Top Description Fields Constructors Methods
org.bouncycastle.x509.util

public Class LDAPStoreHelper

extends Object
Class Inheritance
Imports
java.io.ByteArrayInputStream, .IOException, java.security.Principal, java.security.cert.CertificateParsingException, .X509CRL, .X509Certificate, java.sql.Date, java.util.ArrayList, .Collection, .HashMap, .HashSet, .Iterator, .List, .Map, .Properties, .Set, javax.naming.Context, .NamingEnumeration, .NamingException, javax.naming.directory.Attribute, .DirContext, .InitialDirContext, .SearchControls, .SearchResult, javax.security.auth.x500.X500Principal, org.bouncycastle.asn1.ASN1InputStream, org.bouncycastle.asn1.x509.Certificate, .CertificatePair, org.bouncycastle.jce.X509LDAPCertStoreParameters, org.bouncycastle.jce.provider.X509AttrCertParser, .X509CRLParser, .X509CertPairParser, .X509CertParser, org.bouncycastle.util.StoreException, org.bouncycastle.x509.X509AttributeCertStoreSelector, .X509AttributeCertificate, .X509CRLStoreSelector, .X509CertPairStoreSelector, .X509CertStoreSelector, .X509CertificatePair
This is a general purpose implementation to get X.509 certificates, CRLs, attribute certificates and cross certificates from a LDAP location.

At first a search is performed in the ldap*AttributeNames of the org.bouncycastle.jce.X509LDAPCertStoreParameters with the given information of the subject (for all kind of certificates) or issuer (for CRLs), respectively, if a org.bouncycastle.x509.X509CertStoreSelector or org.bouncycastle.x509.X509AttributeCertificate is given with that details.

For the used schemes see:

Field Summary

Modifier and TypeField and Description
private Map<K, V>
cacheMap

private static int
cacheSize

private static String
LDAP_PROVIDER

Initial Context Factory.

private static long
lifeTime

private X509LDAPCertStoreParameters
params

private static String
REFERRALS_IGNORE

Processing referrals..

private static final String
SEARCH_SECURITY_LEVEL

Security level to be used for LDAP connections.

private static final String
URL_CONTEXT_PREFIX

Package Prefix for loading URL context factories.

Constructor Summary

AccessConstructor and Description
public
LDAPStoreHelper(X509LDAPCertStoreParameters params)

Method Summary

Modifier and TypeMethod and Description
private synchronized void
addToCache(String searchCriteria, List<E> list)

private List<E>

Returns:

A list of found DER encoded attribute certificates.
attrCertSubjectSerialSearch(X509AttributeCertStoreSelector
The selector with the search criteria.
xselector, String[]
Attributes which contain the attribute certificates in the LDAP directory.
attrs, String[]
Attribute names in the LDAP directory which correspond to the subjectAttributeNames.
attrNames, String[]
Subject attribute names (like "CN", "O", "OU") to use to search in the LDAP directory
subjectAttributeNames)

Deprecated as a consequence of X509AttributeCertStoreSelector being deprecated.
Can use the entityName of the holder of the attribute certificate, the serialNumber of attribute certificate and the serialNumber of the associated certificate of the given of the X509AttributeCertSelector.
private List<E>

Returns:

A list of found DER encoded certificates.
certSubjectSerialSearch(X509CertStoreSelector
The selector with the search criteria.
xselector, String[]
Attributes which contain the certificates in the LDAP directory.
attrs, String[]
Attribute names in teh LDAP directory which correspond to the subjectAttributeNames.
attrNames, String[]
Subject attribute names (like "CN", "O", "OU") to use to search in the LDAP directory
subjectAttributeNames)

Deprecated as a consequence of X509CertStoreSelector being deprecated.
Can use the subject and serial and the subject and serialNumber of the certificate of the given of the X509CertStoreSelector.
private DirContext
connectLDAP()

private Set<E>
createAttributeCertificates(List<E> list, X509AttributeCertStoreSelector xselector)

Deprecated as a consequence of X509AttributeCertStoreSelector being deprecated.
private Set<E>
createCerts(List<E> list, X509CertStoreSelector xselector)

Deprecated as a consequence of X509CertStoreSelector being deprecated.
private Set<E>
createCRLs(List<E> list, X509CRLStoreSelector xselector)

private Set<E>
createCrossCertificatePairs(List<E> list, X509CertPairStoreSelector xselector)

private List<E>

Returns:

A list of found DER encoded CRLs.
cRLIssuerSearch(X509CRLStoreSelector
The selector with the search criteria.
xselector, String[]
Attributes which contain the attribute certificates in the LDAP directory.
attrs, String[]
Attribute names in the LDAP directory which correspond to the subjectAttributeNames.
attrNames, String[]
Issuer attribute names (like "CN", "O", "OU") to use to search in the LDAP directory
issuerAttributeNames)

Can use the issuer of the given of the X509CRLStoreSelector.

private List<E>

Returns:

A list of found DER encoded certificate pairs.
crossCertificatePairSubjectSearch(X509CertPairStoreSelector
The selector with the search criteria.
xselector, String[]
Attributes which contain the attribute certificates in the LDAP directory.
attrs, String[]
Attribute names in the LDAP directory which correspond to the subjectAttributeNames.
attrNames, String[]
Subject attribute names (like "CN", "O", "OU") to use to search in the LDAP directory
subjectAttributeNames)

Can use the subject of the forward certificate of the set certificate pair or the subject of the forward org.bouncycastle.x509.X509CertStoreSelector of the given selector.

public Collection<E>

Returns:

A possible empty collection with attribute certificates.
getAACertificates(X509AttributeCertStoreSelector
The selector to find the attribute certificates.
selector)

Deprecated as a consequence of X509AttributeCertStoreSelector being deprecated.
Returns attribute certificates for an attribute authority

The aAcertificate holds the privileges of an attribute authority.

public Collection<E>

Returns:

A possible empty collection with CRLs
getAttributeAuthorityRevocationLists(X509CRLStoreSelector
The CRL selector to use to find the CRLs.
selector)

Returns the revocation list for revoked attribute certificates for an attribute authority

The attributeAuthorityList holds a list of AA certificates that have been revoked.

public Collection<E>

Returns:

A possible empty collection with attribute certificates.
getAttributeCertificateAttributes(X509AttributeCertStoreSelector
The selector to find the attribute certificates.
selector)

Deprecated as a consequence of X509AttributeCertStoreSelector being deprecated.
Returns an attribute certificate for an user.
public Collection<E>

Returns:

A possible empty collection with CRLs.
getAttributeCertificateRevocationLists(X509CRLStoreSelector
The CRL selector to use to find the CRLs.
selector)

Returns the revocation list for revoked attribute certificates.

public Collection<E>

Returns:

A possible empty collection with attribute certificates.
getAttributeDescriptorCertificates(X509AttributeCertStoreSelector
The selector to find the attribute certificates.
selector)

Deprecated as a consequence of X509AttributeCertStoreSelector being deprecated.
Returns an attribute certificate for an authority

The attributeDescriptorCertificate is self signed by a source of authority and holds a description of the privilege and its delegation rules.

public Collection<E>

Returns:

A possible empty collection with CRLs
getAuthorityRevocationLists(X509CRLStoreSelector
The CRL selector to use to find the CRLs.
selector)

Returns the CRLs for issued certificates for other CAs matching the given selector.

public Collection<E>

Returns:

A possible empty collection with certificates.
getCACertificates(X509CertStoreSelector
The selector to find the certificates.
selector)

Deprecated as a consequence of X509CertStoreSelector being deprecated.
Returns CA certificates.
private X500Principal
getCertificateIssuer(X509Certificate cert)

public Collection<E>

Returns:

A possible empty collection with CRLs.
getCertificateRevocationLists(X509CRLStoreSelector
The CRL selector to use to find the CRLs.
selector)

Returns the certificate revocation lists for revoked certificates.

public Collection<E>

Returns:

A possible empty collection with X509CertificatePairs
getCrossCertificatePairs(X509CertPairStoreSelector
The selector to use to find the cross certificates.
selector)

Returns cross certificate pairs.

public Collection<E>

Returns:

A possible empty collection with CRLs.
getDeltaCertificateRevocationLists(X509CRLStoreSelector
The CRL selector to use to find the CRLs.
selector)

