Skip to content

Commit e95e1bf

Browse files
rathnapandirathnapandi
authored
Merge pull request #48 from Axway-API-Management-Plus/cassandra_client_auth
Cassandra client auth
2 parents 1070c02 + e622c14 commit e95e1bf

File tree

10 files changed

+399
-256
lines changed

10 files changed

+399
-256
lines changed

‎.github/badges/jacoco.svg‎

Lines changed: 1 addition & 1 deletion
Loading

‎README.md‎

Lines changed: 69 additions & 54 deletions
Large diffs are not rendered by default.

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>com.axway</groupId>
88
<artifactId>apim-env-module</artifactId>
9-
<version>1.1.9</version>
9+
<version>1.1.10</version>
1010

1111
<name>apim-env-module</name>
1212
<url>https://axway.com</url>

‎src/main/java/com/axway/ExternalConfigLoader.java‎

Lines changed: 58 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -72,21 +72,28 @@ public void updatePassword(EntityStore entityStore) {
7272
disableInterface(entityStore, filterName, "InetInterface");
7373
}
7474
} else if (key.equalsIgnoreCase("cassandra_disablessl")) {
75-
if (passwordValue.equalsIgnoreCase("true")) {
76-
disableCassandraSSL(entityStore);
77-
}
75+
disableCassandraSSL(entityStore, passwordValue);
7876
} else if (key.startsWith("cassandraCert")) {
7977
try {
80-
List<X509Certificate> certificates = certHelper.parseX509(passwordValue);
81-
int index = 0;
82-
for (X509Certificate certificate : certificates) {
83-
String alias = importPublicCertificate(certificate, entityStore);
84-
if (alias != null) {
85-
updateCassandraCert(entityStore, alias, index != 0);
86-
index++;
78+
String pemKey = System.getenv("cassandra_private_key");
79+
String publicKey = System.getenv("cassandra_public_key");
80+
if( pemKey != null && publicKey != null) {
81+
PKCS12 pkcs12 = importCertAndKeyAndCA(entityStore, publicKey, passwordValue, pemKey, null);
82+
Trace.info("Pem file alias name :" + pkcs12.getAlias());
83+
updateCassandraCertAndKey(entityStore, pkcs12.getAlias(), pkcs12.getCertificates());
84+
}else {
85+
List<X509Certificate> certificates = certHelper.parseX509(passwordValue);
86+
87+
int index = 0;
88+
for (X509Certificate certificate : certificates) {
89+
String alias = importPublicCertificate(certificate, entityStore);
90+
if (alias != null) {
91+
updateCassandraCert(entityStore, alias, index != 0);
92+
index++;
93+
}
8794
}
8895
}
89-
} catch (CertificateException | FileNotFoundException e) {
96+
} catch (Exception e) {
9097
Trace.error("Unable to add Cassandra certificate from Environment variable", e);
9198
}
9299
} else if (key.startsWith("certandkey_")) {
@@ -375,22 +382,52 @@ public void updateCassandraPassword(EntityStore entityStore, char[] password) {
375382
entityStore.updateEntity(entity);
376383
}
377384

378-
public void updateCassandraCert(EntityStore entityStore, String alias, boolean append) {
385+
386+
387+
public void updateCassandraCertAndKey(EntityStore entityStore, String clientAuthAlias, Certificate[] certificates) {
388+
Entity entity = getCassandraEntity(entityStore);
389+
boolean useSSL = entity.getBooleanValue("useSSL");
390+
if (useSSL) {
391+
392+
String clientAuth = "sslCertificate";
393+
updateCertEntity(entityStore, entity, clientAuthAlias, clientAuth, false);
394+
String filedName = "sslTrustedCerts";
395+
396+
if( certificates.length > 1){
397+
// Start from 1 To ignore public key associated with private key
398+
for (int i = 1; i < certificates.length; i++) {
399+
Certificate certificate = certificates[i];
400+
String alias = Util.getAliasName((X509Certificate) certificate);
401+
updateCertEntity(entityStore, entity, alias, filedName, true);
402+
}
403+
}
404+
}
405+
}
406+
407+
public Entity getCassandraEntity(EntityStore entityStore){
379408
String shorthandKey = "/[CassandraSettings]name=Cassandra Settings";
380-
Entity entity = getEntity(entityStore, shorthandKey);
409+
return getEntity(entityStore, shorthandKey);
410+
}
411+
412+
public void updateCassandraCert(EntityStore entityStore, String alias, boolean append) {
413+
Entity entity = getCassandraEntity(entityStore);
381414
boolean useSSL = entity.getBooleanValue("useSSL");
382415
if (useSSL) {
383416
String filedName = "sslTrustedCerts";
384417
updateCertEntity(entityStore, entity, alias, filedName, append);
385418
}
386419
}
387420

