Package net.shibboleth.metadata.validate.x509

Class X509RSAOpenSSLKeylistValidator

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.metadata.validate.BaseValidator
net.shibboleth.metadata.validate.x509.AbstractX509Validator
net.shibboleth.metadata.validate.x509.X509RSAOpenSSLKeylistValidator
All Implemented Interfaces:
Validator<X509Certificate>, net.shibboleth.shared.component.Component, net.shibboleth.shared.component.DestructableComponent, net.shibboleth.shared.component.IdentifiableComponent, net.shibboleth.shared.component.IdentifiedComponent, net.shibboleth.shared.component.InitializableComponent
@ThreadSafe public class X509RSAOpenSSLKeylistValidator extends AbstractX509Validator
Validator class to check RSA moduli in X.509 certificates against a list of OpenSSL-format keys.

Appropriate lists are available as part of the mda-keylists-rsa and mda-keylists-rsa-legacy modules.

Since:
0.10.0

  • Nested Class Summary

    Nested classes/interfaces inherited from interface net.shibboleth.metadata.validate.Validator

    Validator.Action

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private final Set<String>
    digestValues
    Set of digest values checked by this validator.
    private Resource
    keylistResource
    Resource that provides the list of keys.
    private int
    keySize
    Restrict checking to a given key size.
    private static final byte[]
    OPEN_SSL_PREFIX
    Sequence of bytes put on the front of the string to be hashed.

  • Constructor Summary

    Constructors
    Constructor
    Description
    X509RSAOpenSSLKeylistValidator()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    protected void
    doDestroy()
     
    protected void
    doInitialize()
     
    void
    doValidate(X509Certificate cert, Item<?> item, String callerId)
    Apply the validator to the object in the given Item context.
    final Resource
    getBlacklistResource()
    Deprecated, for removal: This API element is subject to removal in a future version.
    final Resource
    getKeylistResource()
    Gets the resource that provides the keylist.
    final int
    getKeySize()
    Gets the key size restriction for this list.
    private String
    openSSLDigest(BigInteger modulus)
    Computes the OpenSSL digest value for the given modulus.
    void
    setBlacklistResource(Resource resource)
    Deprecated, for removal: This API element is subject to removal in a future version.
    void
    setKeylistResource(Resource resource)
    Sets the resource that provides the keylist.
    void
    setKeySize(int size)
    Sets a key size restriction for this list.

    Methods inherited from class net.shibboleth.metadata.validate.x509.AbstractX509Validator

    validate

    Methods inherited from class net.shibboleth.metadata.validate.BaseValidator

    addError, addErrorMessage, addErrorMessage, addErrorMessage, addStatus, addWarning, getMessage, makeComponentId, setMessage

    Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

    setId

    Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

    ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

    Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

    checkComponentActive, checkSetterPreconditions, destroy, initialize, isDestroyed, isInitialized

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface net.shibboleth.shared.component.DestructableComponent

    destroy, isDestroyed

    Methods inherited from interface net.shibboleth.shared.component.IdentifiableComponent

    setId

    Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

    getId

    Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

    initialize, isInitialized

    Methods inherited from interface net.shibboleth.metadata.validate.Validator

    validate

  • Field Details

    • OPEN_SSL_PREFIX

      private static final byte[] OPEN_SSL_PREFIX
      Sequence of bytes put on the front of the string to be hashed.

    • keylistResource

      @NonnullAfterInit private Resource keylistResource
      Resource that provides the list of keys.

    • keySize

      private int keySize
      Restrict checking to a given key size. Default: no restriction (0).

    • digestValues

      @Nonnull private final Set<String> digestValues
      Set of digest values checked by this validator.

  • Constructor Details

    • X509RSAOpenSSLKeylistValidator

      public X509RSAOpenSSLKeylistValidator()

  • Method Details

    • getKeylistResource

      @NonnullAfterInit public final Resource getKeylistResource()
      Gets the resource that provides the keylist.
      Returns:
      resource that provides the keylist
      Since:
      0.10.0

    • setKeylistResource

      public void setKeylistResource(@Nonnull Resource resource)
      Sets the resource that provides the keylist.
      Parameters:
      resource - resource that provides the keylist
      Since:
      0.10.0

    • getBlacklistResource

      @Deprecated(since="0.10.0", forRemoval=true) @NonnullAfterInit public final Resource getBlacklistResource()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Gets the resource that provides the keylist.
      Returns:
      resource that provides the keylist

    • setBlacklistResource

      @Deprecated(since="0.10.0", forRemoval=true) public void setBlacklistResource(@Nonnull Resource resource)
      Deprecated, for removal: This API element is subject to removal in a future version.
      Sets the resource that provides the keylist.
      Parameters:
      resource - resource that provides the keylist

    • setKeySize

      public void setKeySize(int size)
      Sets a key size restriction for this list.
      Parameters:
      size - restricted key size, or 0 for no restriction

    • getKeySize

      public final int getKeySize()
      Gets the key size restriction for this list.
      Returns:
      restricted key size for this list, or 0 if no restriction

    • openSSLDigest

      @Nonnull private String openSSLDigest(@Nonnull BigInteger modulus) throws StageProcessingException
      Computes the OpenSSL digest value for the given modulus.
      Parameters:
      modulus - RSA public modulus to be digested
      Returns:
      value to be compared against the list
      Throws:
      StageProcessingException - if SHA1 digester can not be acquired, or for internal errors related to ByteArrayOutputStream

    • doValidate

      public void doValidate(@Nonnull X509Certificate cert, @Nonnull Item<?> item, @Nonnull String callerId) throws StageProcessingException
      Description copied from class: AbstractX509Validator
      Apply the validator to the object in the given Item context. The validator influences future processing by adding item metadata to the Item.
      Specified by:
      doValidate in class AbstractX509Validator
      Parameters:
      cert - the certificate to be validated
      item - the Item context for the validation
      callerId - a String identifying the caller
      Throws:
      StageProcessingException - if an error occurs during validation

    • doDestroy

      protected void doDestroy()
      Overrides:
      doDestroy in class net.shibboleth.shared.component.AbstractInitializableComponent

    • doInitialize

      protected void doInitialize() throws net.shibboleth.shared.component.ComponentInitializationException
      Overrides:
      doInitialize in class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
      Throws:
      net.shibboleth.shared.component.ComponentInitializationException