Skip to content

Commit 729f71b

Browse files
rathnapandirathnapandi
authored
Merge pull request #33 from Axway-API-Management-Plus/kid
set Kid as alias in JWT sign filter
2 parents 8cf2311 + 337507e commit 729f71b

File tree

3 files changed

+49
-58
lines changed

3 files changed

+49
-58
lines changed

‎README.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -130,9 +130,10 @@ environment:
130130

131131
|environment variable Name | Filter / Connection Name | Description|
132132
--- | --- | ---
133-
|jwtsigncert_name|Connect to URL| Public certificate path or base64 encoded content |
134-
|jwtsignkey_name|Connect to URL| Private key of the certificate path or base64 encoded content |
135-
|jwtsigncacert_name|Connect to URL| CA certificate path or baseb4 encoded content |
133+
|jwtsigncert_name|JWT Sign| Public certificate path or base64 encoded content |
134+
|jwtsignkey_name|JWT Sign| Private key of the certificate path or base64 encoded content |
135+
|jwtsigncacert_name|JWT Sign| CA certificate path or baseb4 encoded content |
136+
|jwtsignkid_name|JWT Sign| Kid corresponding to certificate set as alias name in JWT Sign filter |
136137

137138
### Example
138139

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>com.axway</groupId>
88
<artifactId>apim-env-module</artifactId>
9-
<version>1.1.6</version>
9+
<version>1.1.7</version>
1010

1111
<name>apim-env-module</name>
1212
<url>https://axway.com</url>

‎src/main/java/com/axway/ExternalConfigLoader.java‎

Lines changed: 44 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,8 @@
11
package com.axway;
22

33
import com.vordel.common.Config;
4-
import com.vordel.common.crypto.PasswordCipher;
54
import com.vordel.config.ConfigContext;
65
import com.vordel.config.LoadableModule;
7-
import com.vordel.dwe.Service;
86
import com.vordel.es.*;
97
import com.vordel.es.util.ShorthandKeyFinder;
108
import com.vordel.es.xes.PortableESPK;
@@ -25,12 +23,11 @@ public class ExternalConfigLoader implements LoadableModule {
2523

2624
private final CertHelper certHelper = new CertHelper();
2725
private final ExternalInstanceDomainCert externalInstanceDomainCert = new ExternalInstanceDomainCert();
28-
private PasswordCipher passwordCipher;
26+
private final List<String> mailConnectionTypes = Arrays.asList("NONE", "SSL", "TLS");
2927

3028
@Override
3129
public void load(LoadableModule arg0, String arg1) {
3230
Trace.info("loading Password and Certificate Environment variable Module");
33-
passwordCipher = Service.getInstance().getPasswordCipher();
3431
}
3532

