Package se.swedenconnect.security.credential

Class PkiCredentialCollection

java.lang.Object

se.swedenconnect.security.credential.PkiCredentialCollection

public class PkiCredentialCollection
extends Object

A collection of PkiCredential instances.

This class may be used as a bean for a system that uses several different keys, for example a SAML IdP that has a signature key, an encryption key and possibly other keys. By using the predefined Predicates, a credential having the desired properties can be located.

Author:

Martin Lindström

Field Summary

Fields

Modifier and Type	Field	Description
static Predicate<PkiCredential>	encryptionUsage	Predicate that checks if the credential has the PkiCredential.Metadata.USAGE_ENCRYPTION usage.
static Predicate<PkiCredential>	forFutureSigning	Predicate that tells if a credential is intended to be the signing credential in the future.
static Predicate<PkiCredential>	isActive	Predicate that checks if the credential is "active", meaning that the current time is within the PkiCredential.Metadata.ACTIVE_FROM_PROPERTY and PkiCredential.Metadata.ACTIVE_TO_PROPERTY properties.
static Predicate<PkiCredential>	isEc	Predicate that tells whether a credential holds an EC key.
static Predicate<PkiCredential>	isHardwareCredential	Predicate that tells whether a credential is a hardware credential, i.e., stored on an HSM.
static Predicate<PkiCredential>	isNotYetActive	Predicate that tells whether the credential is "not yet active", meaning that the PkiCredential.Metadata.ACTIVE_FROM_PROPERTY setting is after the current time.
static Predicate<PkiCredential>	isRsa	Predicate that tells whether a credential holds an RSA key.
static Predicate<PkiCredential>	noLongerActive	Predicate that checks if the credential is no longer active, meaning that a PkiCredential.Metadata.ACTIVE_TO_PROPERTY setting is before the current time.
static Predicate<PkiCredential>	signatureUsage	Predicate that checks if the credential has the PkiCredential.Metadata.USAGE_SIGNING usage.
static Predicate<PkiCredential>	unspecifiedUsage	Predicate that checks if the credential does not have a specified usage.

Constructor Summary

Constructors

Constructor	Description
PkiCredentialCollection(List<PkiCredential> credentials)	Constructor.

Method Summary

Modifier and Type	Method	Description
void	addCredential(PkiCredential credential)	Adds a credential to the collection.
PkiCredential	getCredential(Predicate<PkiCredential> predicate)	Returns the first credential of the collection whose properties meet the supplied Predicate.
PkiCredential	getCredentialForSigning()	Method that finds a credential suitable for signing.
List<PkiCredential>	getCredentials()	Gets an unmodifiable list of all credentials held in the collection.
List<PkiCredential>	getCredentials(Predicate<PkiCredential> predicate)	Returns all credentials whose properties meet the supplied Predicate.
List<PkiCredential>	getCredentialsForEncryption()	Method that finds credentials suitable for encryption (and decryption).
static Predicate<PkiCredential>	keyId(String kid)	Method that returns a Predicate that checks if a credential has a given key ID.
List<PkiCredential>	removeCredentials(Predicate<PkiCredential> predicate)	Removes all credentials matching the supplied Predicate.
static Predicate<PkiCredential>	usage(String usage)	Method that returns a Predicate that checks if a credential has a given usage.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

isRsa

public static Predicate<PkiCredential> isRsa

Predicate that tells whether a credential holds an RSA key.

isEc

public static Predicate<PkiCredential> isEc

Predicate that tells whether a credential holds an EC key.

isHardwareCredential

public static Predicate<PkiCredential> isHardwareCredential

Predicate that tells whether a credential is a hardware credential, i.e., stored on an HSM.

signatureUsage

public static Predicate<PkiCredential> signatureUsage

Predicate that checks if the credential has the PkiCredential.Metadata.USAGE_SIGNING usage.

encryptionUsage

public static Predicate<PkiCredential> encryptionUsage

Predicate that checks if the credential has the PkiCredential.Metadata.USAGE_ENCRYPTION usage.

unspecifiedUsage

public static Predicate<PkiCredential> unspecifiedUsage

Predicate that checks if the credential does not have a specified usage.

isActive

public static Predicate<PkiCredential> isActive

Predicate that checks if the credential is "active", meaning that the current time is within the PkiCredential.Metadata.ACTIVE_FROM_PROPERTY and PkiCredential.Metadata.ACTIVE_TO_PROPERTY properties. If no such properties are set, the credential is assumed to be active.

noLongerActive

public static Predicate<PkiCredential> noLongerActive

Predicate that checks if the credential is no longer active, meaning that a PkiCredential.Metadata.ACTIVE_TO_PROPERTY setting is before the current time.

isNotYetActive

public static Predicate<PkiCredential> isNotYetActive

Predicate that tells whether the credential is "not yet active", meaning that the PkiCredential.Metadata.ACTIVE_FROM_PROPERTY setting is after the current time.

forFutureSigning

public static Predicate<PkiCredential> forFutureSigning

Predicate that tells if a credential is intended to be the signing credential in the future.

Constructor Details

PkiCredentialCollection

public PkiCredentialCollection(@Nonnull
 List<PkiCredential> credentials)

Constructor.

Parameters:

credentials - the credentials to store in the collection

Method Details

getCredentials

@Nonnull
public List<PkiCredential> getCredentials()

Gets an unmodifiable list of all credentials held in the collection.

Returns:

the credentials

getCredential

@Nullable
public PkiCredential getCredential(@Nonnull
 Predicate<PkiCredential> predicate)

Returns the first credential of the collection whose properties meet the supplied Predicate.

Parameters:

predicate - the Predicate

Returns:

the first credential whose properties meet the supplied predicate, or null if no match is found

getCredentials

@Nonnull
public List<PkiCredential> getCredentials(@Nonnull
 Predicate<PkiCredential> predicate)

Returns all credentials whose properties meet the supplied Predicate.

Parameters:

predicate - the Predicate

Returns:

a unmodifiable list of all matching credentials (may be empty)

addCredential

public void addCredential(@Nonnull
 PkiCredential credential)

Adds a credential to the collection.

Parameters:

credential - the credential to add

removeCredentials

@Nonnull
public List<PkiCredential> removeCredentials(@Nonnull
 Predicate<PkiCredential> predicate)

Removes all credentials matching the supplied Predicate.

Parameters:

predicate - the Predicate

Returns:

a list of the credentials that were removed from the collection

keyId

public static Predicate<PkiCredential> keyId(@Nonnull
 String kid)

Method that returns a Predicate that checks if a credential has a given key ID.

The implementation will look for the credential metadata entry "key-id".

Parameters:

kid - the key ID to check for

Returns:

a Predicate

usage

public static Predicate<PkiCredential> usage(@Nonnull
 String usage)

Method that returns a Predicate that checks if a credential has a given usage.

The implementation will look for the credential metadata entry PkiCredential.Metadata.USAGE_PROPERTY.

Parameters:

usage - the usage to check

Returns:

a Predicate

getCredentialForSigning

@Nullable
public PkiCredential getCredentialForSigning()

Method that finds a credential suitable for signing. It first tries to find an active credential with the usage set to PkiCredential.Metadata.USAGE_SIGNING, and if no such credential is found, an active credential with no specified usage.

Returns:

a PkiCredential or null

getCredentialsForEncryption

@Nonnull
public List<PkiCredential> getCredentialsForEncryption()

Method that finds credentials suitable for encryption (and decryption).

Returns:

a (possibly empty) list of credentials