Examples with TruststoreProvider org.keycloak.truststore.TruststoreProvider used on opensource projects

Example 6 with TruststoreProvider

use of org.keycloak.truststore.TruststoreProvider in project keycloak by keycloak.

the class CertificateValidator method validateTrust.

public CertificateValidator validateTrust() throws GeneralSecurityException {
    if (!_trustValidationEnabled)
        return this;
    TruststoreProvider truststoreProvider = session.getProvider(TruststoreProvider.class);
    if (truststoreProvider == null || truststoreProvider.getTruststore() == null) {
        logger.error("Cannot validate client certificate trust: Truststore not available");
    } else {
        Set<X509Certificate> trustedRootCerts = truststoreProvider.getRootCertificates().entrySet().stream().map(t -> t.getValue()).collect(Collectors.toSet());
        Set<X509Certificate> trustedIntermediateCerts = truststoreProvider.getIntermediateCertificates().entrySet().stream().map(t -> t.getValue()).collect(Collectors.toSet());
        logger.debugf("Found %d trusted root certs, %d trusted intermediate certs", trustedRootCerts.size(), trustedIntermediateCerts.size());
        verifyCertificateTrust(_certChain, trustedRootCerts, trustedIntermediateCerts);
    }
    return this;
}

Example 7 with TruststoreProvider

use of org.keycloak.truststore.TruststoreProvider in project keycloak by keycloak.

the class CertificateValidator method findCAInTruststore.

private X509Certificate findCAInTruststore(X500Principal issuer) throws GeneralSecurityException {
    TruststoreProvider truststoreProvider = session.getProvider(TruststoreProvider.class);
    if (truststoreProvider == null || truststoreProvider.getTruststore() == null) {
        return null;
    }
    Map<X500Principal, X509Certificate> rootCerts = truststoreProvider.getRootCertificates();
    X509Certificate ca = rootCerts.get(issuer);
    if (ca == null) {
        // fallback to lookup the issuer from the list of intermediary CAs
        ca = truststoreProvider.getIntermediateCertificates().get(issuer);
    }
    if (ca != null) {
        ca.checkValidity();
    }
    return ca;
}

Example 8 with TruststoreProvider

use of org.keycloak.truststore.TruststoreProvider in project keycloak by keycloak.

the class CRLUtils method findCRLSignatureCertificateInTruststore.

private static X509Certificate findCRLSignatureCertificateInTruststore(KeycloakSession session, X509Certificate[] certs, X500Principal crlIssuerPrincipal) throws GeneralSecurityException {
    TruststoreProvider truststoreProvider = session.getProvider(TruststoreProvider.class);
    if (truststoreProvider == null || truststoreProvider.getTruststore() == null) {
        throw new GeneralSecurityException("Truststore not available");
    }
    Map<X500Principal, X509Certificate> rootCerts = truststoreProvider.getRootCertificates();
    Map<X500Principal, X509Certificate> intermediateCerts = truststoreProvider.getIntermediateCertificates();
    X509Certificate crlSignatureCertificate = intermediateCerts.get(crlIssuerPrincipal);
    if (crlSignatureCertificate == null) {
        crlSignatureCertificate = rootCerts.get(crlIssuerPrincipal);
    }
    if (crlSignatureCertificate == null) {
        throw new GeneralSecurityException("Not available certificate for CRL issuer '" + crlIssuerPrincipal + "' in the truststore, nor in the CA chain");
    } else {
        log.tracef("Found CRL issuer certificate with subject '%s' in the truststore. Verifying trust anchor", crlIssuerPrincipal);
    }
    // Check if CRL issuer has trust anchor with the checked certificate (See https://tools.ietf.org/html/rfc5280#section-6.3.3 , paragraph (f))
    Set<X500Principal> certificateCAPrincipals = Arrays.asList(certs).stream().map(X509Certificate::getSubjectX500Principal).collect(Collectors.toSet());
    // Remove the checked certificate itself
    certificateCAPrincipals.remove(certs[0].getSubjectX500Principal());
    X509Certificate currentCRLAnchorCertificate = crlSignatureCertificate;
    X500Principal currentCRLAnchorPrincipal = crlIssuerPrincipal;
    while (true) {
        if (certificateCAPrincipals.contains(currentCRLAnchorPrincipal)) {
            log.tracef("Found trust anchor of the CRL issuer '%s' in the CA chain. Anchor is '%s'", crlIssuerPrincipal, currentCRLAnchorPrincipal);
            break;
        }
        // Try to see the anchor
        currentCRLAnchorPrincipal = currentCRLAnchorCertificate.getIssuerX500Principal();
        currentCRLAnchorCertificate = intermediateCerts.get(currentCRLAnchorPrincipal);
        if (currentCRLAnchorCertificate == null) {
            currentCRLAnchorCertificate = rootCerts.get(currentCRLAnchorPrincipal);
        }
        if (currentCRLAnchorCertificate == null) {
            throw new GeneralSecurityException("Certificate for CRL issuer '" + crlIssuerPrincipal + "' available in the truststore, but doesn't have trust anchors with the CA chain.");
        }
    }
    return crlSignatureCertificate;
}