Returns the delta revocation list for revoked certificates.

private List<E>
getFromCache(String searchCriteria)

private String
getSubjectAsString(X509CertStoreSelector xselector)

Deprecated as a consequence of X509CertStoreSelector being deprecated.
public Collection<E>

Returns:

A possible empty collection with certificates.
getUserCertificates(X509CertStoreSelector
The selector to find the certificates.
selector)

Deprecated as a consequence of X509CertStoreSelector being deprecated.
Returns end certificates.
private String
parseDN(String subject, String dNAttributeName)

private List<E>

Returns:

A List of byte arrays with the encodings.
search(String[]
The attribute names to look for in the LDAP.
attributeNames, String
The value the attribute name must have.
attributeValue, String[]
The attributes in the LDAP which hold the certificate, attribute certificate, certificate pair or CRL in a found entry.
attrs)

Returns a List of encodings of the certificates, attribute certificates, CRL or certificate pairs.

private String[]
splitString(String str)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

cacheMapback to summary
private Map<K, V> cacheMap
cacheSizeback to summary
private static int cacheSize
LDAP_PROVIDERback to summary
private static String LDAP_PROVIDER

Initial Context Factory.

lifeTimeback to summary
private static long lifeTime
paramsback to summary
private X509LDAPCertStoreParameters params
REFERRALS_IGNOREback to summary
private static String REFERRALS_IGNORE

Processing referrals..

SEARCH_SECURITY_LEVELback to summary
private static final String SEARCH_SECURITY_LEVEL

Security level to be used for LDAP connections.

URL_CONTEXT_PREFIXback to summary
private static final String URL_CONTEXT_PREFIX

Package Prefix for loading URL context factories.

Constructor Detail

LDAPStoreHelperback to summary
public LDAPStoreHelper(X509LDAPCertStoreParameters params)

Method Detail

addToCacheback to summary
private synchronized void addToCache(String searchCriteria, List<E> list)
attrCertSubjectSerialSearchback to summary
private List<E> attrCertSubjectSerialSearch(X509AttributeCertStoreSelector xselector, String[] attrs, String[] attrNames, String[] subjectAttributeNames) throws StoreException

Deprecated

as a consequence of X509AttributeCertStoreSelector being deprecated. See corresponding docs for further information.

Can use the entityName of the holder of the attribute certificate, the serialNumber of attribute certificate and the serialNumber of the associated certificate of the given of the X509AttributeCertSelector.

Parameters
xselector:X509AttributeCertStoreSelector

The selector with the search criteria.

attrs:String[]

Attributes which contain the attribute certificates in the LDAP directory.

attrNames:String[]

Attribute names in the LDAP directory which correspond to the subjectAttributeNames.

subjectAttributeNames:String[]

Subject attribute names (like "CN", "O", "OU") to use to search in the LDAP directory

Returns:List<E>

A list of found DER encoded attribute certificates.

Exceptions
StoreException:
if an error occurs while searching.
certSubjectSerialSearchback to summary
private List<E> certSubjectSerialSearch(X509CertStoreSelector xselector, String[] attrs, String[] attrNames, String[] subjectAttributeNames) throws StoreException

Deprecated

as a consequence of X509CertStoreSelector being deprecated. See corresponding docs for further information.

Can use the subject and serial and the subject and serialNumber of the certificate of the given of the X509CertStoreSelector. If a certificate for checking is given this has higher precedence.

Parameters
xselector:X509CertStoreSelector

The selector with the search criteria.

attrs:String[]

Attributes which contain the certificates in the LDAP directory.

attrNames:String[]

Attribute names in teh LDAP directory which correspond to the subjectAttributeNames.

subjectAttributeNames:String[]

Subject attribute names (like "CN", "O", "OU") to use to search in the LDAP directory

Returns:List<E>

A list of found DER encoded certificates.

