Use cached keystore

wso2-extensions · Aug 1, 2024 · 391bdaa · 391bdaa
1 parent bd40a69
commit 391bdaa
Show file tree

Hide file tree

Showing 10 changed files with 40 additions and 27 deletions.
diff --git a/...ntity.query.saml/src/main/java/org/wso2/carbon/identity/query/saml/SignKeyDataHolder.java b/...ntity.query.saml/src/main/java/org/wso2/carbon/identity/query/saml/SignKeyDataHolder.java
@@ -27,6 +27,7 @@
 import org.opensaml.security.credential.UsageType;
 import org.opensaml.security.x509.X509Credential;
 import org.wso2.carbon.base.ServerConfiguration;
+import org.wso2.carbon.core.util.CachedKeyStore;
 import org.wso2.carbon.core.util.KeyStoreManager;
 import org.wso2.carbon.identity.base.IdentityException;
 import org.wso2.carbon.identity.core.util.IdentityTenantUtil;
@@ -134,7 +135,7 @@ private void initializeKeyDataForTenant(int tenantID, String tenantDomain) throw
         String keyStoreName = SAMLSSOUtil.generateKSNameFromDomainName(tenantDomain);
         String keyAlias = tenantDomain;
         KeyStoreManager keyMan = KeyStoreManager.getInstance(tenantID);
-        KeyStore keyStore = keyMan.getKeyStore(keyStoreName);
+        CachedKeyStore keyStore = keyMan.getCachedKeyStore(keyStoreName);
         issuerPrivateKey = (PrivateKey) keyMan.getPrivateKey(keyStoreName, tenantDomain);
 
         Certificate[] certificates = keyStore.getCertificateChain(keyAlias);
@@ -170,7 +171,7 @@ private void initializeKeyDataForSuperTenantFromSystemKeyStore() throws Exceptio
         KeyStoreManager keyMan = KeyStoreManager.getInstance(MultitenantConstants.SUPER_TENANT_ID);
         issuerPrivateKey = (PrivateKey) keyAdmin.getPrivateKey(keyAlias, true);
 
-        Certificate[] certificates = keyMan.getPrimaryKeyStore().getCertificateChain(keyAlias);
+        Certificate[] certificates = keyMan.getCachedPrimaryKeyStore().getCertificateChain(keyAlias);
         issuerCerts = Arrays.copyOf(certificates, certificates.length, X509Certificate[].class);
 
         publicKey = issuerCerts[0].getPublicKey();

diff --git a/...tity.query.saml/src/main/java/org/wso2/carbon/identity/query/saml/util/OpenSAML3Util.java b/...tity.query.saml/src/main/java/org/wso2/carbon/identity/query/saml/util/OpenSAML3Util.java
@@ -42,6 +42,7 @@
 import org.opensaml.xmlsec.signature.support.SignatureException;
 import org.opensaml.xmlsec.signature.support.SignatureValidator;
 import org.opensaml.xmlsec.signature.support.Signer;
+import org.wso2.carbon.core.util.CachedKeyStore;
 import org.wso2.carbon.core.util.KeyStoreManager;
 import org.wso2.carbon.identity.application.common.model.FederatedAuthenticatorConfig;
 import org.wso2.carbon.identity.application.common.model.IdentityProvider;
@@ -308,14 +309,14 @@ public static X509CredentialImpl getX509CredentialImplForTenant(String tenantDom
         // get an instance of the corresponding Key Store Manager instance
         keyStoreManager = KeyStoreManager.getInstance(tenantId);
         X509CredentialImpl credentialImpl = null;
-        KeyStore keyStore;
+        CachedKeyStore keyStore;
         try {
             if (tenantId != MultitenantConstants.SUPER_TENANT_ID) {// for tenants, load private key from their generated key store
-                keyStore = keyStoreManager.getKeyStore(generateKSNameFromDomainName(tenantDomain));
+                keyStore = keyStoreManager.getCachedKeyStore(generateKSNameFromDomainName(tenantDomain));
             } else {
                 // for super tenant, load the default pub. cert using the
                 // config. in carbon.xml
-                keyStore = keyStoreManager.getPrimaryKeyStore();
+                keyStore = keyStoreManager.getCachedPrimaryKeyStore();
             }
             java.security.cert.X509Certificate cert =
                     (java.security.cert.X509Certificate) keyStore.getCertificate(alias);

