[spring-extensions] branch main updated: JSE-42 - Fix PKCS11PrivateKeyFactoryBean under Java 11
Ian Young
ian at iay.org.uk
Thu Sep 24 15:58:36 UTC 2020
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch main
in repository spring-extensions.
View the commit online:
http://git.shibboleth.net/view/?p=spring-extensions.git;a=commit;h=a59192aebd2334001bcff44749ec0933dbcb5fce
The following commit(s) were added to refs/heads/main by this push:
new a59192a JSE-42 - Fix PKCS11PrivateKeyFactoryBean under Java 11
a59192a is described below
commit a59192aebd2334001bcff44749ec0933dbcb5fce
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Thu Sep 24 16:58:32 2020 +0100
JSE-42 - Fix PKCS11PrivateKeyFactoryBean under Java 11
https://issues.shibboleth.net/jira/browse/JSE-42
---
.../factory/PKCS11PrivateKeyFactoryBean.java | 21 +++----
.../factory/PKCS11PrivateKeyFactoryBeanTest.java | 70 ++++++++++++++++++++++
.../PKCS11PrivateKeyFactoryBean-softhsm.cfg | 8 +++
3 files changed, 85 insertions(+), 14 deletions(-)
diff --git a/src/main/java/net/shibboleth/ext/spring/factory/PKCS11PrivateKeyFactoryBean.java b/src/main/java/net/shibboleth/ext/spring/factory/PKCS11PrivateKeyFactoryBean.java
index 369d491..2430554 100644
--- a/src/main/java/net/shibboleth/ext/spring/factory/PKCS11PrivateKeyFactoryBean.java
+++ b/src/main/java/net/shibboleth/ext/spring/factory/PKCS11PrivateKeyFactoryBean.java
@@ -17,7 +17,6 @@
package net.shibboleth.ext.spring.factory;
-import java.lang.reflect.Constructor;
import java.security.GeneralSecurityException;
import java.security.KeyStore;
import java.security.KeyStore.PrivateKeyEntry;
@@ -39,8 +38,8 @@ import org.springframework.beans.factory.FactoryBean;
*/
public class PKCS11PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
- /** The class name for the PKCS#11 provider class. */
- private static final String PROVIDER_CLASS_NAME = "sun.security.pkcs11.SunPKCS11";
+ /** The name for the base PKCS#11 provider. */
+ private static final String UNCONFIGURED_PROVIDER_NAME = "SunPKCS11";
/** Singleton {@link Provider} for all instances of this factory. */
private static Provider provider;
@@ -124,18 +123,12 @@ public class PKCS11PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
*/
private Provider getProvider() throws Exception {
if (provider == null) {
- final ClassLoader loader = PKCS11PrivateKeyFactoryBean.class.getClassLoader();
- try {
- final Class<?> providerClass = loader.loadClass(PROVIDER_CLASS_NAME);
- final Constructor<?> providerConstructor = providerClass.getConstructor(String.class);
- provider = (Provider) providerConstructor.newInstance(pkcs11Config);
- Security.addProvider(provider);
- } catch (final ClassNotFoundException e) {
- throw new NoSuchProviderException("unable to load keystore provider class " + PROVIDER_CLASS_NAME);
- } catch (final NoSuchMethodException e) {
- throw new NoSuchProviderException("keystore provider class " + PROVIDER_CLASS_NAME
- + " does not provide a String-argument constructor ");
+ final var baseProvider = Security.getProvider(UNCONFIGURED_PROVIDER_NAME);
+ if (baseProvider == null) {
+ throw new NoSuchProviderException("could not acquire PKCS#11 bridge: " + UNCONFIGURED_PROVIDER_NAME);
}
+ provider = baseProvider.configure(pkcs11Config);
+ Security.addProvider(provider);
}
return provider;
}
diff --git a/src/test/java/net/shibboleth/ext/spring/factory/PKCS11PrivateKeyFactoryBeanTest.java b/src/test/java/net/shibboleth/ext/spring/factory/PKCS11PrivateKeyFactoryBeanTest.java
new file mode 100644
index 0000000..6a1ba93
--- /dev/null
+++ b/src/test/java/net/shibboleth/ext/spring/factory/PKCS11PrivateKeyFactoryBeanTest.java
@@ -0,0 +1,70 @@
+
+package net.shibboleth.ext.spring.factory;
+
+import java.security.Security;
+
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+/**
+ * Test class for {@link PKCS11PrivateKeyFactoryBean}.
+ *
+ * <p>
+ * It's really hard to provide tests for this bean that will run anywhere, because
+ * by definition it requires access to a PKCS#11 token, which is not something you'll
+ * find on any street corner.
+ * </p>
+ *
+ * <p>
+ * The approach taken here is to have one test for known prerequisites which should be
+ * true in all environments, and a number of (by default <em>disabled</em> tests
+ * exercising specific scenarios with specific tokens.
+ * </p>
+ */
+public class PKCS11PrivateKeyFactoryBeanTest {
+
+ /**
+ * Test universal prerequisites.
+ *
+ * @throws Exception if something bad happens
+ */
+ @Test
+ public void testPrerequisites() throws Exception {
+ final var p = Security.getProvider("SunPKCS11");
+ Assert.assertNotNull(p);
+ }
+
+ /**
+ * Test a specific SoftHSM deployment on Ian's desktop
+ * Mac.
+ *
+ * <p>
+ * Disabled by default because our normal test environment doesn't
+ * include this setup.
+ * </p>
+ *
+ * @throws Exception if something bad happens
+ */
+ @Test(enabled = false)
+ public void testSoftHSM() throws Exception {
+ // Locate the configuration file
+ final var configResource =
+ this.getClass().getResource("/net/shibboleth/ext/spring/factory/PKCS11PrivateKeyFactoryBean-softhsm.cfg");
+ final var configFile = configResource.getFile();
+
+ // Wire up the factory bean
+ final var fac = new PKCS11PrivateKeyFactoryBean();
+ fac.setPkcs11Config(configFile);
+ fac.setKeyPassword("1234");
+ fac.setKeyAlias("key2048");
+
+ // Fetch the private key from the resulting keystore
+ final var key = fac.getObject();
+ Assert.assertNotNull(key);
+
+ // Dig a little deeper. The key can't be extracted, but we can
+ // look at the algorithm.
+ Assert.assertEquals(key.getAlgorithm(), "RSA");
+ }
+
+}
diff --git a/src/test/resources/net/shibboleth/ext/spring/factory/PKCS11PrivateKeyFactoryBean-softhsm.cfg b/src/test/resources/net/shibboleth/ext/spring/factory/PKCS11PrivateKeyFactoryBean-softhsm.cfg
new file mode 100644
index 0000000..1024d0d
--- /dev/null
+++ b/src/test/resources/net/shibboleth/ext/spring/factory/PKCS11PrivateKeyFactoryBean-softhsm.cfg
@@ -0,0 +1,8 @@
+#
+# PKCS#11 provider configuration for for SoftHSM running under macOS.
+#
+# Note: this configuration assumes that SoftHSM has been installed using
+# the MacPorts system.
+#
+name = SoftHSM
+library = /opt/local/lib/softhsm/libsofthsm2.so
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list