[java-support] branch maint-7 updated: IDP-1275 - Deferred decryption of private key
Scott Cantor
cantor.2 at osu.edu
Thu Jul 26 19:49:08 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch maint-7
in repository java-support.
View the commit online:
http://git.shibboleth.net/view/?p=java-support.git;a=commit;h=a3cb8b0d561414c53b1b189503c68c14edb23d73
The following commit(s) were added to refs/heads/maint-7 by this push:
new a3cb8b0 IDP-1275 - Deferred decryption of private key
a3cb8b0 is described below
commit a3cb8b0d561414c53b1b189503c68c14edb23d73
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jul 26 19:49:05 2018 -0400
IDP-1275 - Deferred decryption of private key
https://issues.shibboleth.net/jira/browse/IDP-1275
Allow deferring access to secret key.
---
.../support/security/BasicKeystoreKeyStrategy.java | 46 +++++++++++++++-------
.../java/support/security/DataSealer.java | 29 +++++++++++---
2 files changed, 56 insertions(+), 19 deletions(-)
diff --git a/src/main/java/net/shibboleth/utilities/java/support/security/BasicKeystoreKeyStrategy.java b/src/main/java/net/shibboleth/utilities/java/support/security/BasicKeystoreKeyStrategy.java
index c2e8fec..4131ae8 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/security/BasicKeystoreKeyStrategy.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/security/BasicKeystoreKeyStrategy.java
@@ -148,10 +148,13 @@ public class BasicKeystoreKeyStrategy extends AbstractInitializableComponent imp
*
* @param password the keystore password
*/
- public void setKeystorePassword(@Nonnull @NotEmpty final String password) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- keystorePassword = Constraint.isNotNull(password, "Keystore password cannot be null");
+ public void setKeystorePassword(@Nullable final String password) {
+ synchronized(this) {
+ if (password != null && !password.isEmpty())
+ keystorePassword = password;
+ else
+ keystorePassword = null;
+ }
}
/**
@@ -171,10 +174,13 @@ public class BasicKeystoreKeyStrategy extends AbstractInitializableComponent imp
*
* @param password the encryption key password
*/
- public void setKeyPassword(@Nonnull @NotEmpty final String password) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- keyPassword = Constraint.isNotNull(password, "Key password cannot be null");
+ public void setKeyPassword(@Nullable final String password) {
+ synchronized(this) {
+ if (password != null && !password.isEmpty())
+ keyPassword = password;
+ else
+ keyPassword = null;
+ }
}
/**
@@ -213,13 +219,11 @@ public class BasicKeystoreKeyStrategy extends AbstractInitializableComponent imp
Constraint.isNotNull(keystoreType, "Keystore type cannot be null");
Constraint.isNotNull(keystoreResource, "Keystore resource cannot be null");
Constraint.isNotNull(keyVersionResource, "Key version resource cannot be null");
- Constraint.isNotNull(keystorePassword, "Keystore password cannot be null");
Constraint.isNotNull(keyAlias, "Key alias base cannot be null");
- Constraint.isNotNull(keyPassword, "Key password cannot be null");
} catch (final ConstraintViolationException e) {
throw new ComponentInitializationException(e);
}
-
+
updateDefaultKey();
} catch (final KeyException e) {
@@ -267,20 +271,27 @@ public class BasicKeystoreKeyStrategy extends AbstractInitializableComponent imp
ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
synchronized(this) {
- return new Pair<>(currentAlias, defaultKey);
+ if (defaultKey != null) {
+ return new Pair<>(currentAlias, defaultKey);
+ } else {
+ throw new KeyException("Passwords not supplied, keystore is locked");
+ }
}
}
/** {@inheritDoc} */
@Override
@Nonnull public SecretKey getKey(@Nonnull @NotEmpty final String name) throws KeyException {
-
synchronized(this) {
if (defaultKey != null && name.equals(currentAlias)) {
return defaultKey;
}
+
+ if (keystorePassword == null || keyPassword == null) {
+ throw new KeyException("Passwords not supplied, keystore is locked");
+ }
}
-
+
try {
final KeyStore ks = KeyStore.getInstance(keystoreType);
ks.load(keystoreResource.getInputStream(), keystorePassword.toCharArray());
@@ -310,6 +321,12 @@ public class BasicKeystoreKeyStrategy extends AbstractInitializableComponent imp
private void updateDefaultKey() throws KeyException {
synchronized(this) {
+
+ if (keystorePassword == null || keyPassword == null) {
+ log.info("Passwords not supplied, keystore left locked");
+ return;
+ }
+
try (final InputStream is = keyVersionResource.getInputStream()) {
// Refresh the key version and compare to the current one.
final Properties props = new Properties();
@@ -340,6 +357,7 @@ public class BasicKeystoreKeyStrategy extends AbstractInitializableComponent imp
throw new KeyException(e);
}
}
+
}
}
\ No newline at end of file
diff --git a/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java b/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
index e106458..54495f5 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
@@ -67,6 +67,9 @@ public class DataSealer extends AbstractInitializableComponent {
/** Class logger. */
@Nonnull private Logger log = LoggerFactory.getLogger(DataSealer.class);
+ /** Whether the key source is expected to be locked initially. */
+ private boolean lockedAtStartup;
+
/** Source of keys. */
@NonnullAfterInit private DataSealerKeyStrategy keyStrategy;
@@ -79,7 +82,22 @@ public class DataSealer extends AbstractInitializableComponent {
/** Decodes encrypted string to bytes. */
@Nonnull private BinaryDecoder decoder = (Base64) encoder;
-
+ /**
+ * Set whether the key source is expected to be locked at startup, and unlocked
+ * later at runtime.
+ *
+ * <p>Defaults to false.</p>
+ *
+ * @param flag flag to set
+ *
+ * @since 7.4.0
+ */
+ public void setLockedAtStartup(final boolean flag) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ lockedAtStartup = flag;
+ }
+
/**
* Set the key strategy.
*
@@ -122,6 +140,7 @@ public class DataSealer extends AbstractInitializableComponent {
}
/** {@inheritDoc} */
+ @Override
public void doInitialize() throws ComponentInitializationException {
try {
try {
@@ -134,10 +153,10 @@ public class DataSealer extends AbstractInitializableComponent {
random = new SecureRandom();
}
- final SecretKey initialKey = keyStrategy.getDefaultKey().getSecond();
-
- // Before we finish initialization, make sure that things are working.
- testEncryption(initialKey);
+ if (!lockedAtStartup) {
+ // Before we finish initialization, make sure that things are working.
+ testEncryption(keyStrategy.getDefaultKey().getSecond());
+ }
} catch (final KeyException e) {
log.error(e.getMessage());
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list