Attachment #28200 for bug #52500

View | Details | Raw Unified | Return to bug 52500
Collapse All | Expand All

Lines 191-194 Link Here

(-)org/apache/catalina/Realm.java (+6 lines)
191	public void removePropertyChangeListener(PropertyChangeListener listener);	191	public void removePropertyChangeListener(PropertyChangeListener listener);
192		192
193		193
		194	public void setX509UserIdentifierRetrieveField(String userIdentifierRetrieveField);
		195
		196	public void setX509UserIdentifierRetrieveFieldPart(String userIdentifierRetrieveFieldPart);
		197
		198	public void setX509UserIdentifierRetrieverClassName(String className);
		199
194	}	200	}

Line 0 Link Here

(-)org/apache/catalina/realm/UserIdentifierRetriever.java (+10 lines)
	1	/**
	2	* @author Michael Furman
	3	*/
	4	package org.apache.catalina.realm;
	5
	6	import java.security.cert.X509Certificate;
	7
	8	public interface UserIdentifierRetriever {
	9	String getUserIdentifier(X509Certificate clientCert);
	10	}




/**
 * @author Michael Furman
 */
package org.apache.catalina.realm;

import java.security.cert.X509Certificate;
import java.util.List;

import javax.naming.InvalidNameException;
import javax.naming.ldap.LdapName;
import javax.naming.ldap.Rdn;

import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;


public class SubjectDnRetriever implements UserIdentifierRetriever {
	/**
	 * Logger for this class
	 */
	protected final Log logger = LogFactory.getLog(getClass());	
	 

	
	private String subjectDnAttribute = null;
	private String subjectDnAttributeConfiguration = null;
	
    protected SubjectDnRetriever() {
        setSubjectDnAttribute(null);
    }

    protected SubjectDnRetriever(String retrieveAttr) {
        setSubjectDnAttribute(retrieveAttr);
    }
    
    public String getUserIdentifier(X509Certificate clientCert) {
		if (logger.isDebugEnabled()) {
			logger.debug("getUserIdentifier(X509Certificate) - start");
		}
		String subject = getSubjectDN(clientCert);
		String userIdentifier = null;
		if (subject != null) {
			if (logger.isDebugEnabled()) {
				logger.debug("Subject is [" + subject + "].");
			}
			if (subjectDnAttribute == null) {
				if (logger.isDebugEnabled()) {
					logger.debug("subjectDnAttribute is null, so return the whole subject.");
				}
				userIdentifier = subject;
			} else {
				try {
					boolean foundUserIdentifier = false;
					LdapName ldapName = new LdapName(subject);
					List<Rdn> list = ldapName.getRdns();
					if (list != null) {
						for (Rdn rdn : list) {
							String type = rdn.getType();
							if (subjectDnAttribute.equalsIgnoreCase(type.toString()))  {
								Object value = rdn.getValue();
								if (value instanceof String) {
									userIdentifier = (String) value;
									foundUserIdentifier = true;									
									if (logger.isDebugEnabled()) {
										logger.debug("Success to retreive userIdentifier [" + userIdentifier + "].");
									}
									break;
								}		
							}
						}
					}					
					if (!foundUserIdentifier) {
						if (logger.isDebugEnabled()) {
							logger.debug("subject [" + subject + "] does not contain the required attribute [" + subjectDnAttributeConfiguration + "].");
						}	
					}
				} catch (InvalidNameException e) {					
					logger.info("subject [" + subject + "] is not valid name : [" + e.getMessage() + "].");
				}				
			}
		}
		if (logger.isDebugEnabled()) {
			logger.debug("getUserIdentifier(X509Certificate) - end; Ret is [" + userIdentifier + "].");
		}
        return userIdentifier;
    }

    private void setSubjectDnAttribute(String subjectDnAttributeConfiguration) {
		if (logger.isDebugEnabled()) {
			logger.debug("setSubjectDnAttribute(String) - start; subjectDnAttribute [" +  subjectDnAttributeConfiguration + "].");
		}
		this.subjectDnAttributeConfiguration = subjectDnAttributeConfiguration;
		subjectDnAttribute = mapSubjectDnAttribute(subjectDnAttributeConfiguration);
		if (logger.isDebugEnabled()) {
			logger.debug("setSubjectDnAttribute(String) - end; subjectDnAttribute [" +  subjectDnAttribute + "]; subjectDnAttributeConfiguration [" +  subjectDnAttributeConfiguration + "]");
		}
    }
    
    

	private String  mapSubjectDnAttribute(String subjectDnAttributeConfiguration) {
		String ret = null;
		if (subjectDnAttributeConfiguration != null) {
			if (ClientCertificateConstants.EmailOptions.contains(subjectDnAttributeConfiguration.toLowerCase()))  {
				ret = ClientCertificateConstants.EMAIL_SUBJECT_ATTR;				
			} else {
				ret = subjectDnAttributeConfiguration;
			}
		}
		return ret;
	}

	protected String getSubjectDN(X509Certificate clientCert) {
		if (logger.isDebugEnabled()) {
			logger.debug("getSubjectDN(X509Certificate) - start");
		}
		String subject = null;
		if (clientCert != null) {
			if ((clientCert.getSubjectDN()!= null) 
					&& (clientCert.getSubjectDN().getName() != null)) {
					subject = clientCert.getSubjectDN().getName();
			}  else {
				if (logger.isDebugEnabled()) {
					logger.debug("Can not getSubjectDN, SubjectDN is null");
				}
			}
		} else {
			if (logger.isDebugEnabled()) {
				logger.debug("Can not getSubjectDN, clientCert is null");
			}
		}			
		if (logger.isDebugEnabled()) {
			logger.debug("getSubjectDN(X509Certificate) - end; Ret is [" + subject + "].");
		}
        return subject;
        
