Skip to content

Commit 238f4c8

Browse files
Rujun ChenyiliuTo
Rujun Chen
and
yiliuTo
authored
Revert "Azure keyvault trust manager with multiple keystores." (Azure#21230)
* Revert "Azure keyvault trust manager with multiple keystores. (Azure#20548)" * use log instead of printstacktrace Co-authored-by: Yi Liu <yiliu6@microsoft.com>
1 parent de7cb83 commit 238f4c8

File tree

4 files changed

+24
-96
lines changed

4 files changed

+24
-96
lines changed

‎sdk/keyvault/azure-security-keyvault-jca/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,6 @@
205205
<properties>
206206
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
207207
<jacoco.min.branchcoverage>0</jacoco.min.branchcoverage>
208-
<jacoco.min.linecoverage>0</jacoco.min.linecoverage>
208+
<jacoco.min.linecoverage>0.05</jacoco.min.linecoverage>
209209
</properties>
210210
</project>

‎sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultTrustManager.java‎

Lines changed: 20 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,8 @@
33

44
package com.azure.security.keyvault.jca;
55

6-
import javax.net.ssl.X509TrustManager;
7-
import javax.net.ssl.X509ExtendedTrustManager;
8-
import javax.net.ssl.TrustManager;
9-
import javax.net.ssl.SSLEngine;
106
import javax.net.ssl.TrustManagerFactory;
7+
import javax.net.ssl.X509TrustManager;
118
import java.io.IOException;
129
import java.net.Socket;
1310
import java.security.KeyStore;
@@ -17,29 +14,25 @@
1714
import java.security.cert.CertificateException;
1815
import java.security.cert.X509Certificate;
1916
import java.util.logging.Logger;
17+
import javax.net.ssl.SSLEngine;
18+
import javax.net.ssl.X509ExtendedTrustManager;
2019

2120
import static java.util.logging.Level.WARNING;
22-
import static java.util.logging.Level.INFO;
2321

2422
/**
2523
* The Azure Key Vault variant of the X509TrustManager.
2624
*/
2725
public class KeyVaultTrustManager extends X509ExtendedTrustManager {
2826

29-
3027
/**
3128
* Stores the logger.
3229
*/
3330
private static final Logger LOGGER = Logger.getLogger(KeyVaultTrustManager.class.getName());
34-
/**
35-
* Trust manager that employs local JRE keystore.
36-
*/
37-
private X509TrustManager defaultTrustManager;
3831

3932
/**
40-
* Trust manager that employs KeyVault keystore or other 3rd party keystore.
33+
* Stores the default trust manager.
4134
*/
42-
private X509TrustManager trustManager;
35+
private X509TrustManager defaultTrustManager;
4336

4437
/**
4538
* Stores the keystore.
@@ -52,71 +45,31 @@ public class KeyVaultTrustManager extends X509ExtendedTrustManager {
5245
* @param keyStore the keystore.
5346
*/
5447
public KeyVaultTrustManager(KeyStore keyStore) {
55-
56-
if (keyStore != null) {
57-
if (keyStore.getType().equals(KeyVaultKeyStore.KEY_STORE_TYPE)) {
58-
this.keyStore = keyStore;
59-
addTrustManager(this.keyStore);
60-
} else {
61-
addKeyVaultKeystore();
62-
addTrustManager(keyStore);
48+
this.keyStore = keyStore;
49+
if (this.keyStore == null) {
50+
try {
51+
this.keyStore = KeyStore.getInstance(KeyVaultKeyStore.KEY_STORE_TYPE);
52+
this.keyStore.load(null, null);
53+
} catch (KeyStoreException | IOException | NoSuchAlgorithmException | CertificateException ex) {
54+
LOGGER.log(WARNING, "Unable to get AzureKeyVault keystore.", ex);
6355
}
6456
}
65-
addDefaultTrustManager();
66-
67-
}
68-
69-
/**
70-
* Constructor
71-
* @param trustManager The passed-in trust manager.
72-
*/
73-
public KeyVaultTrustManager(TrustManager trustManager) {
74-
75-
this.trustManager = (X509TrustManager) trustManager;
76-
addKeyVaultKeystore();
77-
addDefaultTrustManager();
78-
79-
}
80-
81-
private void addKeyVaultKeystore() {
82-
try {
83-
this.keyStore = KeyStore.getInstance(KeyVaultKeyStore.KEY_STORE_TYPE);
84-
this.keyStore.load(null, null);
85-
} catch (KeyStoreException | IOException | NoSuchAlgorithmException | CertificateException ex) {
86-
LOGGER.log(WARNING, "Unable to get the keyvault keystore.", ex);
87-
}
88-
}
89-
90-
private void addTrustManager(KeyStore keyStore) {
9157
try {
9258
TrustManagerFactory factory = TrustManagerFactory.getInstance("PKIX", "SunJSSE");
9359
factory.init(keyStore);
94-
trustManager = (X509TrustManager) factory.getTrustManagers()[0];
95-
} catch (NoSuchAlgorithmException | NoSuchProviderException | KeyStoreException ex) {
96-
LOGGER.log(WARNING, "Unable to get the trust manager factory.", ex);
97-
}
98-
99-
}
100-
101-
private void addDefaultTrustManager() {
102-
try {
103-
TrustManagerFactory factory = TrustManagerFactory.getInstance("PKIX", "SunJSSE");
104-
factory.init((KeyStore) null);
10560
defaultTrustManager = (X509TrustManager) factory.getTrustManagers()[0];
10661
} catch (NoSuchAlgorithmException | NoSuchProviderException | KeyStoreException ex) {
107-
LOGGER.log(WARNING, "Unable to get the default trust manager factory.", ex);
62+
LOGGER.log(WARNING, "Unable to get the trust manager factory.", ex);
10863
}
109-
11064
if (defaultTrustManager == null) {
11165
try {
11266
TrustManagerFactory factory = TrustManagerFactory.getInstance("PKIX", "IbmJSSE");
113-
factory.init((KeyStore) null);
67+
factory.init(keyStore);
11468
defaultTrustManager = (X509TrustManager) factory.getTrustManagers()[0];
11569
} catch (NoSuchAlgorithmException | NoSuchProviderException | KeyStoreException ex) {
116-
LOGGER.log(WARNING, "Unable to get the default trust manager factory.", ex);
70+
LOGGER.log(WARNING, "Unable to get the trust manager factory.", ex);
11771
}
11872
}
119-
12073
}
12174

