Examples with KeyManager javax.net.ssl.KeyManager used on opensource projects

Example 91 with KeyManager

use of javax.net.ssl.KeyManager in project Payara by payara.

the class IIOPSSLSocketFactory method init.

/**
 * serveralias/clientalias cannot be set at the same time.
 * this method encapsulates the common code for both the client side and
 * server side to create a SSLContext
 * it is called once for each serveralias and once for each clientalias
 */
private SSLInfo init(String alias, boolean ssl2Enabled, String ssl2Ciphers, boolean ssl3Enabled, String ssl3TlsCiphers, boolean tlsEnabled, boolean tlsEnabled11, boolean tlsEnabled12, boolean tlsEnabled13) throws Exception {
    String protocol;
    if (tlsEnabled13) {
        protocol = TLS13;
    } else if (tlsEnabled12) {
        protocol = TLS12;
    } else if (tlsEnabled11) {
        protocol = TLS11;
    } else if (tlsEnabled) {
        protocol = TLS;
    } else if (ssl3Enabled) {
        protocol = SSL3;
    } else if (ssl2Enabled) {
        protocol = SSL2;
    } else {
        // default
        protocol = SSL;
    }
    String[] ssl3TlsCipherArr = null;
    if (tlsEnabled11 || tlsEnabled12 || tlsEnabled13 || tlsEnabled || ssl3Enabled) {
        ssl3TlsCipherArr = getEnabledCipherSuites(ssl3TlsCiphers, false, ssl3Enabled, tlsEnabled, tlsEnabled11, tlsEnabled12, tlsEnabled13);
    }
    String[] ssl2CipherArr = null;
    if (ssl2Enabled) {
        ssl2CipherArr = getEnabledCipherSuites(ssl2Ciphers, true, false, false, false, false, false);
    }
    SSLContext ctx = SSLContext.getInstance(protocol);
    if (Globals.getDefaultHabitat() != null) {
        IIOPSSLUtil sslUtil = Globals.getDefaultHabitat().getService(IIOPSSLUtil.class);
        KeyManager[] mgrs = sslUtil.getKeyManagers(alias);
        ctx.init(mgrs, sslUtil.getTrustManagers(), sslUtil.getInitializedSecureRandom());
    } else {
    // do nothing
    // ctx.init(mgrs, sslUtil.getTrustManagers(), sslUtil.getInitializedSecureRandom());
    }
    SSLInfo newInfo = new SSLInfo(ctx, ssl3TlsCipherArr, ssl2CipherArr);
    if (ssl3Enabled) {
        newInfo.addProtocol(SSL3);
    }
    if (tlsEnabled) {
        newInfo.addProtocol(TLS);
    }
    if (tlsEnabled11) {
        newInfo.addProtocol(TLS11);
    }
    if (tlsEnabled12) {
        newInfo.addProtocol(TLS12);
    }
    if (tlsEnabled13) {
        newInfo.addProtocol(TLS13);
    }
    return newInfo;
}

Example 92 with KeyManager

use of javax.net.ssl.KeyManager in project Payara by payara.

the class RestClientSslContextAliasListener method buildSSlContext.

/**
 * This method evaluate the alias on the global keystore and return the corresponding SSLContext based on the alias
 * if not available the SSLContext should be the default that Jersey implementation set
 *
 * @param alias name of the certificate
 * @return the SSLContext with the corresponding certificate and alias name
 */
protected SSLContext buildSSlContext(String alias) {
    logger.log(Level.FINE, "Building the SSLContext for the alias");
    try {
        KeyManager[] managers = getKeyManagers();
        Optional<X509KeyManager> optionalKeyManager = null;
        optionalKeyManager = Arrays.stream(managers).filter(m -> (m instanceof X509KeyManager)).map(m -> ((X509KeyManager) m)).findFirst();
        KeyStore[] keyStores = getKeyStores();
        for (KeyStore ks : keyStores) {
            if (ks.containsAlias(alias) && optionalKeyManager.isPresent()) {
                X509KeyManager customKeyManager = new SingleCertificateKeyManager(alias, optionalKeyManager.get());
                SSLContext customSSLContext = SSLContext.getInstance("TLS");
                customSSLContext.init(new KeyManager[] { customKeyManager }, null, null);
                return customSSLContext;
            }
        }
    } catch (IOException e) {
        logger.severe("An IOException was thrown with the following message" + e.getMessage());
    } catch (KeyStoreException e) {
        logger.severe("A KeyStoreException was thrown with the following message" + e.getMessage());
    } catch (Exception e) {
        logger.severe("An Exception was thrown with the following message" + e.getMessage());
    }
    return null;
}

Example 93 with KeyManager

use of javax.net.ssl.KeyManager in project ranger by apache.

the class RemoteUnixLoginModule method getLoginReplyFromAuthService.

