Package net.shibboleth.sp.credential.impl

Class X509KeyStoreStorageServiceResolver

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.sp.credential.AbstractOrderedCredentialResolver

net.shibboleth.sp.credential.AbstractStorageServiceCredentialResolver<X509Credential>

net.shibboleth.sp.credential.impl.X509KeyStoreStorageServiceResolver

All Implemented Interfaces:

Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent, Resolver<Credential,CriteriaSet>, OrderedCredentialResolver, CredentialResolver, Ordered

public class X509KeyStoreStorageServiceResolver
extends AbstractStorageServiceCredentialResolver<X509Credential>

A specialized storage-based resolver that can resolve the X509Credential type from a KeyStore, typically though not inherently the "PKCS12" type.

Additional settings are required to specify how to locate the various components such as the keystore data and alias to use. A keystore password may be configured but must be usable for any resolved keys.

Nested Class Summary

Nested classes/interfaces inherited from class net.shibboleth.sp.credential.AbstractOrderedCredentialResolver

AbstractOrderedCredentialResolver.UsageCriterionPredicate

Field Summary

Fields

Modifier and Type	Field	Description
(package private) Template	aliasTemplate	Velocity template for certificate storage key.
private String	aliasTemplateString	Template used to construct the keystore alias to load.
(package private) Template	keyStoreTemplate	Velocity template for keystore storage key.
private String	keyStoreTemplateString	Template used to construct the storage key for the keystore.
private String	keyStoreType	Keystore type.
private final org.slf4j.Logger	log	Class logger.
private char[]	privateKeyPassword	Password for private key(s).

Fields inherited from class net.shibboleth.sp.credential.AbstractStorageServiceCredentialResolver

CONTEXT_KEY_AGENT_ID, CONTEXT_KEY_APPLICATION_ID, CONTEXT_KEY_CRITERIA, CONTEXT_KEY_ENTITY_ID, CONTEXT_KEY_PRC, CONTEXT_KEY_PROTOCOL, CONTEXT_KEY_TX_ENTITY_ID, CONTEXT_KEY_USAGE, DEFAULT_CONTEXT_PREFIX

Fields inherited from interface org.springframework.core.Ordered

HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE

Constructor Summary

Constructors

Constructor	Description
X509KeyStoreStorageServiceResolver()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doInitialize()
protected Iterable<Credential>	doResolve(org.apache.velocity.VelocityContext velocityContext, CriteriaSet criteria, String storageContext)	Perform the resolution as required for the specific type of Credential.
void	setAliasTemplate(String template)	Sets the Velocity template string for the KeyStore alias to load.
void	setKeyStoreTemplate(String template)	Sets the Velocity template string for the keystore's storage key.
void	setKeyStoreType(String type)	Sets the KeyStore type.
void	setPassword(String password)	Sets the password to apply to the keystore and any resolved entries.

Methods inherited from class net.shibboleth.sp.credential.AbstractStorageServiceCredentialResolver

doResolve, getStorageService, getVelocityEngine, populateVelocityContext, setCacheEnabled, setContextTemplate, setEntityIDTransformStrategy, setExpireAfterAccess, setExpireAfterWrite, setMaximumCachedElements, setProtocolMap, setStorageService, setUsageMap, setVelocityEngine

Methods inherited from class net.shibboleth.sp.credential.AbstractOrderedCredentialResolver

getOrder, resolve, resolveSingle, setFilterByUsage, setOrder, setProtocols

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

keyStoreType

@Nonnull
private String keyStoreType

Keystore type.

keyStoreTemplateString

@Nonnull
private String keyStoreTemplateString

Template used to construct the storage key for the keystore.

aliasTemplateString

@Nonnull
private String aliasTemplateString

Template used to construct the keystore alias to load.

privateKeyPassword

@Nullable
private char[] privateKeyPassword

Password for private key(s).

keyStoreTemplate

@NonnullAfterInit
Template keyStoreTemplate

Velocity template for keystore storage key.

aliasTemplate

@NonnullAfterInit
Template aliasTemplate

Velocity template for certificate storage key.

Constructor Details

X509KeyStoreStorageServiceResolver

public X509KeyStoreStorageServiceResolver()

Constructor.

Method Details

setKeyStoreType

public void setKeyStoreType(@Nonnull @NotEmpty
 String type)

Sets the KeyStore type.

Defaults to "PKCS12".

Parameters:

type - keystore type

setKeyStoreTemplate

public void setKeyStoreTemplate(@Nonnull @NotEmpty
 String template)

Sets the Velocity template string for the keystore's storage key.

Defaults to "sp-keystore.p12", which punts any other decoration to the storage context and assumes a fixed keystore with potentially multiple key entries.

Parameters:

template - template string

setAliasTemplate

public void setAliasTemplate(@Nonnull @NotEmpty
 String template)

Sets the Velocity template string for the KeyStore alias to load.

Defaults to "${agentID}${usage}", which assumes per-Agent entries discriminated by usage.

Parameters:

template - template string

setPassword

public void setPassword(@Nullable
 String password)

Sets the password to apply to the keystore and any resolved entries.

Parameters:

password - keystore password

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractStorageServiceCredentialResolver<X509Credential>

Throws:

ComponentInitializationException

doResolve

@Nonnull
@NotLive
@Unmodifiable
protected Iterable<Credential> doResolve(@Nonnull
 org.apache.velocity.VelocityContext velocityContext,
 @Nullable
 CriteriaSet criteria,
 @Nonnull
 String storageContext)
                                  throws ResolverException

Perform the resolution as required for the specific type of Credential.

Subclasses implement this by taking the supplied information and adjusting it if required to perform one or more storage lookups for information needed to construct the resolved credential(s).

Most often, a single Credential (at most) will be returned as it is complex to store the information needed for multiple objects without some fairly exotic tricks, but this is left to the subclass to decide.

Specified by:

doResolve in class AbstractStorageServiceCredentialResolver<X509Credential>

Parameters:

velocityContext - Velocity context constructed from criteria

criteria - input to resolver

storageContext - evaluated storage context

Returns:

zero or more resolved credentials

Throws:

ResolverException - on errors, generally wrapped from storage service