3633
@Override
@@ -60,10 +57,12 @@ private void updatePassword(EntityStore entityStore) {
6057
String key = keysIterator.next();
6158
if (!key.contains("_"))
6259
continue;
60+
if(key.startsWith("ldap_") || key.startsWith("jms_") || key.startsWith("smtp_") || key.startsWith("httpbasic_") || key.startsWith("cassandraconsistency_"))
61+
continue;
6362
String filterName = key.split("_")[1];
6463
String passwordValue = envValues.get(key);
6564
String shorthandKey;
66-
if (key.startsWith("radius")) {
65+
if (key.startsWith("radius")) {
6766
// [RadiusClients]name=RADIUS Client Settings/[RadiusClient]clientName=HMHSRadiusClient/[RadiusServer]host=157.154.52.85,port=1812
6867
shorthandKey = "[RadiusClients]name=RADIUS Client Settings/[RadiusClient]clientName=" + filterName;
6968
for (int i = 1; true; i++) {
@@ -78,10 +77,10 @@ private void updatePassword(EntityStore entityStore) {
7877
port = "1812";
7978
}
8079
String radiusShorthandKey = shorthandKey + "/[RadiusServer]host=" + host + ",port=" + port;
81-
updatePasswordField(entityStore, radiusShorthandKey, "secret", passwordValue, null);
80+
updatePasswordField(entityStore, radiusShorthandKey, "secret", passwordValue);
8281
}
8382
} else if (key.startsWith("cert_")) {
84-
importCertificates(entityStore, passwordValue);
83+
importCertificates(entityStore, passwordValue);
8584
} else if (key.startsWith("disablehttps_")) {
8685
if (passwordValue.equalsIgnoreCase("true")) {
8786
disableInterface(entityStore, filterName, "SSLInterface");
@@ -101,10 +100,7 @@ private void updatePassword(EntityStore entityStore) {
101100
for (X509Certificate certificate : certificates) {
102101
String alias = importPublicCertificate(certificate, entityStore);
103102
if (alias != null) {
104-
if (index == 0)
105-
updateCassandraCert(entityStore, alias, false);
106-
else
107-
updateCassandraCert(entityStore, alias, true);
103+
updateCassandraCert(entityStore, alias, index != 0);
108104
index++;
109105
}
110106
}
@@ -138,7 +134,7 @@ private void updatePassword(EntityStore entityStore) {
138134
String pemKey = System.getenv("listenerkey" + "_" + filterName);
139135
String caCert = System.getenv("listenercacert" + "_" + filterName);
140136
String mTLS = System.getenv("listenermtls" + "_" + filterName);
141-
PKCS12 pkcs12 = importCertAndKeyAndCA(entityStore, passwordValue, caCert, pemKey);
137+
PKCS12 pkcs12 = importCertAndKeyAndCA(entityStore, passwordValue, caCert, pemKey, null);
142138
Trace.info("Pem file alias name :" + pkcs12.getAlias());
143139
configureP12(entityStore, filterName, pkcs12, mTLS);
144140
} catch (Exception e) {
@@ -149,7 +145,7 @@ private void updatePassword(EntityStore entityStore) {
149145
Trace.info("Updating Connect to URL client Auth certificate and key");
150146
String pemKey = System.getenv("connecttourlkey" + "_" + filterName);
151147
String caCert = System.getenv("connecttourlcacert" + "_" + filterName);
152-
String alias = importCertAndKeyAndCA(entityStore, passwordValue, caCert, pemKey).getAlias();
148+
String alias = importCertAndKeyAndCA(entityStore, passwordValue, caCert, pemKey, null).getAlias();
153149
Trace.info("Pem file alias name :" + alias);
154150
connectToURLConfigureP12(entityStore, filterName, alias);
155151
} catch (Exception e) {
@@ -160,22 +156,26 @@ private void updatePassword(EntityStore entityStore) {
160156
Trace.info("Updating JWT Sign - Signing key");
161157
String pemKey = System.getenv("jwtsignkey" + "_" + filterName);
162158
String caCert = System.getenv("jwtsigncacert" + "_" + filterName);
163-
String alias = importCertAndKeyAndCA(entityStore, passwordValue, caCert, pemKey).getAlias();
159+
String alias = System.getenv("jwtsignkid" + "_" + filterName);
160+
PKCS12 pkcs12 = importCertAndKeyAndCA(entityStore, passwordValue, caCert, pemKey, alias);
161+
if (alias == null) {
162+
alias = pkcs12.getAlias();
163+
}
164164
Trace.info("Pem file alias name :" + alias);
165165
jwtSignConfigureP12(entityStore, filterName, alias);
166166
} catch (Exception e) {
167167
Trace.error("Unable to add the key and certificate from Environment variable", e);
168168
}
169169
} else if (key.startsWith("jwtverifycert_")) {
170-
try {
171-
Trace.info("Updating JWT verify certificate");
172-
X509Certificate certificate = certHelper.parseX509(passwordValue).get(0);
173-
String alias = importPublicCertificate(certificate, entityStore);
174-
jwtVerifyConfigureCertificate(entityStore, filterName, alias);
175-
} catch (Exception e) {
176-
Trace.error("Unable to add the certificate from Environment variable", e);
177-
}
178-
}else if (key.startsWith("gatewaytoplogycertandkey_")) {
170+
try {
171+
Trace.info("Updating JWT verify certificate");
172+
X509Certificate certificate = certHelper.parseX509(passwordValue).get(0);
173+
String alias = importPublicCertificate(certificate, entityStore);
174+
jwtVerifyConfigureCertificate(entityStore, filterName, alias);
175+
} catch (Exception e) {
176+
Trace.error("Unable to add the certificate from Environment variable", e);
177+
}
178+
} else if (key.startsWith("gatewaytoplogycertandkey_")) {
179179
try {
180180
Trace.info("Updating Gateway topology certificate");
181181
char[] password = System.getenv("gatewaytoplogycertandkeypassword" + "_" + filterName).toCharArray();
@@ -194,9 +194,9 @@ private void updatePassword(EntityStore entityStore) {
194194
} catch (Exception e) {
195195
Trace.error("Unable to add the p12 from Environment variable", e);
196196
}
197-
}else if(key.startsWith("cassandra_password")){
198-
updateCassandraPassword(entityStore, passwordValue.toCharArray());
199-
}
197+
} else if (key.startsWith("cassandra_password")) {
198+
updateCassandraPassword(entityStore, passwordValue.toCharArray());
199+
}
200200
}
201201