diff --git a/...so.saml/src/main/java/org/wso2/carbon/identity/sso/saml/admin/FileBasedConfigManager.java b/...so.saml/src/main/java/org/wso2/carbon/identity/sso/saml/admin/FileBasedConfigManager.java
@@ -324,9 +324,7 @@ private X509Certificate getCertificateFromKeyStore(String alias) {
 
         try {
             KeyStoreManager keyStoreManager = KeyStoreManager.getInstance(MultitenantConstants.SUPER_TENANT_ID);
-            KeyStore keyStore = keyStoreManager.getPrimaryKeyStore();
-            X509Certificate certificate = (X509Certificate)keyStore.getCertificate(alias);
-            return certificate;
+            return (X509Certificate) keyStoreManager.getCachedPrimaryKeyStore().getCertificate(alias);
         } catch (Exception e) {
             String errorMsg = String.format("Error occurred while retrieving the certificate for " +
                     "the alias '%s'." + alias);

diff --git a/...ty.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/admin/SAMLSSOConfigAdmin.java b/...ty.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/admin/SAMLSSOConfigAdmin.java
@@ -307,7 +307,7 @@ private void saveCertificateToKeyStore(SAMLSSOServiceProviderDO serviceProviderD
 
         if (MultitenantConstants.SUPER_TENANT_ID == tenantId) {
 
-            KeyStore keyStore = manager.getPrimaryKeyStore();
+            KeyStore keyStore = manager.getCachedPrimaryKeyStore().getKeyStore();
 
             // Admin should manually add the service provider signing certificate to the keystore file.
             // If the certificate is available we will set the alias of that certificate.
@@ -320,7 +320,7 @@ private void saveCertificateToKeyStore(SAMLSSOServiceProviderDO serviceProviderD
         } else {
 
             String keyStoreName = getKeyStoreName(tenantId);
-            KeyStore keyStore = manager.getKeyStore(keyStoreName);
+            KeyStore keyStore = manager.getCachedKeyStore(keyStoreName).getKeyStore();
 
             // Add new certificate
             keyStore.setCertificateEntry(serviceProviderDO.getIssuer(), serviceProviderDO.getX509Certificate());

diff --git a/....sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/builders/SignKeyDataHolder.java b/....sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/builders/SignKeyDataHolder.java
@@ -27,6 +27,7 @@
 import org.opensaml.security.x509.X509Credential;
 import org.wso2.carbon.base.ServerConfiguration;
 import org.wso2.carbon.context.PrivilegedCarbonContext;
+import org.wso2.carbon.core.util.CachedKeyStore;
 import org.wso2.carbon.core.util.KeyStoreManager;
 import org.wso2.carbon.identity.base.IdentityException;
 import org.wso2.carbon.identity.core.util.IdentityTenantUtil;
@@ -150,7 +151,7 @@ private void initializeKeyDataForTenant(int tenantID, String tenantDomain) throw
         String keyStoreName = SAMLSSOUtil.generateKSNameFromDomainName(tenantDomain);
         String keyAlias = tenantDomain;
         KeyStoreManager keyMan = KeyStoreManager.getInstance(tenantID);
-        KeyStore keyStore = keyMan.getKeyStore(keyStoreName);
+        CachedKeyStore keyStore = keyMan.getCachedKeyStore(keyStoreName);
         issuerPrivateKey = (PrivateKey) keyMan.getPrivateKey(keyStoreName, tenantDomain);
 
         Certificate[] certificates = keyStore.getCertificateChain(keyAlias);
@@ -184,7 +185,7 @@ private void initializeKeyDataForSuperTenantFromSystemKeyStore() throws Exceptio
         KeyStoreManager keyMan = KeyStoreManager.getInstance(MultitenantConstants.SUPER_TENANT_ID);
         issuerPrivateKey = (PrivateKey) keyAdmin.getPrivateKey(keyAlias, true);
 
-        Certificate[] certificates = keyMan.getPrimaryKeyStore().getCertificateChain(keyAlias);
+        Certificate[] certificates = keyMan.getCachedPrimaryKeyStore().getCertificateChain(keyAlias);
         issuerCerts = Arrays.copyOf(certificates, certificates.length, X509Certificate[].class);
 
         signatureAlgorithm = XMLSignature.ALGO_ID_SIGNATURE_RSA;

diff --git a/...sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/builders/X509CredentialImpl.java b/...sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/builders/X509CredentialImpl.java
@@ -208,7 +208,7 @@ private void initCredentialForTenant(String tenantDomain, KeyStoreManager keySto
             // Derive key store name.
             String jksName = KeystoreUtils.getKeyStoreFileLocation(tenantDomain);
             privateKey = (PrivateKey) keyStoreManager.getPrivateKey(jksName, tenantDomain);
-            signingCert = (X509Certificate) keyStoreManager.getKeyStore(jksName).getCertificate(tenantDomain);
+            signingCert = (X509Certificate) keyStoreManager.getCachedKeyStore(jksName).getCertificate(tenantDomain);
         // This Exception is thrown from the KeyStoreManager.
         } catch (Exception e) {
             throw new IdentityException("Error retrieving private key and the certificate for tenant " +

diff --git a/...n.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/util/SAMLSSOUtil.java b/...n.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/util/SAMLSSOUtil.java
@@ -59,6 +59,7 @@
 import org.w3c.dom.ls.LSOutput;
 import org.w3c.dom.ls.LSSerializer;
 import org.wso2.carbon.context.PrivilegedCarbonContext;
+import org.wso2.carbon.core.util.CachedKeyStore;
 import org.wso2.carbon.core.util.KeyStoreManager;
 import org.wso2.carbon.identity.application.authentication.framework.exception.UserIdNotFoundException;
 import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatedUser;
@@ -958,19 +959,19 @@ public static X509CredentialImpl getX509CredentialImplForTenant(String tenantDom
         keyStoreManager = KeyStoreManager.getInstance(tenantId);
 
         X509CredentialImpl credentialImpl = null;
-        KeyStore keyStore;
+        CachedKeyStore keyStore;
 
         try {
             if (tenantId != -1234) {// for tenants, load private key from their generated key store
                 try {
                     FrameworkUtils.startTenantFlow(tenantDomain);
-                    keyStore = keyStoreManager.getKeyStore(generateKSNameFromDomainName(tenantDomain));
+                    keyStore = keyStoreManager.getCachedKeyStore(generateKSNameFromDomainName(tenantDomain));
                 } finally {
                     FrameworkUtils.endTenantFlow();
                 }
             } else { // for super tenant, load the default pub. cert using the
                 // config. in carbon.xml
-                keyStore = keyStoreManager.getPrimaryKeyStore();
+                keyStore = keyStoreManager.getCachedPrimaryKeyStore();
             }
             java.security.cert.X509Certificate cert =
                     (java.security.cert.X509Certificate) keyStore.getCertificate(alias);

diff --git a/...ntity.sso.saml/src/test/java/org/wso2/carbon/identity/sso/saml/SAMLLogoutHandlerTest.java b/...ntity.sso.saml/src/test/java/org/wso2/carbon/identity/sso/saml/SAMLLogoutHandlerTest.java
@@ -28,6 +28,7 @@
 import org.testng.annotations.BeforeTest;
 import org.testng.annotations.Test;
 import org.wso2.carbon.base.ServerConfiguration;
+import org.wso2.carbon.core.util.CachedKeyStore;
 import org.wso2.carbon.core.util.KeyStoreManager;
 import org.wso2.carbon.core.util.KeyStoreUtil;
 import org.wso2.carbon.identity.application.authentication.framework.context.AuthenticationContext;
@@ -50,6 +51,7 @@
 import org.wso2.carbon.utils.multitenancy.MultitenantConstants;
 
 import java.security.KeyStore;
+import java.security.PrivateKey;
 import java.security.SecureRandom;
 import java.util.HashMap;
 import javax.net.ssl.KeyManager;
@@ -178,6 +180,7 @@ private void createMocks() throws Exception {
 