	}
}




/**
 * @author Michael Furman
 */
package org.apache.catalina.realm;

import java.util.Arrays;
import java.util.List;

public class ClientCertificateConstants {
	

	public enum UserIdentifierRetrieveField {
		SubjectDN, SubjectAlternativeName;		
		public boolean equals(final String str) {
			return name().equals(str);
		}
	}	

	
	public static final String EMAIL_SUBJECT_ATTR = "emailAddress";

		
	public enum SubjectAlternativeNameGeneralNames {
		
		otherName, // byte arrays containing the ASN.1 DER encoded form 
		rfc822Name, // String
		dNSName, // String
		x400Address, // byte arrays containing the ASN.1 DER encoded form 
		directoryName, // String: RFC 2253 string format
		ediPartyName, // byte arrays containing the ASN.1 DER encoded form 
		uniformResourceIdentifier, // String
		iPAddress, // String: IPv4 address - dotted quad notation, IPv6 address - form "a1:a2:...:a8"
		registeredID;
		
		public boolean equals(final String str) {
			return name().equals(str);
		}
		
		public boolean equalsIgnoreCase(final String str) {
			return name().equalsIgnoreCase(str);
		}
	}
	
	// !!! important - set value only in lower case !!!
	
	// SubjectDN
	public static final List<String> EmailOptions = Arrays.asList(EMAIL_SUBJECT_ATTR.toLowerCase(), "e") ;

	// Subject Alternative Name
	public static final List<String> OtherNameOptions = Arrays.asList("other name", "principalname", "principal name", "microsoft principal name") ;
	public static final List<String> RFC822NameOptions = Arrays.asList("rfc822 name", "rfc822name", "emailaddress", "email address", "e-mail address", "e-mailaddress") ;
	public static final List<String> DNSNameOptions = Arrays.asList("dns name", "dnsname") ;
	// x400Address - empty
	public static final List<String> DirectoryNameOptions = Arrays.asList("directory address", "directory address", "x500 name", "x500name", "x.500 name", "x.500name") ;
	// ediPartyName - empty
	public static final List<String> UriOptions = Arrays.asList("url", "uri") ;
	public static final List<String> IPAddressOptions = Arrays.asList("ip address", "ipaddress");
	public static final List<String> RegisteredIDOptions = Arrays.asList("registered id", "registeredid","registered oid", "registeredoid");

}




/**
 * @author Michael Furman
 */
package org.apache.catalina.realm;

import java.security.cert.X509Certificate;

import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;


public class DefaultSubjectDnRetriever implements UserIdentifierRetriever {
	/**
	 * Logger for this class
	 */
	protected final Log logger = LogFactory.getLog(getClass());	
    
    public String getUserIdentifier(X509Certificate clientCert) {
		if (logger.isDebugEnabled()) {
			logger.debug("getUserIdentifier(X509Certificate) - start");
		}
		String userIdentifier = clientCert.getSubjectDN().getName();
		if (logger.isDebugEnabled()) {
			logger.debug("getUserIdentifier(X509Certificate) - end; Ret is [" + userIdentifier + "].");
		}
        return userIdentifier;
    }

}




/**
 * @author Michael Furman
 */
package org.apache.catalina.realm;

import java.io.ByteArrayInputStream;
import java.security.cert.CertificateParsingException;
import java.security.cert.X509Certificate;
import java.util.Collection;
import java.util.Iterator;
import java.util.List;

import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;

import org.bouncycastle.asn1.ASN1InputStream;
import org.bouncycastle.asn1.ASN1Sequence;
import org.bouncycastle.asn1.ASN1TaggedObject;
import org.bouncycastle.asn1.DERObject;
import org.bouncycastle.asn1.DERUTF8String;


public class SubjectAlternativeNameRetriever extends SubjectDnRetriever {
	private static final int NOT_EXISTING_TYPE = -1;


	/**
	 * Logger for this class
	 */
	protected final Log logger = LogFactory.getLog(getClass());
	
	
	private String alternativeIdentifierConfiguration = null; 
   
	private int alternativeIdentifierTypeValue = NOT_EXISTING_TYPE; 

    protected SubjectAlternativeNameRetriever(String alternativeIdentifierConfiguration) {
        setSubjectAlternativeNameGeneralName(alternativeIdentifierConfiguration);
    }

    
    
    @SuppressWarnings("unchecked")
	public String getUserIdentifier(X509Certificate clientCert) {
		if (logger.isDebugEnabled()) {
			logger.debug("getUserIdentifier(X509Certificate) - start");
		}

