAuthority objects that have only
 * name and authentication_only properties set.
 * Other properties will be added in another ticket (system parameters).
 * @return
 */
@Override
@PreAuthorize("hasAuthority('VIEW_APPROVED_CERTIFICATE_AUTHORITIES')" + " or (hasAuthority('GENERATE_AUTH_CERT_REQ') and " + " (#keyUsageType == T(org.niis.xroad.securityserver.restapi.openapi.model.KeyUsageType).AUTHENTICATION" + " or #keyUsageType == null))" + "or (hasAuthority('GENERATE_SIGN_CERT_REQ') and " + "#keyUsageType == T(org.niis.xroad.securityserver.restapi.openapi.model.KeyUsageType).SIGNING)")
public ResponseEntity<Set<CertificateAuthority>> getApprovedCertificateAuthorities(KeyUsageType keyUsageType, Boolean includeIntermediateCas) {
    KeyUsageInfo keyUsageInfo = KeyUsageTypeMapping.map(keyUsageType).orElse(null);
    Collection<ApprovedCaDto> caDtos = null;
    try {
        caDtos = certificateAuthorityService.getCertificateAuthorities(keyUsageInfo, includeIntermediateCas);
    } catch (CertificateAuthorityService.InconsistentCaDataException e) {
        throw new InternalServerErrorException(e);
    }
    Set<CertificateAuthority> cas = certificateAuthorityConverter.convert(caDtos);
    return new ResponseEntity<>(cas, HttpStatus.OK);
}

Example 8 with KeyUsageInfo

use of ee.ria.xroad.signer.protocol.dto.KeyUsageInfo in project X-Road by nordic-institute.

the class MergeOntoFileTokenStrategyTest method mergeKeyShouldOnlyCopyOverAvailabilityOutOfSingleFields.

/**
 * @see MergeOntoFileTokensStrategy#mergeKey(Key, Key)
 */
@Test
public void mergeKeyShouldOnlyCopyOverAvailabilityOutOfSingleFields() {
    final String fileId = "123t5dssd";
    final Token fileToken = new Token("fileToken", "fileId", CryptoUtils.CKM_RSA_PKCS_NAME);
    final Key fileKey = new Key(fileToken, fileId);
    final String fileFriendlyName = "d§gsdasd";
    fileKey.setFriendlyName(fileFriendlyName);
    final boolean fileAvailable = false;
    fileKey.setAvailable(fileAvailable);
    final String fileLabel = "12gggfgergef";
    fileKey.setLabel(fileLabel);
    final String filePublicKey = "qfasqqqweqwe---";
    fileKey.setPublicKey(filePublicKey);
    final KeyUsageInfo fileKeyUsageInfo = KeyUsageInfo.AUTHENTICATION;
    fileKey.setUsage(fileKeyUsageInfo);
    final String memId = "asre111";
    Key memKey = new Key(new Token("memToken", "memId", CryptoUtils.CKM_RSA_PKCS_NAME), memId);
    final boolean memAvailable = true;
    assertNotEquals("test setup failure", fileAvailable, memAvailable);
    memKey.setAvailable(memAvailable);
    memKey.setUsage(KeyUsageInfo.SIGNING);
    memKey.setPublicKey("eeefqweggffgeeew-");
    memKey.setLabel("label111222");
    testedStrategy.mergeKey(fileKey, memKey);
    assertEquals("availability was not merged", memAvailable, fileKey.isAvailable());
    assertEquals("token was merged", fileToken, fileKey.getToken());
    assertEquals("id was merged", fileId, fileKey.getId());
    assertEquals("friendly name was merged", fileFriendlyName, fileKey.getFriendlyName());
    assertEquals("label was merged", fileLabel, fileKey.getLabel());
    assertEquals("public key was merged", filePublicKey, fileKey.getPublicKey());
}

Example 9 with KeyUsageInfo

use of ee.ria.xroad.signer.protocol.dto.KeyUsageInfo in project X-Road by nordic-institute.

the class GlobalConfCheckerTest method setup.

@Before
public void setup() throws Exception {
    doAnswer(answer -> null).when(globalConfFacade).verifyValidity();
    doAnswer(answer -> null).when(globalConfFacade).reload();
    List<MemberInfo> globalMemberInfos = new ArrayList<>(Arrays.asList(TestUtils.getMemberInfo(TestUtils.INSTANCE_FI, TestUtils.MEMBER_CLASS_GOV, TestUtils.MEMBER_CODE_M1, null), TestUtils.getMemberInfo(TestUtils.INSTANCE_FI, TestUtils.MEMBER_CLASS_GOV, TestUtils.MEMBER_CODE_M2, null)));
    when(globalConfFacade.getMembers(any())).thenReturn(globalMemberInfos);
    when(globalConfFacade.getMemberName(any())).thenAnswer(invocation -> {
        ClientId clientId = (ClientId) invocation.getArguments()[0];
        Optional<MemberInfo> m = globalMemberInfos.stream().filter(g -> g.getId().equals(clientId)).findFirst();
        if (m.isPresent()) {
            return m.get().getName();
        } else {
            return null;
        }
    });
    when(globalConfFacade.getInstanceIdentifier()).thenReturn(TestUtils.INSTANCE_FI);
    when(managementRequestSenderService.sendClientRegisterRequest(any())).thenReturn(1);
    KeyInfo ownerSignKey = new TokenTestUtils.KeyInfoBuilder().id(KEY_OWNER_ID).keyUsageInfo(KeyUsageInfo.SIGNING).csr(new CertificateTestUtils.CertRequestInfoBuilder().clientId(OWNER_MEMBER).id(CERT_OWNER_HASH).build()).build();
    KeyInfo newOwnerSignKey = new TokenTestUtils.KeyInfoBuilder().id(KEY_NEW_OWNER_ID).keyUsageInfo(KeyUsageInfo.SIGNING).csr(new CertificateTestUtils.CertRequestInfoBuilder().clientId(NEW_OWNER_MEMBER).id(CERT_NEW_OWNER_HASH).build()).build();
    CertificateInfo certificateInfo = new CertificateTestUtils.CertificateInfoBuilder().id(CERT_AUTH_HASH).build();
    KeyInfo authKey = new TokenTestUtils.KeyInfoBuilder().id(KEY_AUTH_ID).keyUsageInfo(KeyUsageInfo.AUTHENTICATION).cert(certificateInfo).build();
    TokenInfo tokenInfo = new TokenTestUtils.TokenInfoBuilder().friendlyName("fubar").key(ownerSignKey).key(newOwnerSignKey).key(authKey).build();
    Map<String, TokenInfo> tokens = new HashMap<>();
    tokens.put(tokenInfo.getId(), tokenInfo);
    when(signerProxyFacade.getTokens()).thenReturn(new ArrayList<>(tokens.values()));
    when(signerProxyFacade.execute(new GetAuthKey(any()))).thenReturn(new AuthKeyInfo(KEY_AUTH_ID, null, null, certificateInfo));
    when(globalConfService.getMemberClassesForThisInstance()).thenReturn(new HashSet<>(MEMBER_CLASSES));
}

Example 10 with KeyUsageInfo

use of ee.ria.xroad.signer.protocol.dto.KeyUsageInfo in project X-Road by nordic-institute.

the class KeyAndCertificateRequestServiceIntegrationTest method setup.

@Before
public void setup() throws Exception {
    TokenInfo token0 = new TokenTestUtils.TokenInfoBuilder().id(SOFTWARE_TOKEN_ID).type(TokenInfo.SOFTWARE_MODULE_TYPE).friendlyName("mock-token0").build();
    TokenInfo token1 = new TokenTestUtils.TokenInfoBuilder().id(OTHER_TOKEN_ID).type("mock-type").friendlyName("mock-token1").build();
    Map<String, TokenInfo> tokens = new HashMap<>();
    tokens.put(token0.getId(), token0);
    tokens.put(token1.getId(), token1);
    // mock related signer proxy methods
    when(signerProxyFacade.getTokens()).thenReturn(new ArrayList<>(tokens.values()));
    when(signerProxyFacade.getToken(any())).thenAnswer(invocation -> tokens.get(invocation.getArguments()[0]));
    when(signerProxyFacade.generateKey(any(), any())).thenAnswer(invocation -> {
        String tokenId = (String) invocation.getArguments()[0];
        String label = (String) invocation.getArguments()[1];
        // new keys start with usage = null
        KeyInfo keyInfo = new TokenTestUtils.KeyInfoBuilder().id(label).keyUsageInfo(null).friendlyName(label).build();
        TokenInfo token = tokens.get(tokenId);
        token.getKeyInfo().add(keyInfo);
        return keyInfo;
    });
    when(signerProxyFacade.getTokenForKeyId(any())).thenAnswer(invocation -> {
        String keyId = (String) invocation.getArguments()[0];
        return getTokenWithKey(tokens, keyId);
    });
    when(signerProxyFacade.generateCertRequest(any(), any(), any(), any(), any())).thenAnswer(invocation -> {
        // keyInfo is immutable, so we need some work to replace KeyInfo with
        // one that has correct usage
        String keyId = (String) invocation.getArguments()[0];
        KeyUsageInfo keyUsage = (KeyUsageInfo) invocation.getArguments()[2];
        KeyInfo keyInfo = getKey(tokens, keyId);
        TokenInfo tokenInfo = getTokenWithKey(tokens, keyId);
        KeyInfo copy = new TokenTestUtils.KeyInfoBuilder().keyInfo(keyInfo).keyUsageInfo(keyUsage).build();
        tokenInfo.getKeyInfo().remove(keyInfo);
        tokenInfo.getKeyInfo().add(copy);
        return new SignerProxy.GeneratedCertRequestInfo(null, null, null, null, null);
    });
    when(globalConfFacade.getApprovedCAs(any())).thenReturn(Arrays.asList(new ApprovedCAInfo(MOCK_CA, false, "ee.ria.xroad.common.certificateprofile.impl.FiVRKCertificateProfileInfoProvider")));
    ClientId ownerId = ClientId.create("FI", "GOV", "M1");
    SecurityServerId ownerSsId = SecurityServerId.create(ownerId, "TEST-INMEM-SS");
    when(currentSecurityServerId.getServerId()).thenReturn(ownerSsId);
}