         KeyStore keyStore = TestUtils.
                 loadKeyStoreFromFileSystem(TestUtils.getFilePath("wso2carbon.jks"), "wso2carbon", "JKS");
+        CachedKeyStore cachedKeyStore = new CachedKeyStore(keyStore);
 
         SAMLSSOUtil.setRegistryService(registryService);
         when(registryService.getGovernanceSystemRegistry()).thenReturn(registry);
@@ -187,7 +190,7 @@ private void createMocks() throws Exception {
 
         mockStatic(KeyStoreManager.class);
         when(KeyStoreManager.getInstance(MultitenantConstants.SUPER_TENANT_ID)).thenReturn(keyStoreManager);
-        when(keyStoreManager.getPrimaryKeyStore()).thenReturn(keyStore);
+        when(keyStoreManager.getCachedPrimaryKeyStore()).thenReturn(cachedKeyStore);
     }
 
     @Test

diff --git a/...entity.sso.saml/src/test/java/org/wso2/carbon/identity/sso/saml/util/EncryptionTests.java b/...entity.sso.saml/src/test/java/org/wso2/carbon/identity/sso/saml/util/EncryptionTests.java
@@ -26,6 +26,7 @@
 import org.powermock.core.classloader.annotations.PrepareForTest;
 import org.powermock.modules.testng.PowerMockTestCase;
 import org.testng.annotations.Test;
+import org.wso2.carbon.core.util.CachedKeyStore;
 import org.wso2.carbon.core.util.KeyStoreManager;
 import org.wso2.carbon.identity.application.authentication.framework.internal.FrameworkServiceComponent;
 import org.wso2.carbon.identity.core.util.IdentityUtil;
@@ -127,14 +128,16 @@ private void assertEncryptedSAMLAssertion(Assertion assertion, EncryptedAssertio
 
     private void prepareForAssertionEncryption() throws Exception {
 
+        KeyStore keyStore = TestUtils.loadKeyStoreFromFileSystem(
+                TestUtils.getFilePath(TestConstants.KEY_STORE_NAME), TestConstants.WSO2_CARBON, "JKS");
+        CachedKeyStore cachedKeyStore = new CachedKeyStore(keyStore);
+
         when(realmService.getTenantManager()).thenReturn(tenantManager);
         when(tenantManager.getTenantId(anyString())).thenReturn(4567);
         mockStatic(KeyStoreManager.class);
         when(KeyStoreManager.getInstance(anyInt())).thenReturn(keyStoreManager);
-        when(keyStoreManager.getKeyStore(anyString())).thenReturn(TestUtils.loadKeyStoreFromFileSystem(
-                TestUtils.getFilePath(TestConstants.KEY_STORE_NAME), TestConstants.WSO2_CARBON, "JKS"));
-        when(keyStoreManager.getPrimaryKeyStore()).thenReturn(TestUtils.loadKeyStoreFromFileSystem(
-                TestUtils.getFilePath(TestConstants.KEY_STORE_NAME), TestConstants.WSO2_CARBON, "JKS"));
+        when(keyStoreManager.getCachedKeyStore(anyString())).thenReturn(cachedKeyStore);
+        when(keyStoreManager.getCachedPrimaryKeyStore()).thenReturn(cachedKeyStore);
         SAMLSSOUtil.setRealmService(realmService);
 
         mockStatic(IdentityUtil.class);

diff --git a/...entity.sso.saml/src/test/java/org/wso2/carbon/identity/sso/saml/util/SAMLSSOUtilTest.java b/...entity.sso.saml/src/test/java/org/wso2/carbon/identity/sso/saml/util/SAMLSSOUtilTest.java
@@ -30,6 +30,7 @@
 import org.testng.annotations.DataProvider;
 import org.testng.annotations.ObjectFactory;
 import org.testng.annotations.Test;
+import org.wso2.carbon.core.util.CachedKeyStore;
 import org.wso2.carbon.core.util.KeyStoreManager;
 import org.wso2.carbon.identity.application.authentication.framework.internal.FrameworkServiceComponent;
 import org.wso2.carbon.identity.application.common.model.FederatedAuthenticatorConfig;
@@ -64,6 +65,7 @@
 import org.wso2.carbon.utils.multitenancy.MultitenantConstants;
 import org.wso2.carbon.utils.security.KeystoreUtils;
 