		String userIdentifier = null;
		if (clientCert != null) {
			if (alternativeIdentifierTypeValue != NOT_EXISTING_TYPE) {
				boolean foundUserIdentifier = false;
				try {
					if (clientCert.getSubjectAlternativeNames() != null) {
						Collection subjectAlternativeNames = clientCert.getSubjectAlternativeNames();
						Iterator iter = subjectAlternativeNames.iterator();
						while (iter.hasNext()) {
							List subjectAlternativeName = (List) iter.next();
							Integer type = (Integer) subjectAlternativeName.get(0);
							if (type.intValue() == alternativeIdentifierTypeValue) {
								Object subjectAlternativeNameValue = subjectAlternativeName.get(1);
								if (subjectAlternativeNameValue instanceof String) {
									userIdentifier = (String) subjectAlternativeNameValue;
									foundUserIdentifier = true;					
									break;
								} else if (subjectAlternativeNameValue instanceof byte[]) {
									byte[] subjectAlternativeNameValueBytes = (byte[]) subjectAlternativeNameValue;
									userIdentifier = getStringFromASNDerEncodedByteArray(subjectAlternativeNameValueBytes);
									if (userIdentifier != null) {
										foundUserIdentifier = true;
										break;
									}
								} else {
									if (logger.isInfoEnabled()) {
										logger.info("Can not get UserIdentifier, the subjectAlternativeName not supported [" + subjectAlternativeNameValue + "].");
									}
								}
							}
						}
					}
				} catch (CertificateParsingException e) {
					logger.info("Can not get UserIdentifier, can not get subjectAlternativeNames from certificate [" + e.getMessage() + "].");
				}				
				if (foundUserIdentifier) {
					if (logger.isDebugEnabled()) {
						logger.debug("Found userIdentifier [" + userIdentifier + "] from part of subjectAlternativeName [" + alternativeIdentifierConfiguration + "].");
					}
				} else {
					if (logger.isDebugEnabled()) {
						logger.debug("Can not found userIdentifier as part of subjectAlternativeName [" + alternativeIdentifierConfiguration + "].");
					}
				}
				
			} else {
				if (logger.isDebugEnabled()) {
					logger.debug("Can not get UserIdentifier, generalName is null");
				}
			}
		} else {
			if (logger.isDebugEnabled()) {
				logger.debug("Can not get UserIdentifier, clientCert is null");
			}
		}
		if (logger.isDebugEnabled()) {
			logger.debug("getUserIdentifier(X509Certificate) - end; Ret is [" + userIdentifier + "].");
		}

		return userIdentifier;
	}



	

    private void setSubjectAlternativeNameGeneralName(String alternativeIdentifierConfiguration) {
		if (logger.isDebugEnabled()) {
			logger.debug("setSubjectAlternativeNameGeneralName(String) - start; alternativeIdentifier [" +  alternativeIdentifierConfiguration + "].");
		}
		this.alternativeIdentifierConfiguration = null;
		alternativeIdentifierTypeValue = NOT_EXISTING_TYPE;
		
		if (alternativeIdentifierConfiguration != null) {
			this.alternativeIdentifierConfiguration = alternativeIdentifierConfiguration;
			String alternativeIdentifierConfigurationLowerCase = alternativeIdentifierConfiguration.toLowerCase();
			if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.otherName.equalsIgnoreCase (alternativeIdentifierConfiguration)) 
					|| (ClientCertificateConstants.OtherNameOptions.contains(alternativeIdentifierConfigurationLowerCase))) {
				alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.otherName.ordinal();				
			} else if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.rfc822Name.equalsIgnoreCase (alternativeIdentifierConfiguration)) 
					|| (ClientCertificateConstants.RFC822NameOptions.contains(alternativeIdentifierConfigurationLowerCase))) {
				alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.rfc822Name.ordinal();				
			} else if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.dNSName.equalsIgnoreCase (alternativeIdentifierConfiguration)) 
					|| (ClientCertificateConstants.DNSNameOptions.contains(alternativeIdentifierConfigurationLowerCase))) {
				alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.dNSName.ordinal();				
			} else if (ClientCertificateConstants.SubjectAlternativeNameGeneralNames.x400Address.equalsIgnoreCase (alternativeIdentifierConfiguration)) {
				alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.x400Address.ordinal();				
			} else if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.directoryName.equalsIgnoreCase (alternativeIdentifierConfiguration)) 
					|| (ClientCertificateConstants.DirectoryNameOptions.contains(alternativeIdentifierConfigurationLowerCase))) {
				alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.directoryName.ordinal();				
			} else if (ClientCertificateConstants.SubjectAlternativeNameGeneralNames.ediPartyName.equalsIgnoreCase (alternativeIdentifierConfiguration)) {
				alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.ediPartyName.ordinal();				
			} else if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.uniformResourceIdentifier.equalsIgnoreCase (alternativeIdentifierConfiguration)) 
					|| (ClientCertificateConstants.UriOptions.contains(alternativeIdentifierConfigurationLowerCase))) {				
				alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.uniformResourceIdentifier.ordinal();				
			} else if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.iPAddress.equalsIgnoreCase (alternativeIdentifierConfiguration)) 
					|| (ClientCertificateConstants.IPAddressOptions.contains(alternativeIdentifierConfigurationLowerCase))) {					
				alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.iPAddress.ordinal();				
			} else if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.registeredID.equalsIgnoreCase (alternativeIdentifierConfiguration)) 
				|| (ClientCertificateConstants.RegisteredIDOptions.contains(alternativeIdentifierConfigurationLowerCase))) {									
				alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.registeredID.ordinal();				
			} else {
				try {
					alternativeIdentifierTypeValue = (new Integer(alternativeIdentifierConfiguration)).intValue();
				}catch (NumberFormatException e) {
					alternativeIdentifierTypeValue = NOT_EXISTING_TYPE;
				}
			}
		
		}
		if (logger.isDebugEnabled()) {
			logger.debug("setSubjectAlternativeNameGeneralName(String) - end; alternativeIdentifier [" +  alternativeIdentifierConfiguration + "], alternativeIdentifierType [" +  alternativeIdentifierTypeValue + "].");
		}
    }


	private String getStringFromASNDerEncodedByteArray(byte[] byteArray) {
		if (logger.isDebugEnabled()) {
			logger.debug("getStringFromASNDerEncodedByteArray(byte[]) - start");
		}

