// Set the default value
issuerPolicy = TokenVerifierConstants.SELF_AND_MANGED;
} else if (!(issuerPolicy.equals(TokenVerifierConstants.SELF_ONLY)
|| issuerPolicy.equals(TokenVerifierConstants.MANGED_ONLY) || issuerPolicy
.equals(TokenVerifierConstants.SELF_AND_MANGED))) {
throw new IdentityException("Invalid Issuer Policy!");
}
try {
store = KeyStore.getInstance(storeType);
stream = new FileInputStream(keyStore);
store.load(stream, storePass.toCharArray());
privateKey = (PrivateKey) store.getKey(keyAlias, keyPass.toCharArray());
trustStore = store;
} catch (Exception e) {
throw new IdentityException("Cannot load the private key", e);
} finally {
if (stream != null) {
try {
stream.close();
} catch (IOException e) {
log.error("Error while closing system keystore file", e);
}
}
}
// Step 2: Reading Token validate policy - Promiscuous/BlackList/WhiteList/CertValidate
// Promiscuous - In this mode, all tokens that has a valid signature are allowed
// CertValidate - In this mode, all tokens that has a valid signature by an IdP who has a
// trusted certificate are allowed
// WhiteList - First CertValidity checked and after that if the issuer
// DN is in the white list, the token is allowed
// BlackList - First CertValidity checked and after that if the issuer
// DN is not listed in the BlackList, the token is allowed
validatePolicy = IdentityUtil.getProperty(ServerConfig.TOKEN_VALIDATE_POLICY);
if (validatePolicy == null || validatePolicy.trim().length() == 0) {
validatePolicy = TokenVerifierConstants.CERT_VALIDATE;
}
// Step 3: Reading parameters of each policy
if (validatePolicy.equals(TokenVerifierConstants.BLACK_LIST)) {
String value = IdentityUtil.getProperty(ServerConfig.BLACK_LIST);
if (value != null) {
blackList = readBlackWhiteList(value);
}
} else if (validatePolicy.equals(TokenVerifierConstants.WHITE_LIST)) {
String value = IdentityUtil.getProperty(ServerConfig.WHITE_LIST);
if (value != null) {
whiteList = readBlackWhiteList(value);
}
}
if (validatePolicy.equals(TokenVerifierConstants.WHITE_LIST)
|| validatePolicy.equals(TokenVerifierConstants.BLACK_LIST)
|| validatePolicy.equals(TokenVerifierConstants.CERT_VALIDATE)) {
String javaHome = null;
String defaultKeyStore = null;
FileInputStream fileStream = null;
KeyStore sysKS = null;
String defaultStorePass = IdentityUtil.getProperty(ServerConfig.SYSTEM_KEY_STORE_PASS);
if (defaultStorePass == null) {
// assume that it hasn't been changed
defaultStorePass = "changeit";
}
javaHome = System.getenv("JAVA_HOME");
if (javaHome == null) {
throw new IdentityException("Cannot find JAVA_HOME");
}
defaultKeyStore = IdentityUtil.getProperty(ServerConfig.SYSTEM_KEY_STORE);
if (defaultKeyStore != null && defaultKeyStore.trim().length() > 0) {
defaultKeyStore = javaHome + defaultKeyStore;
} else {
if (File.separator.equals("/")) {
defaultKeyStore = javaHome + TokenVerifierConstants.CACERTS_STORE_UNIX;
} else {
defaultKeyStore = javaHome + TokenVerifierConstants.CACERTS_STORE_WIN;
}
}
try {
fileStream = new FileInputStream(defaultKeyStore);
sysKS = KeyStore.getInstance("JKS");
sysKS.load(fileStream, defaultStorePass.toCharArray());
this.systemStore = sysKS;
} catch (RuntimeException e){
throw e;
} catch (Exception e) {
throw new IdentityException("Cannot load system key store");
} finally {
if (fileStream != null) {
try {
fileStream.close();
} catch (IOException e) {