A CertStore that retrieves Certificates and CRLs from an LDAP directory, using the PKIX LDAP V2 Schema (RFC 2587): http://www.ietf.org/rfc/rfc2587.txt.

Before calling the engineGetCertificates or engineGetCRLs methods, the LDAPCertStore(CertStoreParameters) constructor is called to create the CertStore and establish the DNS name and port of the LDAP server from which Certificates and CRLs will be retrieved.

Concurrent Access

As described in the javadoc for CertStoreSpi, the engineGetCertificates and engineGetCRLs methods must be thread-safe. That is, multiple threads may concurrently invoke these methods on a single LDAPCertStore object (or more than one) with no ill effects. This allows a CertPathBuilder to search for a CRL while simultaneously searching for further certificates, for instance.

This is achieved by adding the synchronized keyword to the engineGetCertificates and engineGetCRLs methods.

This classes uses caching and requests multiple attributes at once to minimize LDAP round trips. The cache is associated with the CertStore instance. It uses soft references to hold the values to minimize impact on footprint and currently has a maximum size of 750 attributes and a 30 second default lifetime.

We always request CA certificates, cross certificate pairs, and ARLs in a single LDAP request when any one of them is needed. The reason is that we typically need all of them anyway and requesting them in one go can reduce the number of requests to a third. Even if we don't need them, these attributes are typically small enough not to cause a noticeable overhead. In addition, when the prefetchCRLs flag is true, we also request the full CRLs. It is currently false initially but set to true once any request for an ARL to the server returns an null value. The reason is that CRLs could be rather large but are rarely used. This implementation should improve performance in most cases.

Nested and Inner Type Summary

Modifier and Type	Class and Description
private static class	LDAPCertStore.Key

Field Summary

Modifier and Type	Field and Description
private static final Cache<LDAPCertStore.Key, LDAPCertStoreImpl>	certStoreCache Returns an LDAPCertStoreImpl object.
private static final Debug	debug
private LDAPCertStoreImpl	impl
private String	ldapDN

Access	Constructor and Description
public	LDAPCertStore(CertStoreParameters params)

Method Summary

Modifier and Type	Method and Description
public synchronized Collection<X509Certificate>	Returns: a `Collection` of `Certificate`s that match the specified selector engineGetCertificates(CertSelector a `CertSelector` used to select which `Certificate`s should be returned. selector) Implements abstract java.security.cert.CertStoreSpi.engineGetCertificates. Returns a `Collection` of `Certificate`s that match the specified selector.
public synchronized Collection<X509CRL>	Returns: A `Collection` of `CRL`s that match the specified selector engineGetCRLs(CRLSelector A `CRLSelector` used to select which `CRL`s should be returned. Specify `null` to return all `CRL`s. selector) Implements abstract java.security.cert.CertStoreSpi.engineGetCRLs. Returns a `Collection` of `CRL`s that match the specified selector.
pack-priv static synchronized LDAPCertStoreImpl	getInstance(LDAPCertStoreParameters params)

Field Detail

certStoreCache	back to summary
private static final Cache<LDAPCertStore.Key, LDAPCertStoreImpl> certStoreCache Returns an LDAPCertStoreImpl object. This method consults a cache of LDAPCertStoreImpl objects (shared per JVM) using the corresponding LDAP server name and port info as a key.

debug	back to summary
private static final Debug debug

impl	back to summary
private LDAPCertStoreImpl impl

ldapDN	back to summary
private String ldapDN

LDAPCertStore	back to summary
public LDAPCertStore(CertStoreParameters params) throws InvalidAlgorithmParameterException

Method Detail

engineGetCertificates back to summary

engineGetCertificates	back to summary
public synchronized Collection<X509Certificate> engineGetCertificates(CertSelector selector) throws CertStoreException Implements abstract java.security.cert.CertStoreSpi.engineGetCertificates. Returns a `Collection` of `Certificate`s that match the specified selector. If no `Certificate`s match the selector, an empty `Collection` will be returned. It is not practical to search every entry in the LDAP database for matching `Certificate`s. Instead, the `CertSelector` is examined in order to determine where matching `Certificate`s are likely to be found (according to the PKIX LDAPv2 schema, RFC 2587). If the subject is specified, its directory entry is searched. If the issuer is specified, its directory entry is searched. If neither the subject nor the issuer are specified (or the selector is not an `X509CertSelector`), a `CertStoreException` is thrown. Parameters selector:CertSelector a `CertSelector` used to select which `Certificate`s should be returned. Returns:Collection<X509Certificate> a `Collection` of `Certificate`s that match the specified selector Annotations @Override Exceptions CertStoreException: if an exception occurs

public synchronized Collection<X509Certificate> engineGetCertificates(CertSelector selector) throws CertStoreException

Implements abstract java.security.cert.CertStoreSpi.engineGetCertificates.

