[java-support] branch main updated: JSPT-117 - Add warning to basic key strategy for outdated resource

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-support.

View the commit online:
http://git.shibboleth.net/view/?p=java-support.git;a=commit;h=3a86919c64ead1984b38d9b9a0ed473e97616a80

The following commit(s) were added to refs/heads/main by this push:
     new 3a86919  JSPT-117 - Add warning to basic key strategy for outdated resource
3a86919 is described below

commit 3a86919c64ead1984b38d9b9a0ed473e97616a80
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Mar 2 14:28:05 2022 -0500

    JSPT-117 - Add warning to basic key strategy for outdated resource
    
    https://shibboleth.atlassian.net/browse/JSPT-117
---
 .../support/security/impl/BasicKeystoreKeyStrategy.java    | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/main/java/net/shibboleth/utilities/java/support/security/impl/BasicKeystoreKeyStrategy.java b/src/main/java/net/shibboleth/utilities/java/support/security/impl/BasicKeystoreKeyStrategy.java
index b81de3d..a868088 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/security/impl/BasicKeystoreKeyStrategy.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/security/impl/BasicKeystoreKeyStrategy.java
@@ -27,6 +27,8 @@ import java.security.NoSuchAlgorithmException;
 import java.security.UnrecoverableKeyException;
 import java.security.cert.CertificateException;
 import java.time.Duration;
+import java.time.Instant;
+import java.time.temporal.ChronoUnit;
 import java.util.Properties;
 import java.util.Timer;
 import java.util.TimerTask;
@@ -349,6 +351,18 @@ public class BasicKeystoreKeyStrategy extends AbstractInitializableComponent imp
                 return;
             }
             
+            if (defaultKey == null) {
+                // Check for outdated key.
+                try {
+                    final long lastModified = keyVersionResource.lastModified();
+                    if (lastModified < Instant.now().minus(30, ChronoUnit.DAYS).toEpochMilli()) {
+                        log.warn("Keystore version resource unmodified in 30 days, consider rotating key");
+                    }
+                } catch (final IOException e) {
+                    log.debug("Unable to obtain keystore version resource modification time");
+                }
+            }
+            
             try (final InputStream is = keyVersionResource.getInputStream()) {
                 // Refresh the key version and compare to the current one.
                 final Properties props = new Properties();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.