Package net.shibboleth.sp.credential.impl

Class X509CredentialStorageServiceResolver

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.sp.credential.AbstractOrderedCredentialResolver
net.shibboleth.sp.credential.AbstractStorageServiceCredentialResolver<X509Credential>
net.shibboleth.sp.credential.impl.X509CredentialStorageServiceResolver
All Implemented Interfaces:
Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent, Resolver<Credential,CriteriaSet>, OrderedCredentialResolver, CredentialResolver, Ordered
public class X509CredentialStorageServiceResolver extends AbstractStorageServiceCredentialResolver<X509Credential>
A specialized storage-based resolver that can resolve the X509Credential type.

Additional settings are required to specify how to locate the various components such as the private key and certificate(s). A key password may be configured but must be usable for any resolved keys.

The private key and certificate(s) must be stored separately for this implementation in DER or PEM fornat but cannot be binary-encoded.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • privateKeyTemplateString

      @Nonnull private String privateKeyTemplateString
      Template used to construct the storage key for the private key.

    • certificateTemplateString

      @Nonnull private String certificateTemplateString
      Template used to construct the storage key for the public key certificate(s).

    • crlTemplateString

      @Nullable private String crlTemplateString
      Template used to construct the storage key for the CRL(s).

    • privateKeyPassword

      @Nullable private char[] privateKeyPassword
      Password for private key(s).

    • privateKeyTemplate

      @NonnullAfterInit Template privateKeyTemplate
      Velocity template for private key storage key.

    • certificateTemplate

      @NonnullAfterInit Template certificateTemplate
      Velocity template for certificate storage key.

    • crlTemplate

      @NonnullAfterInit Template crlTemplate
      Velocity template for CRL storage key.

  • Constructor Details

    • X509CredentialStorageServiceResolver

      public X509CredentialStorageServiceResolver()
      Constructor.

  • Method Details

    • setPrivateKeyTemplate

      public void setPrivateKeyTemplate(@Nonnull @NotEmpty String template)
      Sets the Velocity template string for the private key's storage key.

      Defaults to "sp${usage}.key", which punts any other decoration to the storage context.

      Parameters:
      template - template string

    • setCertificateTemplate

      public void setCertificateTemplate(@Nonnull @NotEmpty String template)
      Sets the Velocity template string for the certificate's storage key.

      Defaults to "sp${usage}.crt", which punts any other decoration to the storage context.

      Parameters:
      template - template string

    • setCRLTemplateString

      public void setCRLTemplateString(@Nullable @NotEmpty String template)
      Sets the Velocity template string for the CRL's storage key.

      Defaults to null, ignoring the CRL component.

      Parameters:
      template - template string

    • setPrivateKeyPassword

      public void setPrivateKeyPassword(@Nullable String password)
      Sets the private key password to apply to any resolved keys.
      Parameters:
      password - key password

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractStorageServiceCredentialResolver<X509Credential>
      Throws:
      ComponentInitializationException

    • doResolve

      @Nonnull @NotLive @Unmodifiable protected Iterable<Credential> doResolve(@Nonnull org.apache.velocity.VelocityContext velocityContext, @Nullable CriteriaSet criteria, @Nonnull String storageContext) throws ResolverException
      Perform the resolution as required for the specific type of Credential.

      Subclasses implement this by taking the supplied information and adjusting it if required to perform one or more storage lookups for information needed to construct the resolved credential(s).

      Most often, a single Credential (at most) will be returned as it is complex to store the information needed for multiple objects without some fairly exotic tricks, but this is left to the subclass to decide.

      Specified by:
      doResolve in class AbstractStorageServiceCredentialResolver<X509Credential>
      Parameters:
      velocityContext - Velocity context constructed from criteria
      criteria - input to resolver
      storageContext - evaluated storage context
      Returns:
      zero or more resolved credentials
      Throws:
      ResolverException - on errors, generally wrapped from storage service