Returns a Collection of Certificates that match the specified selector. If no Certificates match the selector, an empty Collection will be returned.

It is not practical to search every entry in the LDAP database for matching Certificates. Instead, the CertSelector is examined in order to determine where matching Certificates are likely to be found (according to the PKIX LDAPv2 schema, RFC 2587). If the subject is specified, its directory entry is searched. If the issuer is specified, its directory entry is searched. If neither the subject nor the issuer are specified (or the selector is not an X509CertSelector), a CertStoreException is thrown.

Parameters

selector:CertSelector: a CertSelector used to select which Certificates should be returned.

Returns:Collection<X509Certificate>

a Collection of Certificates that match the specified selector

Annotations

@Override

Exceptions

CertStoreException:: if an exception occurs

engineGetCRLs back to summary

engineGetCRLs	back to summary
public synchronized Collection<X509CRL> engineGetCRLs(CRLSelector selector) throws CertStoreException Implements abstract java.security.cert.CertStoreSpi.engineGetCRLs. Returns a `Collection` of `CRL`s that match the specified selector. If no `CRL`s match the selector, an empty `Collection` will be returned. It is not practical to search every entry in the LDAP database for matching `CRL`s. Instead, the `CRLSelector` is examined in order to determine where matching `CRL`s are likely to be found (according to the PKIX LDAPv2 schema, RFC 2587). If issuerNames or certChecking are specified, the issuer's directory entry is searched. If neither issuerNames or certChecking are specified (or the selector is not an `X509CRLSelector`), a `CertStoreException` is thrown. Parameters selector:CRLSelector A `CRLSelector` used to select which `CRL`s should be returned. Specify `null` to return all `CRL`s. Returns:Collection<X509CRL> A `Collection` of `CRL`s that match the specified selector Annotations @Override Exceptions CertStoreException: if an exception occurs

public synchronized Collection<X509CRL> engineGetCRLs(CRLSelector selector) throws CertStoreException

Implements abstract java.security.cert.CertStoreSpi.engineGetCRLs.

Returns a Collection of CRLs that match the specified selector. If no CRLs match the selector, an empty Collection will be returned.

It is not practical to search every entry in the LDAP database for matching CRLs. Instead, the CRLSelector is examined in order to determine where matching CRLs are likely to be found (according to the PKIX LDAPv2 schema, RFC 2587). If issuerNames or certChecking are specified, the issuer's directory entry is searched. If neither issuerNames or certChecking are specified (or the selector is not an X509CRLSelector), a CertStoreException is thrown.

Parameters

selector:CRLSelector: A CRLSelector used to select which CRLs should be returned. Specify null to return all CRLs.

Returns:Collection<X509CRL>

A Collection of CRLs that match the specified selector

Annotations

@Override

Exceptions

CertStoreException:: if an exception occurs

getInstance	back to summary
pack-priv static synchronized LDAPCertStoreImpl getInstance(LDAPCertStoreParameters params) throws NoSuchAlgorithmException, InvalidAlgorithmParameterException

sun.security.provider.certpath.ldap back to summary

private Class LDAPCertStore.Key

Class Inheritance

extends Object

java.lang.Object
sun.security.provider.certpath.ldap.LDAPCertStore.Key

Field Summary

Modifier and Type	Field and Description
pack-priv volatile int	hashCode
pack-priv int	port
pack-priv String	serverName

Constructor Summary

Access	Constructor and Description
pack-priv	Key(String serverName, int port)

Method Summary

Modifier and Type	Method and Description
public boolean	equals(Object obj) Overrides java.lang.Object.equals. Indicates whether some other object is "equal to" this one.
public int	hashCode() Overrides java.lang.Object.hashCode. Returns a hash code value for this object.

