Example 14-2 Code Fragment: Obtaining Custom Configuration Data From MBean

public class MyCertPathProviderRuntimeImpl implements CertPathProvider
{
:
:
   public void initialize(ProviderMBean mBean, SecurityServices securityServices)
   {
     MyCertPathProviderMBean myMBean = (MyCertPathProviderMBean)mBean;
     description = myMBean.getDescription();
     customConfigData = myMBean.getCustomConfigData();
:
}
:
   // make my config data available to my JDK CertPathBuilderSpi and    
   // CertPathValidatorSpi impls
   private String getCustomConfigData() { return customConfigData; }
}
:
static public class MyJDKCertPathBuilder extends CertPathBuilderSpi
{
:
//get my runtime implementation instance which holds the configuration
//data needed to build and validate the cert path
MyCertPathProviderRuntimeImpl runtime =
(MyCertPathProviderRuntimeImpl)params.getCertPathProvider();
String myCustomConfigData = runtime.getCustomConfigData();

Example 14-5 shows how to register your JDK implementation with the JDK.

To implement the CertPathProvider SSPI, provide implementations for the methods described in Understand the Purpose of the Provider SSPIs and the following methods:

• getCertPathBuilder

  public CertPathBuilder getCertPathBuilder()
  

  Gets a CertPath Provider's JDK CertPathBuilder that invokes your JDK CertPathBuilderSpi implementation, as shown in Example 14-3. A CertPathBuilder finds, and optionally validates, a certificate chain.

Example 14-3 Code Fragment: getCertPathBuilder

public void initialize(ProviderMBean mBean, SecurityServices securityServices)   
{
:
     // get my JDK cert path impls
     try {
       certPathBuilder = CertPathBuilder.getInstance(BUILDER_ALGORITHM);
     } catch (NoSuchAlgorithmException e) { throw new AssertionError("..."); }

• getCertPathValidator

  public CertPathValidator getCertPathValidator()
  

  Gets a CertPath Provider's JDK CertPathValidator that invokes your JDK CertPathValidatorSpi implementation, as shown in Example 14-4. A CertPathValidator validates a certificate chain.

Example 14-4 Code Fragment: getCertPathValidator

public void initialize(ProviderMBean mBean, SecurityServices securityServices)   
{
:
     // get my JDK cert path impls
     try {
       certPathValidator = CertPathValidator.getInstance(VALIDATOR_ALGORITHM);
     } catch (NoSuchAlgorithmException e) { throw new AssertionError("..."); }
   }

Example 14-5 Implementing the JDK Security Provider

public class MyCertPathProviderRuntimeImpl implements CertPathProvider
{
private static final String MY_JDK_SECURITY_PROVIDER_NAME = "MyCertPathProvider";
private static final String BUILDER_ALGORITHM = MY_JDK_SECURITY_PROVIDER_NAME + "CertPathBuilder";
private static final String VALIDATOR_ALGORITHM = MY_JDK_SECURITY_PROVIDER_NAME + "CertPathValidator";
:
:
   public void initialize(ProviderMBean mBean, SecurityServices securityServices)
   {
     MyCertPathProviderMBean myMBean = (MyCertPathProviderMBean)mBean;

     description = myMBean.getDescription();

     customConfigData = myMBean.getCustomConfigData();

// register my cert path impls with the JDK
// so that the CLV framework may invoke them via
// the JDK cert path apis.
if (Security.getProvider(MY_JDK_SECURITY_PROVIDER_NAME) == null) {
   AccessController.doPrivileged(
     new PrivilegedAction() {
       public Object run() {
         Security.addProvider(new MyJDKSecurityProvider());
         return null;
       }
     }
   );
}
:
// This class implements the JDK security provider that registers 
// this provider's cert path builder and cert path validator implementations 
// with the JDK.
private class MyJDKSecurityProvider extends Provider
 {
   private MyJDKSecurityProvider()
    {
      super(MY_JDK_SECURITY_PROVIDER_NAME, 1.0, "MyCertPathProvider JDK CertPath provider");
      put("CertPathBuilder." + BUILDER_ALGORITHM,
 "com.acme.MyPathProviderRuntimeImpl$MyJDKCertPathBuilder");
      put("CertPathValidator." + VALIDATOR_ALGORITHM,
 "com.acme.MyCertPathProviderRuntimeImpl$MyJDKCertPathValidator");
    }
 }
}

Example 14-6 Creating the Sample Cert Path Provider

package com.acme;

import weblogic.management.security.ProviderMBean;
import weblogic.security.pk.CertPathSelector;
import weblogic.security.pk.SubjectDNSelector;
import weblogic.security.pk.WLSCertPathBuilderResult;
import weblogic.security.pk.WLSCertPathValidatorResult;
import weblogic.security.service.ContextHandler;
import weblogic.security.spi.CertPathBuilderParametersSpi;
import weblogic.security.spi.CertPathProvider;
import weblogic.security.spi.CertPathValidatorParametersSpi;
import weblogic.security.spi.SecurityServices;
import weblogic.security.SSL.SSLValidationConstants;

import java.security.InvalidAlgorithmParameterException;
import java.security.NoSuchAlgorithmException;
import java.security.AccessController;
import java.security.PrivilegedAction;
import java.security.Provider;
import java.security.Security;
import java.security.cert.CertPath;
import java.security.cert.CertPathBuilder;
import java.security.cert.CertPathBuilderResult;
import java.security.cert.CertPathBuilderSpi;
import java.security.cert.CertPathBuilderException;
import java.security.cert.CertPathParameters;
import java.security.cert.CertPathValidator;
import java.security.cert.CertPathValidatorResult;
import java.security.cert.CertPathValidatorSpi;
import java.security.cert.CertPathValidatorException;
import java.security.cert.X509Certificate;

public class MyCertPathProviderRuntimeImpl implements CertPathProvider
{
   private static final String MY_JDK_SECURITY_PROVIDER_NAME = "MyCertPathProvider";
   private static final String BUILDER_ALGORITHM = MY_JDK_SECURITY_PROVIDER_NAME + "CertPathBuilder";
   private static final String VALIDATOR_ALGORITHM = MY_JDK_SECURITY_PROVIDER_NAME + "CertPathValidator";

   // Used to invoke my JDK cert path builder / validator implementations
   private CertPathBuilder   certPathBuilder;
   private CertPathValidator certPathValidator;

   // remember my custom configuration data from my mbean
   private String customConfigData;

   private String description;

   public void initialize(ProviderMBean mBean, SecurityServices securityServices)
   {
     MyCertPathProviderMBean myMBean = (MyCertPathProviderMBean)mBean;

     description = myMBean.getDescription();

     customConfigData = myMBean.getCustomConfigData();

     // register my cert path impls with the JDK
     // so that the CLV framework may invoke them via
     // the JDK cert path apis.
     if (Security.getProvider(MY_JDK_SECURITY_PROVIDER_NAME) == null) {
       AccessController.doPrivileged(
         new PrivilegedAction() {
           public Object run() {
            Security.addProvider(new MyJDKSecurityProvider());
             return null;
           }
         }
       );
     }

     // get my JDK cert path impls
     try {
       certPathBuilder = CertPathBuilder.getInstance(BUILDER_ALGORITHM);
     } catch (NoSuchAlgorithmException e) { throw new AssertionError("..."); }

     try {
       certPathValidator = CertPathValidator.getInstance(VALIDATOR_ALGORITHM);
     } catch (NoSuchAlgorithmException e) { throw new AssertionError("..."); }
   }

   public void             shutdown          () {                     }
   public String           getDescription       () { return description;    }
   public CertPathBuilder  getCertPathBuilder   () { return certPathBuilder;}
   public CertPathValidator getCertPathValidator () { return certPathValidator;}

   // make my config data available to my JDK CertPathBuilderSpi and    
   // CertPathValidatorSpi impls
   private String getCustomConfigData() { return customConfigData; }

   /**
   * This class contains JDK cert path builder implementation for this provider.
   */

   static public class MyJDKCertPathBuilder extends CertPathBuilderSpi
    {
     public CertPathBuilderResult
      engineBuild(CertPathParameters genericParams)
       throws CertPathBuilderException, InvalidAlgorithmParameterException
     {

   // narrow the CertPathParameters to the WLS ones so we can get the
   // data needed to build and validate the cert path
   if (!(genericParams instanceof CertPathBuilderParametersSpi)) {
     throw new InvalidAlgorithmParameterException("The CertPathParameters must be a
 weblogic.security.pk.CertPathBuilderParametersSpi instance.");
   }

   CertPathBuilderParametersSpi params = (CertPathBuilderParametersSpi)genericParams;

   // get my runtime implementation instance which holds the configuration
   // data needed to build and validate the cert path
   MyCertPathProviderRuntimeImpl runtime = (MyCertPathProviderRuntimeImpl)params.getCertPathProvider();
   String myCustomConfigData = runtime.getCustomConfigData();

   // get the selector which indicates which cert path the caller wants built.
   // it can be an EndCertificateSelector, SubjectDNSelector,    
   // IssuerDNSerialNumberSelector
   // or a SubjectKeyIdentifier.
   CertPathSelector genericSelector = params.getCertPathSelector();

   // decide which kinds of selectors this builder wants to support.

