Create parser pool interface and move current pool to an implementation of this inter...

[java-idp.git] / src / edu / internet2 / middleware / shibboleth / idp / provider / BaseHandler.java

diff --git a/src/edu/internet2/middleware/shibboleth/idp/provider/BaseHandler.java b/src/edu/internet2/middleware/shibboleth/idp/provider/BaseHandler.java
index e08c996..b7bef56 100644 (file)
--- a/src/edu/internet2/middleware/shibboleth/idp/provider/BaseHandler.java
+++ b/src/edu/internet2/middleware/shibboleth/idp/provider/BaseHandler.java
@@ -16,18 +16,29 @@
 
 package edu.internet2.middleware.shibboleth.idp.provider;
 
+import java.io.IOException;
+import java.security.cert.CertificateParsingException;
 import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Collection;
 import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
 
 import javax.security.auth.x500.X500Principal;
 
 import org.apache.log4j.Logger;
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.DERObject;
+import org.bouncycastle.asn1.DERObjectIdentifier;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.DERSet;
+import org.bouncycastle.asn1.DERString;
 import org.w3c.dom.Element;
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
 
 import edu.internet2.middleware.shibboleth.common.ShibbolethConfigurationException;
-import edu.internet2.middleware.shibboleth.common.provider.ShibbolethTrust;
 import edu.internet2.middleware.shibboleth.idp.IdPConfig;
 import edu.internet2.middleware.shibboleth.idp.IdPProtocolHandler;
 
@@ -39,6 +50,7 @@ import edu.internet2.middleware.shibboleth.idp.IdPProtocolHandler;
 public abstract class BaseHandler implements IdPProtocolHandler {
 
        private static Logger log = Logger.getLogger(BaseHandler.class.getName());
+       private static final String CN_OID = "2.5.4.3";
        private HashSet<String> locations = new HashSet<String>();
 
        /**
@@ -84,10 +96,74 @@ public abstract class BaseHandler implements IdPProtocolHandler {
 
        protected static String getHostNameFromDN(X500Principal dn) {
 
-               return ShibbolethTrust.getHostNameFromDN(dn);
+               // Parse the ASN.1 representation of the dn and grab the last CN component that we find
+               // We used to do this with the dn string, but the JDK's default parsing caused problems with some DNs
+               try {
+                       ASN1InputStream asn1Stream = new ASN1InputStream(dn.getEncoded());
+                       DERObject parent = asn1Stream.readObject();
+
+                       if (!(parent instanceof DERSequence)) {
+                               log.error("Unable to extract host name name from certificate subject DN: incorrect ASN.1 encoding.");
+                               return null;
+                       }
+
+                       String cn = null;
+                       for (int i = 0; i < ((DERSequence) parent).size(); i++) {
+                               DERObject dnComponent = ((DERSequence) parent).getObjectAt(i).getDERObject();
+                               if (!(dnComponent instanceof DERSet)) {
+                                       log.debug("No DN components.");
+                                       continue;
+                               }
+
+                               // Each DN component is a set
+                               for (int j = 0; j < ((DERSet) dnComponent).size(); j++) {
+                                       DERObject grandChild = ((DERSet) dnComponent).getObjectAt(j).getDERObject();
+
+                                       if (((DERSequence) grandChild).getObjectAt(0) != null
+                                                       && ((DERSequence) grandChild).getObjectAt(0).getDERObject() instanceof DERObjectIdentifier) {
+                                               DERObjectIdentifier componentId = (DERObjectIdentifier) ((DERSequence) grandChild).getObjectAt(
+                                                               0).getDERObject();
+
+                                               if (CN_OID.equals(componentId.getId())) {
+                                                       // OK, this dn component is actually a cn attribute
+                                                       if (((DERSequence) grandChild).getObjectAt(1) != null
+                                                                       && ((DERSequence) grandChild).getObjectAt(1).getDERObject() instanceof DERString) {
+                                                               cn = ((DERString) ((DERSequence) grandChild).getObjectAt(1).getDERObject()).getString();
+                                                       }
+                                               }
+                                       }
+                               }
+                       }
+                       asn1Stream.close();
+                       return cn;
+
+               } catch (IOException e) {
+                       log.error("Unable to extract host name name from certificate subject DN: ASN.1 parsing failed: " + e);
+                       return null;
+               }
        }
 
        protected static String[] getCredentialNames(X509Certificate cert) {
-               return ShibbolethTrust.getCredentialNames(cert);
+
+               ArrayList<String> names = new ArrayList<String>();
+               names.add(cert.getSubjectX500Principal().getName(X500Principal.RFC2253));
+               try {
+                       Collection altNames = cert.getSubjectAlternativeNames();
+                       if (altNames != null) {
+                               for (Iterator nameIterator = altNames.iterator(); nameIterator.hasNext();) {
+                                       List altName = (List) nameIterator.next();
+                                       if (altName.get(0).equals(new Integer(2)) && altName.get(1) instanceof String) { // 2 is DNS
+                                               names.add((String) altName.get(1));
+                                       } else if (altName.get(0).equals(new Integer(6)) && altName.get(1) instanceof String) { // 6 is URI
+                                               names.add((String) altName.get(1));
+                                       }
+                               }
+                       }
+               } catch (CertificateParsingException e1) {
+                       log.error("Encountered an problem trying to extract Subject Alternate "
+                                       + "Name from supplied certificate: " + e1);
+               }
+               names.add(getHostNameFromDN(cert.getSubjectX500Principal()));
+               return (String[]) names.toArray(new String[1]);
        }
 }
\ No newline at end of file