388-
public void disableCassandraSSL(EntityStore entityStore) {
421+
public void disableCassandraSSL(EntityStore entityStore, String value) {
389422
String shorthandKey = "/[CassandraSettings]name=Cassandra Settings";
390423
Entity entity = getEntity(entityStore, shorthandKey);
391-
entity.setBooleanField("useSSL", false);
424+
boolean boolValue = Boolean.parseBoolean(value);
425+
entity.setBooleanField("useSSL", !boolValue);
392426
entityStore.updateEntity(entity);
393-
Trace.info("Disabled Cassandra SSL");
427+
if(!boolValue)
428+
Trace.info("Disabled Cassandra SSL");
429+
else
430+
Trace.info("Enabled Cassandra SSL");
394431
}
395432

396433
// Supports both HTTP and HTTPS interfaces where interfaceType are InetInterface, SSLInterface
@@ -415,7 +452,6 @@ private String importPublicCertificate(X509Certificate certificate, EntityStore
415452
String escapedAlias = ShorthandKeyFinder.escapeFieldValue(alias);
416453
Entity certEntity = getCertEntity(entityStore, escapedAlias);
417454
Trace.info("Alias :" + alias + "Escaped alias :" + escapedAlias);
418-
419455
if (certEntity == null) {
420456
Trace.info("Adding cert");
421457
certEntity = EntityStoreDelegate.createDefaultedEntity(entityStore, "Certificate");
@@ -498,14 +534,16 @@ private void updateCertEntity(EntityStore entityStore, Entity entity, String ali
498534
String certStoreDistinguishedName = espk.getFieldValueOfReferencedEntity("dname");
499535
Trace.info(" alias name from Gateway Cert store :" + certStoreDistinguishedName);
500536
if (certStoreDistinguishedName.equals(alias)) {
501-
Trace.info("Removing existing certs" + alias);
537+
Trace.info("Removing existing cert as it matches the current cert" + alias);
502538
values.remove(value);
539+
continue;
503540
}
504-
Trace.info("adding " + alias);
505-
values.add(new Value(portableESPK));
506541
}
542+
Trace.info("adding " + alias);
543+
values.add(new Value(portableESPK));
507544
field.setValues(values);
508545
} else {
546+
Trace.debug("Replacing exising cert reference");
509547
entity.setReferenceField(fieldName, portableESPK);
510548
}
511549
entityStore.updateEntity(entity);

‎src/main/java/com/axway/Util.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package com.axway;
22

3+
import java.security.cert.X509Certificate;
34
import java.util.HashMap;
45
import java.util.Iterator;
56
import java.util.Map;
@@ -30,4 +31,14 @@ public static Map<String, Map<String, String>> parseCred(Map<String, String> env
3031
}
3132
return values;
3233
}
34+
35+
public static String getAliasName(X509Certificate certificate){
36+
37+
38+
String alias = certificate.getSubjectDN().getName();
39+
if (alias.equals("")) {
40+
alias = certificate.getSerialNumber().toString();
41+
}
42+
return alias;
43+
}
3344
}