   if (genericSelector instanceof SubjectDNSelector) {

    // get the subject dn of the end certificate of the cert path the caller     
   // wants built
    SubjectDNSelector selector = (SubjectDNSelector)genericSelector;
    String subjectDN = selector.getSubjectDN();

   // if your implementation requires trusted CAs, get them.
   // otherwise, ignore them.  that is, it's a quality of service
   // issue whether or not you require trusted CAs.
   X509Certificate[] trustedCAs = params.getTrustedCAs();

   // if your implementation requires looks for extra data in
   // the context handler, get it.  otherwise ignore it.
   ContextHandler context = params.getContext();
   if (context != null) {
   // ...
   }

   // use my custom configuration data (ie. myCustomConfigData),
   // the trusted CAs (if applicable to my implementation),
   // the context (if applicable to my implementation),
   // and the subject DN to build and validate the cert path
   CertPath certpath = ...
   // or X509Certificate[] chain = ...

   // if not found, throw an exception:
   if (...) {
    throw new CertPathBuilderException("Could not build a cert path for " + subjectDN);
   }

   // if not valid, throw an exception:
   if (...) { 
    throw new CertPathBuilderException("Could not validate the cert path for " + subjectDN);
   }

   // if found and valid, return the cert path.
   // for convenience, use the WLSCertPathBuilderResult class
   return new WLSCertPathBuilderResult(certpath);
   // or return new WLSCertPathBuilderResult(chain);

   } else {

   // the caller passed in a selector that my implementation does not support
   throw new InvalidAlgorithmParameterException("MyCertPathProvider only
   supports weblogoic.security.pk.SubjectDNSelector");
   }
  }
}

   /**
   * This class contains JDK cert path validator implementation for this provider.
   */

   static public class MyJDKCertPathValidator extends CertPathValidatorSpi
   {
     public CertPathValidatorResult
      engineValidate(CertPath certPath, CertPathParameters genericParams)
       throws CertPathValidatorException, InvalidAlgorithmParameterException
     {

   // narrow the CertPathParameters to the WLS ones so we can get the
   // data needed to build and validate the cert path
   if (!(genericParams instanceof CertPathValidatorParametersSpi)) {
     throw new InvalidAlgorithmParameterException("The CertPathParameters must be a
 weblogic.security.pk.CertPathValidatorParametersSpi instance.");
   }

     CertPathValidatorParametersSpi params = (CertPathValidatorParametersSpi)genericParams;


     // get my runtime implementation instance which holds the configuration
     // data needed to build and validate the cert path
     MyCertPathProviderRuntimeImpl runtime = (MyCertPathProviderRuntimeImpl)params.getCertPathProvider();
     String myCustomConfigData = runtime.getCustomConfigData();

     // if your implementation requires trusted CAs, get them.
     // otherwise, ignore them.  that is, it's a quality of service
     // issue whether or not you require trusted CAs.
     X509Certificate[] trustedCAs = params.getTrustedCAs();

     // if your implementation requires looks for extra data in
     // the context handler, get it.  otherwise ignore it.
     ContextHandler context = params.getContext();
     if (context != null) {
       // ...
     }

     // The CLV framework has already done some minimal validation
     // on the cert path before sending it to your provider:
     //   1) the cert path is not empty
     //   2) the cert path starts with the end cert
     //   3) each certificate in the cert path was issued and
     //      signed by the next certificate in the chain
     //      So, your validator can rely on these checks having
     //      already been performed (vs your validator needing to
     //      do these checks too).

   // Use my custom configuration data (ie. myCustomConfigData),
   // the trusted CAs (if applicable to my implementation),
   // and the context (if applicable to my implementation)
   // to validate the cert path

   // if not valid, throw an exception:
   if (...) {
     throw new CertPathValidatorException("Could not validate the cerpath " + certPath);
   }
   // if valid, return success

   // For convenience, use the WLSCertPathValidatorResult class

   return new WLSCertPathValidatorResult();
  }
}

   // This class implements the JDK security provider that registers this    // provider's
   // cert path builder and cert path validator implementations with the JDK.
   private class MyJDKSecurityProvider extends Provider
   {
   private MyJDKSecurityProvider()
   {
     super(MY_JDK_SECURITY_PROVIDER_NAME, 1.0, "MyCertPathProvider JDK CertPath provider");
     put("CertPathBuilder." + BUILDER_ALGORITHM, "com.acme.MyPathProviderRuntimeImpl$MyJDKCertPathBuilder");
     put("CertPathValidator." + VALIDATOR_ALGORITHM, "com.acme.MyCertPathProviderRuntimeImpl$MyJDKCertPathValidator");
   }
  }
}