/**
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at
* https://opensso.dev.java.net/public/CDDLv1.0.html or
* opensso/legal/CDDLv1.0.txt
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file
* at opensso/legal/CDDLv1.0.txt.
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*
* $Id: KeyUtil.java,v 1.5 2009/06/08 23:41:03 madan_ranganath Exp $
*
* Portions Copyrighted 2013-2014 ForgeRock AS
*/
package com.sun.identity.federation.key;
import java.util.Map;
import java.util.List;
import java.util.Hashtable;
import java.util.Iterator;
import java.io.ByteArrayInputStream;
import java.security.cert.CertificateFactory;
import java.security.PublicKey;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;
import org.apache.xml.security.encryption.XMLCipher;
import com.sun.identity.common.SystemConfigurationUtil;
import com.sun.identity.federation.common.FSUtils;
import com.sun.identity.federation.common.IFSConstants;
import com.sun.identity.federation.jaxb.entityconfig.BaseConfigType;
import com.sun.identity.federation.meta.IDFFMetaUtils;
import com.sun.identity.liberty.ws.common.jaxb.xmlsig.KeyInfoType;
import com.sun.identity.liberty.ws.common.jaxb.xmlsig.X509DataElement;
import com.sun.identity.liberty.ws.meta.jaxb.ProviderDescriptorType;
import com.sun.identity.liberty.ws.meta.jaxb.KeyDescriptorType;
import com.sun.identity.saml.common.SAMLConstants;
import com.sun.identity.saml.xmlsig.KeyProvider;
/**
* The <code>KeyUtil</code> provides methods to obtain
* the hosting entity's signing key and decryption key, and
* to obtain a partner entity's signature verification key
* and encryption related information
*/
public class KeyUtil {
private static KeyProvider kp = null;
// key is EntityID|Role
// value is EncInfo
public static Hashtable encHash = new Hashtable();
// key is EntityID|Role
// value is X509Certificate
protected static Hashtable sigHash = new Hashtable();
static {
try {
kp = (KeyProvider)Class.forName(SystemConfigurationUtil.getProperty(
SAMLConstants.KEY_PROVIDER_IMPL_CLASS,
SAMLConstants.JKS_KEY_PROVIDER)).newInstance();
} catch (ClassNotFoundException cnfe) {
FSUtils.debug.error(
"KeyUtil static block:" +
" Couldn't find the class.",
cnfe);
kp = null;
} catch (InstantiationException ie) {
FSUtils.debug.error(
"KeyUtil static block:" +
" Couldn't instantiate the key provider instance.",
ie);
kp = null;
} catch (IllegalAccessException iae) {
FSUtils.debug.error(
"KeyUtil static block:" +
" Couldn't access the default constructor.",
iae);
kp = null;
}
}
private KeyUtil() {
}
/**
* Returns the instance of <code>KeyProvider</code>.
* @return <code>KeyProvider</code>
*/
public static KeyProvider getKeyProviderInstance() {
return kp;
}
/**
* Returns the host entity's signing certificate alias.
* @param baseConfig <code>BaseConfigType</code> for the host entity
* @return <code>String</code> for host entity's signing
* certificate alias
*/
public static String getSigningCertAlias(BaseConfigType baseConfig) {
Map map = IDFFMetaUtils.getAttributes(baseConfig);
List list = (List)map.get(IFSConstants.SIGNING_CERT_ALIAS);
if ((list != null) && (!list.isEmpty())) {
String alias = (String)list.get(0);
if ((alias != null) && (alias.length() != 0) && (kp != null)) {
return alias;
}
}
return null;
}
/**
* Returns the host entity's decryption key.