		String ret = null;
		try {	
			ASN1InputStream asn1InputStream = new ASN1InputStream(new ByteArrayInputStream(byteArray));
			DERObject derObject = asn1InputStream.readObject();
			ASN1Sequence asn1Sequence = ASN1Sequence.getInstance(derObject);
			Object objectValue = asn1Sequence.getObjectAt(1);
			if (objectValue instanceof ASN1TaggedObject) {
				ASN1TaggedObject asn1TaggedObject = (ASN1TaggedObject) objectValue;
				try {
					if (logger.isDebugEnabled()) {
						logger.debug("Try to get string from DERUTF8String.");
					}
					DERObject derTaggedObject = asn1TaggedObject.getObject();
					DERUTF8String derUtf8String = DERUTF8String.getInstance(derTaggedObject);
					ret = derUtf8String.getString();
				} catch (IllegalArgumentException e) {
					if (logger.isDebugEnabled()) {
						logger.debug("Can not get String From DERUTF8String, [" + e.getMessage() + "].");
					}
				}				
			}
		} catch (Exception e) {
			if (logger.isInfoEnabled()) {
				logger.info("Can not get String From ASNDerEncoded ByteArray, [" + e.getMessage() + "].");
			}
		}

		if (logger.isDebugEnabled()) {
			logger.debug("getStringFromASNDerEncodedByteArray(byte[]) - end. Ret is [" + ret + "].");
		}
		return ret;

	}
	

}

Lines 49-54 Link Here

(-)org/apache/catalina/realm/RealmBase.java (-1 / +82 lines)
49	import org.apache.catalina.deploy.SecurityCollection;	49	import org.apache.catalina.deploy.SecurityCollection;
50	import org.apache.catalina.deploy.SecurityConstraint;	50	import org.apache.catalina.deploy.SecurityConstraint;
51	import org.apache.catalina.mbeans.MBeanUtils;	51	import org.apache.catalina.mbeans.MBeanUtils;
		52	import org.apache.catalina.realm.ClientCertificateConstants.UserIdentifierRetrieveField;
52	import org.apache.catalina.util.LifecycleMBeanBase;	53	import org.apache.catalina.util.LifecycleMBeanBase;
53	import org.apache.catalina.util.MD5Encoder;	54	import org.apache.catalina.util.MD5Encoder;
54	import org.apache.juli.logging.Log;	55	import org.apache.juli.logging.Log;
Lines 153-158 Link Here
153	protected boolean stripRealmForGss = true;	154	protected boolean stripRealmForGss = true;
154		155
155		156
		157	private UserIdentifierRetriever userIdentifierRetriever = null;
		158
		159	private String x509UserIdentifierRetrieveField = null;
		160
		161	private String x509UserIdentifierRetrieveFieldPart = null;
		162
		163	private String x509UserIdentifierRetrieverClassName;
		164
156	// ------------------------------------------------------------- Properties	165	// ------------------------------------------------------------- Properties
157		166
158		167
Lines 1194-1200 Link Here
1194	* Return the Principal associated with the given certificate.	1203	* Return the Principal associated with the given certificate.
1195	*/	1204	*/
1196	protected Principal getPrincipal(X509Certificate usercert) {	1205	protected Principal getPrincipal(X509Certificate usercert) {
1197	return(getPrincipal(usercert.getSubjectDN().getName()));	1206	createUserIdentifierRetriever();
		1207	String userIdentifier = userIdentifierRetriever.getUserIdentifier(usercert);
		1208
		1209	if (log.isDebugEnabled())
		1210	log.debug("Get principal for [" + userIdentifier + "]");
		1211	return(getPrincipal(userIdentifier));
1198	}	1212	}
1199		1213
1200		1214
Lines 1393-1397 Link Here
1393	return name;	1407	return name;
1394	}	1408	}
1395	}	1409	}
		1410
		1411	public void setX509UserIdentifierRetrieveFieldPart(String userIdentifierRetrieveFieldPart) {
		1412	this.x509UserIdentifierRetrieveFieldPart = userIdentifierRetrieveFieldPart;
1396		1413
		1414	}
		1415
		1416	public void setX509UserIdentifierRetrieveField(String userIdentifierRetrieveField) {
		1417	this.x509UserIdentifierRetrieveField = userIdentifierRetrieveField;
		1418	}
		1419
		1420	public void setX509UserIdentifierRetrieverClassName(String className) {
		1421	this.x509UserIdentifierRetrieverClassName = className;
		1422	}
		1423	private void createUserIdentifierRetriever() {
		1424
		1425	if (userIdentifierRetriever == null) {
		1426	boolean created = createUserIdentifierRetrieverFromClassName();
		1427	if (!created) {
		1428	if (UserIdentifierRetrieveField.SubjectDN.equals(x509UserIdentifierRetrieveField)) {
		1429	if (x509UserIdentifierRetrieveFieldPart == null) {
		1430	userIdentifierRetriever = new SubjectDnRetriever();
		1431	} else {
		1432	userIdentifierRetriever = new SubjectDnRetriever(x509UserIdentifierRetrieveFieldPart);
		1433	}
		1434	} else if (UserIdentifierRetrieveField.SubjectAlternativeName.equals(x509UserIdentifierRetrieveField)) {
		1435	if (x509UserIdentifierRetrieveFieldPart == null) {
		1436	userIdentifierRetriever = new SubjectDnRetriever();
		1437	String warnString = "Can not create userIdentifierRetriever : userIdentifierRetrieveFieldPart is null when userIdentifierRetrieveField is [" + x509UserIdentifierRetrieveField + "]. userIdentifierRetriever is created for SubjectDn field.";
		1438	log.warn(warnString);
		1439	} else {
		1440	userIdentifierRetriever = new SubjectAlternativeNameRetriever(x509UserIdentifierRetrieveFieldPart);
		1441	}
		1442	} else {
		1443	userIdentifierRetriever = new DefaultSubjectDnRetriever();
		1444	}
		1445	}
		1446	}
		1447	}
		1448
		1449	@SuppressWarnings("unchecked")
		1450	private boolean createUserIdentifierRetrieverFromClassName() {
		1451
		1452	boolean created = false;
		1453	if ((x509UserIdentifierRetrieverClassName != null) && (x509UserIdentifierRetrieverClassName != "")) {
		1454	Class<? extends UserIdentifierRetriever> x509UserIdentifierRetrieverClass = null;
		1455	try {
		1456	x509UserIdentifierRetrieverClass = (Class<? extends UserIdentifierRetriever>) Class.forName(x509UserIdentifierRetrieverClassName);
		1457	userIdentifierRetriever = x509UserIdentifierRetrieverClass.newInstance();
		1458	created = true;
		1459	} catch (ClassCastException e) {
		1460	String warnString = "Class [" + x509UserIdentifierRetrieverClassName + "] is not instance of [" + UserIdentifierRetriever.class.getSimpleName() + "].";
		1461	log.warn(warnString);
		1462	} catch (ClassNotFoundException e) {
		1463	String warnString = "Class [" + x509UserIdentifierRetrieverClassName + "] was not found.";
		1464	log.warn(warnString, e);
		1465	} catch (InstantiationException e) {
		1466	String warnString = "Cannot instantiate class [" + x509UserIdentifierRetrieverClassName + "].";
		1467	log.warn(warnString);
		1468	} catch (IllegalAccessException e) {
		1469	String warnString = "Cannot instantiate class [" + x509UserIdentifierRetrieverClassName + "].";
		1470	log.warn(warnString);
		1471	}
		1472
		1473	}
		1474	return created;
		1475	}
		1476
		1477
1397	}	1478	}

