Class SpiffeTrustManager

java.lang.Object

javax.net.ssl.X509ExtendedTrustManager

io.spiffe.provider.SpiffeTrustManager

All Implemented Interfaces:

TrustManager, X509TrustManager

public final class SpiffeTrustManager
extends X509ExtendedTrustManager

Implementation of an X.509 TrustManager for the SPIFFE Provider.

Provides methods to validate X.509 certificates chains using trusted certs provided by a BundleSource maintained via the Workload API and to verify the SPIFFE IDs against a Set of accepted SPIFFE IDs provided by a Supplier.

Constructor Summary

Constructors

Constructor	Description
SpiffeTrustManager(@NonNull io.spiffe.bundle.BundleSource<io.spiffe.bundle.x509bundle.X509Bundle> x509BundleSource)	Constructor.
SpiffeTrustManager(@NonNull io.spiffe.bundle.BundleSource<io.spiffe.bundle.x509bundle.X509Bundle> x509BundleSource, @NonNull SpiffeIdVerifier spiffeIdVerifier)	Constructor.
SpiffeTrustManager(@NonNull io.spiffe.bundle.BundleSource<io.spiffe.bundle.x509bundle.X509Bundle> x509BundleSource, @NonNull Supplier<Set<io.spiffe.spiffeid.SpiffeId>> acceptedSpiffeIdsSupplier)	Constructor.

Method Summary

Modifier and Type	Method	Description
void	checkClientTrusted(@NonNull X509Certificate[] chain, String authType)	Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for Client SSL authentication based on the authentication type.
void	checkClientTrusted(@NonNull X509Certificate[] chain, String authType, Socket socket)	checkClientTrusted(X509Certificate[], String)
void	checkClientTrusted(@NonNull X509Certificate[] chain, String authType, SSLEngine sslEngine)	checkClientTrusted(X509Certificate[], String)
void	checkServerTrusted(@NonNull X509Certificate[] chain, String authType)	Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for Server SSL authentication based on the authentication type.
void	checkServerTrusted(@NonNull X509Certificate[] chain, String authType, Socket socket)	checkServerTrusted(X509Certificate[], String)
void	checkServerTrusted(@NonNull X509Certificate[] chain, String authType, SSLEngine sslEngine)	checkServerTrusted(X509Certificate[], String)
X509Certificate[]	getAcceptedIssuers()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SpiffeTrustManager

public SpiffeTrustManager(@NonNull
 @NonNull io.spiffe.bundle.BundleSource<io.spiffe.bundle.x509bundle.X509Bundle> x509BundleSource,
 @NonNull
 @NonNull Supplier<Set<io.spiffe.spiffeid.SpiffeId>> acceptedSpiffeIdsSupplier)

Constructor.

Creates a SpiffeTrustManager with an X.509 bundle source used to provide the trusted bundles, and a Supplier of a Set of accepted SpiffeId to be used during peer SVID validation.

Parameters:

x509BundleSource - an implementation of a BundleSource

acceptedSpiffeIdsSupplier - a Supplier of a Set of accepted SPIFFE IDs.

SpiffeTrustManager

public SpiffeTrustManager(@NonNull
 @NonNull io.spiffe.bundle.BundleSource<io.spiffe.bundle.x509bundle.X509Bundle> x509BundleSource,
 @NonNull
 @NonNull SpiffeIdVerifier spiffeIdVerifier)

Constructor.

Creates a SpiffeTrustManager with an X.509 bundle source used to provide the trusted bundles, and a SpiffeIdVerifier which will be called to determine if a SpiffeId should be accepted during peer SVID validation.

Parameters:

x509BundleSource - an implementation of a BundleSource

spiffeIdVerifier - a SpiffeIdVerifier that will be called to determine if a peer's SPIFFE ID is acceptable

SpiffeTrustManager

public SpiffeTrustManager(@NonNull
 @NonNull io.spiffe.bundle.BundleSource<io.spiffe.bundle.x509bundle.X509Bundle> x509BundleSource)

Constructor.

Creates a SpiffeTrustManager with an X.509 bundle source used to provide the trusted bundles, and a flag to indicate that any SPIFFE ID will be accepted.

Any SPIFFE ID will be accepted during peer SVID validation.

Parameters:

x509BundleSource - an implementation of a BundleSource

Method Details

checkClientTrusted

public void checkClientTrusted(@NonNull
 @NonNull X509Certificate[] chain,
 String authType)
                        throws CertificateException

Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for Client SSL authentication based on the authentication type.

Throws a CertificateException if the chain cannot be chained to a trusted bundled, or if the SPIFFE ID in the chain is not in the Set of accepted SPIFFE IDs.

Parameters:

chain - the peer certificate chain

authType - not used

Throws:

CertificateException - when the chain or the SPIFFE ID presented are not trusted.

checkServerTrusted

public void checkServerTrusted(@NonNull
 @NonNull X509Certificate[] chain,
 String authType)
                        throws CertificateException

Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for Server SSL authentication based on the authentication type.

Throws a CertificateException if the chain cannot be chained to a trusted bundled, or if the SPIFFE ID in the chain is not in the Set of accepted SPIFFE IDs.

Parameters:

chain - the peer certificate chain

authType - not used

Throws:

CertificateException - when the chain or the SPIFFE ID presented are not trusted.

getAcceptedIssuers

public X509Certificate[] getAcceptedIssuers()

checkClientTrusted

public void checkClientTrusted(@NonNull
 @NonNull X509Certificate[] chain,
 String authType,
 Socket socket)
                        throws CertificateException

checkClientTrusted(X509Certificate[], String)

Specified by:

checkClientTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(@NonNull
 @NonNull X509Certificate[] chain,
 String authType,
 Socket socket)
                        throws CertificateException

checkServerTrusted(X509Certificate[], String)

Specified by:

checkServerTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkClientTrusted

public void checkClientTrusted(@NonNull
 @NonNull X509Certificate[] chain,
 String authType,
 SSLEngine sslEngine)
                        throws CertificateException

checkClientTrusted(X509Certificate[], String)

Specified by:

checkClientTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(@NonNull
 @NonNull X509Certificate[] chain,
 String authType,
 SSLEngine sslEngine)
                        throws CertificateException

checkServerTrusted(X509Certificate[], String)

Specified by:

checkServerTrusted in class X509ExtendedTrustManager

Throws:

CertificateException