community/device-mgt-core
1
0
Fork 0
mirror of https://repository.entgra.net/community/device-mgt-core.git synced 2025-10-06 02:01:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix client cert verification issue in sub tenants

Browse Source
This commit is contained in:
Lasantha Dharmakeerthi 2024-10-29 04:55:29 +00:00
commit 7f06804823
3 changed files with 50 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
components/certificate-mgt/io.entgra.device.mgt.core.certificate.mgt.core/src/main/java/io/entgra/device/mgt/core/certificate/mgt/core/impl/CertificateGenerator.java
View File

@ -29,6 +29,7 @@ import io.entgra.device.mgt.core.certificate.mgt.core.util.CertificateManagement
import io.entgra.device.mgt.core.certificate.mgt.core.util.CommonUtil;
import io.entgra.device.mgt.core.certificate.mgt.core.util.Serializer;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.lang.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.bouncycastle.asn1.ASN1Encodable;
@ -429,19 +430,34 @@ public class CertificateGenerator {
generateCertificate(byteArrayInputStream);
if (reqCert != null && reqCert.getSerialNumber() != null) {
log.debug("looking up certificate for serial: " + reqCert.getSerialNumber().toString());
CertificateResponse lookUpCertificate = keyStoreReader.getCertificateBySerial(
reqCert.getSerialNumber().toString());
if (log.isDebugEnabled()) {
log.debug("looking up certificate for serial: " + reqCert.getSerialNumber().toString());
}
String orgUnit = CommonUtil.getSubjectDnAttribute(reqCert,
CertificateManagementConstants.ORG_UNIT_ATTRIBUTE);
CertificateResponse lookUpCertificate;
if (StringUtils.isNotEmpty(orgUnit)) {
int tenantId = Integer.parseInt(orgUnit.split(("_"))[1]);
lookUpCertificate = keyStoreReader.getCertificateBySerial(reqCert.getSerialNumber().toString(),
tenantId);
} else {
lookUpCertificate = keyStoreReader.getCertificateBySerial(
reqCert.getSerialNumber().toString());
}
if (lookUpCertificate != null && lookUpCertificate.getCertificate() != null) {
log.debug("certificate found for serial: " + reqCert.getSerialNumber()
.toString());
if (log.isDebugEnabled()) {
log.debug("certificate found for serial: " + reqCert.getSerialNumber()
.toString());
}
Certificate certificate = (Certificate) Serializer.deserialize(lookUpCertificate.getCertificate());
if (certificate instanceof X509Certificate) {
return (X509Certificate) certificate;
}
} else {
log.debug("certificate not found for serial: " + reqCert.getSerialNumber()
.toString());
if (log.isDebugEnabled()) {
log.debug("certificate not found for serial: " + reqCert.getSerialNumber()
.toString());
}
}
}
@ -464,7 +480,6 @@ public class CertificateGenerator {
log.error(errorMsg);
throw new KeystoreException(errorMsg, e);
}
return null;
}

1
components/certificate-mgt/io.entgra.device.mgt.core.certificate.mgt.core/src/main/java/io/entgra/device/mgt/core/certificate/mgt/core/util/CertificateManagementConstants.java
View File

@ -35,6 +35,7 @@ public final class CertificateManagementConstants {
public static final String DES_EDE = "DESede";
public static final String CONF_LOCATION = "conf.location";
public static final String DEFAULT_PRINCIPAL = "O=WSO2, OU=Mobile, C=LK";
public static final String ORG_UNIT_ATTRIBUTE = "OU=";
public static final String RSA_PRIVATE_KEY_BEGIN_TEXT = "-----BEGIN RSA PRIVATE KEY-----\n";
public static final String RSA_PRIVATE_KEY_END_TEXT = "-----END RSA PRIVATE KEY-----";
public static final String EMPTY_TEXT = "";

26
components/certificate-mgt/io.entgra.device.mgt.core.certificate.mgt.core/src/main/java/io/entgra/device/mgt/core/certificate/mgt/core/util/CommonUtil.java
View File

@ -17,7 +17,10 @@
*/
package io.entgra.device.mgt.core.certificate.mgt.core.util;
import org.apache.commons.lang.StringUtils;
import java.math.BigInteger;
import java.security.cert.X509Certificate;
import java.util.Calendar;
import java.util.Date;
@ -42,4 +45,27 @@ public class CommonUtil {
public static synchronized BigInteger generateSerialNumber() {
return BigInteger.valueOf(System.currentTimeMillis());
}
/**
* Returns the value of the given attribute from the subject distinguished name. eg: "entgra.net"
* from "CN=entgra.net"
* @param requestCertificate {@link X509Certificate} that needs to extract an attribute from
* @param attribute the attribute name that needs to be extracted from the cert. eg: "CN="
* @return the value of the attribute
*/
public static String getSubjectDnAttribute(X509Certificate requestCertificate, String attribute) {
String distinguishedName = requestCertificate.getSubjectDN().getName();
if (StringUtils.isNotEmpty(distinguishedName)) {
String[] dnSplits = distinguishedName.split(",");
for (String dnSplit : dnSplits) {
if (dnSplit.contains(attribute)) {
String[] cnSplits = dnSplit.split("=");
if (StringUtils.isNotEmpty(cnSplits[1])) {
return cnSplits[1];
}
}
}
}
return null;
}
}