PAYARA-3789 Unify DN Representation #4042
Conversation
|
Jenkins test please |
.../core/src/main/java/com/sun/enterprise/security/auth/realm/certificate/CertificateRealm.java
Outdated
Show resolved
Hide resolved
.../core/src/main/java/com/sun/enterprise/security/auth/realm/certificate/CertificateRealm.java
Outdated
Show resolved
Hide resolved
| oidMapInitialiser.put("0.9.2342.19200300.100.1.1", "UID"); | ||
| oidMapInitialiser.put("0.9.2342.19200300.100.1.25", "DC"); | ||
| oidMapInitialiser.put("1.2.840.113549.1.9.1", "EMAIL"); | ||
| oidMapInitialiser.put("1.2.840.113549.1.9.1", "EMAILADDRESS"); |
There was a problem hiding this comment.
Duplicate, so always EMAILADDRESS used and never EMAIL.
.../core/src/main/java/com/sun/enterprise/security/auth/realm/certificate/CertificateRealm.java
Outdated
Show resolved
Hide resolved
|
I seem to have broken it with my recent changes, will reopen once it's all working again. |
…-3789-Unify-DN-Representation
|
Also tested using IAIK provider and seems to work |
|
Jenkins test please |
| @@ -101,7 +103,30 @@ | |||
|
|
|||
| // Descriptive string of the authentication type of this realm. | |||
| public static final String AUTH_TYPE = "certificate"; | |||
|
|
|||
| public static final Map<String, String> oidMap; | |||
| @@ -173,7 +176,7 @@ private static String getPrincipalName(X509Certificate[] certificates, SecurityC | |||
| // Use the full DN name from the certificates. This should normally be the same as | |||
| // context.getCallerPrincipal(), but a realm could have decided to map the name in which | |||
| // case they will be different. | |||
| return certificates[0].getSubjectX500Principal().getName(); | |||
| return certificates[0].getSubjectX500Principal().getName(X500Principal.RFC2253, CertificateRealm.oidMap); | |||
There was a problem hiding this comment.
We are using getName(X500Principal.RFC2253, CertificateRealm.oidMap) several times. Make a utility method so that X500Principal representation is only in 1 place for future?
There was a problem hiding this comment.
I'm not sure that's really worth it? Unless I'm misunderstanding you we'd just be replacing certificates[0].getSubjectX500Principal().getName(X500Principal.RFC2253, CertificateRealm.oidMap) with CertificateRealm.getX500PrincipalSubjectName(certificates[0]).
It seems fragile to me to store the name of the certificate somewhere outside of the actual certificate itself.
Also, it isn't strictly necessary for me to put the full X500Principal.RFC2253 stuff everywhere, it's me just being safe. From my testing as long as you get the name in this manner from the CertificateRealm it propagates outward such that simply doing getName() will still have the OIDs translated.
|
Jenkins test please |
|
PAYARA-3937 Created to track code improvement request. |
…epresentation PAYARA-3789 Unify DN Representation
Should also stop requiring OIDs for most known fields (e.g. EMAILADDRESS)