+import java.security.KeyStore;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -403,15 +405,18 @@ public void testGetDestinationException() throws Exception {
     @Test
     public void testGetX509CredentialImplForSuperTenant() throws Exception {
 
+        KeyStore keyStore = TestUtils.loadKeyStoreFromFileSystem(TestUtils
+                .getFilePath("wso2carbon.jks"), "wso2carbon", "JKS");
+        CachedKeyStore cachedKeyStore = new CachedKeyStore(keyStore);
         prepareForGetIssuer();
         mockStatic(FrameworkServiceComponent.class);
         when(FrameworkServiceComponent.getRealmService()).thenReturn(realmService);
         when(realmService.getTenantManager()).thenReturn(tenantManager);
         when(tenantManager.getTenantId(anyString())).thenReturn(-1234);
         mockStatic(KeyStoreManager.class);
         when(KeyStoreManager.getInstance(eq(-1234))).thenReturn(keyStoreManager);
-        when(keyStoreManager.getPrimaryKeyStore()).thenReturn(TestUtils.loadKeyStoreFromFileSystem(TestUtils
-                .getFilePath("wso2carbon.jks"), "wso2carbon", "JKS"));
+        when(keyStoreManager.getCachedPrimaryKeyStore()).thenReturn(cachedKeyStore);
+        when(keyStoreManager.getCachedKeyStore(anyString())).thenReturn(cachedKeyStore);
         X509CredentialImpl x509Credential = SAMLSSOUtil.getX509CredentialImplForTenant("carbon.super", "wso2carbon");
         assertNotNull(x509Credential.getPublicKey(), "public key is missing");
     }
@@ -427,9 +432,9 @@ public void testGetX509CredentialImplForTenant() throws Exception {
         when(tenantManager.getTenantId(anyString())).thenReturn(1);
         mockStatic(KeyStoreManager.class);
         when(KeyStoreManager.getInstance(eq(1))).thenReturn(keyStoreManager);
-        when(keyStoreManager.getKeyStore(eq(SAMLSSOUtil.generateKSNameFromDomainName(TestConstants.WSO2_TENANT_DOMAIN)))).thenReturn
-                (TestUtils.loadKeyStoreFromFileSystem(TestUtils
-                        .getFilePath(TestConstants.KEY_STORE_NAME), TestConstants.WSO2_CARBON, "JKS"));
+        when(keyStoreManager.getCachedKeyStore(eq(SAMLSSOUtil.generateKSNameFromDomainName(TestConstants.WSO2_TENANT_DOMAIN)))).thenReturn
+                (new CachedKeyStore(TestUtils.loadKeyStoreFromFileSystem(TestUtils
+                        .getFilePath(TestConstants.KEY_STORE_NAME), TestConstants.WSO2_CARBON, "JKS")));
         X509CredentialImpl x509Credential = SAMLSSOUtil.getX509CredentialImplForTenant(TestConstants
                 .WSO2_TENANT_DOMAIN, TestConstants.WSO2_CARBON);
         assertNotNull(x509Credential.getPublicKey(), "public key is missing for tenant");
@@ -443,7 +448,7 @@ public void testGetX509CredentialImplException() throws Exception {
         when(tenantManager.getTenantId(anyString())).thenReturn(1);
         mockStatic(KeyStoreManager.class);
         when(KeyStoreManager.getInstance(eq(1))).thenReturn(keyStoreManager);
-        when(keyStoreManager.getKeyStore(eq(SAMLSSOUtil.generateKSNameFromDomainName(TestConstants.WSO2_TENANT_DOMAIN)))).thenReturn
+        when(keyStoreManager.getCachedKeyStore(eq(SAMLSSOUtil.generateKSNameFromDomainName(TestConstants.WSO2_TENANT_DOMAIN)))).thenReturn
                 (null);
         X509CredentialImpl x509Credential = SAMLSSOUtil.getX509CredentialImplForTenant(TestConstants
                 .WSO2_TENANT_DOMAIN, TestConstants.WSO2_CARBON);