org.opensaml.xml.security.x509
Class X509Util

java.lang.Object
  org.opensaml.xml.security.x509.X509Util

public class X509Util
extends java.lang.Object

Utility class for working with X509 objects.

Nested Class Summary

static class

X509Util.ENCODING_FORMAT Encoding used to store a key or certificate in a file.

Field Summary

static java.lang.String	CN_OID Common Name (CN) OID.
static java.lang.Integer	DIRECTORY_ALT_NAME RFC 2459 Directory Name Subject Alt Name type.
static java.lang.Integer	DNS_ALT_NAME RFC 2459 DNS Subject Alt Name type.
static java.lang.Integer	EDI_PARTY_ALT_NAME RFC 2459 EDI Party Name Subject Alt Name type.
static java.lang.Integer	IP_ADDRESS_ALT_NAME RFC 2459 IP Address Subject Alt Name type.
static java.lang.Integer	OTHER_ALT_NAME RFC 2459 Other Subject Alt Name type.
static java.lang.Integer	REGISTERED_ID_ALT_NAME RFC 2459 Registered ID Subject Alt Name type.
static java.lang.Integer	RFC822_ALT_NAME RFC 2459 RFC 822 (email address) Subject Alt Name type.
static java.lang.Integer	URI_ALT_NAME RFC 2459 URI Subject Alt Name type.
static java.lang.Integer	X400ADDRESS_ALT_NAME RFC 2459 X.400 Address Subject Alt Name type.

Constructor Summary

protected

X509Util() Constructed.

Method Summary

static java.util.Collection<java.security.cert.X509Certificate>	decodeCertificate(byte[] certs) Decodes X.509 certificates in DER or PEM format.
static java.util.Collection<java.security.cert.X509Certificate>	decodeCertificate(java.io.File certs) Decodes X.509 certificates in DER or PEM format.
static java.util.Collection<java.security.cert.X509CRL>	decodeCRLs(byte[] crls) Decodes CRLS in DER or PKCS#7 format.
static java.util.Collection<java.security.cert.X509CRL>	decodeCRLs(java.io.File crls) Decodes CRLS in DER or PKCS#7 format.
static java.security.cert.X509Certificate	determineEntityCertificate(java.util.Collection<java.security.cert.X509Certificate> certs, java.security.PrivateKey privateKey) Determines the certificate, from the collection, associated with the private key.
static java.util.List	getAltNames(java.security.cert.X509Certificate certificate, java.lang.Integer[] nameTypes) Gets the list of alternative names of a given name type.
static java.util.List<java.lang.String>	getCommonNames(javax.security.auth.x500.X500Principal dn) Gets the commons names that appear within the given distinguished name.
static java.lang.String	getIdentifiersToken(X509Credential credential, X500DNHandler handler) Gets a formatted string representing identifier information from the supplied credential.
static byte[]	getSubjectKeyIdentifier(java.security.cert.X509Certificate certificate) Get the plain (non-DER encoded) value of the Subject Key Identifier extension of an X.509 certificate, if present.
static java.util.List	getSubjectNames(java.security.cert.X509Certificate certificate, java.lang.Integer[] altNameTypes) Gets the common name components of the issuer and all the subject alt names of a given type.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

CN_OID

public static final java.lang.String CN_OID

Common Name (CN) OID.

See Also:

Constant Field Values

OTHER_ALT_NAME

public static final java.lang.Integer OTHER_ALT_NAME

RFC 2459 Other Subject Alt Name type.

RFC822_ALT_NAME

public static final java.lang.Integer RFC822_ALT_NAME

RFC 2459 RFC 822 (email address) Subject Alt Name type.

DNS_ALT_NAME

public static final java.lang.Integer DNS_ALT_NAME

RFC 2459 DNS Subject Alt Name type.

X400ADDRESS_ALT_NAME

public static final java.lang.Integer X400ADDRESS_ALT_NAME

RFC 2459 X.400 Address Subject Alt Name type.

DIRECTORY_ALT_NAME

public static final java.lang.Integer DIRECTORY_ALT_NAME

RFC 2459 Directory Name Subject Alt Name type.

EDI_PARTY_ALT_NAME

public static final java.lang.Integer EDI_PARTY_ALT_NAME

RFC 2459 EDI Party Name Subject Alt Name type.

URI_ALT_NAME

public static final java.lang.Integer URI_ALT_NAME

RFC 2459 URI Subject Alt Name type.

IP_ADDRESS_ALT_NAME

public static final java.lang.Integer IP_ADDRESS_ALT_NAME

RFC 2459 IP Address Subject Alt Name type.

