[java-metadata-aggregator] 01/03: MDA-297 - Add a softhsm token

[Ian Young]

This is an automated email from the git hooks/post-receive script.

iay pushed a commit to branch main
in repository java-metadata-aggregator.

View the commit online:
http://git.shibboleth.net/view/?p=java-metadata-aggregator.git;a=commit;h=fcfdcf373538adbe64c679bcc953528dd15906df

commit fcfdcf373538adbe64c679bcc953528dd15906df
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Mon Oct 23 17:30:20 2023 +0100

    MDA-297 - Add a softhsm token
    
    https://shibboleth.atlassian.net/browse/MDA-297
---
 doc/wiki/.gitignore                       |  2 ++
 doc/wiki/make-keys.sh                     |  4 ++++
 doc/wiki/path/to/input/pkcs11-softhsm.cfg |  3 +++
 doc/wiki/setup-softhsm.sh                 | 22 ++++++++++++++++++++++
 4 files changed, 31 insertions(+)

diff --git a/doc/wiki/.gitignore b/doc/wiki/.gitignore
index b20e15d..944e8b6 100644
--- a/doc/wiki/.gitignore
+++ b/doc/wiki/.gitignore
@@ -2,5 +2,7 @@
 .rnd
 path/to/input/private-key.pem
 path/to/input/self-signed.pem
+path/to/input/self-signed.p12
 path/to/output/*
 !path/to/output/.gitkeep
+softhsm
diff --git a/doc/wiki/make-keys.sh b/doc/wiki/make-keys.sh
index 00a2b66..743ad60 100755
--- a/doc/wiki/make-keys.sh
+++ b/doc/wiki/make-keys.sh
@@ -2,6 +2,7 @@
 
 KEYFILE=path/to/input/private-key.pem
 CERTFILE=path/to/input/self-signed.pem
+P12FILE=path/to/input/self-signed.p12
 
 # Generate an RSA private key
 openssl genrsa >$KEYFILE
@@ -10,3 +11,6 @@ chmod 600 $KEYFILE
 # Generate a self-signed certificate based on that key
 openssl req -key $KEYFILE -new -x509 -days 365 -out $CERTFILE \
     -subj "/CN=test-self-signed"
+
+# Create PKCS12 keystore from private key and public certificate.
+openssl pkcs12 -export -name key10 -passout pass:password -in $CERTFILE -inkey $KEYFILE -out $P12FILE
diff --git a/doc/wiki/path/to/input/pkcs11-softhsm.cfg b/doc/wiki/path/to/input/pkcs11-softhsm.cfg
new file mode 100644
index 0000000..d569459
--- /dev/null
+++ b/doc/wiki/path/to/input/pkcs11-softhsm.cfg
@@ -0,0 +1,3 @@
+# PKCS#11 provider configuration for softhsm running under Amazon Linux
+name = softhsm
+library = /usr/lib64/pkcs11/libsofthsm2.so
diff --git a/doc/wiki/setup-softhsm.sh b/doc/wiki/setup-softhsm.sh
new file mode 100755
index 0000000..1543e0a
--- /dev/null
+++ b/doc/wiki/setup-softhsm.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/sh
+
+# Clear any previous softhsm setup
+rm -rf softhsm
+mkdir -p softhsm/tokens
+
+# Create configuration file
+export SOFTHSM2_CONF=$PWD/softhsm/softhsm2.conf
+echo "directories.tokendir = $PWD/softhsm/tokens" >$SOFTHSM2_CONF
+
+# Initialise the token
+softhsm2-util --init-token --slot 0 --label "test" \
+    --so-pin 1234 \
+    --pin 12341234
+
+# Load the credential
+keytool -importkeystore --addprovider SunPKCS11 -providerarg path/to/input/pkcs11-softhsm.cfg \
+    -srcstoretype pkcs12 -srckeystore path/to/input/self-signed.p12 -srcstorepass password \
+    -deststoretype PKCS11 -destkeystore NONE -deststorepass 12341234
+
+keytool -list --addprovider SunPKCS11 -providerarg path/to/input/pkcs11-softhsm.cfg \
+    -storetype PKCS11 -keystore NONE -storepass 12341234

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.