com.sun.jini.discovery.internal
Class X500Provider

java.lang.Object
  extended by com.sun.jini.discovery.internal.BaseProvider
      extended by com.sun.jini.discovery.internal.X500Provider
All Implemented Interfaces:
DiscoveryFormatProvider
Direct Known Subclasses:
X500Client, X500Server

 class X500Provider
extends BaseProvider

Superclass for providers for the net.jini.discovery.x500.* discovery formats.


Nested Class Summary
(package private)  class X500Provider.SigningBufferFactory
          Buffer factory which signs data written into the buffers it dispenses.
 
Field Summary
private static AuthPermission authPermission
           
private  CertStore[] certStores
           
private static Pattern hostPortPattern
           
private static int INT_LEN
           
private static String JSSE
           
protected  String keyAlgorithm
          The key algorithm name (for example, "DSA").
protected  String keyAlgorithmOID
          The key algorithm OID.
(package private) static Logger logger
           
protected  int maxSignatureLength
          The maximum length of generated signatures, in bytes.
private static String NAME
           
protected  String signatureAlgorithm
          The signature algorithm (for example, "SHA1withDSA").
private  Object storeLock
           
private  KeyStore trustStore
           
 
Fields inherited from class com.sun.jini.discovery.internal.BaseProvider
formatName
 
Constructor Summary
X500Provider(String formatName, String signatureAlgorithm, int maxSignatureLength, String keyAlgorithm, String keyAlgorithmOID)
          Creates an instance with the given attributes.
 
Method Summary
private static boolean canGetSubject()
          Test whether the caller has AuthPermission("getSubject").
(package private)  void checkAuthenticationPermission(X500Principal principal, String action)
          If a security manager is installed, checks that the calling context has AuthenticationPermission for the given principal and action (with no peer principal specified).
private static void checkCertificate(X509Certificate cert)
          Throws a CertificateException if the given certificate is not currently valid, or specifies a KeyUsage extension which prohibits use in digital signatures.
private static ByteBuffer ensureArrayBacking(ByteBuffer buf)
          Returns given buffer if it is backed by an array; otherwise, returns a newly created array-backed buffer into which the remaining contents of the given buffer have been transferred.
protected  Certificate getCertificate(X500Principal principal)
          Returns certificate corresponding to the given principal, or null if no matching certificate can be found.
private  Certificate getCertificate0(X500Principal principal)
          Main body of getCertificate(), called from within a doPrivileged block.
(package private)  X500PrivateCredential[] getPrivateCredentials()
          Returns non-null array containing the usable X.500 private credentials of the current subject (if any).
private  Signature getSignature()
          Returns newly obtained Signature implementing the signature algorithm for this instance.
private  void initStores()
          Initializes trust store and cert stores based on system property values.
(package private) static void secureThrow(SecurityException detailedException, UnsupportedConstraintException genericException)
          Only throw non-generic exception if caller has getSubject permission.
private static Collection syncGetInstances(Collection coll, Class cl)
          Returns a new collection containing all instances of the specified class contained in the given collection.
(package private)  boolean verify(ByteBuffer data, ByteBuffer sig, PublicKey key)
          Returns true if the sig buffer contains the signature of the contents of the data buffer; returns false otherwise.
 
Methods inherited from class com.sun.jini.discovery.internal.BaseProvider
getFormatName
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

NAME

private static final String NAME
See Also:
Constant Field Values

JSSE

private static final String JSSE
See Also:
Constant Field Values

INT_LEN

private static final int INT_LEN
See Also:
Constant Field Values

hostPortPattern

private static final Pattern hostPortPattern

authPermission

private static final AuthPermission authPermission

logger

static final Logger logger

signatureAlgorithm

protected final String signatureAlgorithm
The signature algorithm (for example, "SHA1withDSA").


maxSignatureLength

protected final int maxSignatureLength
The maximum length of generated signatures, in bytes.


keyAlgorithm

protected final String keyAlgorithm
The key algorithm name (for example, "DSA").


keyAlgorithmOID

protected final String keyAlgorithmOID
The key algorithm OID.


trustStore

private KeyStore trustStore

certStores

private CertStore[] certStores

storeLock

private final Object storeLock
Constructor Detail

X500Provider

X500Provider(String formatName,
             String signatureAlgorithm,
             int maxSignatureLength,
             String keyAlgorithm,
             String keyAlgorithmOID)
Creates an instance with the given attributes.

Method Detail

getCertificate

protected Certificate getCertificate(X500Principal principal)
                              throws IOException,
                                     GeneralSecurityException
Returns certificate corresponding to the given principal, or null if no matching certificate can be found. Subclasses can override this method to customize the certificate search mechanism.