REGISTERED_ID_ALT_NAME

public static final java.lang.Integer REGISTERED_ID_ALT_NAME

RFC 2459 Registered ID Subject Alt Name type.

Constructor Detail

X509Util

protected X509Util()

Constructed.

Method Detail

determineEntityCertificate

public static java.security.cert.X509Certificate determineEntityCertificate(java.util.Collection<java.security.cert.X509Certificate> certs,
                                                                            java.security.PrivateKey privateKey)
                                                                     throws SecurityException

Determines the certificate, from the collection, associated with the private key.

Parameters:

certs - certificates to check

privateKey - entity's private key

Returns:

the certificate associated with entity's private key or null if not certificate in the collection is associated with the given private key

Throws:

SecurityException - thrown if the public or private keys checked are of an unsupported type

Since:

1.2

getCommonNames

public static java.util.List<java.lang.String> getCommonNames(javax.security.auth.x500.X500Principal dn)

Gets the commons names that appear within the given distinguished name. The returned list provides the names in the order they appeared in the DN.

Parameters:

dn - the DN to extract the common names from

Returns:

the common names that appear in the DN in the order they appear or null if the given DN is null

getAltNames

public static java.util.List getAltNames(java.security.cert.X509Certificate certificate,
                                         java.lang.Integer[] nameTypes)

Gets the list of alternative names of a given name type.

Parameters:

certificate - the certificate to extract the alternative names from

nameTypes - the name types

Returns:

the alt names, of the given type, within the cert

getSubjectNames

public static java.util.List getSubjectNames(java.security.cert.X509Certificate certificate,
                                             java.lang.Integer[] altNameTypes)

Gets the common name components of the issuer and all the subject alt names of a given type.

Parameters:

certificate - certificate to extract names from

altNameTypes - type of alt names to extract

Returns:

list of subject names in the certificate

getSubjectKeyIdentifier

public static byte[] getSubjectKeyIdentifier(java.security.cert.X509Certificate certificate)

Get the plain (non-DER encoded) value of the Subject Key Identifier extension of an X.509 certificate, if present.

Parameters:

certificate - an X.509 certificate possibly containing a subject key identifier

Returns:

the plain (non-DER encoded) value of the Subject Key Identifier extension, or null if the certificate does not contain the extension

Throws:

java.io.IOException

decodeCertificate

public static java.util.Collection<java.security.cert.X509Certificate> decodeCertificate(java.io.File certs)
                                                                                  throws java.security.cert.CertificateException

Decodes X.509 certificates in DER or PEM format.

Parameters:

certs - encoded certs

Returns:

decoded certs

Throws:

java.security.cert.CertificateException - thrown if the certificates can not be decoded

Since:

1.2

decodeCertificate

public static java.util.Collection<java.security.cert.X509Certificate> decodeCertificate(byte[] certs)
                                                                                  throws java.security.cert.CertificateException

Decodes X.509 certificates in DER or PEM format.

Parameters:

certs - encoded certs

Returns:

decoded certs

Throws:

java.security.cert.CertificateException - thrown if the certificates can not be decoded

decodeCRLs

public static java.util.Collection<java.security.cert.X509CRL> decodeCRLs(java.io.File crls)
                                                                   throws java.security.cert.CRLException

Decodes CRLS in DER or PKCS#7 format. If in PKCS#7 format only the CRLs are decode, the rest of the content is ignored.

Parameters:

crls - encoded CRLs

Returns:

decoded CRLs

Throws:

java.security.cert.CRLException - thrown if the CRLs can not be decoded

Since:

1.2

decodeCRLs

public static java.util.Collection<java.security.cert.X509CRL> decodeCRLs(byte[] crls)
                                                                   throws java.security.cert.CRLException

Decodes CRLS in DER or PKCS#7 format. If in PKCS#7 format only the CRLs are decode, the rest of the content is ignored.

Parameters:

crls - encoded CRLs

Returns:

decoded CRLs

Throws:

java.security.cert.CRLException - thrown if the CRLs can not be decoded

getIdentifiersToken

public static java.lang.String getIdentifiersToken(X509Credential credential,
                                                   X500DNHandler handler)

Gets a formatted string representing identifier information from the supplied credential.

This could for example be used in logging messages.

Often it will be the case that a given credential that is being evaluated will NOT have a value for the entity ID property. So extract the certificate subject DN, and if present, the credential's entity ID.

Parameters:

credential - the credential for which to produce a token.

handler - the X.500 DN handler to use. If null, a new instance of InternalX500DNHandler will be used.

Returns:

a formatted string containing identifier information present in the credential