/*
* Copyright 2013, The Sporting Exchange Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.betfair.cougar.core.impl.security;
import com.betfair.cougar.api.security.IdentityToken;
import com.betfair.cougar.api.security.IdentityTokenResolver;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.naming.InvalidNameException;
import javax.naming.NamingException;
import javax.naming.ldap.LdapName;
import javax.naming.ldap.Rdn;
import javax.security.auth.x500.X500Principal;
import java.security.Principal;
import java.security.cert.X509Certificate;
import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
/**
* An abstract class to deal with loading application keys from the Common name of a 2-way SSL encryption.
*/
public abstract class SSLAwareTokenResolver<I,O,C> implements IdentityTokenResolver<I,O,C> {
public static final String SSL_CERT_INFO = "X-SSL-Cert-Info";
private final CertInfoExtractor certInfoExtractor;
protected SSLAwareTokenResolver(CertInfoExtractor certInfoExtractor) {
if (certInfoExtractor == null) {
throw new IllegalArgumentException("CertInfoExtractor cannot be null");
}
this.certInfoExtractor = certInfoExtractor;
}
protected void attachCertInfo(List<IdentityToken> credentials, X509Certificate[] certificateChain) throws NamingException {
// Check if a SSL Common name has appeared
String sSLCertInfo = findCertInfo(certificateChain);
if (sSLCertInfo != null) {
credentials.add(new IdentityToken(SSL_CERT_INFO, sSLCertInfo));
}
}
/**
* Find an the info from the cert chain provided. <code>null</code> if none found
*/
protected String findCertInfo(X509Certificate[] x509certificates) throws NamingException {
if (x509certificates != null && x509certificates.length != 0) {
// Only ever use the first certificate, as this si the client supplied one.
// Further ones are trust stores and CAs that have signed the first cert.
Principal subject = x509certificates[0].getSubjectDN();
if (subject != null && subject.getName() != null) {
List<Rdn> rdns;
try {
rdns = new LdapName(subject.getName()).getRdns();
}
catch (InvalidNameException ine) {
return null;
}
return certInfoExtractor.extractCertInfo(rdns);
}
}
return null;
}
}