Inherited from java.lang.Object:: clone finalize getClass notify notifyAll toString wait wait wait

Field Detail

hashCode	back to summary
pack-priv volatile int hashCode

port	back to summary
pack-priv int port

serverName	back to summary
pack-priv String serverName

Constructor Detail

Key	back to summary
pack-priv Key(String serverName, int port)

Method Detail

equals back to summary

equals	back to summary
public boolean equals(Object obj) Overrides java.lang.Object.equals. Doc from java.lang.Object.equals. Indicates whether some other object is "equal to" this one. The `equals` method implements an equivalence relation on non-null object references: It is reflexive: for any non-null reference value `x`, `x.equals(x)` should return `true`. It is symmetric: for any non-null reference values `x` and `y`, `x.equals(y)` should return `true` if and only if `y.equals(x)` returns `true`. It is transitive: for any non-null reference values `x`, `y`, and `z`, if `x.equals(y)` returns `true` and `y.equals(z)` returns `true`, then `x.equals(z)` should return `true`. It is consistent: for any non-null reference values `x` and `y`, multiple invocations of `x.equals(y)` consistently return `true` or consistently return `false`, provided no information used in `equals` comparisons on the objects is modified. For any non-null reference value `x`, `x.equals(null)` should return `false`. An equivalence relation partitions the elements it operates on into equivalence classes; all the members of an equivalence class are equal to each other. Members of an equivalence class are substitutable for each other, at least for some purposes. Annotations @Override

public boolean equals(Object obj)

Overrides java.lang.Object.equals.

Doc from java.lang.Object.equals.

Indicates whether some other object is "equal to" this one.

The equals method implements an equivalence relation on non-null object references:

It is reflexive: for any non-null reference value x, x.equals(x) should return true.
It is symmetric: for any non-null reference values x and y, x.equals(y) should return true if and only if y.equals(x) returns true.
It is transitive: for any non-null reference values x, y, and z, if x.equals(y) returns true and y.equals(z) returns true, then x.equals(z) should return true.
It is consistent: for any non-null reference values x and y, multiple invocations of x.equals(y) consistently return true or consistently return false, provided no information used in equals comparisons on the objects is modified.
For any non-null reference value x, x.equals(null) should return false.

An equivalence relation partitions the elements it operates on into equivalence classes; all the members of an equivalence class are equal to each other. Members of an equivalence class are substitutable for each other, at least for some purposes.

Annotations

@Override

hashCode back to summary

hashCode	back to summary
public int hashCode() Overrides java.lang.Object.hashCode. Doc from java.lang.Object.hashCode. Returns a hash code value for this object. This method is supported for the benefit of hash tables such as those provided by `java.util.HashMap`. The general contract of `hashCode` is: Whenever it is invoked on the same object more than once during an execution of a Java application, the `hashCode` method must consistently return the same integer, provided no information used in `equals` comparisons on the object is modified. This integer need not remain consistent from one execution of an application to another execution of the same application. If two objects are equal according to the `equals` method, then calling the `hashCode` method on each of the two objects must produce the same integer result. It is not required that if two objects are unequal according to the `equals` method, then calling the `hashCode` method on each of the two objects must produce distinct integer results. However, the programmer should be aware that producing distinct integer results for unequal objects may improve the performance of hash tables. Annotations @Override

public int hashCode()

Overrides java.lang.Object.hashCode.

Doc from java.lang.Object.hashCode.

Returns a hash code value for this object. This method is supported for the benefit of hash tables such as those provided by java.util.HashMap.

The general contract of hashCode is:

Whenever it is invoked on the same object more than once during an execution of a Java application, the hashCode method must consistently return the same integer, provided no information used in equals comparisons on the object is modified. This integer need not remain consistent from one execution of an application to another execution of the same application.
If two objects are equal according to the equals method, then calling the hashCode method on each of the two objects must produce the same integer result.
It is not required that if two objects are unequal according to the equals method, then calling the hashCode method on each of the two objects must produce distinct integer results. However, the programmer should be aware that producing distinct integer results for unequal objects may improve the performance of hash tables.

Annotations

@Override

public final Class LDAPCertStore

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Class LDAPCertStore.Key

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail