别名为mykey的SAML-Key没有私钥

Question

I am trying to modifying a sample program of spring-boot security with saml. https://github.com/vdenotaris/spring-boot-security-saml-sample . I got the certificate(.crt) from my Identity provider and I tried to create a sample keystore(.jks) to test my connectivity before integrating to my application. I followed below steps to create the certificate.

Create Key store

keytool -keystore mykeystore.jks -genkey -alias saml

When I try to list my keystore I have one private Key

Listing the Keystore

keytool -list -V -storepass changeit -keystore mykeystore.jks

The I imported the certificate provided by the IDP team using below command.

keytool -import -file myidp.crt -storepass changeit -keystore mykeystore.jks

Now my when I list my jks file I have two entries one private.

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

Alias name: saml
Creation date: May 24, 2016
Entry type: PrivateKeyEntry
XXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXX
*******************************************
*******************************************
Alias name: mykey
Creation date: May 24, 2016
Entry type: trustedCertEntry
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
*******************************************
*******************************************

I modified the WebSecurityConfi.java class, I did not give any pass phrase while importing the crt to key store. I have tried to keep the alias name as same, but then I was getting below error.

keytool error: java.lang.Exception: **Public keys in reply and keystore don't match

  @Bean
    public KeyManager keyManager() {
        DefaultResourceLoader loader = new DefaultResourceLoader();
        Resource storeFile =   loader.getResource("classpath:/saml/myKeystore.jks");

        String storePass = "changeit";
        Map<String, String> passwords = new HashMap<>();
        passwords.put("changeit", "changeit");
        String defaultKey = "mykey";
        return new JKSKeyManager(storeFile, storePass, passwords, defaultKey);
    }

Now I am getting below exception, I know it is some issue with my JKS creation. Could you please suggest how to add private key for my trusted store. I only received the .crt file from IDP provider. Do I have to do any other steps to add the private key for my trusted store? I checked couple of post like Key with alias xxx doesn't have a private key with Spring SAML similar to my issue but I am not able to figure out the issue with certificate creation.

ERROR [http-nio-8080-exec-4] (DirectJDKLog.java:182) - Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception java.lang.RuntimeException: Key with alias mykey doesn't have a private key at org.springframework.security.saml.metadata.MetadataGenerator.getServerKeyInfo(MetadataGenerator.java:209) at org.springframework.security.saml.metadata.MetadataGenerator.buildSPSSODescriptor(MetadataGenerator.java:329) at org.springframework.security.saml.metadata.MetadataGenerator.generateMetadata(MetadataGenerator.java:189) at org.springframework.security.saml.metadata.MetadataGeneratorFilter.processMetadataInitialization(MetadataGeneratorFilter.java:127) at org.springframework.security.saml.metadata.MetadataGeneratorFilter.doFilter(MetadataGeneratorFilter.java:86) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330) at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:21 3) at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:176) at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:87) at org.spring framework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:77) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) at org.apache.catalina.c ore.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:521) at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1096) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:674) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1500) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run( NioEndpoint.java:1456) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:745) DEBUG [http-nio-8080-exec-4] (DispatcherServlet.java:861) - DispatcherServlet with name 'dispatcherServlet' processing GET request for [/error] DEBUG [http-nio-8080-exec-4] (AbstractHandlerMethodMapping.java:318) - Looking up handler method for path /error DEBUG [http-nio-8080-exec-4] (AbstractHandlerMethodMapping.java:325) - Returning handler method [public org.springframework.http.ResponseEntity> org.springframework.boot.autoconfigure.web.BasicErrorController.error(javax.servlet.http.HttpServletRequest)] DEBUG [http-nio-8080-exec-4] (AbstractBeanFactory.java:251) - Returning cached instance of singleton bean 'basicErrorController' DEBUG [http-nio-8080-exec-4] (DispatcherSer vlet.java:947) - Last-Modified value for [/error] is: -1 DEBUG [http-nio-8080-exec-4] (AbstractMessageConverterMethodProcessor.java:225) - Written [{timestamp=Tue May 24 19:12:00 IST 2016, status=500, error=Internal Server Error, exception=java.lang.RuntimeException, message=Key with alias mykey doesn't have a private key, path=/favicon.ico}] as "application/json;charset=UTF-8" using [org.springframework.http.converter.json.MappingJackson2HttpMessageConverter@380682cd] DEBUG [http-nio-8080-exec-4] (DispatcherServlet.java:1034) - Null ModelAndView returned to DispatcherServlet with name 'dispatcherServlet': assuming HandlerAdapter completed request handling

Answer 1

You need to import the signed certificate using the same alias as the private key.

Now my when I list my jks file I have two entries, one private

You should only have one, private.

Answer 2

You can have any number of private key entries in your keystore... but you can configure only one private key to spring saml... you private key should be of type Entry type: PrivateKeyEntry .. and update your spring-security.xml to have alias of the private key. Eg

<!-- Central storage of cryptographic keys -->
            <bean id="keyManager" class="org.springframework.security.saml.key.JKSKeyManager">
                <constructor-arg value="classpath:keycloak.jks"/>
                <constructor-arg type="java.lang.String" value="password"/>
                <constructor-arg>
                    <map>
                        <entry key="YOUR_ALIAS" value="password"/>
                    </map>
                </constructor-arg>
                <constructor-arg type="java.lang.String" value="YOUR_ALIAS"/>
            </bean>