private String getLoginReplyFromAuthService(String aUserName, char[] modifiedPasschar) throws LoginException {
    String ret = null;
    Socket sslsocket = null;
    char[] prefix = new String("LOGIN:" + aUserName + " ").toCharArray();
    char[] tail = new String("\n").toCharArray();
    char[] loginData = new char[prefix.length + modifiedPasschar.length + tail.length];
    System.arraycopy(prefix, 0, loginData, 0, prefix.length);
    System.arraycopy(modifiedPasschar, 0, loginData, prefix.length, modifiedPasschar.length);
    System.arraycopy(tail, 0, loginData, prefix.length + modifiedPasschar.length, tail.length);
    try {
        try {
            if (SSLEnabled) {
                SSLContext context = SSLContext.getInstance(SSL_ALGORITHM);
                KeyManager[] km = null;
                if (keyStorePath != null) {
                    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
                    InputStream in = null;
                    in = getFileInputStream(keyStorePath);
                    try {
                        ks.load(in, keyStorePathPassword.toCharArray());
                    } finally {
                        if (in != null) {
                            in.close();
                        }
                    }
                    KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
                    kmf.init(ks, keyStorePathPassword.toCharArray());
                    km = kmf.getKeyManagers();
                }
                TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
                TrustManager[] tm = null;
                if (serverCertValidation) {
                    KeyStore trustStoreKeyStore = null;
                    if (trustStorePath != null) {
                        trustStoreKeyStore = KeyStore.getInstance(KeyStore.getDefaultType());
                        InputStream in = null;
                        in = getFileInputStream(trustStorePath);
                        try {
                            trustStoreKeyStore.load(in, trustStorePathPassword.toCharArray());
                            trustManagerFactory.init(trustStoreKeyStore);
                            tm = trustManagerFactory.getTrustManagers();
                        } finally {
                            if (in != null) {
                                in.close();
                            }
                        }
                    }
                } else {
                    TrustManager ignoreValidationTM = new X509TrustManager() {

                        public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
                        // Ignore Server Certificate Validation
                        }

                        public X509Certificate[] getAcceptedIssuers() {
                            return new X509Certificate[0];
                        }

                        public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
                        // Ignore Server Certificate Validation
                        }
                    };
                    tm = new TrustManager[] { ignoreValidationTM };
                }
                SecureRandom random = new SecureRandom();
                context.init(km, tm, random);
                SSLSocketFactory sf = context.getSocketFactory();
                sslsocket = sf.createSocket(remoteHostName, remoteHostAuthServicePort);
            } else {
                sslsocket = new Socket(remoteHostName, remoteHostAuthServicePort);
            }
            OutputStreamWriter writer = new OutputStreamWriter(sslsocket.getOutputStream());
            writer.write(loginData);
            writer.flush();
            BufferedReader reader = new BufferedReader(new InputStreamReader(sslsocket.getInputStream()));
            ret = reader.readLine();
            reader.close();
            writer.close();
        } finally {
            if (sslsocket != null) {
                sslsocket.close();
            }
        }
    } catch (Throwable t) {
        throw new LoginException("FAILED: unable to authenticate to AuthenticationService: " + remoteHostName + ":" + remoteHostAuthServicePort + ", Exception: [" + t + "]");
    } finally {
        log("Login of user String: {" + aUserName + "}, return from AuthServer: {" + ret + "}");
        Arrays.fill(loginData, ' ');
        Arrays.fill(modifiedPasschar, ' ');
    }
    return ret;
}

Example 94 with KeyManager

use of javax.net.ssl.KeyManager in project ranger by apache.

the class SolrAuditDestination method getKeyManagers.

private KeyManager[] getKeyManagers() {
    KeyManager[] kmList = null;
    String credentialProviderPath = MiscUtil.getStringProperty(props, RANGER_POLICYMGR_CLIENT_KEY_FILE_CREDENTIAL);
    String keyStoreAlias = RANGER_POLICYMGR_CLIENT_KEY_FILE_CREDENTIAL_ALIAS;
    String keyStoreFile = MiscUtil.getStringProperty(props, RANGER_POLICYMGR_CLIENT_KEY_FILE);
    String keyStoreFilepwd = MiscUtil.getCredentialString(credentialProviderPath, keyStoreAlias);
    if (StringUtils.isNotEmpty(keyStoreFile) && StringUtils.isNotEmpty(keyStoreFilepwd)) {
        InputStream in = null;
        try {
            in = getFileInputStream(keyStoreFile);
            if (in != null) {
                String keyStoreType = MiscUtil.getStringProperty(props, RANGER_POLICYMGR_CLIENT_KEY_FILE_TYPE);
                keyStoreType = StringUtils.isNotEmpty(keyStoreType) ? keyStoreType : RANGER_POLICYMGR_CLIENT_KEY_FILE_TYPE_DEFAULT;
                KeyStore keyStore = KeyStore.getInstance(keyStoreType);
                keyStore.load(in, keyStoreFilepwd.toCharArray());
                KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(RANGER_SSL_KEYMANAGER_ALGO_TYPE);
                keyManagerFactory.init(keyStore, keyStoreFilepwd.toCharArray());
                kmList = keyManagerFactory.getKeyManagers();
            } else {
                LOG.error("Unable to obtain keystore from file [" + keyStoreFile + "]");
            }
        } catch (KeyStoreException e) {
            LOG.error("Unable to obtain from KeyStore :" + e.getMessage(), e);
        } catch (NoSuchAlgorithmException e) {
            LOG.error("SSL algorithm is NOT available in the environment", e);
        } catch (CertificateException e) {
            LOG.error("Unable to obtain the requested certification ", e);
        } catch (FileNotFoundException e) {
            LOG.error("Unable to find the necessary SSL Keystore Files", e);
        } catch (IOException e) {
            LOG.error("Unable to read the necessary SSL Keystore Files", e);
        } catch (UnrecoverableKeyException e) {
            LOG.error("Unable to recover the key from keystore", e);
        } finally {
            close(in, keyStoreFile);
        }
    }
    return kmList;
}

Example 95 with KeyManager

use of javax.net.ssl.KeyManager in project ranger by apache.

the class EmbeddedServer method getKeyManagers.

private KeyManager[] getKeyManagers() {
    KeyManager[] kmList = null;
    String keyStoreFile = EmbeddedServerUtil.getConfig("ranger.keystore.file");
    String keyStoreAlias = EmbeddedServerUtil.getConfig("ranger.keystore.alias", "keyStoreCredentialAlias");
    if (StringUtils.isBlank(keyStoreFile)) {
        keyStoreFile = getKeystoreFile();
        keyStoreAlias = EmbeddedServerUtil.getConfig("ranger.service.https.attrib.keystore.credential.alias", "keyStoreCredentialAlias");
    }
    String keyStoreFileType = EmbeddedServerUtil.getConfig("ranger.keystore.file.type", RANGER_KEYSTORE_FILE_TYPE_DEFAULT);
    String credentialProviderPath = EmbeddedServerUtil.getConfig("ranger.credential.provider.path");
    String keyStoreFilepwd = CredentialReader.getDecryptedString(credentialProviderPath, keyStoreAlias, keyStoreFileType);
    if (StringUtils.isNotEmpty(keyStoreFile) && StringUtils.isNotEmpty(keyStoreFilepwd)) {
        InputStream in = null;
        try {
            in = getFileInputStream(keyStoreFile);
            if (in != null) {
                KeyStore keyStore = KeyStore.getInstance(keyStoreFileType);
                keyStore.load(in, keyStoreFilepwd.toCharArray());
                KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
                keyManagerFactory.init(keyStore, keyStoreFilepwd.toCharArray());
                kmList = keyManagerFactory.getKeyManagers();
            } else {
                LOG.severe("Unable to obtain keystore from file [" + keyStoreFile + "]");
            }
        } catch (KeyStoreException e) {
            LOG.log(Level.SEVERE, "Unable to obtain from KeyStore :" + e.getMessage(), e);
        } catch (NoSuchAlgorithmException e) {
            LOG.log(Level.SEVERE, "SSL algorithm is NOT available in the environment", e);
        } catch (CertificateException e) {
            LOG.log(Level.SEVERE, "Unable to obtain the requested certification ", e);
        } catch (FileNotFoundException e) {
            LOG.log(Level.SEVERE, "Unable to find the necessary SSL Keystore Files", e);
        } catch (IOException e) {
            LOG.log(Level.SEVERE, "Unable to read the necessary SSL Keystore Files", e);
        } catch (UnrecoverableKeyException e) {
            LOG.log(Level.SEVERE, "Unable to recover the key from keystore", e);
        } finally {
            close(in, keyStoreFile);
        }
    } else {
        if (StringUtils.isBlank(keyStoreFile)) {
            LOG.warning("Config 'ranger.keystore.file' or 'ranger.service.https.attrib.keystore.file' is not found or contains blank value");
        } else if (StringUtils.isBlank(keyStoreAlias)) {
            LOG.warning("Config 'ranger.keystore.alias' or 'ranger.service.https.attrib.keystore.credential.alias' is not found or contains blank value");
        } else if (StringUtils.isBlank(credentialProviderPath)) {
            LOG.warning("Config 'ranger.credential.provider.path' is not found or contains blank value");
        } else if (StringUtils.isBlank(keyStoreFilepwd)) {
            LOG.warning("Unable to read credential from credential store file [" + credentialProviderPath + "] for given alias:" + keyStoreAlias);
        }
    }
    return kmList;
}