Commit 19fa080f authored by Patrick Dowler's avatar Patrick Dowler
Browse files

allow Credutil to throw CertificateException when proxy cert is invalid

parent 028672ec

cadc-cdp/build.gradle

+1 −1
Original line number Original line Diff line number Diff line
@@ -19,7 +19,7 @@ sourceCompatibility = 1.7 




group = 'org.opencadc'

group = 'org.opencadc'





version = '1.0.1'

version = '1.0.2'





dependencies {

dependencies {

    compile 'log4j:log4j:1.2.+'

    compile 'log4j:log4j:1.2.+'

cadc-cdp/src/main/java/ca/nrc/cadc/cred/client/CredUtil.java

+8 −8
Original line number Original line Diff line number Diff line
@@ -74,7 +74,6 @@ import ca.nrc.cadc.auth.AuthMethod; 
import ca.nrc.cadc.auth.AuthenticationUtil;

import ca.nrc.cadc.auth.AuthenticationUtil;

import ca.nrc.cadc.auth.SSLUtil;

import ca.nrc.cadc.auth.SSLUtil;

import ca.nrc.cadc.auth.X509CertificateChain;

import ca.nrc.cadc.auth.X509CertificateChain;

import ca.nrc.cadc.profiler.Profiler;

import ca.nrc.cadc.reg.Standards;

import ca.nrc.cadc.reg.Standards;

import ca.nrc.cadc.reg.client.LocalAuthority;

import ca.nrc.cadc.reg.client.LocalAuthority;

import java.io.File;

import java.io.File;
@@ -84,6 +83,7 @@ import java.security.PrivilegedActionException; 
import java.security.PrivilegedExceptionAction;

import java.security.PrivilegedExceptionAction;

import java.security.cert.CertificateException;

import java.security.cert.CertificateException;

import java.security.cert.CertificateExpiredException;

import java.security.cert.CertificateExpiredException;

import java.security.cert.CertificateNotYetValidException;

import javax.security.auth.Subject;

import javax.security.auth.Subject;

import org.apache.log4j.Logger;

import org.apache.log4j.Logger;
@@ -122,9 +122,11 @@ public class CredUtil 
     * 

     * 

     * @throws AccessControlException

     * @throws AccessControlException

     * @return true if subject has valid credentials, false if subject is anonymous

     * @return true if subject has valid credentials, false if subject is anonymous

     * @throws java.security.cert.CertificateExpiredException

     * @throws java.security.cert.CertificateNotYetValidException

     */

     */

    public static boolean checkCredentials()

    public static boolean checkCredentials()

        throws AccessControlException

        throws AccessControlException,  CertificateExpiredException, CertificateNotYetValidException

    {

    {

        return checkCredentials(AuthenticationUtil.getCurrentSubject());

        return checkCredentials(AuthenticationUtil.getCurrentSubject());

    }

    }
@@ -140,9 +142,11 @@ public class CredUtil 
     * 

     * 

     * @param subject

     * @param subject

     * @return true if subject has valid credentials, false if subject is anonymous

     * @return true if subject has valid credentials, false if subject is anonymous

     * @throws java.security.cert.CertificateExpiredException

     * @throws java.security.cert.CertificateNotYetValidException

     */

     */

    public static boolean checkCredentials(final Subject subject)

    public static boolean checkCredentials(final Subject subject)

        throws AccessControlException

        throws AccessControlException, CertificateExpiredException, CertificateNotYetValidException

    {

    {

        AuthMethod am = AuthenticationUtil.getAuthMethod(subject);

        AuthMethod am = AuthenticationUtil.getAuthMethod(subject);

        if (am == null || AuthMethod.ANON.equals(am))

        if (am == null || AuthMethod.ANON.equals(am))
@@ -196,11 +200,7 @@ public class CredUtil 
                subject.getPublicCredentials().add(privateKeyChain);

                subject.getPublicCredentials().add(privateKeyChain);

            }

            }

        }

        }

        catch (CertificateException e)

        finally { }

        {

            throw new AccessControlException("credential service returned an invalid certificate");

        }

        

        return true;

        return true;

    }

    }

}
 
}