PrivateKeyCallback.Request req = privKeyCallback.getRequest();
PrivateKey privKey = null;
Certificate[] certs = null;
if (req == null) {
// no request type - set default key
PrivateKeyEntry pke = getDefaultPrivateKeyEntry(
kstores, passwords);
if (pke != null) {
privKey = pke.getPrivateKey();
certs = pke.getCertificateChain();
}
privKeyCallback.setKey(privKey, certs);
passwords = null;
return;
}
// find key based on request type
try {
if (req instanceof PrivateKeyCallback.AliasRequest) {
PrivateKeyCallback.AliasRequest aReq =
(PrivateKeyCallback.AliasRequest)req;
String alias = aReq.getAlias();
PrivateKeyEntry privKeyEntry = null;
if (alias == null) {
// use default key
privKeyEntry = getDefaultPrivateKeyEntry(kstores, passwords);
} else {
privKeyEntry = SSLUtils.getPrivateKeyEntryFromTokenAlias(alias);
}
if (privKeyEntry != null) {
privKey = privKeyEntry.getPrivateKey();
certs = privKeyEntry.getCertificateChain();
}
} else if (req instanceof PrivateKeyCallback.IssuerSerialNumRequest) {
PrivateKeyCallback.IssuerSerialNumRequest isReq =
(PrivateKeyCallback.IssuerSerialNumRequest)req;
X500Principal issuer = isReq.getIssuer();
BigInteger serialNum = isReq.getSerialNum();
if (issuer != null && serialNum != null) {
boolean found = false;
for (int i = 0; i < kstores.length && !found; i++) {
Enumeration aliases = kstores[i].aliases();
while (aliases.hasMoreElements() && !found) {
String nextAlias = (String)aliases.nextElement();
Key key = kstores[i].getKey(nextAlias, passwords[i].toCharArray());
if (key != null && (key instanceof PrivateKey)) {
Certificate[] certificates =
kstores[i].getCertificateChain(nextAlias);
// check issuer/serial
X509Certificate eeCert = (X509Certificate)certificates[0];
if (eeCert.getIssuerX500Principal().equals(issuer) &&
eeCert.getSerialNumber().equals(serialNum)) {
privKey = (PrivateKey)key;
certs = certificates;
found = true;
}
}
}
}
}
} else if (req instanceof PrivateKeyCallback.SubjectKeyIDRequest) {
PrivateKeyCallback.SubjectKeyIDRequest skReq =
(PrivateKeyCallback.SubjectKeyIDRequest)req;
byte[] subjectKeyID = skReq.getSubjectKeyID();
if (subjectKeyID != null) {
boolean found = false;
// In DER, subjectKeyID will be an OCTET STRING of OCTET STRING
DerValue derValue1 = new DerValue(
DerValue.tag_OctetString, subjectKeyID);
DerValue derValue2 = new DerValue(
DerValue.tag_OctetString, derValue1.toByteArray());
byte[] derSubjectKeyID = derValue2.toByteArray();
for (int i = 0; i < kstores.length && !found; i++) {
Enumeration aliases = kstores[i].aliases();
while (aliases.hasMoreElements() && !found) {
String nextAlias = (String)aliases.nextElement();
Key key = kstores[i].getKey(nextAlias, passwords[i].toCharArray());
if (key != null && (key instanceof PrivateKey)) {
Certificate[] certificates =
kstores[i].getCertificateChain(nextAlias);
X509Certificate eeCert = (X509Certificate)certificates[0];
// Extension: SubjectKeyIdentifier
byte[] derSubKeyID = eeCert.getExtensionValue(SUBJECT_KEY_IDENTIFIER_OID);
if (derSubKeyID != null &&
Arrays.equals(derSubKeyID, derSubjectKeyID)) {
privKey = (PrivateKey)key;
certs = certificates;
found = true;
}
}
}
}
}
} else if (req instanceof PrivateKeyCallback.DigestRequest) {
PrivateKeyCallback.DigestRequest dReq =
(PrivateKeyCallback.DigestRequest)req;
byte[] digest = dReq.getDigest();
String algorithm = dReq.getAlgorithm();
PrivateKeyEntry privKeyEntry = null;
if (digest == null) {
// get default key
privKeyEntry = getDefaultPrivateKeyEntry(kstores, passwords);
} else {
if (algorithm == null) {
algorithm = DEFAULT_DIGEST_ALGORITHM;
}
MessageDigest md = MessageDigest.getInstance(algorithm);
privKeyEntry = getPrivateKeyEntry(kstores, passwords, md, digest);
}
if (privKeyEntry != null) {
privKey = privKeyEntry.getPrivateKey();
certs = privKeyEntry.getCertificateChain();
}
} else {
if (_logger.isLoggable(Level.FINE)) {
_logger.log(Level.FINE,
"invalid request type: " + req.getClass().getName());