Return to bug 52500

Line 0 Link Here

(-)org/apache/catalina/realm/SubjectDnRetriever.java (+138 lines)
		1	/**
		2	* @author Michael Furman
		3	*/
		4	package org.apache.catalina.realm;
		5
		6	import java.security.cert.X509Certificate;
		7	import java.util.List;
		8
		9	import javax.naming.InvalidNameException;
		10	import javax.naming.ldap.LdapName;
		11	import javax.naming.ldap.Rdn;
		12
		13	import org.apache.juli.logging.Log;
		14	import org.apache.juli.logging.LogFactory;
		15
		16
		17	public class SubjectDnRetriever implements UserIdentifierRetriever {
		18	/**
		19	* Logger for this class
		20	*/
		21	protected final Log logger = LogFactory.getLog(getClass());
		22
		23
		24
		25	private String subjectDnAttribute = null;
		26	private String subjectDnAttributeConfiguration = null;
		27
		28	protected SubjectDnRetriever() {
		29	setSubjectDnAttribute(null);
		30	}
		31
		32	protected SubjectDnRetriever(String retrieveAttr) {
		33	setSubjectDnAttribute(retrieveAttr);
		34	}
		35
		36	public String getUserIdentifier(X509Certificate clientCert) {
		37	if (logger.isDebugEnabled()) {
		38	logger.debug("getUserIdentifier(X509Certificate) - start");
		39	}
		40	String subject = getSubjectDN(clientCert);
		41	String userIdentifier = null;
		42	if (subject != null) {
		43	if (logger.isDebugEnabled()) {
		44	logger.debug("Subject is [" + subject + "].");
		45	}
		46	if (subjectDnAttribute == null) {
		47	if (logger.isDebugEnabled()) {
		48	logger.debug("subjectDnAttribute is null, so return the whole subject.");
		49	}
		50	userIdentifier = subject;
		51	} else {
		52	try {
		53	boolean foundUserIdentifier = false;
		54	LdapName ldapName = new LdapName(subject);
		55	List<Rdn> list = ldapName.getRdns();
		56	if (list != null) {
		57	for (Rdn rdn : list) {
		58	String type = rdn.getType();
		59	if (subjectDnAttribute.equalsIgnoreCase(type.toString())) {
		60	Object value = rdn.getValue();
		61	if (value instanceof String) {
		62	userIdentifier = (String) value;
		63	foundUserIdentifier = true;
		64	if (logger.isDebugEnabled()) {
65	logger.debug("Success to retreive userIdentifier [" + userIdentifier + "].");
66	}
67	break;
68	}
69	}
70	}
71	}
72	if (!foundUserIdentifier) {
73	if (logger.isDebugEnabled()) {
74	logger.debug("subject [" + subject + "] does not contain the required attribute [" + subjectDnAttributeConfiguration + "].");
75	}
76	}
77	} catch (InvalidNameException e) {
78	logger.info("subject [" + subject + "] is not valid name : [" + e.getMessage() + "].");
79	}
80	}
81	}
82	if (logger.isDebugEnabled()) {
83	logger.debug("getUserIdentifier(X509Certificate) - end; Ret is [" + userIdentifier + "].");
84	}
85	return userIdentifier;
86	}
87
88	private void setSubjectDnAttribute(String subjectDnAttributeConfiguration) {
89	if (logger.isDebugEnabled()) {
90	logger.debug("setSubjectDnAttribute(String) - start; subjectDnAttribute [" + subjectDnAttributeConfiguration + "].");
91	}
92	this.subjectDnAttributeConfiguration = subjectDnAttributeConfiguration;
93	subjectDnAttribute = mapSubjectDnAttribute(subjectDnAttributeConfiguration);
94	if (logger.isDebugEnabled()) {
95	logger.debug("setSubjectDnAttribute(String) - end; subjectDnAttribute [" + subjectDnAttribute + "]; subjectDnAttributeConfiguration [" + subjectDnAttributeConfiguration + "]");
96	}
97	}
98
99
100
101	private String mapSubjectDnAttribute(String subjectDnAttributeConfiguration) {
102	String ret = null;
103	if (subjectDnAttributeConfiguration != null) {
104	if (ClientCertificateConstants.EmailOptions.contains(subjectDnAttributeConfiguration.toLowerCase())) {
105	ret = ClientCertificateConstants.EMAIL_SUBJECT_ATTR;
106	} else {
107	ret = subjectDnAttributeConfiguration;
108	}
109	}
110	return ret;
111	}
112
113	protected String getSubjectDN(X509Certificate clientCert) {
114	if (logger.isDebugEnabled()) {
115	logger.debug("getSubjectDN(X509Certificate) - start");
116	}
117	String subject = null;
118	if (clientCert != null) {
119	if ((clientCert.getSubjectDN()!= null)
120	&& (clientCert.getSubjectDN().getName() != null)) {
121	subject = clientCert.getSubjectDN().getName();
122	} else {
123	if (logger.isDebugEnabled()) {
124	logger.debug("Can not getSubjectDN, SubjectDN is null");
125	}
126	}
127	} else {
128	if (logger.isDebugEnabled()) {
129	logger.debug("Can not getSubjectDN, clientCert is null");
130	}
131	}
132	if (logger.isDebugEnabled()) {
133	logger.debug("getSubjectDN(X509Certificate) - end; Ret is [" + subject + "].");
134	}
135	return subject;
136
137	}
138	}