‎src/test/java/com/axway/ExternalConfigLoaderTest.java‎

Lines changed: 72 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
import com.vordel.es.Entity;
44
import com.vordel.es.EntityStore;
55
import com.vordel.es.EntityStoreFactory;
6+
import com.vordel.es.Value;
67
import com.vordel.es.util.ShorthandKeyFinder;
78
import com.vordel.es.xes.PortableESPK;
89
import com.vordel.trace.Trace;
@@ -25,6 +26,7 @@
2526
import java.security.cert.CertificateException;
2627
import java.security.cert.X509Certificate;
2728
import java.util.*;
29+
import java.util.stream.Collectors;
2830

2931
import static org.powermock.api.mockito.PowerMockito.mockStatic;
3032

@@ -79,12 +81,26 @@ public void testDisableInterface(){
7981
@Test
8082
public void testDisableCassandraSSL(){
8183

82-
externalConfigLoader.disableCassandraSSL(entityStore);
84+
externalConfigLoader.disableCassandraSSL(entityStore, "true");
8385
String shorthandKey = "/[CassandraSettings]name=Cassandra Settings";
8486
Entity entity = externalConfigLoader.getEntity(entityStore, shorthandKey);
87+
System.out.println(entity.getBooleanValue("useSSL"));
8588
Assert.assertFalse(entity.getBooleanValue("useSSL"));
8689
}
8790

91+
@Test
92+
public void testEnableCassandraSSL() throws NoSuchFieldException, IllegalAccessException{
93+
94+
Map<String, String> envVars = new HashMap<>();
95+
envVars.put("cassandra_disablessl", "false");
96+
setupEnvVariables(envVars);
97+
externalConfigLoader.updatePassword(entityStore);
98+
String shorthandKey = "/[CassandraSettings]name=Cassandra Settings";
99+
Entity entity = externalConfigLoader.getEntity(entityStore, shorthandKey);
100+
Assert.assertTrue(entity.getBooleanValue("useSSL"));
101+
}
102+
103+
88104

89105
@Test
90106
public void testUpdateLDAP(){
@@ -237,6 +253,8 @@ public void testUpdateCassandraCert() throws NoSuchFieldException, IllegalAccess
237253
"PLHu3INlHcXQs3AY0wNBLhL2jBwZ0uwBYK+entFpCgb+Z+RQ+uxs3joYuKEMj6M6\n" +
238254
"6Xi8yAoGAN92VRi93iss3A7zoAsrPXCO7pNZdz3QzJ3Jjv9KW48DmQ==\n" +
239255
"-----END CERTIFICATE-----";
256+
257+
240258
envVars.put("cassandraCert_root", certificate);
241259
setupEnvVariables(envVars);
242260
String shorthandKey = "/[CassandraSettings]name=Cassandra Settings";
@@ -249,6 +267,59 @@ public void testUpdateCassandraCert() throws NoSuchFieldException, IllegalAccess
249267

