Package se.swedenconnect.security.credential

Class Pkcs11Credential

java.lang.Object

se.swedenconnect.security.credential.AbstractPkiCredential

se.swedenconnect.security.credential.AbstractReloadablePkiCredential

se.swedenconnect.security.credential.Pkcs11Credential

All Implemented Interfaces:

DisposableBean, InitializingBean, PkiCredential, ReloadablePkiCredential

public class Pkcs11Credential
extends AbstractReloadablePkiCredential

A PKCS#11 credential implementation of the PkiCredential and ReloadablePkiCredential interfaces.

Author:

Martin Lindström (martin@idsec.se), Stefan Santesson (stefan@idsec.se)

Constructor Summary

Constructors

Constructor	Description
Pkcs11Credential()	Default constructor.
Pkcs11Credential(Pkcs11Configuration configuration, String alias, char[] pin)	Constructor.
Pkcs11Credential(Pkcs11Configuration configuration, String alias, char[] pin, X509Certificate certificate)	Constructor that takes a X.509 certificate as an argument.
Pkcs11Credential(Pkcs11Configuration configuration, String alias, char[] pin, List<X509Certificate> certificates)	Constructor that takes a list of X.509 certificates as an argument.

Method Summary

Modifier and Type	Method	Description
void	afterPropertiesSet()	The default implementation verfies that the public key and the private key is available.
void	destroy()	Implementations that need to perform clean-up actions should override this method.
X509Certificate	getCertificate()	Gets the certificate holding the public key of the key pair.
List<X509Certificate>	getCertificateChain()	Gets a certificate chain for the credential, where the first element is the entity certificate (PkiCredential.getCertificate()).
protected String	getDefaultName()	If the credential name property is not explicitly assigned using AbstractPkiCredential.setName(String) a name is calculated based on a credential's properties.
PrivateKey	getPrivateKey()	Gets the private key.
PublicKey	getPublicKey()	Gets the public key.
boolean	isHardwareCredential()	Returns true.
void	reload()	Is called if the connection to the device has been lost.
void	setAlias(String alias)	Assigns the alias of the key pair on the token.
void	setConfiguration(Pkcs11Configuration configuration)	Assigns the PKCS#11 configuration for the token that holds this credential.
void	setConfigurationFile(String configurationFile)	Assigns the PKCS#11 configuration file to use.
void	setPin(char[] pin)	Assigns the PIN (key password) needed to unlock the token.
void	setPrivateKey(PrivateKey privateKey)	Will throw an IllegalArgumentException since the private key will be read from the device.
void	setPublicKey(PublicKey publicKey)	Will throw an IllegalArgumentException since the public key will be read from the certificate.

Methods inherited from class se.swedenconnect.security.credential.AbstractReloadablePkiCredential

getTestFunction, setTestFunction

Methods inherited from class se.swedenconnect.security.credential.AbstractPkiCredential

getName, setCertificate, setCertificate, setCertificateChain, setName, setPrivateKey, setPrivateKey

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface se.swedenconnect.security.credential.PkiCredential

getName, init, setCertificate, setCertificateChain

Constructor Details

Pkcs11Credential

public Pkcs11Credential()

Default constructor.

Pkcs11Credential

public Pkcs11Credential(Pkcs11Configuration configuration,
 String alias,
 char[] pin)
                 throws IllegalArgumentException,
SecurityException

Constructor.

Parameters:

configuration - the PKCS#11 configuration

alias - the token entry from where to load the private key and certificate

pin - the PIN to unlock the token

Throws:

IllegalArgumentException - for missing parameters

SecurityException - if loading of the private key and/or certificate fails

Pkcs11Credential

public Pkcs11Credential(Pkcs11Configuration configuration,
 String alias,
 char[] pin,
 X509Certificate certificate)

Constructor that takes a X.509 certificate as an argument. This constructor should be used if we know that the certificate is not placed on the device (only the private key).

Parameters:

configuration - the PKCS#11 configuration

alias - the token entry from where to load the private key

pin - the PIN to unlock the token

certificate - the certificate

Pkcs11Credential

public Pkcs11Credential(Pkcs11Configuration configuration,
 String alias,
 char[] pin,
 List<X509Certificate> certificates)

Constructor that takes a list of X.509 certificates as an argument. This constructor should be used if we know that the certificate chain is not placed on the device (only the private key).