Line 0 Link Here

(-)org/apache/catalina/realm/ClientCertificateConstants.java (+60 lines)
	1	/**
	2	* @author Michael Furman
	3	*/
	4	package org.apache.catalina.realm;
	5
	6	import java.util.Arrays;
	7	import java.util.List;
	8
	9	public class ClientCertificateConstants {
	10
	11
	12	public enum UserIdentifierRetrieveField {
	13	SubjectDN, SubjectAlternativeName;
	14	public boolean equals(final String str) {
	15	return name().equals(str);
	16	}
	17	}
	18
	19
	20	public static final String EMAIL_SUBJECT_ATTR = "emailAddress";
	21
	22
	23	public enum SubjectAlternativeNameGeneralNames {
	24
	25	otherName, // byte arrays containing the ASN.1 DER encoded form
	26	rfc822Name, // String
	27	dNSName, // String
	28	x400Address, // byte arrays containing the ASN.1 DER encoded form
	29	directoryName, // String: RFC 2253 string format
	30	ediPartyName, // byte arrays containing the ASN.1 DER encoded form
	31	uniformResourceIdentifier, // String
	32	iPAddress, // String: IPv4 address - dotted quad notation, IPv6 address - form "a1:a2:...:a8"
	33	registeredID;
	34
	35	public boolean equals(final String str) {
	36	return name().equals(str);
	37	}
	38
	39	public boolean equalsIgnoreCase(final String str) {
	40	return name().equalsIgnoreCase(str);
	41	}
	42	}
	43
	44	// !!! important - set value only in lower case !!!
	45
	46	// SubjectDN
	47	public static final List<String> EmailOptions = Arrays.asList(EMAIL_SUBJECT_ATTR.toLowerCase(), "e") ;
	48
	49	// Subject Alternative Name
	50	public static final List<String> OtherNameOptions = Arrays.asList("other name", "principalname", "principal name", "microsoft principal name") ;
	51	public static final List<String> RFC822NameOptions = Arrays.asList("rfc822 name", "rfc822name", "emailaddress", "email address", "e-mail address", "e-mailaddress") ;
	52	public static final List<String> DNSNameOptions = Arrays.asList("dns name", "dnsname") ;
	53	// x400Address - empty
	54	public static final List<String> DirectoryNameOptions = Arrays.asList("directory address", "directory address", "x500 name", "x500name", "x.500 name", "x.500name") ;
	55	// ediPartyName - empty
	56	public static final List<String> UriOptions = Arrays.asList("url", "uri") ;
	57	public static final List<String> IPAddressOptions = Arrays.asList("ip address", "ipaddress");
	58	public static final List<String> RegisteredIDOptions = Arrays.asList("registered id", "registeredid","registered oid", "registeredoid");
	59
	60	}

