APIdia Launch Partner
Top Description Inners Fields Constructors Methods
sun.security.provider.certpath.ldap

pack-priv final Class LDAPCertStoreImpl

extends Object
Class Inheritance
Imports
java.io.ByteArrayInputStream, java.net.URI, java.util.*, javax.naming.CompositeName, .Context, .InvalidNameException, .NamingEnumeration, .NamingException, .NameNotFoundException, .CommunicationException, javax.naming.directory.Attribute, .Attributes, .BasicAttributes, java.security.*, java.security.cert.Certificate, java.security.cert.*, javax.naming.ldap.InitialLdapContext, .LdapContext, .LdapName, javax.security.auth.x500.X500Principal, com.sun.jndi.ldap.LdapReferralException, sun.security.util.HexDumpEncoder, .Cache, .Debug, .SecurityProperties, sun.security.provider.certpath.X509CertificatePair
Core implementation of a LDAP Cert Store.
Since
9
See Also
java.security.cert.CertStore

Nested and Inner Type Summary

Modifier and TypeClass and Description
private class
LDAPCertStoreImpl.LDAPRequest

Private class encapsulating the actual LDAP operations and cache handling.

Field Summary

Modifier and TypeField and Description
private static final String
ARL

private static final byte[][]
BB0

private static final String
CA_CERT

private int
cacheHits

private int
cacheMisses

private CertificateFactory
cf

The CertificateFactory used to decode certificates from their binary stored form.

private boolean
communicationError

Flag indicating that communication error occurred.

private static final String
CRL

private static final String
CROSS_CERT

private LdapContext
ctx

The JNDI directory context.

private static final Debug
debug

private static final int
DEFAULT_CACHE_LIFETIME

private static final int
DEFAULT_CACHE_SIZE

private static final Attributes
EMPTY_ATTRIBUTES

private static final int
LIFETIME

private static final long
MAX_CRL_DOWNLOAD_SIZE

Maximum size for a CRL downloaded through an LDAPCertStoreImpl in bytes.

private boolean
prefetchCRLs

Flag indicating whether we should prefetch CRLs.

private static final String
PROP_DISABLE_APP_RESOURCE_FILES

private static final String
PROP_LIFETIME

private int
requests

private static final String[]
STRING0

private static final String
USER_CERT

LDAP attribute identifiers.

private final Cache<String, byte[][]>
valueCache

Constructor Summary

AccessConstructor and Description
pack-priv
LDAPCertStoreImpl(String serverName, int port)

Creates a CertStore with the specified parameters.

Method Summary

Modifier and TypeMethod and Description
private void
createInitialDirContext(String
Server DNS name hosting LDAP service
server, int
Port at which server listens for requests
port)

Create InitialDirContext.

private Collection<X509Certificate>
getCertificates(LDAPCertStoreImpl.LDAPRequest request, String id, X509CertSelector sel)

pack-priv synchronized Collection<X509Certificate>

Returns:

a Collection of X509Certificates that match the specified selector
getCertificates(X509CertSelector
a X509CertSelector used to select which Certificates should be returned.
xsel, String ldapDN)

Returns a Collection of X509Certificates that match the specified selector.

private Collection<X509CertificatePair>
getCertPairs(LDAPCertStoreImpl.LDAPRequest request, String id)

private Collection<X509CRL>

Returns:

a Collection of CRLs found
getCRLs(LDAPCertStoreImpl.LDAPRequest
the LDAP request used for this CRL fetch operation
request, String
the attribute identifier
id, X509CRLSelector
a X509CRLSelector that the CRLs must match
sel)

Gets CRLs from an attribute id and location in the LDAP directory.

pack-priv synchronized Collection<X509CRL>

Returns:

A Collection of X509CRLs that match the specified selector
getCRLs(X509CRLSelector
A X509CRLSelector used to select which CRLs should be returned. Specify null to return all CRLs.
xsel, String ldapDN)

Returns a Collection of X509CRLs that match the specified selector.

private Collection<X509Certificate>
getMatchingCrossCerts(LDAPCertStoreImpl.LDAPRequest request, X509CertSelector forward, X509CertSelector reverse)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

ARLback to summary
private static final String ARL
BB0back to summary
private static final byte[][] BB0
CA_CERTback to summary
private static final String CA_CERT
cacheHitsback to summary
private int cacheHits
cacheMissesback to summary
private int cacheMisses
cfback to summary
private CertificateFactory cf

The CertificateFactory used to decode certificates from their binary stored form.

communicationErrorback to summary
private boolean communicationError

Flag indicating that communication error occurred.