Parameters:

configuration - the PKCS#11 configuration

alias - the token entry from where to load the private key

pin - the PIN to unlock the token

certificates - the certificate chain (entity certificate placed first)

Method Details

afterPropertiesSet

public void afterPropertiesSet()
                        throws Exception

The default implementation verfies that the public key and the private key is available. Implementations that needs to be initialized (for example by loading the keys) should override this method.

Specified by:

afterPropertiesSet in interface InitializingBean

Overrides:

afterPropertiesSet in class AbstractPkiCredential

Throws:

Exception

destroy

public void destroy()

Implementations that need to perform clean-up actions should override this method. The default implementation does nothing.

Specified by:

destroy in interface DisposableBean

Overrides:

destroy in class AbstractPkiCredential

isHardwareCredential

public boolean isHardwareCredential()

Returns true.

Returns:

true if the credential resides in a hardware module and false otherwise

getPrivateKey

public PrivateKey getPrivateKey()

Gets the private key.

Specified by:

getPrivateKey in interface PkiCredential

Overrides:

getPrivateKey in class AbstractPkiCredential

Returns:

the private key

setPrivateKey

public void setPrivateKey(PrivateKey privateKey)

Will throw an IllegalArgumentException since the private key will be read from the device.

Overrides:

setPrivateKey in class AbstractPkiCredential

Parameters:

privateKey - the private key

getPublicKey

public PublicKey getPublicKey()

Gets the public key.

Specified by:

getPublicKey in interface PkiCredential

Overrides:

getPublicKey in class AbstractPkiCredential

Returns:

the public key

setPublicKey

public void setPublicKey(PublicKey publicKey)

Will throw an IllegalArgumentException since the public key will be read from the certificate.

Overrides:

setPublicKey in class AbstractPkiCredential

Parameters:

publicKey - the public key.

getCertificate

public X509Certificate getCertificate()

Gets the certificate holding the public key of the key pair. May be null depending on whether certificates are handled by the implementing class.

Specified by:

getCertificate in interface PkiCredential

Overrides:

getCertificate in class AbstractPkiCredential

Returns:

the certificate, or null if no certificate is configured for the credential

getCertificateChain

public List<X509Certificate> getCertificateChain()

Gets a certificate chain for the credential, where the first element is the entity certificate (PkiCredential.getCertificate()). If no certificate is configured for the credential an empty list is returned.

Specified by:

getCertificateChain in interface PkiCredential

Overrides:

getCertificateChain in class AbstractPkiCredential

Returns:

a list of certificates, or an empty list

setConfiguration

public void setConfiguration(Pkcs11Configuration configuration)

Assigns the PKCS#11 configuration for the token that holds this credential.

Parameters:

configuration - the configuration

setConfigurationFile

public void setConfigurationFile(String configurationFile)
                          throws Pkcs11ConfigurationException

Assigns the PKCS#11 configuration file to use.

Note: An instance of DefaultPkcs11Configuration will be created. This assumes the use of the SunPKCS11 security provider. If another provider is desired, use the setConfiguration(Pkcs11Configuration) instead.

Parameters:

configurationFile - complete path to the PKCS#11 configuration file

Throws:

Pkcs11ConfigurationException - if the configuration file is invalid

setAlias

public void setAlias(String alias)

Assigns the alias of the key pair on the token.

Parameters:

alias - the alias

setPin

public void setPin(char[] pin)

Assigns the PIN (key password) needed to unlock the token.

Parameters:

pin - the PIN

reload

public void reload()
            throws Exception

Is called if the connection to the device has been lost. In those cases we reload the private key.

Throws:

Exception - for reloading errors

getDefaultName

protected String getDefaultName()

If the credential name property is not explicitly assigned using AbstractPkiCredential.setName(String) a name is calculated based on a credential's properties.

Implementations must not assume that the object has been correctly initialized.

Specified by:

getDefaultName in class AbstractPkiCredential

Returns:

the credential name