12275
@Override
@@ -131,11 +84,7 @@ public void checkClientTrusted(X509Certificate[] chain, String authType)
13184
try {
13285
defaultTrustManager.checkClientTrusted(chain, authType);
13386
} catch (CertificateException ce) {
134-
try {
135-
trustManager.checkClientTrusted(chain, authType);
136-
} catch (CertificateException ce1) {
137-
pass = false;
138-
}
87+
pass = false;
13988
}
14089

14190
/*
@@ -146,7 +95,7 @@ public void checkClientTrusted(X509Certificate[] chain, String authType)
14695
try {
14796
alias = keyStore.getCertificateAlias(chain[0]);
14897
} catch (KeyStoreException kse) {
149-
LOGGER.log(INFO, "Unable to get the certificate in keyvault keystore.", kse);
98+
LOGGER.log(WARNING, "Unable to get the certificate in AzureKeyVault keystore.", kse);
15099
}
151100
if (alias == null) {
152101
throw new CertificateException("Unable to verify in keystore");
@@ -166,12 +115,9 @@ public void checkServerTrusted(X509Certificate[] chain, String authType)
166115
try {
167116
defaultTrustManager.checkServerTrusted(chain, authType);
168117
} catch (CertificateException ce) {
169-
try {
170-
trustManager.checkServerTrusted(chain, authType);
171-
} catch (CertificateException ce1) {
172-
pass = false;
173-
}
118+
pass = false;
174119
}
120+
175121
/*
176122
* Step 2 - see if the certificate exists in the keystore.
177123
*/
@@ -180,7 +126,7 @@ public void checkServerTrusted(X509Certificate[] chain, String authType)
180126
try {
181127
alias = keyStore.getCertificateAlias(chain[0]);
182128
} catch (KeyStoreException kse) {
183-
LOGGER.log(INFO, "Unable to get the certificate in keyvault keystore.", kse);
129+
LOGGER.log(WARNING, "Unable to get the certificate in AzureKeyVault keystore.", kse);
184130
}
185131
if (alias == null) {
186132
throw new CertificateException("Unable to verify in keystore");

‎sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultTrustManagerFactory.java‎

Lines changed: 2 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,10 @@
55

66
import javax.net.ssl.ManagerFactoryParameters;
77
import javax.net.ssl.TrustManager;
8-
import javax.net.ssl.TrustManagerFactory;
98
import javax.net.ssl.TrustManagerFactorySpi;
109
import java.security.KeyStore;
11-
import java.security.NoSuchAlgorithmException;
12-
import java.security.NoSuchProviderException;
13-
import java.security.InvalidAlgorithmParameterException;
1410
import java.util.ArrayList;
1511
import java.util.List;
16-
import java.util.logging.Level;
1712
import java.util.logging.Logger;
1813

1914
/**
@@ -33,26 +28,13 @@ public class KeyVaultTrustManagerFactory extends TrustManagerFactorySpi {
3328

3429
@Override
3530
protected void engineInit(KeyStore keystore) {
36-
LOGGER.entering("KeyVaultTrustManagerFactory", "engineInit", keystore);
31+
LOGGER.entering("KeyVaultKeyManagerFactory", "engineInit", keystore);
3732
trustManagers.add(new KeyVaultTrustManager(keystore));
3833
}
3934

4035
@Override
4136
protected void engineInit(ManagerFactoryParameters spec) {
42-
/**
43-
* At least, Tomcat initialises its ssl context's trust manager in this way.
44-
* If we don't implement this method, the server side "overrideTrustManagerFactory: true" does not work.
45-
*/
46-
LOGGER.entering("KeyVaultTrustManagerFactory", "engineInit", spec);
47-
if (spec != null) {
48-
try {
49-
TrustManagerFactory factory = TrustManagerFactory.getInstance("PKIX", "SunJSSE");
50-
factory.init(spec);
51-
trustManagers.add(new KeyVaultTrustManager(factory.getTrustManagers()[0]));
52-
} catch (NoSuchAlgorithmException | NoSuchProviderException | InvalidAlgorithmParameterException e) {
53-
LOGGER.log(Level.WARNING, "Unable to get the KeyVaultTrustManagerFactory", e);
54-
}
55-
}
37+
LOGGER.entering("KeyVaultKeyManagerFactory", "engineInit", spec);
5638
}
5739

5840
@Override

‎sdk/spring/azure-spring-boot-starter-keyvault-certificates/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,7 @@ To configure Spring Cloud Gateway for outbound SSL, add the following configurat
286286
azure:
287287
keyvault:
288288
uri: <the URI of the Azure Key Vault to use>
289-
jca:
289+
jca:
290290
overrideTrustManagerFactory: true
291291
```
292292

0 commit comments

Comments
 (0)