Exceptions
StoreException:
if an error occurs while searching.
connectLDAPback to summary
private DirContext connectLDAP() throws NamingException
createAttributeCertificatesback to summary
private Set<E> createAttributeCertificates(List<E> list, X509AttributeCertStoreSelector xselector) throws StoreException

Deprecated

as a consequence of X509AttributeCertStoreSelector being deprecated. See corresponding docs for further information.

createCertsback to summary
private Set<E> createCerts(List<E> list, X509CertStoreSelector xselector) throws StoreException

Deprecated

as a consequence of X509CertStoreSelector being deprecated. See corresponding docs for further information.

createCRLsback to summary
private Set<E> createCRLs(List<E> list, X509CRLStoreSelector xselector) throws StoreException
createCrossCertificatePairsback to summary
private Set<E> createCrossCertificatePairs(List<E> list, X509CertPairStoreSelector xselector) throws StoreException
cRLIssuerSearchback to summary
private List<E> cRLIssuerSearch(X509CRLStoreSelector xselector, String[] attrs, String[] attrNames, String[] issuerAttributeNames) throws StoreException

Can use the issuer of the given of the X509CRLStoreSelector.

Parameters
xselector:X509CRLStoreSelector

The selector with the search criteria.

attrs:String[]

Attributes which contain the attribute certificates in the LDAP directory.

attrNames:String[]

Attribute names in the LDAP directory which correspond to the subjectAttributeNames.

issuerAttributeNames:String[]

Issuer attribute names (like "CN", "O", "OU") to use to search in the LDAP directory

Returns:List<E>

A list of found DER encoded CRLs.

Exceptions
StoreException:
if an error occurs while searching.
crossCertificatePairSubjectSearchback to summary
private List<E> crossCertificatePairSubjectSearch(X509CertPairStoreSelector xselector, String[] attrs, String[] attrNames, String[] subjectAttributeNames) throws StoreException

Can use the subject of the forward certificate of the set certificate pair or the subject of the forward org.bouncycastle.x509.X509CertStoreSelector of the given selector.

Parameters
xselector:X509CertPairStoreSelector

The selector with the search criteria.

attrs:String[]

Attributes which contain the attribute certificates in the LDAP directory.

attrNames:String[]

Attribute names in the LDAP directory which correspond to the subjectAttributeNames.

subjectAttributeNames:String[]

Subject attribute names (like "CN", "O", "OU") to use to search in the LDAP directory

Returns:List<E>

A list of found DER encoded certificate pairs.

Exceptions
StoreException:
if an error occurs while searching.
getAACertificatesback to summary
public Collection<E> getAACertificates(X509AttributeCertStoreSelector selector) throws StoreException

Deprecated

as a consequence of X509AttributeCertStoreSelector being deprecated. See corresponding docs for further information.

Returns attribute certificates for an attribute authority

The aAcertificate holds the privileges of an attribute authority.

Parameters
selector:X509AttributeCertStoreSelector

The selector to find the attribute certificates.

Returns:Collection<E>

A possible empty collection with attribute certificates.

getAttributeAuthorityRevocationListsback to summary
public Collection<E> getAttributeAuthorityRevocationLists(X509CRLStoreSelector selector) throws StoreException

Returns the revocation list for revoked attribute certificates for an attribute authority

The attributeAuthorityList holds a list of AA certificates that have been revoked.

Parameters
selector:X509CRLStoreSelector

The CRL selector to use to find the CRLs.

Returns:Collection<E>

A possible empty collection with CRLs

getAttributeCertificateAttributesback to summary
public Collection<E> getAttributeCertificateAttributes(X509AttributeCertStoreSelector selector) throws StoreException

Deprecated

as a consequence of X509AttributeCertStoreSelector being deprecated. See corresponding docs for further information.

Returns an attribute certificate for an user.

The attributeCertificateAttribute holds the privileges of a user

Parameters
selector:X509AttributeCertStoreSelector

The selector to find the attribute certificates.

Returns:Collection<E>

A possible empty collection with attribute certificates.

getAttributeCertificateRevocationListsback to summary
public Collection<E> getAttributeCertificateRevocationLists(X509CRLStoreSelector selector) throws StoreException

Returns the revocation list for revoked attribute certificates.

The attributeCertificateRevocationList holds a list of attribute certificates that have been revoked.

Parameters
selector:X509CRLStoreSelector

The CRL selector to use to find the CRLs.

