[jetty94-dta-ssl] branch master updated: Add option to expose trust store certificates as issuers.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository jetty94-dta-ssl.

View the commit online:
http://git.shibboleth.net/view/?p=jetty94-dta-ssl.git;a=commit;h=338035f3672af67663d9c372d6bec1158ef9294c

The following commit(s) were added to refs/heads/master by this push:
       new  338035f   Add option to expose trust store certificates as issuers.
338035f is described below

commit 338035f3672af67663d9c372d6bec1158ef9294c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon May 18 12:51:49 2020 -0400

    Add option to expose trust store certificates as issuers.
---
 .../DelegateToApplicationSslContextFactory.java    | 45 +++++++++++++++++++++-
 1 file changed, 44 insertions(+), 1 deletion(-)

diff --git a/src/main/java/net/shibboleth/utilities/jetty94/DelegateToApplicationSslContextFactory.java b/src/main/java/net/shibboleth/utilities/jetty94/DelegateToApplicationSslContextFactory.java
index e2bbcd9..baa12f0 100644
--- a/src/main/java/net/shibboleth/utilities/jetty94/DelegateToApplicationSslContextFactory.java
+++ b/src/main/java/net/shibboleth/utilities/jetty94/DelegateToApplicationSslContextFactory.java
@@ -18,16 +18,26 @@
 package net.shibboleth.utilities.jetty94;
 
 import java.security.KeyStore;
+import java.security.KeyStoreException;
 import java.security.cert.CRL;
+import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
+import java.util.ArrayList;
 import java.util.Collection;
+import java.util.Iterator;
+import java.util.List;
 
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.X509TrustManager;
 
+import org.eclipse.jetty.util.log.Log;
+
 /** A Jetty SSL context factory that delegates X.509 trust evaluation to the application. */
 public class DelegateToApplicationSslContextFactory extends org.eclipse.jetty.util.ssl.SslContextFactory.Server {
 
+    /** Whether to expose the certificates in the trust store as accepted issuers. */
+    private boolean advertiseIssuers;
+    
     /**
      * Constructor.
      * 
@@ -37,6 +47,17 @@ public class DelegateToApplicationSslContextFactory extends org.eclipse.jetty.ut
         setWantClientAuth(true);
         setValidateCerts(false);
     }
+    
+    /**
+     * Set whether to advertise the certificates in the trust store as accepted issuers.
+     * 
+     * <p>Defaults to false.</p>
+     * 
+     * @param flag flag to set
+     */
+    public void setAdvertiseIssuers(final boolean flag) {
+        advertiseIssuers = flag;
+    }
 
     /** {@inheritDoc} */
     @Override
@@ -53,7 +74,29 @@ public class DelegateToApplicationSslContextFactory extends org.eclipse.jetty.ut
 
             /** {@inheritDoc} */
             public X509Certificate[] getAcceptedIssuers() {
-                return new X509Certificate[] {};
+                
+                if (!advertiseIssuers || trustStore == null) {
+                    return new X509Certificate[] {};
+                }
+                
+                final List<X509Certificate> issuers = new ArrayList<>();
+                
+                try {
+                    final Iterator<String> aliases = trustStore.aliases().asIterator();
+                    while (aliases.hasNext()) {
+                        final String alias = aliases.next();
+                        if (trustStore.isCertificateEntry(alias)) {
+                            final Certificate cert = trustStore.getCertificate(aliases.next());
+                            if (cert instanceof X509Certificate) {
+                                issuers.add((X509Certificate) cert);
+                            }
+                        }
+                    }
+                } catch (final KeyStoreException e) {
+                    Log.getLogger(DelegateToApplicationSslContextFactory.class).warn(e);
+                }
+                
+                return issuers.toArray(new X509Certificate[issuers.size()]);
             }
         };
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.