Author: thomas.diesler(a)jboss.com Date: 2007-06-14 15:06:30 -0400 (Thu, 14 Jun 2007) New Revision: 3586 Modified: branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/extensions/security/SecurityStore.java branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityConfiguration.java branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityOMFactory.java branches/jbossws-2.0/jbossws-core/src/main/resources/schema/jboss-ws-security_1_0.xsd Log: [JBWS-1594] Support certificate password different from keystore Modified: branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/extensions/security/SecurityStore.java =================================================================== --- branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/extensions/security/SecurityStore.java 2007-06-14 18:38:23 UTC (rev 3585) +++ branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/extensions/security/SecurityStore.java 2007-06-14 19:06:30 UTC (rev 3586) @@ -45,6 +45,7 @@ import java.util.ArrayList; import java.util.Arrays; import java.util.Enumeration; +import java.util.HashMap; import java.util.List; import java.util.StringTokenizer; @@ -54,8 +55,8 @@ * <code>SecurityStore</code> holds and loads the keystore and truststore required for encyption and signing. * * @author <a href="mailto:jason.greene@jboss.com">Jason T. Greene</a> - * @author <a href="mailto:jason.greene@jboss.com">Magesh Kumar B</a> - * @version $Revision$ + * @author Magesh Kumar B + * @author Thomas.Diesler(a)jboss.com */ public class SecurityStore { @@ -69,22 +70,26 @@ private String trustStorePassword; + private HashMap<String, String> keyPasswords; + public SecurityStore() throws WSSecurityException { - this(null, null, null, null, null, null); + this(null, null, null, null, null, null, null); } - public SecurityStore(URL keyStoreURL, String keyStoreType, String keyStorePassword) throws WSSecurityException + public SecurityStore(URL keyStoreURL, String keyStoreType, String keyStorePassword, HashMap<String, String> keyPasswords) throws WSSecurityException { loadKeyStore(keyStoreURL, keyStoreType, keyStorePassword); loadTrustStore(keyStoreURL, keyStoreType, keyStorePassword); + this.keyPasswords = keyPasswords; } - public SecurityStore(URL keyStoreURL, String keyStoreType, String keyStorePassword, URL trustStoreURL, String trustStoreType, String trustStorePassword) + public SecurityStore(URL keyStoreURL, String keyStoreType, String keyStorePassword, HashMap<String, String> keyPasswords, URL trustStoreURL, String trustStoreType, String trustStorePassword) throws WSSecurityException { loadKeyStore(keyStoreURL, keyStoreType, keyStorePassword); loadTrustStore(trustStoreURL, trustStoreType, trustStorePassword); + this.keyPasswords = keyPasswords; } private void loadKeyStore(URL keyStoreURL, String keyStoreType, String keyStorePassword) throws WSSecurityException @@ -405,7 +410,10 @@ PrivateKey key; try { - key = (PrivateKey)keyStore.getKey(alias, decryptPassword(keyStorePassword).toCharArray()); + String password = keyStorePassword; + if (keyPasswords != null && keyPasswords.containsKey(alias)) + password = keyPasswords.get(alias); + key = (PrivateKey)keyStore.getKey(alias, decryptPassword(password).toCharArray()); } catch (Exception e) { Modified: branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java =================================================================== --- branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java 2007-06-14 18:38:23 UTC (rev 3585) +++ branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java 2007-06-14 19:06:30 UTC (rev 3586) @@ -138,7 +138,7 @@ try { - SecurityStore securityStore = new SecurityStore(config.getKeyStoreURL(), config.getKeyStoreType(), config.getKeyStorePassword(), config.getTrustStoreURL(), + SecurityStore securityStore = new SecurityStore(config.getKeyStoreURL(), config.getKeyStoreType(), config.getKeyStorePassword(), config.getKeyPasswords(), config.getTrustStoreURL(), config.getTrustStoreType(), config.getTrustStorePassword()); SecurityDecoder decoder = new SecurityDecoder(securityStore); @@ -289,7 +289,7 @@ try { - SecurityStore securityStore = new SecurityStore(config.getKeyStoreURL(), config.getKeyStoreType(), config.getKeyStorePassword(), config.getTrustStoreURL(), + SecurityStore securityStore = new SecurityStore(config.getKeyStoreURL(), config.getKeyStoreType(), config.getKeyStorePassword(), config.getKeyPasswords() , config.getTrustStoreURL(), config.getTrustStoreType(), config.getTrustStorePassword()); SecurityEncoder encoder = new SecurityEncoder(operations, securityStore); encoder.encode(soapMessage.getSOAPPart()); Modified: branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityConfiguration.java =================================================================== --- branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityConfiguration.java 2007-06-14 18:38:23 UTC (rev 3585) +++ branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityConfiguration.java 