Returns:Collection<E>

A possible empty collection with CRLs.

getAttributeDescriptorCertificatesback to summary
public Collection<E> getAttributeDescriptorCertificates(X509AttributeCertStoreSelector selector) throws StoreException

Deprecated

as a consequence of X509AttributeCertStoreSelector being deprecated. See corresponding docs for further information.

Returns an attribute certificate for an authority

The attributeDescriptorCertificate is self signed by a source of authority and holds a description of the privilege and its delegation rules.

Parameters
selector:X509AttributeCertStoreSelector

The selector to find the attribute certificates.

Returns:Collection<E>

A possible empty collection with attribute certificates.

getAuthorityRevocationListsback to summary
public Collection<E> getAuthorityRevocationLists(X509CRLStoreSelector selector) throws StoreException

Returns the CRLs for issued certificates for other CAs matching the given selector.
The authorityRevocationList attribute includes revocation information regarding certificates issued to other CAs.

Parameters
selector:X509CRLStoreSelector

The CRL selector to use to find the CRLs.

Returns:Collection<E>

A possible empty collection with CRLs

getCACertificatesback to summary
public Collection<E> getCACertificates(X509CertStoreSelector selector) throws StoreException

Deprecated

as a consequence of X509CertStoreSelector being deprecated. See corresponding docs for further information.

Returns CA certificates.

The cACertificate attribute of a CA's directory entry shall be used to store self-issued certificates (if any) and certificates issued to this CA by CAs in the same realm as this CA.

Parameters
selector:X509CertStoreSelector

The selector to find the certificates.

Returns:Collection<E>

A possible empty collection with certificates.

getCertificateIssuerback to summary
private X500Principal getCertificateIssuer(X509Certificate cert)
getCertificateRevocationListsback to summary
public Collection<E> getCertificateRevocationLists(X509CRLStoreSelector selector) throws StoreException

Returns the certificate revocation lists for revoked certificates.

Parameters
selector:X509CRLStoreSelector

The CRL selector to use to find the CRLs.

Returns:Collection<E>

A possible empty collection with CRLs.

getCrossCertificatePairsback to summary
public Collection<E> getCrossCertificatePairs(X509CertPairStoreSelector selector) throws StoreException

Returns cross certificate pairs.

Parameters
selector:X509CertPairStoreSelector

The selector to use to find the cross certificates.

Returns:Collection<E>

A possible empty collection with X509CertificatePairs

getDeltaCertificateRevocationListsback to summary
public Collection<E> getDeltaCertificateRevocationLists(X509CRLStoreSelector selector) throws StoreException

Returns the delta revocation list for revoked certificates.

Parameters
selector:X509CRLStoreSelector

The CRL selector to use to find the CRLs.

Returns:Collection<E>

A possible empty collection with CRLs.

getFromCacheback to summary
private List<E> getFromCache(String searchCriteria)
getSubjectAsStringback to summary
private String getSubjectAsString(X509CertStoreSelector xselector)

Deprecated

as a consequence of X509CertStoreSelector being deprecated. See corresponding docs for further information.

getUserCertificatesback to summary
public Collection<E> getUserCertificates(X509CertStoreSelector selector) throws StoreException

Deprecated

as a consequence of X509CertStoreSelector being deprecated. See corresponding docs for further information.

Returns end certificates.

The attributeDescriptorCertificate is self signed by a source of authority and holds a description of the privilege and its delegation rules.

Parameters
selector:X509CertStoreSelector

The selector to find the certificates.

Returns:Collection<E>

A possible empty collection with certificates.

parseDNback to summary
private String parseDN(String subject, String dNAttributeName)
searchback to summary
private List<E> search(String[] attributeNames, String attributeValue, String[] attrs) throws StoreException

Returns a List of encodings of the certificates, attribute certificates, CRL or certificate pairs.

Parameters
attributeNames:String[]

The attribute names to look for in the LDAP.

attributeValue:String

The value the attribute name must have.

attrs:String[]

The attributes in the LDAP which hold the certificate, attribute certificate, certificate pair or CRL in a found entry.

Returns:List<E>

A List of byte arrays with the encodings.

Exceptions
StoreException:
if an error occurs getting the results from the LDAP directory.
splitStringback to summary
private String[] splitString(String str)