* @param baseConfig <code>BaseConfigType</code> for the host entity
* @return <code>PrivateKey</code> for decrypting a message received
* by the host entity
*/
public static PrivateKey getDecryptionKey(BaseConfigType baseConfig) {
Map map = IDFFMetaUtils.getAttributes(baseConfig);
List list = (List)map.get(IFSConstants.ENCRYPTION_CERT_ALIAS);
PrivateKey decryptionKey = null;
if ((list != null) && (!list.isEmpty())) {
String alias = (String)list.get(0);
if ((alias != null) && (alias.length() != 0) && (kp != null)) {
decryptionKey = kp.getPrivateKey(alias);
}
}
return decryptionKey;
}
/**
* Returns the partner entity's signature verification certificate.
* @param providerDescriptor <code>ProviderDescriptorType</code> for
* the partner entity
* @param entityID partner entity's ID
* @param isIDP whether partner entity's role is IDP or SP
* @return <code>X509Certificate</code> for verifying the partner
* entity's signature
*/
public static X509Certificate getVerificationCert(
ProviderDescriptorType providerDescriptor, String entityID,
boolean isIDP) {
String role = (isIDP) ? "idp":"sp";
if (FSUtils.debug.messageEnabled()) {
FSUtils.debug.message("KeyUtil.getVerificationCert: " +
"Entering... \nEntityID=" + entityID + "\nRole=" + role);
}
// first try to get it from cache
String index = entityID.trim() + "|" + role;
X509Certificate cert = (X509Certificate)sigHash.get(index);
if (cert != null) {
return cert;
}
// else get it from meta
if (providerDescriptor == null) {
FSUtils.debug.error("KeyUtil.getVerificationCert: " +
"Null ProviderDescriptorType input for entityID=" +
entityID + " in " + role + " role.");
return null;
}
KeyDescriptorType kd =
getKeyDescriptor(providerDescriptor, "signing");
if (kd == null) {
FSUtils.debug.error("KeyUtil.getVerificationCert: " +
"No signing KeyDescriptor for entityID=" +
entityID + " in " + role + " role.");
return null;
}
cert = getCert(kd);
if (cert == null) {
FSUtils.debug.error("KeyUtil.getVerificationCert: " +
"No signing cert for entityID=" +
entityID + " in " + role + " role.");
return null;
}
sigHash.put(index, cert);
return cert;
}
/**
* Returns the encryption information which will be used in
* encrypting messages intended for the partner entity.
* @param providerDescriptor <code>ProviderDescriptorType</code> for
* the partner entity
* @param entityID partner entity's ID
* @param isIDP whether partner entity's role is IDP or SP
* @return <code>EncInfo</code> which includes partner entity's
* public key for wrapping the secret key, data encryption algorithm,
* and data encryption strength
*/
public static EncInfo getEncInfo(ProviderDescriptorType providerDescriptor,
String entityID, boolean isIDP) {
String role = (isIDP) ? "idp":"sp";
if (FSUtils.debug.messageEnabled()) {
FSUtils.debug.message("KeyUtil.getEncInfo: " +
"Entering... \nEntityID=" + entityID + "\nRole="+role);
}
// first try to get it from cache
String index = entityID.trim()+"|"+role;
EncInfo encInfo = (EncInfo)encHash.get(index);
if (encInfo != null) {
return encInfo;
}
// else get it from meta
if (providerDescriptor == null) {
FSUtils.debug.error("KeyUtil.getEncInfo: " +
"Null ProviderDescriptorType input for entityID=" +
entityID + " in " + role + " role.");
return null;
}
KeyDescriptorType kd =
getKeyDescriptor(providerDescriptor, "encryption");
if (kd == null) {
FSUtils.debug.error("KeyUtil.getEncInfo: " +
"No encryption KeyDescriptor for entityID=" +
entityID + " in " + role + " role.");
return null;
}
X509Certificate cert = getCert(kd);
if (cert == null) {
FSUtils.debug.error("KeyUtil.getEncInfo: " +
"No encryption cert for entityID=" +
entityID + " in " + role + " role.");
return null;
}
String algorithm = kd.getEncryptionMethod();
int keySize = kd.getKeySize().intValue();
if ((algorithm == null) || (algorithm.length() == 0)) {
algorithm = XMLCipher.AES_128;
keySize = 128;
}
PublicKey pk = cert.getPublicKey();
if (pk != null) {
encInfo = new EncInfo(pk, algorithm, keySize);
}
if (encInfo != null) {
encHash.put(index, encInfo);
}
return encInfo;
}
/**
* Returns <code>KeyDescriptorType</code> from
* <code>ProviderDescriptorType</code>.