The default implementation of this method does the following: the first time this method is called on this instance, a keystore containing trust anchors for the certificate to return is loaded. The location of the file to load the keystore from can be specified (in order of precedence) by the com.sun.jini.discovery.x500.trustStore and javax.net.ssl.trustStore system properties; if no location is specified, then the cacerts file in the lib/security subdirectory of the JDK installation directory is used. If specified, the location is treated as a URL. If no protocol is specified in the URL or it is an unknown protocol, then, the location is treated as a file name. Depending on which system property is used to specify the keystore location, the com.sun.jini.discovery.x500.trustStoreType and com.sun.jini.discovery.x500.trustStorePassword or javax.net.ssl.trustStoreType and javax.net.ssl.trustStorePassword system properties can be used to specify the type of the keystore and the password to use when loading it. If no keystore type is specified, then the type returned by KeyStore.getDefaultType() is used; if no password is specified, then no password is used when loading the keystore. Additionally, if the com.sun.jini.discovery.x500.ldapCertStores system property is set, its value is interpreted as a comma-separated list of "host[:port]" elements which are used to obtain references to LDAP-based CertStore instances.

For each call, the default implementation of this method creates a PKIX CertPathBuilder and calls its build method, passing as the argument a PKIXBuilderParameters instance initialized with the aforementioned keystore, CertStores (if any), and a CertSelector based on the provided X.500 principal and the key algorithm OID for this instance. If the build operation succeeds, the resulting certificate is returned.

Throws:
IOException
GeneralSecurityException

getPrivateCredentials

X500PrivateCredential[] getPrivateCredentials()
Returns non-null array containing the usable X.500 private credentials of the current subject (if any). This method does not check that the caller has AuthenticationPermission to use the credentials.


canGetSubject

private static boolean canGetSubject()
Test whether the caller has AuthPermission("getSubject").

Returns:
true if the caller has AuthPermission("getSubject"), false otherwise

secureThrow

static void secureThrow(SecurityException detailedException,
                        UnsupportedConstraintException genericException)
                 throws UnsupportedConstraintException
Only throw non-generic exception if caller has getSubject permission.

Parameters:
detailedException - the real SecurityException to be thrown if caller has the "getSubject" AuthPermission
genericException - the generic UnsupportedConstraintException to be thrown if caller does not have the "getSubject" AuthPermission
Throws:
UnsupportedConstraintException

checkAuthenticationPermission

void checkAuthenticationPermission(X500Principal principal,
                                   String action)
If a security manager is installed, checks that the calling context has AuthenticationPermission for the given principal and action (with no peer principal specified).


verify

boolean verify(ByteBuffer data,
               ByteBuffer sig,
               PublicKey key)
         throws SignatureException,
                InvalidKeyException,
                NoSuchAlgorithmException
Returns true if the sig buffer contains the signature of the contents of the data buffer; returns false otherwise. The passed in buffers will be modified in case they do not have a backing array.

Throws:
SignatureException
InvalidKeyException
NoSuchAlgorithmException

getCertificate0

private Certificate getCertificate0(X500Principal principal)
                             throws IOException,
                                    GeneralSecurityException
Main body of getCertificate(), called from within a doPrivileged block.

Throws:
IOException
GeneralSecurityException

initStores

private void initStores()
                 throws IOException,
                        GeneralSecurityException
Initializes trust store and cert stores based on system property values.

Throws:
IOException
GeneralSecurityException

getSignature

private Signature getSignature()
                        throws NoSuchAlgorithmException
Returns newly obtained Signature implementing the signature algorithm for this instance.

Throws:
NoSuchAlgorithmException

syncGetInstances

private static Collection syncGetInstances(Collection coll,
                                           Class cl)
Returns a new collection containing all instances of the specified class contained in the given collection. All operations on the given collection are performed while synchronized on the collection.


checkCertificate

private static void checkCertificate(X509Certificate cert)
                              throws CertificateException
Throws a CertificateException if the given certificate is not currently valid, or specifies a KeyUsage extension which prohibits use in digital signatures.

Throws:
CertificateException

ensureArrayBacking

private static ByteBuffer ensureArrayBacking(ByteBuffer buf)
Returns given buffer if it is backed by an array; otherwise, returns a newly created array-backed buffer into which the remaining contents of the given buffer have been transferred.



Copyright 2007-2010, multiple authors.
Licensed under the Apache License, Version 2.0, see the NOTICE file for attributions.