250268
}
251269

270+
271+
@Test
272+
public void testUpdateCassandraCertAndKey() throws NoSuchFieldException, IllegalAccessException {
273+
274+
Map<String, String> envVars = new HashMap<>();
275+
String certificate = "-----BEGIN CERTIFICATE-----\n" +
276+
"MIICxDCCAaygAwIBAgIGAW5HwjW7MA0GCSqGSIb3DQEBCwUAMBExDzANBgNVBAMM\n" +
277+
"BkRvbWFpbjAgFw0xOTEwMzEyMTI1NDBaGA8yMTE5MTAxNDIxMjU0MFowETEPMA0G\n" +
278+
"A1UEAwwGRG9tYWluMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlX2n\n" +
279+
"ePJaDMGWpNUwgyCfyDVIMjLKRjvJ7bID+BF+LI9gxJ2mUVFXl822fT3m2BR5oG8s\n" +
280+
"N/8JgvM+ie2PHxAWYokQcRSwYAFmMMMKp69M8sqAJHrm/QoVvFwCFVm+7DqJVKWu\n" +
281+
"q5K+J+ophJQNhvSl0KLorFI8IodLZq5cDtyhfaB27Zbk1A9ha4PfXmnoFWbDwoZU\n" +
282+
"UanoUy3xisbZ6HTvGKkawn53XaRJo5rn13b/9Np8PCJZLNmAiWoIB3NVyetwxS5C\n" +
283+
"4FwIm2ZRJZny5l+CgJ9Frs9Y0teAz4Z1bqJWn+kfBCxGW8Ab7W7t6ah3a/WoQxi2\n" +
284+
"HDU/134lBvoPhh9udwIDAQABoyAwHjAPBgNVHRMECDAGAQH/AgEAMAsGA1UdDwQE\n" +
285+
"AwICvDANBgkqhkiG9w0BAQsFAAOCAQEAlEo5pn1j8spkVg3RbLap80iwo8Slk+Fw\n" +
286+
"v8tGqR+GJEiJXDgnPPDMkrE+wtC1kT4VxyQw8D0eittUPjFmoMdxoUwM5Ddf4qS7\n" +
287+
"3LBO74CULyFZ0teyJoaVBjaG6MTg0ZfwUZt552IVLBgjbbE/yYu/dOJckpZlcZE7\n" +
288+
"yRw3ffr/trqh2B5tzwJMnWsakRwAtooRJ2RZ8ufQUhEYdI/7KJajZDQ0IFxleyPZ\n" +
289+
"PLHu3INlHcXQs3AY0wNBLhL2jBwZ0uwBYK+entFpCgb+Z+RQ+uxs3joYuKEMj6M6\n" +
290+
"6Xi8yAoGAN92VRi93iss3A7zoAsrPXCO7pNZdz3QzJ3Jjv9KW48DmQ==\n" +
291+
"-----END CERTIFICATE-----";
292+
293+
String pemKey = "src/test/resources/acp-key.pem";
294+
String cert = "src/test/resources/acp-crt.pem";
295+
296+
297+
envVars.put("cassandraCert_root", certificate);
298+
envVars.put("cassandra_private_key", pemKey);
299+
envVars.put("cassandra_public_key", cert);
300+
301+
setupEnvVariables(envVars);
302+
String shorthandKey = "/[CassandraSettings]name=Cassandra Settings";
303+
Entity entity = externalConfigLoader.getEntity(entityStore, shorthandKey);
304+
entity.setBooleanField("useSSL", true);
305+
entityStore.updateEntity(entity);
306+
externalConfigLoader.updatePassword(entityStore);
307+
entity = externalConfigLoader.getEntity(entityStore, shorthandKey);
308+
String certAlias = "/[Certificates]name=Certificate Store/[Certificate]dname=CN=Domain";
309+
List<Value> values = entity.getField("sslTrustedCerts").getValueList();
310+
311+
System.out.println(values);
312+
System.out.println(values.size());
313+
List<Value> filteredValues = values.stream().filter(value -> ((PortableESPK)value.getRef()).toShorthandString().equals(certAlias)).collect(Collectors.toList());
314+
315+
Assert.assertEquals("sslTrustedCerts", certAlias, ((PortableESPK)filteredValues.get(0).getRef()).toShorthandString());
316+
Assert.assertEquals("sslCertificate", "/[Certificates]name=Certificate Store/[Certificate]dname=213910179734667807042092962809881497910", ((PortableESPK)entity.getField("sslCertificate").getValueList().get(0).getRef()).toShorthandString());
317+
318+
319+
}
320+
321+
322+
252323
@Test
253324
public void testUpdateCassandraKPSTablesConsistencyLevel(){
254325

‎src/test/resources/test-env/CertStore.sha256‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
cf683379d11b876556502b0c76ea031796da4cd3c5537ad5346037db4ccc9b3f
1+
446511abc9f9cd7584f5009fbbc2b455562be047a09f2b53d9e0d1960adcac01

0 commit comments

Comments
 (0)