inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-08-07 17:49:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix for ALF-10189:

Browse Source 
o Alfresco key store manages keys and backup keys internally
  o moved key registration and checking into AlfrescoKeyStoreImpl
  o encryptor thread cache fix resulting from reload of key stores at runtime
  o more encryption and key store tests
  o tidy up + more comments
  o moved hard-coded values to properties file

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@30405 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Steven Glover
2011-09-11 12:09:24 +00:00
parent 195ea9c810
commit 69d5e091e0
18 changed files with 1011 additions and 341 deletions
Download Patch File Download Diff File Expand all files Collapse all files

83
source/java/org/alfresco/encryption/KeyStoreChecker.java
View File

@@ -18,18 +18,11 @@
*/
package org.alfresco.encryption;
import org.alfresco.error.AlfrescoRuntimeException;
import org.alfresco.repo.transaction.RetryingTransactionHelper;
import org.alfresco.repo.transaction.RetryingTransactionHelper.RetryingTransactionCallback;
import org.alfresco.service.transaction.TransactionService;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Validates an Alfresco keystore by ensuring that it's registered keys have not changed.
*
* The keys are registered using the AttributeService and are stored in one level under TOP_LEVEL_KEY
* (so key aliases must be unique across however many keystores are being used).
* Checks the repository key stores.
*
* @since 4.0
*
@@ -37,80 +30,24 @@ import org.apache.commons.logging.LogFactory;
public class KeyStoreChecker
{
private static final Log logger = LogFactory.getLog(KeyStoreChecker.class);
private TransactionService transactionService;
private EncryptionKeysRegistryImpl encryptionKeysRegistry;
private AlfrescoKeyStore mainKeyStore;
public KeyStoreChecker()
{
}
public void setEncryptionKeysRegistry(EncryptionKeysRegistryImpl encryptionKeysRegistry)
public void setMainKeyStore(AlfrescoKeyStore mainKeyStore)
{
this.encryptionKeysRegistry = encryptionKeysRegistry;
this.mainKeyStore = mainKeyStore;
}
public void setTransactionService(TransactionService transactionService)
public void validateKeyStores() throws InvalidKeystoreException, MissingKeyException
{
this.transactionService = transactionService;
}
public KeyStoreChecker(EncryptionKeysRegistryImpl encryptionKeysRegistry)
{
this.encryptionKeysRegistry = encryptionKeysRegistry;
}
protected void createKeyStore(AlfrescoKeyStore keyStore)
{
keyStore.create();
// Register the key store keys
for(String keyAlias : keyStore.getKeyAliases())
mainKeyStore.validateKeys();
if(!mainKeyStore.exists())
{
encryptionKeysRegistry.registerKey(keyAlias);
mainKeyStore.create();
}
}
public void checkKeyStore(final AlfrescoKeyStore keyStore)
{
// TODO check that, if keystore exists, keys are registered
RetryingTransactionHelper retryingTransactionHelper = transactionService.getRetryingTransactionHelper();
final RetryingTransactionCallback<Void> checkKeysCallback = new RetryingTransactionCallback<Void>()
{
public Void execute() throws Throwable
{
KeysReport keysReport = encryptionKeysRegistry.getKeysReport();
// Check for the existence of a key store first
if(keyStore.exists())
{
// The keystore exists - check whether any keys have been changed
// find out which registered keys have changed
if(keysReport.getKeysChanged().size() > 0)
{
// Note: this will halt the application bootstrap.
throw new AlfrescoRuntimeException("The keys with aliases " + keysReport.getKeysChanged() + " have been changed, re-instate the previous keystore");
}
}
else
{
// keystore not found, check whether any keys have been registered
if(keysReport.getKeysChanged().size() + keysReport.getKeysUnchanged().size() > 0)
{
// Note: this will halt the application bootstrap.
throw new AlfrescoRuntimeException("Keys have already been registered, re-instate the previous keystore");
}
if(logger.isDebugEnabled())
{
logger.debug("Keystore not found, creating...");
}
createKeyStore(keyStore);
}
return null;
}
};
retryingTransactionHelper.doInTransaction(checkKeysCallback, false);
}
}