[英]How to get X.509 client certificate in Grizzly 2.3 (when using client authentication)
I would like to verify the CN field of the client x.509 certificate on my server that runs a JAX-RS web service based on Grizzly 2.3. 我想在运行基于Grizzly 2.3的JAX-RS Web服务的服务器上验证客户端x.509证书的CN字段。 I found some examples for Grizzly 1, but it seems the code has changed significantly.
我找到了Grizzly 1的一些例子,但似乎代码发生了重大变化。 Here the code I have:
这里是我的代码:
class Transport {
public static void main(String[] args){
ResourceConfig rc = new PackagesResourceConfig(Transport.class.getPackage().getName());
String url = "http://myhost:8080/myURL";
URI uri = UriBuilder.fromUri(url).build();
HttpServer server = GrizzlyServerFactory.createHttpServer(uri, rc);
SSLContextConfigurator sslContext = new SSLContextConfigurator();
sslContext.setKeyStoreFile("path_to_my_keystore");
sslContext.setKeyStorePass("password");
sslContext.setTrustStoreFile("path_to_my_truststore");
sslContext.setTrustStorePass("password");
sslContext.setSecurityProtocol("TLSv1.2");
SSLEngineConfigurator sslEngineConfigurator = new SSLEngineConfigurator(sslContext);
sslEngineConfigurator.setNeedClientAuth(true);
sslEngineConfigurator.setWantClientAuth(true);
sslEngineConfigurator.setEnabledCipherSuites(new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA"});
sslEngineConfigurator.setClientMode(false);
NetworkListener listener = new NetworkListener("grizzly_ssl", uri.getHost(), 8443);
listener.setSecure(true);
listener.setSSLEngineConfig(sslEngineConfigurator);
server.addListener(listener);
}
@POST
@Produces({ MediaType.APPLICATION_XML })
@Consumes({ MediaType.APPLICATION_XML })
@Path("foo")
public Response receivePayload(MyPayload payload) {
// How can I get the CN of the client x.509 certificate / or the fingerprint of the certificate?
}
}
I found the answer here [1] and [2]. 我在这里找到答案[1]和[2]。
[1] How to grab a pki certificate with Jersey / Spring? [1] 如何获得Jersey / Spring的pki证书? [2] Grizzly and ServletContainerContext
[2] Grizzly和ServletContainerContext
Here is the code that works (only for Jersey 1.1, not for Jersey 2): 这是有效的代码(仅适用于Jersey 1.1,不适用于Jersey 2):
class Transport {
public static void main(String[] args){
ResourceConfig rc = new PackagesResourceConfig(Transport.class.getPackage().getName());
String url = "http://myhost:8080/myURL";
URI uri = UriBuilder.fromUri(url).build();
HttpServer server = GrizzlyServerFactory.createHttpServer(uri, new HttpHandler() {
@Override
public void service(Request request, org.glassfish.grizzly.http.server.Response response) throws Exception {
response.setStatus(404, "Not found");
response.getWriter().write("404: not found");
}
});
// Initialize and register Jersey Servlet
WebappContext context = new WebappContext("WebappContext", "");
ServletRegistration registration = context.addServlet("ServletContainer", ServletContainer.class);
registration.setInitParameter(ServletContainer.RESOURCE_CONFIG_CLASS,
ClassNamesResourceConfig.class.getName());
registration.setInitParameter(ClassNamesResourceConfig.PROPERTY_CLASSNAMES, Transport.class.getName());
registration.addMapping("/*");
context.deploy(server);
SSLContextConfigurator sslContext = new SSLContextConfigurator();
sslContext.setKeyStoreFile("path_to_my_keystore");
sslContext.setKeyStorePass("password");
sslContext.setTrustStoreFile("path_to_my_truststore");
sslContext.setTrustStorePass("password");
sslContext.setSecurityProtocol("TLSv1.2");
SSLEngineConfigurator sslEngineConfigurator = new SSLEngineConfigurator(sslContext);
sslEngineConfigurator.setNeedClientAuth(true);
sslEngineConfigurator.setWantClientAuth(true);
sslEngineConfigurator.setEnabledCipherSuites(new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA"});
sslEngineConfigurator.setClientMode(false);
NetworkListener listener = new NetworkListener("grizzly_ssl", uri.getHost(), 8443);
listener.setSecure(true);
listener.setSSLEngineConfig(sslEngineConfigurator);
server.addListener(listener);
}
@POST
@Produces({ MediaType.APPLICATION_XML })
@Consumes({ MediaType.APPLICATION_XML })
@Path("foo")
public Response receivePayload(@Context HttpServletRequest request, MyPayload payload) {
X509Certificate[] certChain = (X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate");
if (certChain == null || certChain.length == 0){
LOG.info("X509cert not found");
return null;
}
X509Certificate certificate = certChain[0];
// get information such as CN from certificate
}
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.