Spring/spring-ws
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Configurable PKIXBuilderParameters for XWSS

Browse Source 
Allow customization of the PKIXBuilderParameters by having a factory
method for it. Also added a revocationEnabled flag, defaulting to false.

Issue: SWS-853
This commit is contained in:
Arjen Poutsma
2014-02-03 11:55:05 +01:00
parent 84a52e2bd5
commit 6620b1a39d
1 changed files with 34 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/KeyStoreCallbackHandler.java
View File

@@ -35,9 +35,6 @@ import java.util.Arrays;
import java.util.Enumeration;
import javax.crypto.SecretKey;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.ws.soap.security.support.KeyStoreUtils;
import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
import com.sun.xml.wss.impl.callback.DecryptionKeyCallback;
import com.sun.xml.wss.impl.callback.EncryptionKeyCallback;
@@ -45,6 +42,9 @@ import com.sun.xml.wss.impl.callback.SignatureKeyCallback;
import com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback;
import org.apache.xml.security.utils.RFC2253Parser;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.ws.soap.security.support.KeyStoreUtils;
/**
* Callback handler that uses Java Security <code>KeyStore</code>s to handle cryptographic callbacks. Allows for
* specific key stores to be set for various cryptographic operations.
@@ -124,6 +124,8 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
private char[] symmetricKeyPassword;
private boolean revocationEnabled = false;
private static X509Certificate getCertificate(String alias, KeyStore store) throws IOException {
try {
return (X509Certificate) store.getCertificate(alias);
@@ -214,7 +216,15 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
this.trustStore = trustStore;
}
public void afterPropertiesSet() throws Exception {
/**
* Determines if certificate revocation checking is enabled or not. Default is
* {@code false}.
*/
public void setRevocationEnabled(boolean revocationEnabled) {
this.revocationEnabled = revocationEnabled;
}
public void afterPropertiesSet() throws Exception {
if (keyStore == null) {
loadDefaultKeyStore();
}
@@ -601,6 +611,23 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
}
}
/**
* Creates a {@code PKIXBuilderParameters} instance with the given parameters.
* Default implementation simply instantiates one, without setting additional
* parameters.
*
* @param trustStore the trust store to use
* @param certSelector the certificate selector to use
* @return the builder parameters
* @throws GeneralSecurityException in case of errors
* @see #setRevocationEnabled(boolean)
*/
protected PKIXBuilderParameters createBuilderParameters(KeyStore trustStore, X509CertSelector certSelector)
throws GeneralSecurityException {
return new PKIXBuilderParameters(trustStore, certSelector);
}
//
// Inner classes
//
@@ -644,8 +671,8 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
PKIXBuilderParameters parameters;
CertPathBuilder builder;
try {
parameters = new PKIXBuilderParameters(trustStore, certSelector);
parameters.setRevocationEnabled(false);
parameters = createBuilderParameters(trustStore, certSelector);
parameters.setRevocationEnabled(revocationEnabled);
builder = CertPathBuilder.getInstance("PKIX");
}
catch (GeneralSecurityException ex) {
@@ -702,4 +729,5 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
}
}
}
}