Skip to content
This repository was archived by the owner on Jan 15, 2020. It is now read-only.

Commit aaf6a34

Browse files
yadvryadvr
committed
CLOUDSTACK-8035: Generate and store X509Cert and reuse this for SAML
The fix generates X509Certificate if missing from DB and uses that for eternity. SAML SP metadata remains same since it's using the same X509 certificate and it remains same after restarts. The certificate is serialized, base64 encoded and stored in the keystore table under a specific name. For reading, it's retrieved, base64 decoded and deserialized. Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com> (cherry picked from commit 4358714) Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
1 parent 173710d commit aaf6a34

2 files changed

Lines changed: 34 additions & 8 deletions

File tree

‎plugins/user-authenticators/saml2/src/org/apache/cloudstack/saml/SAML2AuthManagerImpl.java‎

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
import org.apache.cloudstack.framework.security.keystore.KeystoreVO;
2828
import org.apache.cloudstack.utils.auth.SAMLUtils;
2929
import org.apache.log4j.Logger;
30+
import org.apache.commons.codec.binary.Base64;
3031
import org.opensaml.DefaultBootstrap;
3132
import org.opensaml.common.xml.SAMLConstants;
3233
import org.opensaml.saml2.metadata.EntityDescriptor;
@@ -45,6 +46,12 @@
4546
import javax.ejb.Local;
4647
import javax.inject.Inject;
4748
import javax.xml.stream.FactoryConfigurationError;
49+
import java.io.ByteArrayInputStream;
50+
import java.io.ByteArrayOutputStream;
51+
import java.io.IOException;
52+
import java.io.ObjectInputStream;
53+
import java.io.ObjectOutput;
54+
import java.io.ObjectOutputStream;
4855
import java.security.InvalidKeyException;
4956
import java.security.KeyPair;
5057
import java.security.NoSuchAlgorithmException;
@@ -94,12 +101,12 @@ public boolean start() {
94101
}
95102

96103
private boolean setup() {
97-
KeystoreVO keyStoreVO = _ksDao.findByName(SAMLUtils.CERTIFICATE_NAME);
104+
KeystoreVO keyStoreVO = _ksDao.findByName(SAMLUtils.SAMLSP_KEYPAIR);
98105
if (keyStoreVO == null) {
99106
try {
100107
KeyPair keyPair = SAMLUtils.generateRandomKeyPair();
101-
_ksDao.save(SAMLUtils.CERTIFICATE_NAME, SAMLUtils.savePrivateKey(keyPair.getPrivate()), SAMLUtils.savePublicKey(keyPair.getPublic()), "saml-sp");
102-
keyStoreVO = _ksDao.findByName(SAMLUtils.CERTIFICATE_NAME);
108+
_ksDao.save(SAMLUtils.SAMLSP_KEYPAIR, SAMLUtils.savePrivateKey(keyPair.getPrivate()), SAMLUtils.savePublicKey(keyPair.getPublic()), "samlsp-keypair");
109+
keyStoreVO = _ksDao.findByName(SAMLUtils.SAMLSP_KEYPAIR);
103110
} catch (NoSuchProviderException | NoSuchAlgorithmException e) {
104111
s_logger.error("Unable to create and save SAML keypair");
105112
}
@@ -110,10 +117,28 @@ private boolean setup() {
110117
PublicKey publicKey = SAMLUtils.loadPublicKey(keyStoreVO.getKey());
111118
if (privateKey != null && publicKey != null) {
112119
spKeyPair = new KeyPair(publicKey, privateKey);
113-
try {
114-
spX509Key = SAMLUtils.generateRandomX509Certificate(spKeyPair);
115-
} catch (NoSuchAlgorithmException | NoSuchProviderException | CertificateEncodingException | SignatureException | InvalidKeyException e) {
116-
s_logger.error("SAML Plugin won't be able to use X509 signed authentication");
120+
KeystoreVO x509VO = _ksDao.findByName(SAMLUtils.SAMLSP_X509CERT);
121+
if (x509VO == null) {
122+
try {
123+
spX509Key = SAMLUtils.generateRandomX509Certificate(spKeyPair);
124+
ByteArrayOutputStream bos = new ByteArrayOutputStream();
125+
ObjectOutput out = new ObjectOutputStream(bos);
126+
out.writeObject(spX509Key);
127+
out.flush();
128+
_ksDao.save(SAMLUtils.SAMLSP_X509CERT, Base64.encodeBase64String(bos.toByteArray()), "", "samlsp-x509cert");
129+
bos.close();
130+
} catch (NoSuchAlgorithmException | NoSuchProviderException | CertificateEncodingException | SignatureException | InvalidKeyException | IOException e) {
131+
s_logger.error("SAML Plugin won't be able to use X509 signed authentication");
132+
}
133+
} else {
134+
try {
135+
ByteArrayInputStream bi = new ByteArrayInputStream(Base64.decodeBase64(x509VO.getCertificate()));
136+
ObjectInputStream si = new ObjectInputStream(bi);
137+
spX509Key = (X509Certificate) si.readObject();
138+
bi.close();
139+
} catch (IOException | ClassNotFoundException ignored) {
140+
s_logger.error("SAML Plugin won't be able to use X509 signed authentication. Failed to load X509 Certificate from Database.");
141+
}
117142
}
118143
}
119144
}

‎utils/src/org/apache/cloudstack/utils/auth/SAMLUtils.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,8 @@ public class SAMLUtils {
100100
public static final String SAML_NS = "SAML-";
101101
public static final String SAML_NAMEID = "SAML_NAMEID";
102102
public static final String SAML_SESSION = "SAML_SESSION";
103-
public static final String CERTIFICATE_NAME = "SAMLSP_CERTIFICATE";
103+
public static final String SAMLSP_KEYPAIR = "SAMLSP_KEYPAIR";
104+
public static final String SAMLSP_X509CERT = "SAMLSP_X509CERT";
104105

105106
public static String createSAMLId(String uid) {
106107
if (uid == null) {

0 commit comments

Comments
 (0)