boolean optionalV3Check = false;
/** ** get session id from the request header and *** */
/** ** get private key from servlet context. *** */
String id = request.getHeader(SOTSignOnToolConstants.SESSION_ID);
RSAPrivateKey privateKey = (RSAPrivateKey) getServletConfig()
.getServletContext().getAttribute(id);
if (privateKey == null) {
// Error!!
response.setStatus(SOTSignOnToolConstants.UNKNOWN);
return;
}
/** ** get X509 certificate from the request. *** */
X509Certificate[] certs = (X509Certificate[]) request
.getAttribute("javax.servlet.request.X509Certificate");
// error!
if (certs == null || certs.length == 0) {
response.setStatus(SOTSignOnToolConstants.CERT_NOT_FOUND);
return;
}
X509Certificate cert = certs[0];
/** ** get proxy certificate data from the request. *** */
String proxyStr = "";
try {
DataInputStream dis = new DataInputStream(request.getInputStream());
proxyStr = dis.readUTF();
dis.close();
} catch (Exception e) {
log.error(e.toString());
}
/** ** check whether proxy cert is malicious or not. *** */
/** ** this check is optional. *** */
optionalV3Check = (Boolean.valueOf(rb.getString("OPTIONAL_CERT_CHECK")))
.booleanValue();
if (optionalV3Check) {
SOTV3Verifier verifier = new SOTV3Verifier();
if (!verifier.verifyProxyCert(proxyStr, cert)) {
log.error("proxy cert invalid!");
response.setStatus(SOTSignOnToolConstants.CERT_MALICIOUS);
return;
}
}
/** ** concatenate x509 and proxy and private key and *** */
/** ** save to a file. *** */
byte[] converted;
try {
converted = convert8to1(privateKey.getEncoded());
} catch (Exception e) {
// should never happen.
log.error(e.toString());
response.setStatus(SOTSignOnToolConstants.FAILED_SAVE_PROXY);
return;