CRLback to summary
private static final String CRL
CROSS_CERTback to summary
private static final String CROSS_CERT
ctxback to summary
private LdapContext ctx

The JNDI directory context.

debugback to summary
private static final Debug debug
DEFAULT_CACHE_LIFETIMEback to summary
private static final int DEFAULT_CACHE_LIFETIME
DEFAULT_CACHE_SIZEback to summary
private static final int DEFAULT_CACHE_SIZE
EMPTY_ATTRIBUTESback to summary
private static final Attributes EMPTY_ATTRIBUTES
LIFETIMEback to summary
private static final int LIFETIME
MAX_CRL_DOWNLOAD_SIZEback to summary
private static final long MAX_CRL_DOWNLOAD_SIZE

Maximum size for a CRL downloaded through an LDAPCertStoreImpl in bytes. This can be controlled by the com.sun.security.crl.maxSize Security or System property. The System property, if set, overrides the Security property. The default size is 20MiB.

prefetchCRLsback to summary
private boolean prefetchCRLs

Flag indicating whether we should prefetch CRLs.

PROP_DISABLE_APP_RESOURCE_FILESback to summary
private static final String PROP_DISABLE_APP_RESOURCE_FILES
PROP_LIFETIMEback to summary
private static final String PROP_LIFETIME
requestsback to summary
private int requests
STRING0back to summary
private static final String[] STRING0
USER_CERTback to summary
private static final String USER_CERT

LDAP attribute identifiers.

valueCacheback to summary
private final Cache<String, byte[][]> valueCache

Constructor Detail

LDAPCertStoreImplback to summary
pack-priv LDAPCertStoreImpl(String serverName, int port) throws InvalidAlgorithmParameterException

Creates a CertStore with the specified parameters.

Method Detail

createInitialDirContextback to summary
private void createInitialDirContext(String server, int port) throws InvalidAlgorithmParameterException

Create InitialDirContext.

Parameters
server:String

Server DNS name hosting LDAP service

port:int

Port at which server listens for requests

Exceptions
InvalidAlgorithmParameterException:
if creation fails
getCertificatesback to summary
private Collection<X509Certificate> getCertificates(LDAPCertStoreImpl.LDAPRequest request, String id, X509CertSelector sel) throws CertStoreException
getCertificatesback to summary
pack-priv synchronized Collection<X509Certificate> getCertificates(X509CertSelector xsel, String ldapDN) throws CertStoreException

Returns a Collection of X509Certificates that match the specified selector. If no X509Certificates match the selector, an empty Collection will be returned.

It is not practical to search every entry in the LDAP database for matching X509Certificates. Instead, the X509CertSelector is examined in order to determine where matching Certificates are likely to be found (according to the PKIX LDAPv2 schema, RFC 2587). If the subject is specified, its directory entry is searched. If the issuer is specified, its directory entry is searched. If neither the subject nor the issuer are specified (or the selector is not an X509CertSelector), a CertStoreException is thrown.

Parameters
xsel:X509CertSelector

a X509CertSelector used to select which Certificates should be returned.

Returns:Collection<X509Certificate>

a Collection of X509Certificates that match the specified selector

Exceptions
CertStoreException:
if an exception occurs
getCertPairsback to summary
private Collection<X509CertificatePair> getCertPairs(LDAPCertStoreImpl.LDAPRequest request, String id) throws CertStoreException
getCRLsback to summary
private Collection<X509CRL> getCRLs(LDAPCertStoreImpl.LDAPRequest request, String id, X509CRLSelector sel) throws CertStoreException

Gets CRLs from an attribute id and location in the LDAP directory. Returns a Collection containing only the CRLs that match the specified X509CRLSelector.

Parameters
request:LDAPCertStoreImpl.LDAPRequest

the LDAP request used for this CRL fetch operation

id:String

the attribute identifier

sel:X509CRLSelector

a X509CRLSelector that the CRLs must match

Returns:Collection<X509CRL>

a Collection of CRLs found

Exceptions
CertStoreException:
if an exception occurs
getCRLsback to summary
pack-priv synchronized Collection<X509CRL> getCRLs(X509CRLSelector xsel, String ldapDN) throws CertStoreException

Returns a Collection of X509CRLs that match the specified selector. If no X509CRLs match the selector, an empty Collection will be returned.

