Examples with KeyUsageInfo ee.ria.xroad.signer.protocol.dto.KeyUsageInfo used on opensource projects

Example 11 with KeyUsageInfo

use of ee.ria.xroad.signer.protocol.dto.KeyUsageInfo in project X-Road by nordic-institute.

the class OrphanRemovalServiceTest method setup.

@Before
public void setup() throws Exception {
    KeyInfo key01 = new TokenTestUtils.KeyInfoBuilder().id(KEY_01_ID).keyUsageInfo(KeyUsageInfo.SIGNING).csr(new CertificateTestUtils.CertRequestInfoBuilder().clientId(NON_DELETED_CLIENT_ID_O1).id(ORPHAN_CSR_01_ID).build()).build();
    KeyInfo key05 = new TokenTestUtils.KeyInfoBuilder().id(KEY_05_ID).keyUsageInfo(KeyUsageInfo.SIGNING).csr(new CertificateTestUtils.CertRequestInfoBuilder().clientId(DELETED_CLIENT_ID_WITH_ORPHAN_CSR_O5).id(ORPHAN_CSR_05_ID).build()).build();
    KeyInfo key06 = new TokenTestUtils.KeyInfoBuilder().id(KEY_06_ID).keyUsageInfo(KeyUsageInfo.SIGNING).cert(new CertificateTestUtils.CertificateInfoBuilder().clientId(DELETED_CLIENT_ID_WITH_ORPHAN_CERT_O6).id(ORPHAN_CERT_06_HASH).build()).build();
    KeyInfo key071 = new TokenTestUtils.KeyInfoBuilder().id(KEY_07_SIGN_ORPHAN_1_ID).keyUsageInfo(KeyUsageInfo.SIGNING).cert(new CertificateTestUtils.CertificateInfoBuilder().clientId(DELETED_CLIENT_ID_WITH_MULTIPLE_KEYS_07).id(ORPHAN_CERT_07_1_HASH).build()).build();
    KeyInfo key072 = new TokenTestUtils.KeyInfoBuilder().id(KEY_07_SIGN_ORPHAN_2_ID).keyUsageInfo(KeyUsageInfo.SIGNING).cert(new CertificateTestUtils.CertificateInfoBuilder().clientId(DELETED_CLIENT_ID_WITH_MULTIPLE_KEYS_07).id(ORPHAN_CERT_07_2_HASH).build()).csr(new CertificateTestUtils.CertRequestInfoBuilder().clientId(DELETED_CLIENT_ID_WITH_MULTIPLE_KEYS_07).id(ORPHAN_CSR_07_2_ID).build()).build();
    KeyInfo key073 = new TokenTestUtils.KeyInfoBuilder().id(KEY_07_SIGN_SHARED_ID).keyUsageInfo(KeyUsageInfo.SIGNING).cert(new CertificateTestUtils.CertificateInfoBuilder().clientId(DELETED_CLIENT_ID_WITH_MULTIPLE_KEYS_07).id(SHARED_KEY_CERT_07_1_HASH).build()).cert(new CertificateTestUtils.CertificateInfoBuilder().clientId(DELETED_CLIENT_ID_WITH_MULTIPLE_KEYS_07).id(SHARED_KEY_CERT_07_2_HASH).build()).csr(new CertificateTestUtils.CertRequestInfoBuilder().clientId(DELETED_CLIENT_ID_WITH_MULTIPLE_KEYS_07).id(SHARED_KEY_CSR_07_ID).build()).csr(new CertificateTestUtils.CertRequestInfoBuilder().clientId(KEY_SHARING_CLIENT_07_08).id(SHARED_KEY_CSR_08_ID).build()).build();
    KeyInfo key074 = new TokenTestUtils.KeyInfoBuilder().id(KEY_07_AUTH_ID).keyUsageInfo(KeyUsageInfo.AUTHENTICATION).cert(new CertificateTestUtils.CertificateInfoBuilder().id(AUTH_CERT_07_HASH).build()).build();
    TokenInfo tokenInfo = new TokenTestUtils.TokenInfoBuilder().friendlyName("fubar").key(key01).key(key05).key(key06).key(key071).key(key072).key(key073).key(key074).build();
    Map<String, KeyInfo> certCsrIdentifierToKey = new HashMap<>();
    // certs and csrs should not have duplicate ids/hashes
    tokenInfo.getKeyInfo().forEach(key -> key.getCerts().forEach(cert -> {
        if (certCsrIdentifierToKey.containsKey(cert.getId()))
            throw new RuntimeException("duplicate");
        certCsrIdentifierToKey.put(cert.getId(), key);
    }));
    tokenInfo.getKeyInfo().forEach(key -> key.getCertRequests().forEach(csr -> {
        if (certCsrIdentifierToKey.containsKey(csr.getId()))
            throw new RuntimeException("duplicate");
        certCsrIdentifierToKey.put(csr.getId(), key);
    }));
    doReturn(Collections.singletonList(tokenInfo)).when(signerProxyFacade).getTokens();
    Map<ClientId, ClientType> localClients = new HashMap<>();
    ALL_LOCAL_CLIENTS.forEach(id -> {
        ClientType clientType = new ClientType();
        clientType.setIdentifier(id);
        localClients.put(id, clientType);
    });
    doReturn(new ArrayList(localClients.values())).when(clientRepository).getAllLocalClients();
    doAnswer(invocation -> {
        ClientId clientId = (ClientId) invocation.getArguments()[0];
        return localClients.get(clientId);
    }).when(clientRepository).getClient(any());
    doReturn(tokenInfo).when(signerProxyFacade).getTokenForKeyId(any());
    doAnswer(invocation -> {
        String certHash = (String) invocation.getArguments()[0];
        return new TokenInfoAndKeyId(tokenInfo, certCsrIdentifierToKey.get(certHash).getId());
    }).when(signerProxyFacade).getTokenAndKeyIdForCertHash(any());
    doAnswer(invocation -> {
        String csrId = (String) invocation.getArguments()[0];
        return new TokenInfoAndKeyId(tokenInfo, certCsrIdentifierToKey.get(csrId).getId());
    }).when(signerProxyFacade).getTokenAndKeyIdForCertRequestId(any());
}

Example 12 with KeyUsageInfo

use of ee.ria.xroad.signer.protocol.dto.KeyUsageInfo in project X-Road by nordic-institute.

the class CertificateAuthorityService method getCertificateAuthorities.

/**
 * Return approved certificate authorities
 * @param keyUsageInfo list CAs for this type of key usage. If null, list all.
 * @param includeIntermediateCas true = also include intermediate CAs.
 *                               false = only include top CAs
 * @throws InconsistentCaDataException if required CA data could not be extracted, for example due to OCSP
 * responses not being valid
 * @return list of approved CAs
 */
@Cacheable(GET_CERTIFICATE_AUTHORITIES_CACHE)
public List<ApprovedCaDto> getCertificateAuthorities(KeyUsageInfo keyUsageInfo, boolean includeIntermediateCas) throws InconsistentCaDataException {
    log.debug("getCertificateAuthorities");
    List<X509Certificate> caCerts = new ArrayList<>(globalConfService.getAllCaCertsForThisInstance());
    List<ApprovedCaDto> dtos = new ArrayList<>();
    // map of each subject - issuer DN pair for easy lookups
    Map<String, String> subjectsToIssuers = caCerts.stream().collect(Collectors.toMap(x509 -> x509.getSubjectDN().getName(), x509 -> x509.getIssuerDN().getName()));
    // we only fetch ocsp responses for intermediate approved CAs
    // configured as approved CA and its issuer cert is also an approved CA
    List<X509Certificate> filteredCerts = caCerts.stream().filter(cert -> subjectsToIssuers.containsKey(cert.getIssuerDN().getName())).collect(Collectors.toList());
    String[] base64EncodedOcspResponses;
    try {
        String[] certHashes = CertUtils.getCertHashes(new ArrayList<>(filteredCerts));
        base64EncodedOcspResponses = signerProxyFacade.getOcspResponses(certHashes);
    } catch (Exception e) {
        throw new InconsistentCaDataException("failed to get read CA OCSP responses", e);
    }
    if (filteredCerts.size() != base64EncodedOcspResponses.length) {
        throw new InconsistentCaDataException(String.format("ocsp responses do not match ca certs %d vs %d", filteredCerts.size(), base64EncodedOcspResponses.length));
    }
    // build dtos
    for (X509Certificate cert : caCerts) {
        int idx = filteredCerts.indexOf(cert);
        dtos.add(buildCertificateAuthorityDto(cert, (idx != -1) ? base64EncodedOcspResponses[idx] : null, subjectsToIssuers));
    }
    if (keyUsageInfo == KeyUsageInfo.SIGNING) {
        // remove "authentication only" CAs
        dtos = dtos.stream().filter(dto -> !(Boolean.TRUE.equals(dto.isAuthenticationOnly()))).collect(Collectors.toList());
    }
    if (!includeIntermediateCas) {
        // remove intermediate CAs
        dtos = dtos.stream().filter(dto -> dto.isTopCa()).collect(Collectors.toList());
    }
    return dtos;
}

Example 13 with KeyUsageInfo

use of ee.ria.xroad.signer.protocol.dto.KeyUsageInfo in project X-Road by nordic-institute.

the class TokensApiController method addKeyAndCsr.

@Override
@PreAuthorize("hasAuthority('GENERATE_KEY') " + " and (hasAuthority('GENERATE_AUTH_CERT_REQ') or hasAuthority('GENERATE_SIGN_CERT_REQ'))")
@AuditEventMethod(event = RestApiAuditEvent.GENERATE_KEY_AND_CSR)
public ResponseEntity<KeyWithCertificateSigningRequestId> addKeyAndCsr(String tokenId, KeyLabelWithCsrGenerate keyLabelWithCsrGenerate) {
    // squid:S3655 throwing NoSuchElementException if there is no value present is
    // fine since keyUsageInfo is mandatory parameter
    CsrGenerate csrGenerate = keyLabelWithCsrGenerate.getCsrGenerateRequest();
    KeyUsageInfo keyUsageInfo = KeyUsageTypeMapping.map(csrGenerate.getKeyUsageType()).get();
    ClientId memberId = null;
    if (KeyUsageInfo.SIGNING == keyUsageInfo) {
        // memberId not used for authentication csrs
        memberId = clientConverter.convertId(csrGenerate.getMemberId());
    }
    // squid:S3655 throwing NoSuchElementException if there is no value present is
    // fine since csr format is mandatory parameter
    CertificateRequestFormat csrFormat = CsrFormatMapping.map(csrGenerate.getCsrFormat()).get();
    KeyAndCertificateRequestService.KeyAndCertRequestInfo keyAndCertRequest;
    try {
        keyAndCertRequest = keyAndCertificateRequestService.addKeyAndCertRequest(tokenId, keyLabelWithCsrGenerate.getKeyLabel(), memberId, keyUsageInfo, csrGenerate.getCaName(), csrGenerate.getSubjectFieldValues(), csrFormat);
    } catch (ClientNotFoundException | CertificateAuthorityNotFoundException | DnFieldHelper.InvalidDnParameterException e) {
        throw new BadRequestException(e);
    } catch (ActionNotPossibleException e) {
        throw new ConflictException(e);
    } catch (TokenNotFoundException e) {
        throw new ResourceNotFoundException(e);
    }
    KeyWithCertificateSigningRequestId result = new KeyWithCertificateSigningRequestId();
    Key key = keyConverter.convert(keyAndCertRequest.getKeyInfo());
    result.setKey(key);
    result.setCsrId(keyAndCertRequest.getCertReqId());
    return new ResponseEntity<>(result, HttpStatus.OK);
}