org.jasig.cas.adaptors.x509.authentication.handler.support
Class X509CredentialsAuthenticationHandler

java.lang.Object
  org.jasig.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler
      org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler

All Implemented Interfaces:

AuthenticationHandler, NamedAuthenticationHandler

public class X509CredentialsAuthenticationHandler
extends AbstractPreAndPostProcessingAuthenticationHandler

Authentication Handler that accepts X509 Certificiates, determines their validity and ensures that they were issued by a trusted issuer. (targeted at X509v3) Optionally checks KeyUsage extension in the user certificate (container should do that too). Note that this handler trusts the servlet container to do some initial checks like path validation. Deployers can supply an optional pattern to match subject dns against to further restrict certificates in case they are not using their own issuer. It's also possible to specify a maximum pathLength for the SUPPLIED certificates. (note that this does not include a pathLength check for the root certificate) [PathLength is 0 for the CA certficate that issues the end-user certificate]

Since:

3.0.4

Version:

$Revision$ $Date$

Author:

Scott Battaglia, Jan Van der Velpen

Constructor Summary

X509CredentialsAuthenticationHandler()

Method Summary

protected boolean	doAuthentication(Credentials credentials)
void	setCheckKeyUsage(boolean checkKeyUsage)
void	setMaxPathLength(int maxPathLength)
void	setMaxPathLengthAllowUnspecified(boolean allowed)
void	setRequireKeyUsage(boolean requireKeyUsage)
void	setRevocationChecker(RevocationChecker checker) Sets the component responsible for evaluating certificate revocation status for client certificates presented to handler.
void	setSubjectDnPattern(String subjectDnPattern)
void	setTrustedIssuerDnPattern(String trustedIssuerDnPattern)
boolean	supports(Credentials credentials)

Methods inherited from class org.jasig.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler

authenticate, getName, postAuthenticate, preAuthenticate, setName

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

X509CredentialsAuthenticationHandler

public X509CredentialsAuthenticationHandler()

Method Detail

supports

public boolean supports(Credentials credentials)

doAuthentication

protected final boolean doAuthentication(Credentials credentials)
                                  throws AuthenticationException

Specified by:

doAuthentication in class AbstractPreAndPostProcessingAuthenticationHandler

Throws:

AuthenticationException

setTrustedIssuerDnPattern

public void setTrustedIssuerDnPattern(String trustedIssuerDnPattern)

setMaxPathLength

public void setMaxPathLength(int maxPathLength)

Parameters:

maxPathLength - The maxPathLength to set.

setMaxPathLengthAllowUnspecified

public void setMaxPathLengthAllowUnspecified(boolean allowed)

Parameters:

allowed - Allow CA certs to have unlimited intermediate certs (default=false).

setCheckKeyUsage

public void setCheckKeyUsage(boolean checkKeyUsage)

Parameters:

checkKeyUsage - The checkKeyUsage to set.

setRequireKeyUsage

public void setRequireKeyUsage(boolean requireKeyUsage)

Parameters:

requireKeyUsage - The requireKeyUsage to set.

setSubjectDnPattern

public void setSubjectDnPattern(String subjectDnPattern)

setRevocationChecker

public void setRevocationChecker(RevocationChecker checker)

Sets the component responsible for evaluating certificate revocation status for client certificates presented to handler. The default checker is a NO-OP implementation for backward compatibility with previous versions that do not perform revocation checking.

Parameters:

checker - Revocation checker component.