Line 0 Link Here

(-)org/apache/catalina/realm/DefaultSubjectDnRetriever.java (+29 lines)
	1	/**
	2	* @author Michael Furman
	3	*/
	4	package org.apache.catalina.realm;
	5
	6	import java.security.cert.X509Certificate;
	7
	8	import org.apache.juli.logging.Log;
	9	import org.apache.juli.logging.LogFactory;
	10
	11
	12	public class DefaultSubjectDnRetriever implements UserIdentifierRetriever {
	13	/**
	14	* Logger for this class
	15	*/
	16	protected final Log logger = LogFactory.getLog(getClass());
	17
	18	public String getUserIdentifier(X509Certificate clientCert) {
	19	if (logger.isDebugEnabled()) {
	20	logger.debug("getUserIdentifier(X509Certificate) - start");
	21	}
	22	String userIdentifier = clientCert.getSubjectDN().getName();
	23	if (logger.isDebugEnabled()) {
	24	logger.debug("getUserIdentifier(X509Certificate) - end; Ret is [" + userIdentifier + "].");
	25	}
	26	return userIdentifier;
	27	}
	28
	29	}

Line 0 Link Here

(-)org/apache/catalina/realm/SubjectAlternativeNameRetriever.java (+205 lines)
		1	/**
		2	* @author Michael Furman
		3	*/
		4	package org.apache.catalina.realm;
		5
		6	import java.io.ByteArrayInputStream;
		7	import java.security.cert.CertificateParsingException;
		8	import java.security.cert.X509Certificate;
		9	import java.util.Collection;
		10	import java.util.Iterator;
		11	import java.util.List;
		12
		13	import org.apache.juli.logging.Log;
		14	import org.apache.juli.logging.LogFactory;
		15
		16	import org.bouncycastle.asn1.ASN1InputStream;
		17	import org.bouncycastle.asn1.ASN1Sequence;
		18	import org.bouncycastle.asn1.ASN1TaggedObject;
		19	import org.bouncycastle.asn1.DERObject;
		20	import org.bouncycastle.asn1.DERUTF8String;
		21
		22
		23	public class SubjectAlternativeNameRetriever extends SubjectDnRetriever {
		24	private static final int NOT_EXISTING_TYPE = -1;
		25
		26
		27	/**
		28	* Logger for this class
		29	*/
		30	protected final Log logger = LogFactory.getLog(getClass());
		31
		32
		33	private String alternativeIdentifierConfiguration = null;
		34
		35	private int alternativeIdentifierTypeValue = NOT_EXISTING_TYPE;
		36
		37	protected SubjectAlternativeNameRetriever(String alternativeIdentifierConfiguration) {
		38	setSubjectAlternativeNameGeneralName(alternativeIdentifierConfiguration);
		39	}
		40
		41
		42
		43	@SuppressWarnings("unchecked")
		44	public String getUserIdentifier(X509Certificate clientCert) {
		45	if (logger.isDebugEnabled()) {
		46	logger.debug("getUserIdentifier(X509Certificate) - start");
		47	}
		48
		49	String userIdentifier = null;
		50	if (clientCert != null) {
		51	if (alternativeIdentifierTypeValue != NOT_EXISTING_TYPE) {
		52	boolean foundUserIdentifier = false;
		53	try {
		54	if (clientCert.getSubjectAlternativeNames() != null) {
		55	Collection subjectAlternativeNames = clientCert.getSubjectAlternativeNames();
		56	Iterator iter = subjectAlternativeNames.iterator();
		57	while (iter.hasNext()) {
		58	List subjectAlternativeName = (List) iter.next();
		59	Integer type = (Integer) subjectAlternativeName.get(0);
		60	if (type.intValue() == alternativeIdentifierTypeValue) {
		61	Object subjectAlternativeNameValue = subjectAlternativeName.get(1);
		62	if (subjectAlternativeNameValue instanceof String) {
		63	userIdentifier = (String) subjectAlternativeNameValue;
		64	foundUserIdentifier = true;
65	break;
66	} else if (subjectAlternativeNameValue instanceof byte[]) {
67	byte[] subjectAlternativeNameValueBytes = (byte[]) subjectAlternativeNameValue;
68	userIdentifier = getStringFromASNDerEncodedByteArray(subjectAlternativeNameValueBytes);
69	if (userIdentifier != null) {
70	foundUserIdentifier = true;
71	break;
72	}
73	} else {
74	if (logger.isInfoEnabled()) {
75	logger.info("Can not get UserIdentifier, the subjectAlternativeName not supported [" + subjectAlternativeNameValue + "].");
76	}
77	}
78	}
79	}
80	}
81	} catch (CertificateParsingException e) {
82	logger.info("Can not get UserIdentifier, can not get subjectAlternativeNames from certificate [" + e.getMessage() + "].");
83	}
84	if (foundUserIdentifier) {
85	if (logger.isDebugEnabled()) {
86	logger.debug("Found userIdentifier [" + userIdentifier + "] from part of subjectAlternativeName [" + alternativeIdentifierConfiguration + "].");
87	}
88	} else {
89	if (logger.isDebugEnabled()) {
90	logger.debug("Can not found userIdentifier as part of subjectAlternativeName [" + alternativeIdentifierConfiguration + "].");
91	}
92	}
93
94	} else {
95	if (logger.isDebugEnabled()) {
96	logger.debug("Can not get UserIdentifier, generalName is null");
97	}
98	}
99	} else {
100	if (logger.isDebugEnabled()) {
101	logger.debug("Can not get UserIdentifier, clientCert is null");
102	}
103	}
104	if (logger.isDebugEnabled()) {
105	logger.debug("getUserIdentifier(X509Certificate) - end; Ret is [" + userIdentifier + "].");
106	}
107
108	return userIdentifier;
109	}
110
111
112
113
114
115	private void setSubjectAlternativeNameGeneralName(String alternativeIdentifierConfiguration) {
116	if (logger.isDebugEnabled()) {
117	logger.debug("setSubjectAlternativeNameGeneralName(String) - start; alternativeIdentifier [" + alternativeIdentifierConfiguration + "].");
