我想在运行基于 Grizzly 2.3 的 JAX-RS Web 服务的服务器上验证客户端 x.509 证书的 CN 字段。我找到了一些 Grizzly 1 的示例,但代码似乎发生了重大变化。这是我的代码:
class Transport {
public static void main(String[] args){
ResourceConfig rc = new PackagesResourceConfig(Transport.class.getPackage().getName());
String url = "http://myhost:8080/myURL";
URI uri = UriBuilder.fromUri(url).build();
HttpServer server = GrizzlyServerFactory.createHttpServer(uri, rc);
SSLContextConfigurator sslContext = new SSLContextConfigurator();
sslContext.setKeyStoreFile("path_to_my_keystore");
sslContext.setKeyStorePass("password");
sslContext.setTrustStoreFile("path_to_my_truststore");
sslContext.setTrustStorePass("password");
sslContext.setSecurityProtocol("TLSv1.2");
SSLEngineConfigurator sslEngineConfigurator = new SSLEngineConfigurator(sslContext);
sslEngineConfigurator.setNeedClientAuth(true);
sslEngineConfigurator.setWantClientAuth(true);
sslEngineConfigurator.setEnabledCipherSuites(new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA"});
sslEngineConfigurator.setClientMode(false);
NetworkListener listener = new NetworkListener("grizzly_ssl", uri.getHost(), 8443);
listener.setSecure(true);
listener.setSSLEngineConfig(sslEngineConfigurator);
server.addListener(listener);
}
@POST
@Produces({ MediaType.APPLICATION_XML })
@Consumes({ MediaType.APPLICATION_XML })
@Path("foo")
public Response receivePayload(MyPayload payload) {
// How can I get the CN of the client x.509 certificate / or the fingerprint of the certificate?
}
}
最佳答案
我在这里 [1] 和 [2] 找到了答案。
[1] How to grab a pki certificate with Jersey / Spring? [2] Grizzly and ServletContainerContext
这是有效的代码(仅适用于 Jersey 1.1,不适用于 Jersey 2):
class Transport {
public static void main(String[] args){
ResourceConfig rc = new PackagesResourceConfig(Transport.class.getPackage().getName());
String url = "http://myhost:8080/myURL";
URI uri = UriBuilder.fromUri(url).build();
HttpServer server = GrizzlyServerFactory.createHttpServer(uri, new HttpHandler() {
@Override
public void service(Request request, org.glassfish.grizzly.http.server.Response response) throws Exception {
response.setStatus(404, "Not found");
response.getWriter().write("404: not found");
}
});
// Initialize and register Jersey Servlet
WebappContext context = new WebappContext("WebappContext", "");
ServletRegistration registration = context.addServlet("ServletContainer", ServletContainer.class);
registration.setInitParameter(ServletContainer.RESOURCE_CONFIG_CLASS,
ClassNamesResourceConfig.class.getName());
registration.setInitParameter(ClassNamesResourceConfig.PROPERTY_CLASSNAMES, Transport.class.getName());
registration.addMapping("/*");
context.deploy(server);
SSLContextConfigurator sslContext = new SSLContextConfigurator();
sslContext.setKeyStoreFile("path_to_my_keystore");
sslContext.setKeyStorePass("password");
sslContext.setTrustStoreFile("path_to_my_truststore");
sslContext.setTrustStorePass("password");
sslContext.setSecurityProtocol("TLSv1.2");
SSLEngineConfigurator sslEngineConfigurator = new SSLEngineConfigurator(sslContext);
sslEngineConfigurator.setNeedClientAuth(true);
sslEngineConfigurator.setWantClientAuth(true);
sslEngineConfigurator.setEnabledCipherSuites(new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA"});
sslEngineConfigurator.setClientMode(false);
NetworkListener listener = new NetworkListener("grizzly_ssl", uri.getHost(), 8443);
listener.setSecure(true);
listener.setSSLEngineConfig(sslEngineConfigurator);
server.addListener(listener);
}
@POST
@Produces({ MediaType.APPLICATION_XML })
@Consumes({ MediaType.APPLICATION_XML })
@Path("foo")
public Response receivePayload(@Context HttpServletRequest request, MyPayload payload) {
X509Certificate[] certChain = (X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate");
if (certChain == null || certChain.length == 0){
LOG.info("X509cert not found");
return null;
}
X509Certificate certificate = certChain[0];
// get information such as CN from certificate
}
}
关于java - 如何在 Grizzly 2.3 中获取 X.509 客户端证书(使用客户端身份验证时),我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/17377538/