|
||||||||||
| PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
| SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD | |||||||||
com.sun.grid.grm.security.ca
Class GrmCATrustManager
java.lang.Objectcom.sun.grid.grm.security.ca.GrmCATrustManager
- All Implemented Interfaces:
- javax.net.ssl.TrustManager, javax.net.ssl.X509TrustManager
public class GrmCATrustManager
- extends java.lang.Object
- implements javax.net.ssl.X509TrustManager
- extends java.lang.Object
The GidCATrustManager validates the certificates of incoming SSL connections. It uses the certificates and CRLs of the gridengine certificate authority.
The GrmCATrustManager delegates all request to a PKIX TrustManager. If the CRL file or the ca certificate file of the gridengine CA has been changed the PKIX TrustManager is recreated.
The path to the CA certificate file is taken from the default path
(SecurityPathUtil#getCaCertFile). If the default file does not
exist the callbackHandler is used to query this file (FileCallback
with type SecurityConstants.CACERT_FILE_CALLBACK
ExecutionEnv env = ...
TrustManager [] trustManagers = new TrustManager [] {
new GrmCATrustManager(env);
}
SSLContext ctx = SSLContext.getInstance("SSL");
ctx.init(null, trustManagers, null);
- See Also:
SecurityPathUtil.getCaCertFile(com.sun.grid.grm.bootstrap.ExecutionEnv),FileCallback,SecurityConstants.CACERT_FILE_CALLBACK
| Field Summary | |
|---|---|
static java.lang.String |
CA_ALIAS
alias for the ca certificate |
| Constructor Summary | |
|---|---|
GrmCATrustManager(com.sun.grid.grm.bootstrap.ExecutionEnv env)
Creates a new instance of GrmCATrustManager. |
|
GrmCATrustManager(com.sun.grid.grm.bootstrap.ExecutionEnv env,
javax.security.auth.callback.CallbackHandler callbackHandler)
Createa a new GrmCATrustManager which
can use a callback handler to query the path to
the ca cert file. |
|
| Method Summary | |
|---|---|
void |
checkClientTrusted(java.security.cert.X509Certificate[] chain,
java.lang.String authType)
Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for client SSL authentication based on the authentication type. |
void |
checkServerTrusted(java.security.cert.X509Certificate[] chain,
java.lang.String authType)
Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for server SSL authentication based on the authentication type. |
java.security.cert.X509Certificate[] |
getAcceptedIssuers()
Return an array of certificate authority certificates which are trusted for authenticating peers. |
| Methods inherited from class java.lang.Object |
|---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
| Field Detail |
|---|
CA_ALIAS
public static final java.lang.String CA_ALIAS
- alias for the ca certificate
- See Also:
- Constant Field Values
| Constructor Detail |
|---|
GrmCATrustManager
public GrmCATrustManager(com.sun.grid.grm.bootstrap.ExecutionEnv env)
- Creates a new instance of GrmCATrustManager.
- Parameters:
env- the execution environment
GrmCATrustManager
public GrmCATrustManager(com.sun.grid.grm.bootstrap.ExecutionEnv env,
javax.security.auth.callback.CallbackHandler callbackHandler)
- Createa a new
GrmCATrustManagerwhich can use a callback handler to query the path to the ca cert file.- Parameters:
env- the execution envcallbackHandler- the callback handler
| Method Detail |
|---|
checkClientTrusted
public void checkClientTrusted(java.security.cert.X509Certificate[] chain,
java.lang.String authType)
throws java.security.cert.CertificateException
- Given the partial or complete certificate chain provided by the
peer, build a certificate path to a trusted root and return if
it can be validated and is trusted for client SSL
authentication based on the authentication type.
The authentication type is determined by the actual certificate
used. For instance, if RSAPublicKey is used, the authType
should be "RSA". Checking is case-sensitive.
- Specified by:
checkClientTrustedin interfacejavax.net.ssl.X509TrustManager
- Parameters:
chain- the peer certificate chainauthType- the authentication type based on the client certificate- Throws:
java.lang.IllegalArgumentException- if null or zero-length chain is passed in for the chain parameter or if null or zero-length string is passed in for the authType parameterjava.security.cert.CertificateException- if the certificate chain is not trusted by this TrustManager.
checkServerTrusted
public void checkServerTrusted(java.security.cert.X509Certificate[] chain,
java.lang.String authType)
throws java.security.cert.CertificateException
- Given the partial or complete certificate chain provided by the
peer, build a certificate path to a trusted root and return if
it can be validated and is trusted for server SSL
authentication based on the authentication type.
The authentication type is the key exchange algorithm portion
of the cipher suites represented as a String, such as "RSA",
"DHE_DSS". Note: for some exportable cipher suites, the key
exchange algorithm is determined at run time during the
handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5,
the authType should be RSA_EXPORT when an ephemeral RSA key is
used for the key exchange, and RSA when the key from the server
certificate is used. Checking is case-sensitive.
- Specified by:
checkServerTrustedin interfacejavax.net.ssl.X509TrustManager
- Parameters:
chain- the peer certificate chainauthType- the key exchange algorithm used- Throws:
java.lang.IllegalArgumentException- if null or zero-length chain is passed in for the chain parameter or if null or zero-length string is passed in for the authType parameterjava.security.cert.CertificateException- if the certificate chain is not trusted by this TrustManager.
getAcceptedIssuers
public java.security.cert.X509Certificate[] getAcceptedIssuers()
- Return an array of certificate authority certificates
which are trusted for authenticating peers.
- Specified by:
getAcceptedIssuersin interfacejavax.net.ssl.X509TrustManager
- Returns:
- a non-null (possibly empty) array of acceptable CA issuer certificates.
|
||||||||||
| PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
| SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD | |||||||||
The Contents of this document are made available subject to the terms of the Sun Industry Standards Source License Version 1.2 (see Sun Industry Standards Source License Version 1.2).