118	}
119	this.alternativeIdentifierConfiguration = null;
120	alternativeIdentifierTypeValue = NOT_EXISTING_TYPE;
121
122	if (alternativeIdentifierConfiguration != null) {
123	this.alternativeIdentifierConfiguration = alternativeIdentifierConfiguration;
124	String alternativeIdentifierConfigurationLowerCase = alternativeIdentifierConfiguration.toLowerCase();
125	if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.otherName.equalsIgnoreCase (alternativeIdentifierConfiguration))
126	\|\| (ClientCertificateConstants.OtherNameOptions.contains(alternativeIdentifierConfigurationLowerCase))) {
127	alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.otherName.ordinal();
128	} else if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.rfc822Name.equalsIgnoreCase (alternativeIdentifierConfiguration))
129	\|\| (ClientCertificateConstants.RFC822NameOptions.contains(alternativeIdentifierConfigurationLowerCase))) {
130	alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.rfc822Name.ordinal();
131	} else if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.dNSName.equalsIgnoreCase (alternativeIdentifierConfiguration))
132	\|\| (ClientCertificateConstants.DNSNameOptions.contains(alternativeIdentifierConfigurationLowerCase))) {
133	alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.dNSName.ordinal();
134	} else if (ClientCertificateConstants.SubjectAlternativeNameGeneralNames.x400Address.equalsIgnoreCase (alternativeIdentifierConfiguration)) {
135	alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.x400Address.ordinal();
136	} else if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.directoryName.equalsIgnoreCase (alternativeIdentifierConfiguration))
137	\|\| (ClientCertificateConstants.DirectoryNameOptions.contains(alternativeIdentifierConfigurationLowerCase))) {
138	alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.directoryName.ordinal();
139	} else if (ClientCertificateConstants.SubjectAlternativeNameGeneralNames.ediPartyName.equalsIgnoreCase (alternativeIdentifierConfiguration)) {
140	alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.ediPartyName.ordinal();
141	} else if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.uniformResourceIdentifier.equalsIgnoreCase (alternativeIdentifierConfiguration))
142	\|\| (ClientCertificateConstants.UriOptions.contains(alternativeIdentifierConfigurationLowerCase))) {
143	alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.uniformResourceIdentifier.ordinal();
144	} else if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.iPAddress.equalsIgnoreCase (alternativeIdentifierConfiguration))
145	\|\| (ClientCertificateConstants.IPAddressOptions.contains(alternativeIdentifierConfigurationLowerCase))) {
146	alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.iPAddress.ordinal();
147	} else if ((ClientCertificateConstants.SubjectAlternativeNameGeneralNames.registeredID.equalsIgnoreCase (alternativeIdentifierConfiguration))
148	\|\| (ClientCertificateConstants.RegisteredIDOptions.contains(alternativeIdentifierConfigurationLowerCase))) {
149	alternativeIdentifierTypeValue = ClientCertificateConstants.SubjectAlternativeNameGeneralNames.registeredID.ordinal();
150	} else {
151	try {
152	alternativeIdentifierTypeValue = (new Integer(alternativeIdentifierConfiguration)).intValue();
153	}catch (NumberFormatException e) {
154	alternativeIdentifierTypeValue = NOT_EXISTING_TYPE;
155	}
156	}
157
158	}
159	if (logger.isDebugEnabled()) {
160	logger.debug("setSubjectAlternativeNameGeneralName(String) - end; alternativeIdentifier [" + alternativeIdentifierConfiguration + "], alternativeIdentifierType [" + alternativeIdentifierTypeValue + "].");
161	}
162	}
163
164
165	private String getStringFromASNDerEncodedByteArray(byte[] byteArray) {
166	if (logger.isDebugEnabled()) {
167	logger.debug("getStringFromASNDerEncodedByteArray(byte[]) - start");
168	}
169
170	String ret = null;
171	try {
172	ASN1InputStream asn1InputStream = new ASN1InputStream(new ByteArrayInputStream(byteArray));
173	DERObject derObject = asn1InputStream.readObject();
174	ASN1Sequence asn1Sequence = ASN1Sequence.getInstance(derObject);
175	Object objectValue = asn1Sequence.getObjectAt(1);
176	if (objectValue instanceof ASN1TaggedObject) {
177	ASN1TaggedObject asn1TaggedObject = (ASN1TaggedObject) objectValue;
178	try {
179	if (logger.isDebugEnabled()) {
180	logger.debug("Try to get string from DERUTF8String.");
181	}
182	DERObject derTaggedObject = asn1TaggedObject.getObject();
183	DERUTF8String derUtf8String = DERUTF8String.getInstance(derTaggedObject);
184	ret = derUtf8String.getString();
185	} catch (IllegalArgumentException e) {
186	if (logger.isDebugEnabled()) {
187	logger.debug("Can not get String From DERUTF8String, [" + e.getMessage() + "].");
188	}
189	}
190	}
191	} catch (Exception e) {
192	if (logger.isInfoEnabled()) {
193	logger.info("Can not get String From ASNDerEncoded ByteArray, [" + e.getMessage() + "].");
194	}
195	}
196
197	if (logger.isDebugEnabled()) {
198	logger.debug("getStringFromASNDerEncodedByteArray(byte[]) - end. Ret is [" + ret + "].");
199	}
200	return ret;
201
202	}
203
204
205	}