202202
Map<String, Map<String, String>> httpBasicObjs = Util.parseCred(httpBasic);
@@ -206,7 +206,7 @@ private void updatePassword(EntityStore entityStore) {
206206
Map<String, String> attributes = entry.getValue();
207207
String password = attributes.get("password");
208208
String shorthandKey = "/[AuthProfilesGroup]name=Auth Profiles/[BasicAuthGroup]name=HTTP Basic/[BasicProfile]name=" + filterName;
209-
updatePasswordField(entityStore, shorthandKey, "httpAuthPass", password, null);
209+
updatePasswordField(entityStore, shorthandKey, "httpAuthPass", password);
210210
}
211211
}
212212

@@ -246,7 +246,7 @@ private void updatePassword(EntityStore entityStore) {
246246
}
247247
}
248248

249-
private void importCertificates(EntityStore entityStore, String passwordValue){
249+
private void importCertificates(EntityStore entityStore, String passwordValue) {
250250
try {
251251
List<X509Certificate> certificates = certHelper.parseX509(passwordValue);
252252
for (X509Certificate certificate : certificates) {
@@ -264,17 +264,13 @@ private Map<String, String> groupEnvVariables(Map<String, String> envValues, Str
264264
.collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
265265
}
266266

267-
268-
269-
270267
private void updatePasswordField(EntityStore entityStore, String shorthandKey, String fieldName, String
271-
value, Object secret) {
268+
value) {
272269
Trace.info("updating password");
273270
Entity entity = getEntity(entityStore, shorthandKey);
274271
if (entity == null)
275272
return;
276273
value = Base64.getEncoder().encodeToString(value.getBytes());
277-
//passwordCipher.encrypt()
278274
entity.setStringField(fieldName, value);
279275
entityStore.updateEntity(entity);
280276
}
@@ -288,7 +284,6 @@ private void setUsernameAndPassword(Map<String, String> attributes, Entity entit
288284
String password = attributes.get("password");
289285
if (password != null) {
290286
password = Base64.getEncoder().encodeToString(password.getBytes());
291-
//passwordCipher.encrypt()
292287
entity.setStringField("password", password);
293288
}
294289
String username = attributes.get("username");
@@ -332,12 +327,11 @@ private void updateSMTP(EntityStore entityStore, Map<String, String> attributes,
332327
} else {
333328
entity = getEntity(entityStore, "/[SMTPServerGroup]name=SMTP Servers/[SMTPServer]name=" + filterName);
334329
}
335-
if( entity == null){
336-
Trace.error("Unable to locate SMTP connection : " + filterName );
330+
if (entity == null) {
331+
Trace.error("Unable to locate SMTP connection : " + filterName);
337332
return;
338333
}
339334
setUsernameAndPassword(attributes, entity, "username");
340-
341335
String host = attributes.get("url");
342336
if (host != null) {
343337
entity.setStringField("smtpServer", host);
@@ -348,7 +342,6 @@ private void updateSMTP(EntityStore entityStore, Map<String, String> attributes,
348342