2007-06-14 19:06:30 UTC (rev 3586) @@ -45,6 +45,7 @@ private URL trustStoreURL; private String trustStoreType; private String trustStorePassword; + private HashMap<String, String> keyPasswords = new HashMap<String, String>(); public WSSecurityConfiguration() { @@ -154,4 +155,14 @@ { this.trustStoreFile = trustStoreFile; } + + public HashMap<String, String> getKeyPasswords() + { + return keyPasswords; + } + + public void setKeyPasswords(HashMap<String, String> keyPasswords) + { + this.keyPasswords = keyPasswords; + } } Modified: branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityOMFactory.java =================================================================== --- branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityOMFactory.java 2007-06-14 18:38:23 UTC (rev 3585) +++ branches/jbossws-2.0/jbossws-core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityOMFactory.java 2007-06-14 19:06:30 UTC (rev 3586) @@ -1,24 +1,24 @@ /* -* JBoss, Home of Professional Open Source -* Copyright 2005, JBoss Inc., and individual contributors as indicated -* by the @authors tag. See the copyright.txt in the distribution for a -* full listing of individual contributors. -* -* This is free software; you can redistribute it and/or modify it -* under the terms of the GNU Lesser General Public License as -* published by the Free Software Foundation; either version 2.1 of -* the License, or (at your option) any later version. -* -* This software is distributed in the hope that it will be useful, -* but WITHOUT ANY WARRANTY; without even the implied warranty of -* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -* Lesser General Public License for more details. -* -* You should have received a copy of the GNU Lesser General Public -* License along with this software; if not, write to the Free -* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA -* 02110-1301 USA, or see the FSF site: http://www.fsf.org. -*/ + * JBoss, Home of Professional Open Source + * Copyright 2005, JBoss Inc., and individual contributors as indicated + * by the @authors tag. See the copyright.txt in the distribution for a + * full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ package org.jboss.ws.metadata.wsse; import java.io.IOException; @@ -88,7 +88,7 @@ try { Unmarshaller unmarshaller = UnmarshallerFactory.newInstance().newUnmarshaller(); - WSSecurityConfiguration configuration = (WSSecurityConfiguration) unmarshaller.unmarshal(is, this, null); + WSSecurityConfiguration configuration = (WSSecurityConfiguration)unmarshaller.unmarshal(is, this, null); return configuration; } catch (JBossXBException e) @@ -105,28 +105,27 @@ } } - public WSSecurityConfiguration parse(String xmlString) throws JBossXBException { if (xmlString == null) throw new IllegalArgumentException("Security config xml String cannot be null"); Unmarshaller unmarshaller = UnmarshallerFactory.newInstance().newUnmarshaller(); - WSSecurityConfiguration configuration = (WSSecurityConfiguration) unmarshaller.unmarshal(xmlString, this, null); + WSSecurityConfiguration configuration = (WSSecurityConfiguration)unmarshaller.unmarshal(xmlString, this, null); return configuration; - + } - + public WSSecurityConfiguration parse(StringReader strReader) throws JBossXBException { if (strReader == null) throw new IllegalArgumentException("Security InputStream cannot be null"); Unmarshaller unmarshaller = UnmarshallerFactory.newInstance().newUnmarshaller(); - WSSecurityConfiguration configuration = (WSSecurityConfiguration) unmarshaller.unmarshal(strReader, this, null); + WSSecurityConfiguration configuration = (WSSecurityConfiguration)unmarshaller.unmarshal(strReader, this, null); return configuration; } - + /** * This method is called on the factory by the object model builder when the * parsing starts. @@ -141,18 +140,17 @@ return root; } - public void setValue(WSSecurityConfiguration configuration, UnmarshallingContext navigator, String namespaceURI, - String localName, String value) + public void setValue(WSSecurityConfiguration configuration, UnmarshallingContext navigator, String namespaceURI, String localName, String value) { log.trace("setValue: [obj=" + configuration + ",value=" + value + "]"); - String method = (String) options.get(localName); + String method = (String)options.get(localName); if (method == null) return; // Dispatch to propper initializer try { - WSSecurityConfiguration.class.getMethod(method, new Class[] {String.class}).invoke(configuration, new Object[]{value}); + WSSecurityConfiguration.class.getMethod(method, new Class[] { String.class }).invoke(configuration, new Object[] { value }); } catch (Exception e) { @@ -163,14 +161,19 @@ /** * Called when parsing of a new element started. */ - public Object newChild(WSSecurityConfiguration configuration, UnmarshallingContext navigator, String namespaceURI, - String localName, Attributes attrs) + public Object newChild(WSSecurityConfiguration configuration, UnmarshallingContext navigator, String namespaceURI, String localName, Attributes attrs) { log.trace("newChild: " + localName); if ("config".equals(localName)) { return new Config(); } + if ("key-passwords".equals(localName)) + { + HashMap pwds = new HashMap(); + configuration.setKeyPasswords(pwds); + return pwds; + } if ("port".equals(localName)) { return new Port(attrs.getValue("", "name")); @@ -179,10 +182,24 @@ } /** + * Called when parsing the contents of the <key-password> tag. + */ + public Object newChild(HashMap passwords, UnmarshallingContext navigator, String namespaceURI, String localName, Attributes attrs) + { + log.trace("newChild: " + localName); + if ("key-password".equals(localName)) + { + String alias = attrs.getValue("", "alias"); + String pwd = attrs.getValue("", "password"); + passwords.put(alias, pwd); + } + return null; + } + + /** * Called when parsing character is complete. */ - public void addChild(WSSecurityConfiguration configuration, Config defaultConfig, UnmarshallingContext navigator, - String namespaceURI, String localName) + public void addChild(WSSecurityConfiguration configuration, Config defaultConfig, UnmarshallingContext navigator, String namespaceURI, String localName) { log.trace("addChild: [obj=" + configuration + ",child=" + defaultConfig + "]"); configuration.setDefaultConfig(defaultConfig); @@ -191,8 +208,7 @@ /** * Called when parsing character is complete. */ - public void addChild(WSSecurityConfiguration configuration, Port port, UnmarshallingContext navigator, String namespaceURI, - String localName) + public void addChild(WSSecurityConfiguration configuration, Port port, UnmarshallingContext navigator, String namespaceURI, String localName) { log.trace("addChild: [obj=" + configuration + ",child=" + port + "]"); configuration.addPort(port); @@ -210,7 +226,7 @@ Boolean include = new Boolean(true); String timestamp = attrs.getValue("", "includeTimestamp"); if (timestamp != null) - include = (Boolean) SimpleTypeBindings.unmarshal(timestamp, SimpleTypeBindings.XS_BOOLEAN_NAME, null); + include = (Boolean)SimpleTypeBindings.unmarshal(timestamp, SimpleTypeBindings.XS_BOOLEAN_NAME, null); return new Sign(attrs.getValue("", "type"), attrs.getValue("", "alias"), include.booleanValue()); } @@ -279,7 +295,6 @@ config.setRequires(requires); } - private Object handleTargets(Object object, UnmarshallingContext navigator, String namespaceURI, String localName, Attributes attrs) { log.trace("newChild: " + localName); @@ -456,8 +471,7 @@ /** * Called when parsing of a new element started. */ - public Object newChild(Operation operation, UnmarshallingContext navigator, String namespaceURI, String localName, - Attributes attrs) + public Object newChild(Operation operation, UnmarshallingContext navigator, String namespaceURI, String localName, Attributes attrs) { log.trace("newChild: " + localName); if ("config".equals(localName)) Modified: branches/jbossws-2.0/jbossws-core/src/main/resources/schema/jboss-ws-security_1_0.xsd =================================================================== --- branches/jbossws-2.0/jbossws-core/src/main/resources/schema/jboss-ws-security_1_0.xsd 2007-06-14 18:38:23 UTC (rev 3585) +++ branches/jbossws-2.0/jbossws-core/src/main/resources/schema/jboss-ws-security_1_0.xsd 2007-06-14 19:06:30 UTC (rev 3586) @@ -33,6 +33,11 @@ <xs:documentation>This specifies the trust store's password.</xs:documentation> </xs:annotation> </xs:element> + <xs:element name="key-passwords" type="passwordsType" minOccurs="0"> + <xs:annotation> + <xs:documentation>The passwords for the private keys in the keystore. Only required if the passwords are different from that of the keystore.</xs:documentation> + </xs:annotation> + </xs:element> <xs:element name="config" type="configType" minOccurs="0"> <xs:annotation> <xs:documentation>The default security configuration that is applied to all operations on all ports. This is only used if there is no port/operation config.</xs:documentation> @@ -46,6 +51,27 @@ </xs:sequence> </xs:complexType> </xs:element> + <xs:complexType name="passwordsType"> + <xs:sequence> + <xs:element name="key-password" type="passwordType" minOccurs="0" maxOccurs="unbounded"> + <xs:annotation> + <xs:documentation>The password for a private key in the keystore. Necessary only if the password is different from that of the keystore.</xs:documentation> + </xs:annotation> + </xs:element> + </xs:sequence> + </xs:complexType> + <xs:complexType name="passwordType"> + <xs:attribute name="alias" type="xs:string" use="required"> + <xs:annotation> + <xs:documentation>The name of the private key.</xs:documentation> + </xs:annotation> + </xs:attribute> + <xs:attribute name="password" type="xs:string"> + <xs:annotation> + <xs:documentation>The password of this private key. If not specified, the keystore password will be used.</xs:documentation> + </xs:annotation> + </xs:attribute> + </xs:complexType> <xs:complexType name="configType" mixed="true"> <xs:all> <xs:element name="timestamp" type="timestampType" minOccurs="0">