* {@inheritDoc}
*/
public Entry mapCertificateToUser(Certificate[] certificateChain)
throws DirectoryException
{
FingerprintCertificateMapperCfg config = currentConfig;
AttributeType fingerprintAttributeType = config.getFingerprintAttribute();
String fingerprintAlgorithm = this.fingerprintAlgorithm;
// Make sure that a peer certificate was provided.
if ((certificateChain == null) || (certificateChain.length == 0))
{
Message message = ERR_FCM_NO_PEER_CERTIFICATE.get();
throw new DirectoryException(ResultCode.INVALID_CREDENTIALS, message);
}
// Get the first certificate in the chain. It must be an X.509 certificate.
X509Certificate peerCertificate;
try
{
peerCertificate = (X509Certificate) certificateChain[0];
}
catch (Exception e)
{
if (debugEnabled())
{
TRACER.debugCaught(DebugLogLevel.ERROR, e);
}
Message message = ERR_FCM_PEER_CERT_NOT_X509.get(
String.valueOf(certificateChain[0].getType()));
throw new DirectoryException(ResultCode.INVALID_CREDENTIALS, message);
}
// Get the signature from the peer certificate and create a digest of it
// using the configured algorithm.
String fingerprintString;
try
{
MessageDigest digest = MessageDigest.getInstance(fingerprintAlgorithm);
byte[] fingerprintBytes = digest.digest(peerCertificate.getEncoded());
fingerprintString = bytesToColonDelimitedHex(fingerprintBytes);
}
catch (Exception e)
{
if (debugEnabled())
{
TRACER.debugCaught(DebugLogLevel.ERROR, e);
}
String peerSubject = peerCertificate.getSubjectX500Principal().getName(
X500Principal.RFC2253);
Message message = ERR_FCM_CANNOT_CALCULATE_FINGERPRINT.get(
peerSubject, getExceptionMessage(e));
throw new DirectoryException(ResultCode.INVALID_CREDENTIALS, message);
}
// Create the search filter from the fingerprint.
AttributeValue value =
AttributeValues.create(fingerprintAttributeType, fingerprintString);
SearchFilter filter =
SearchFilter.createEqualityFilter(fingerprintAttributeType, value);
// If we have an explicit set of base DNs, then use it. Otherwise, use the
// set of public naming contexts in the server.
Collection<DN> baseDNs = config.getUserBaseDN();
if ((baseDNs == null) || baseDNs.isEmpty())
{
baseDNs = DirectoryServer.getPublicNamingContexts().keySet();
}