349343
private void updateAlertSMTP(EntityStore entityStore, Map<String, String> attributes, String filterName) {
350344
Trace.info("Updating SMTP Alert connection");
351-
352345
if (filterName.equalsIgnoreCase("manager")) {
353346
Entity entity = getEntity(entityStore, "/[AlertManager]name=Default Alert Configuration/[EmailAlertSystem]name=API Manager Email Alerts");
354347
if (entity == null) {
@@ -368,7 +361,7 @@ private void updateMailConnectionTypeAndPort(Entity entity, String filterName, S
368361
String connectionType = System.getenv("smtp_" + filterName + "_connectionType");
369362
if (connectionType != null) {
370363
// Possible Values NONE, SSL TLS
371-
if (MailConnectionTypes.valueOf(connectionType) != null) {
364+
if (mailConnectionTypes.contains(connectionType)) {
372365
entity.setStringField("connectionType", connectionType);
373366
} else {
374367
Trace.error("Invalid connection type : " + connectionType);
@@ -377,7 +370,7 @@ private void updateMailConnectionTypeAndPort(Entity entity, String filterName, S
377370
String port = System.getenv("smtp_" + filterName + "_port");
378371
if (port != null) {
379372
try {
380-
entity.setStringField(portFieldName,port);
373+
entity.setStringField(portFieldName, port);
381374
} catch (NumberFormatException e) {
382375
Trace.error("Invalid SMTP port number :" + port);
383376
}
@@ -403,8 +396,6 @@ private void updateCassandraCert(EntityStore entityStore, String alias, boolean
403396
}
404397
}
405398

406-
407-
408399
private void disableCassandraSSL(EntityStore entityStore) {
409400
String shorthandKey = "/[CassandraSettings]name=Cassandra Settings";
410401
Entity entity = getEntity(entityStore, shorthandKey);
@@ -493,11 +484,8 @@ private void trustRootAndIntermediateCerts(EntityStore entityStore, Entity entit
493484
final String alias = principal.getName();
494485
Trace.info("Trusting cert :" + alias);
495486
String fieldName = "caCert";
496-
if (i == 1) {
497-
updateCertEntity(entityStore, entity, alias, fieldName, false);
498-
} else
499-
// Trust more than one certificate for mutual auth
500-
updateCertEntity(entityStore, entity, alias, fieldName, true);
487+
// Trust more than one certificate for mutual auth
488+
updateCertEntity(entityStore, entity, alias, fieldName, i != 1);
501489
}
502490
}
503491

@@ -647,20 +635,22 @@ private PKCS12 importP12(EntityStore entityStore, String cert, char[] password)
647635
}
648636

649637

650-
private PKCS12 importCertAndKeyAndCA(EntityStore entityStore, String cert, String ca, String key) throws Exception {
638+
private PKCS12 importCertAndKeyAndCA(EntityStore entityStore, String cert, String ca, String key, String alias) throws Exception {
651639

652640
PKCS12 pkcs12 = new PKCS12();
653641
List<X509Certificate> caCerts = new ArrayList<>();
654642
if (ca != null) {
655643
caCerts = certHelper.parseX509(ca);
656644
}
657645
X509Certificate certObj = certHelper.parseX509(cert).get(0);
658-
String alias = certObj.getSubjectDN().getName();
659-
if (alias.equals("")) {
660-
alias = certObj.getSerialNumber().toString();
646+
if (alias == null) {
647+
alias = certObj.getSubjectDN().getName();
648+
if (alias.equals("")) {
649+
alias = certObj.getSerialNumber().toString();
650+
}
661651
}
662652
PrivateKey privateKey = certHelper.parsePrivateKey(key);
663-
if( privateKey == null){
653+
if (privateKey == null) {
664654
throw new Exception("Unable to parse a private key");
665655
}
666656
Trace.info("Certificate alias name : " + alias);
@@ -731,7 +721,8 @@ private void updateCassandraConsistencyLevel(EntityStore entityStore, String rea
731721

732722
}
733723

734-
private void updateCassandraConsistencyLevel(ShorthandKeyFinder shorthandKeyFinder, String shorthandKey, String readConsistencyLevelFieldName, String readConsistencyLevel, String writeConsistencyLevelFieldName, String writeConsistencyLevel) {
724+
private void updateCassandraConsistencyLevel(ShorthandKeyFinder shorthandKeyFinder, String shorthandKey, String readConsistencyLevelFieldName, String readConsistencyLevel,
725+
String writeConsistencyLevelFieldName, String writeConsistencyLevel) {
735726
List<Entity> kpsEntities = shorthandKeyFinder.getEntities(shorthandKey);
736727
if (kpsEntities != null) {
737728
Trace.info("Total number of KPS Store: " + kpsEntities.size() + " in entity : " + shorthandKey);
@@ -744,6 +735,5 @@ private void updateCassandraConsistencyLevel(ShorthandKeyFinder shorthandKeyFind
744735
}
745736
}
746737

747-
public enum MailConnectionTypes {NONE, SSL, TLS}
748738

749739
}

0 commit comments

Comments
 (0)