Package io.bdeploy.common.security
Class SecurityHelper
java.lang.Object
io.bdeploy.common.security.SecurityHelper
Encapsulates certificate and token handling for mutual authentication.
-
Field Summary
Fields -
Method Summary
Modifier and TypeMethodDescriptionstatic SecretKeySpeccreateSecretKey(char[] password) <T> StringcreateSignaturePack(T payload, Path keystore, char[] passphrase) Creates a new encoded and signed token for this server.<T> StringcreateSignaturePack(T payload, KeyStore keystore, char[] passphrase) Creates a new encoded and signed token for this server.<T> StringcreateToken(T payload, KeyStore ks, char[] passphrase) Create a valid security token suitable for HTTPS traffic verification.static Stringdecrypt(String data, SecretKeySpec key) static Stringencrypt(String data, SecretKeySpec key) static SecurityHelper<T> TgetSelfVerifiedPayloadFromPack(String token, Class<T> clazz) Accepts a token inStringform, extracts the payload from it (seecreateSignaturePack(Object, Path, char[])) and verifies that the enclosed signature is valid for the decoded payload using the enclosed public certificate.getSignedToken(KeyStore ks, char[] passphrase) Retrieve the signed token for authentication against a server using this helper to decode the token.getTokenFromPack(String pack) Extract the pure token (required for HTTPS authentication) from a signature pack.<T> TgetVerifiedPayload(String token, Class<T> clazz, KeyStore ks) Accepts a token inStringform, extracts the payload from it (seecreateSignaturePack(Object, Path, char[])) and verifies that the enclosed signature is valid for the decoded payload.voidimportSignaturePack(String pack, Path keystore, char[] passphrase) voidimportSignaturePack(String pack, KeyStore ks, char[] passphrase) Accepts an encoded and signed token and imports the enclosed security relevant information into the given (JCEKS) keystore.loadPrivateKeyStore(InputStream is, char[] passphrase) loadPrivateKeyStore(Path keystore, char[] passphrase) Load and return a PKCS12 formatted keystore.loadPublicKeyStore(InputStream is, char[] passphrase) loadPublicKeyStore(Path keystore, char[] passphrase) Load and return (create on demand) a JCEKS formatted keystore.
-
Field Details
-
ROOT_ALIAS
- See Also:
-
CERT_ALIAS
- See Also:
-
-
Method Details
-
getInstance
-
createSecretKey
- Parameters:
password- the password for the key- Returns:
- a secret key which can be used for encryption and decryption of passwords
- Throws:
GeneralSecurityException
-
encrypt
- Parameters:
data- the data to encryptkey- the key to use to encrypt- Returns:
- the encrypted data
- Throws:
GeneralSecurityException
-
decrypt
- Parameters:
data- the encrypted datakey- the key to use to decrypt the data- Returns:
- the decrypted data
- Throws:
GeneralSecurityException
-
createSignaturePack
public <T> String createSignaturePack(T payload, KeyStore keystore, char[] passphrase) throws GeneralSecurityException Creates a new encoded and signed token for this server.To generate an appropriate self signed certificate in a (PKCS12) keystore, use this:
openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 17800 -out cert.pem openssl pkcs12 -inkey key.pem -in cert.pem -export -out certstore.p12
- Parameters:
payload- the payload to sign. will be serialized and encoded in the final signed tokenkeystore- the keystore containing the private key. The keystore must be in PKCS12 format and contain exactly one entry, which is the private X.509 certificate.passphrase- the passphrase for both the keystore and the certificate within.- Returns:
- an encoded and signed token containing all security relevant information for a client to connect to this server.
- Throws:
GeneralSecurityException
-
createSignaturePack
public <T> String createSignaturePack(T payload, Path keystore, char[] passphrase) throws GeneralSecurityException, IOException Creates a new encoded and signed token for this server.To generate an appropriate self signed certificate in a (PKCS12) keystore, use this:
openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 17800 -out cert.pem openssl pkcs12 -inkey key.pem -in cert.pem -export -out certstore.p12
- Parameters:
payload- the payload to sign. will be serialized and encoded in the final signed tokenkeystore- the keystore containing the private key. The keystore must be in PKCS12 format and contain exactly one entry, which is the private X.509 certificate.passphrase- the passphrase for both the keystore and the certificate within.- Returns:
- an encoded and signed token containing all security relevant information for a client to connect to this server.
- Throws:
GeneralSecurityExceptionIOException
-
createToken
Create a valid security token suitable for HTTPS traffic verification. Used to pass to clients connecting and authorizing to use APIs.- Parameters:
payload- the token payload.ks- the keystore.passphrase- the passphrase.- Returns:
- a signed token
-
getVerifiedPayload
public <T> T getVerifiedPayload(String token, Class<T> clazz, KeyStore ks) throws GeneralSecurityException Accepts a token inStringform, extracts the payload from it (seecreateSignaturePack(Object, Path, char[])) and verifies that the enclosed signature is valid for the decoded payload.- Parameters:
token- the encoded payload and signature.clazz- theClassof the payload - used for de-serialization.ks- the keystore containing the private key and certificate- Returns:
- the signed payload, if the signature is valid.
- Throws:
GeneralSecurityException
-
getSelfVerifiedPayloadFromPack
public <T> T getSelfVerifiedPayloadFromPack(String token, Class<T> clazz) throws GeneralSecurityException, IOException Accepts a token inStringform, extracts the payload from it (seecreateSignaturePack(Object, Path, char[])) and verifies that the enclosed signature is valid for the decoded payload using the enclosed public certificate.This does NOT verify that the enclosed signature is valid against a present private key.
- Parameters:
token- the encoded payload and signature.clazz- theClassof the payload - used for de-serialization.- Returns:
- the signed payload, if the signature is valid.
- Throws:
GeneralSecurityExceptionIOException
-
getTokenFromPack
Extract the pure token (required for HTTPS authentication) from a signature pack. -
importSignaturePack
public void importSignaturePack(String pack, KeyStore ks, char[] passphrase) throws GeneralSecurityException, IOException Accepts an encoded and signed token and imports the enclosed security relevant information into the given (JCEKS) keystore. The keystore is created if it does not exist.- Parameters:
pack- the token/signature pack inStringformks- the keystore to use.passphrase- the passphrase used to decode and encode the keystore.- Throws:
GeneralSecurityExceptionIOException
-
importSignaturePack
public void importSignaturePack(String pack, Path keystore, char[] passphrase) throws GeneralSecurityException, IOException Loads aKeyStorefrom the givenPathor creates one if it does not exist, imports the signature pack and saves theKeyStoreafterwards back to the givenPath.- Throws:
GeneralSecurityExceptionIOException- See Also:
-
getSignedToken
Retrieve the signed token for authentication against a server using this helper to decode the token.- Parameters:
ks- the public keystorepassphrase- the passphrase for the keystore- Returns:
- an encoded token which can be sent to the server.
- Throws:
GeneralSecurityException
-
loadPrivateKeyStore
public KeyStore loadPrivateKeyStore(Path keystore, char[] passphrase) throws GeneralSecurityException, IOException Load and return a PKCS12 formatted keystore.- Throws:
GeneralSecurityExceptionIOException
-
loadPrivateKeyStore
public KeyStore loadPrivateKeyStore(InputStream is, char[] passphrase) throws GeneralSecurityException, IOException - Throws:
GeneralSecurityExceptionIOException- See Also:
-
loadPublicKeyStore
public KeyStore loadPublicKeyStore(Path keystore, char[] passphrase) throws GeneralSecurityException, IOException Load and return (create on demand) a JCEKS formatted keystore.- Throws:
GeneralSecurityExceptionIOException
-
loadPublicKeyStore
public KeyStore loadPublicKeyStore(InputStream is, char[] passphrase) throws GeneralSecurityException, IOException - Throws:
GeneralSecurityExceptionIOException- See Also:
-