It is not practical to search every entry in the LDAP database for matching X509CRLs. Instead, the X509CRLSelector is examined in order to determine where matching X509CRLs are likely to be found (according to the PKIX LDAPv2 schema, RFC 2587). If issuerNames or certChecking are specified, the issuer's directory entry is searched. If neither issuerNames or certChecking are specified (or the selector is not an X509CRLSelector), a CertStoreException is thrown.

Parameters
xsel:X509CRLSelector

A X509CRLSelector used to select which CRLs should be returned. Specify null to return all CRLs.

Returns:Collection<X509CRL>

A Collection of X509CRLs that match the specified selector

Exceptions
CertStoreException:
if an exception occurs
getMatchingCrossCertsback to summary
private Collection<X509Certificate> getMatchingCrossCerts(LDAPCertStoreImpl.LDAPRequest request, X509CertSelector forward, X509CertSelector reverse) throws CertStoreException
sun.security.provider.certpath.ldap back to summary

private Class LDAPCertStoreImpl.LDAPRequest

extends Object
Class Inheritance
  • java.lang.Object
  • sun.security.provider.certpath.ldap.LDAPCertStoreImpl.LDAPRequest
Private class encapsulating the actual LDAP operations and cache handling. Use: LDAPRequest request = new LDAPRequest(dn); request.addRequestedAttribute(CROSS_CERT); request.addRequestedAttribute(CA_CERT); byte[][] crossValues = request.getValues(CROSS_CERT); byte[][] caValues = request.getValues(CA_CERT); At most one LDAP request is sent for each instance created. If all getValues() calls can be satisfied from the cache, no request is sent at all. If a request is sent, all requested attributes are always added to the cache irrespective of whether the getValues() method is called.

Field Summary

Modifier and TypeField and Description
private final LdapName
name

private final List<String>
requestedAttributes

private Map<String, byte[][]>
valueMap

Constructor Summary

AccessConstructor and Description
pack-priv
LDAPRequest(String name)

Method Summary

Modifier and TypeMethod and Description
pack-priv void
addRequestedAttribute(String attrId)

private void
cacheAttribute(String attrId, byte[][] values)

Add the values to the cache.

private static String
checkName(String name)

private static byte[][]
getAttributeValues(Attribute attr)

Get the values for the given attribute.

private Map<String, byte[][]>

Returns:

the value Map
getValueMap()

Get a map containing the values for this request.

pack-priv byte[][]

Returns:

an array of binary values (byte arrays)
getValues(String
the attribute identifier
attrId)

Gets one or more binary values from an attribute.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

nameback to summary
private final LdapName name
requestedAttributesback to summary
private final List<String> requestedAttributes
valueMapback to summary
private Map<String, byte[][]> valueMap

Constructor Detail

LDAPRequestback to summary
pack-priv LDAPRequest(String name) throws CertStoreException

Method Detail

addRequestedAttributeback to summary
pack-priv void addRequestedAttribute(String attrId)
cacheAttributeback to summary
private void cacheAttribute(String attrId, byte[][] values)

Add the values to the cache.

checkNameback to summary
private static String checkName(String name) throws CertStoreException
getAttributeValuesback to summary
private static byte[][] getAttributeValues(Attribute attr) throws NamingException

Get the values for the given attribute. If the attribute is null or does not contain any values, a zero length byte array is returned. NOTE that it is assumed that all values are byte arrays.

getValueMapback to summary
private Map<String, byte[][]> getValueMap() throws NamingException

Get a map containing the values for this request. The first time this method is called on an object, the LDAP request is sent, the results parsed and added to a private map and also to the cache of this LDAPCertStore. Subsequent calls return the private map immediately. The map contains an entry for each requested attribute. The attribute name is the key, values are byte[][]. If there are no values for that attribute, values are byte[0][].

Returns:Map<String, byte[][]>

the value Map

Exceptions
NamingException:
if a naming exception occurs
getValuesback to summary
pack-priv byte[][] getValues(String attrId) throws NamingException

Gets one or more binary values from an attribute.

Parameters
attrId:String

the attribute identifier

Returns:byte[][]

an array of binary values (byte arrays)

Exceptions
NamingException:
if a naming exception occurs