Examples with PrivateKeyCallback javax.security.auth.message.callback.PrivateKeyCallback used on opensource projects

Example 6 with PrivateKeyCallback

use of javax.security.auth.message.callback.PrivateKeyCallback in project Payara by payara.

the class BaseContainerCallbackHandler method processPrivateKey.

private void processPrivateKey(PrivateKeyCallback privKeyCallback) {
    KeyStore[] kstores = secSup.getKeyStores();
    _logger.log(Level.FINE, "JASPIC: In PrivateKeyCallback Processor");
    // Make sure we have a keystore
    if (kstores == null || kstores.length == 0) {
        // cannot get any information
        privKeyCallback.setKey(null, null);
        return;
    }
    // get the request type
    PrivateKeyCallback.Request req = privKeyCallback.getRequest();
    PrivateKey privKey = null;
    Certificate[] certs = null;
    if (req == null) {
        // no request type - set default key
        PrivateKeyEntry pke = getDefaultPrivateKeyEntry(kstores);
        if (pke != null) {
            privKey = pke.getPrivateKey();
            certs = pke.getCertificateChain();
        }
        privKeyCallback.setKey(privKey, certs);
        return;
    }
    // find key based on request type
    try {
        if (req instanceof PrivateKeyCallback.AliasRequest) {
            PrivateKeyCallback.AliasRequest aReq = (PrivateKeyCallback.AliasRequest) req;
            String alias = aReq.getAlias();
            PrivateKeyEntry privKeyEntry;
            if (alias == null) {
                // use default key
                privKeyEntry = getDefaultPrivateKeyEntry(kstores);
            } else {
                privKeyEntry = sslUtils.getPrivateKeyEntryFromTokenAlias(alias);
            }
            if (privKeyEntry != null) {
                privKey = privKeyEntry.getPrivateKey();
                certs = privKeyEntry.getCertificateChain();
            }
        } else if (req instanceof PrivateKeyCallback.IssuerSerialNumRequest) {
            PrivateKeyCallback.IssuerSerialNumRequest isReq = (PrivateKeyCallback.IssuerSerialNumRequest) req;
            X500Principal issuer = isReq.getIssuer();
            BigInteger serialNum = isReq.getSerialNum();
            if (issuer != null && serialNum != null) {
                boolean found = false;
                for (int i = 0; i < kstores.length && !found; i++) {
                    Enumeration aliases = kstores[i].aliases();
                    while (aliases.hasMoreElements() && !found) {
                        String nextAlias = (String) aliases.nextElement();
                        PrivateKey key = secSup.getPrivateKeyForAlias(nextAlias, i);
                        if (key != null) {
                            Certificate[] certificates = kstores[i].getCertificateChain(nextAlias);
                            // check issuer/serial
                            X509Certificate eeCert = (X509Certificate) certificates[0];
                            if (eeCert.getIssuerX500Principal().equals(issuer) && eeCert.getSerialNumber().equals(serialNum)) {
                                privKey = key;
                                certs = certificates;
                                found = true;
                            }
                        }
                    }
                }
            }
        } else if (req instanceof PrivateKeyCallback.SubjectKeyIDRequest) {
            PrivateKeyCallback.SubjectKeyIDRequest skReq = (PrivateKeyCallback.SubjectKeyIDRequest) req;
            byte[] subjectKeyID = skReq.getSubjectKeyID();
            if (subjectKeyID != null) {
                boolean found = false;
                // In DER, subjectKeyID will be an OCTET STRING of OCTET STRING
                DerValue derValue1 = new DerValue(DerValue.tag_OctetString, subjectKeyID);
                DerValue derValue2 = new DerValue(DerValue.tag_OctetString, derValue1.toByteArray());
                byte[] derSubjectKeyID = derValue2.toByteArray();
                for (int i = 0; i < kstores.length && !found; i++) {
                    Enumeration aliases = kstores[i].aliases();
                    while (aliases.hasMoreElements() && !found) {
                        String nextAlias = (String) aliases.nextElement();
                        PrivateKey key = secSup.getPrivateKeyForAlias(nextAlias, i);
                        if (key != null) {
                            Certificate[] certificates = kstores[i].getCertificateChain(nextAlias);
                            X509Certificate eeCert = (X509Certificate) certificates[0];
                            // Extension: SubjectKeyIdentifier
                            byte[] derSubKeyID = eeCert.getExtensionValue(SUBJECT_KEY_IDENTIFIER_OID);
                            if (derSubKeyID != null && Arrays.equals(derSubKeyID, derSubjectKeyID)) {
                                privKey = key;
                                certs = certificates;
                                found = true;
                            }
                        }
                    }
                }
            }
        } else if (req instanceof PrivateKeyCallback.DigestRequest) {
            PrivateKeyCallback.DigestRequest dReq = (PrivateKeyCallback.DigestRequest) req;
            byte[] digest = dReq.getDigest();
            String algorithm = dReq.getAlgorithm();
            PrivateKeyEntry privKeyEntry = null;
            if (digest == null) {
                // get default key
                privKeyEntry = getDefaultPrivateKeyEntry(kstores);
            } else {
                if (algorithm == null) {
                    algorithm = DEFAULT_DIGEST_ALGORITHM;
                }
                MessageDigest md = MessageDigest.getInstance(algorithm);
                privKeyEntry = getPrivateKeyEntry(kstores, md, digest);
            }
            if (privKeyEntry != null) {
                privKey = privKeyEntry.getPrivateKey();
                certs = privKeyEntry.getCertificateChain();
            }
        } else {
            if (_logger.isLoggable(Level.FINE)) {
                _logger.log(Level.FINE, "invalid request type: " + req.getClass().getName());
            }
        }
    } catch (Exception e) {
        // KeyStoreException
        if (_logger.isLoggable(FINE)) {
            _logger.log(FINE, "JASPIC: In PrivateKeyCallback Processor: " + " Error reading key !", e);
        }
    } finally {
        privKeyCallback.setKey(privKey, certs);
    }
}