org.jasig.cas.adaptors.x509.authentication.handler.support

Class X509CredentialsAuthenticationHandler

java.lang.Object

org.jasig.cas.authentication.AbstractAuthenticationHandler

org.jasig.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler

org.jasig.cas.adaptors.x509.authentication.handler.support.X509CredentialsAuthenticationHandler

All Implemented Interfaces:

AuthenticationHandler

public class X509CredentialsAuthenticationHandler
extends AbstractPreAndPostProcessingAuthenticationHandler

Authentication Handler that accepts X509 Certificates, determines their validity and ensures that they were issued by a trusted issuer. (targeted at X509v3) Optionally checks KeyUsage extension in the user certificate (container should do that too). Note that this handler trusts the servlet container to do some initial checks like path validation. Deployers can supply an optional pattern to match subject dns against to further restrict certificates in case they are not using their own issuer. It's also possible to specify a maximum pathLength for the SUPPLIED certificates. (note that this does not include a pathLength check for the root certificate) [PathLength is 0 for the CA certificate that issues the end-user certificate]

Since:

3.0.4

Author:

Scott Battaglia, Jan Van der Velpen

Constructor Summary

Constructors

Constructor and Description
X509CredentialsAuthenticationHandler()

Method Summary

Methods

Modifier and Type	Method and Description
protected HandlerResult	doAuthentication(Credential credential)
void	setCheckKeyUsage(boolean checkKeyUsage)
void	setMaxPathLength(int maxPathLength)
void	setMaxPathLengthAllowUnspecified(boolean allowed)
void	setRequireKeyUsage(boolean requireKeyUsage)
void	setRevocationChecker(RevocationChecker checker) Sets the component responsible for evaluating certificate revocation status for client certificates presented to handler.
void	setSubjectDnPattern(String subjectDnPattern)
void	setTrustedIssuerDnPattern(String trustedIssuerDnPattern)
boolean	supports(Credential credential)

Methods inherited from class org.jasig.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler

authenticate, postAuthenticate, preAuthenticate

Methods inherited from class org.jasig.cas.authentication.AbstractAuthenticationHandler

getName, setName

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

X509CredentialsAuthenticationHandler

public X509CredentialsAuthenticationHandler()

Method Detail

supports

public boolean supports(Credential credential)

doAuthentication

protected final HandlerResult doAuthentication(Credential credential)
                                        throws GeneralSecurityException,
                                               PreventedException

Specified by:

doAuthentication in class AbstractPreAndPostProcessingAuthenticationHandler

Throws:

GeneralSecurityException

PreventedException

setTrustedIssuerDnPattern

public void setTrustedIssuerDnPattern(String trustedIssuerDnPattern)

setMaxPathLength

public void setMaxPathLength(int maxPathLength)

Parameters:

maxPathLength - The maxPathLength to set.

setMaxPathLengthAllowUnspecified

public void setMaxPathLengthAllowUnspecified(boolean allowed)

Parameters:

allowed - Allow CA certs to have unlimited intermediate certs (default=false).

setCheckKeyUsage

public void setCheckKeyUsage(boolean checkKeyUsage)

Parameters:

checkKeyUsage - The checkKeyUsage to set.

setRequireKeyUsage

public void setRequireKeyUsage(boolean requireKeyUsage)

Parameters:

requireKeyUsage - The requireKeyUsage to set.

setSubjectDnPattern

public void setSubjectDnPattern(String subjectDnPattern)

setRevocationChecker

public void setRevocationChecker(RevocationChecker checker)

Sets the component responsible for evaluating certificate revocation status for client certificates presented to handler. The default checker is a NO-OP implementation for backward compatibility with previous versions that do not perform revocation checking.

Parameters:

checker - Revocation checker component.