* @param providerDescriptor <code>ProviderDescriptorType</code> which
* contains <code>KeyDescriptor</code>s.
* @param usage type of the <code>KeyDescriptorType</code> to be retrieved.
* Its value is "encryption" or "signing".
* @return KeyDescriptorType in <code>ProviderDescriptorType</code> that
* matched the usage type.
*/
public static KeyDescriptorType getKeyDescriptor(
ProviderDescriptorType providerDescriptor, String usage) {
if (providerDescriptor == null) {
return null;
}
List list = providerDescriptor.getKeyDescriptor();
Iterator iter = list.iterator();
KeyDescriptorType kd = null;
String use = null;
KeyDescriptorType noUsageKD = null;
while (iter.hasNext()) {
kd = (KeyDescriptorType)iter.next();
use = kd.getUse();
if ((use == null) || (use.trim().length() == 0)) {
if (noUsageKD == null) {
noUsageKD = kd;
}
continue;
}
if (use.trim().toLowerCase().equals(usage)) {
break;
} else {
kd = null;
}
}
if (kd != null) {
return kd;
} else {
return noUsageKD;
}
}
/**
* Returns certificate stored in <code>KeyDescriptorType</code> in
* <code>ProviderDescriptorType</code>.
* @param providerDescriptor <code>ProviderDescriptorType</code> which
* contains <code>KeyDescriptor</code>s.
* @param usage type of the <code>KeyDescriptorType</code> to be retrieved.
* Its value is "encryption" or "signing".
* @return X509Certificate contained in <code>KeyDescriptorType</code>; or
* <code>null</code> if no certificate is included.
*/
public static X509Certificate getCert(
ProviderDescriptorType providerDescriptor, String usage) {
return getCert(getKeyDescriptor(providerDescriptor, usage));
}
/**
* Returns certificate stored in <code>KeyDescriptorType</code>.
* @param kd <code>KeyDescriptorType</code> which contains certificate info
* @return X509Certificate contained in <code>KeyDescriptorType</code>; or
* <code>null</code> if no certificate is included.
*/
public static X509Certificate getCert(KeyDescriptorType kd) {
if (kd == null) {
return null;
}
KeyInfoType ki = kd.getKeyInfo();
if (ki == null) {
FSUtils.debug.error("KeyUtil.getCert: No KeyInfo.");
return null;
}
X509DataElement data = (X509DataElement) ki.getContent().get(0);
byte[] bt =
((com.sun.identity.liberty.ws.common.jaxb.xmlsig.X509DataType.X509Certificate)
data.getX509IssuerSerialOrX509SKIOrX509SubjectName().get(0)).
getValue();
CertificateFactory cf = null;
try {
cf = CertificateFactory.getInstance("X.509");
} catch (java.security.cert.CertificateException ce) {
FSUtils.debug.error("KeyUtil.getCert: " +
"Unable to get CertificateFactory for X.509 type", ce);
return null;
}
ByteArrayInputStream bais = new ByteArrayInputStream(bt);
X509Certificate retCert = null;
try {
while (bais.available() > 0) {
retCert = (X509Certificate)cf.generateCertificate(bais);
}
} catch (java.security.cert.CertificateException ce) {
FSUtils.debug.error("KeyUtil.getCert: " +
"Unable to generate certificate from byte "+
"array input stream.", ce);
return null;
}
return retCert;
}
}