Java SecretResolver.isTokenProtected方法代码示例

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
/**
 * Resolve carbon secure vault encrypted properties.
 * @param environment property values which need to construct the InitialContext
 */
private static void resolveEncryptedProperties(Hashtable environment) {
    if (environment != null) {
        Properties properties = convertToProperties(environment);
        SecretResolver secretResolver = SecretResolverFactory.create(properties);
        for (Object key : environment.keySet()) {
            if (secretResolver != null && secretResolver.isInitialized()) {
                String value = environment.get(key.toString()).toString();
                if(value != null && value.startsWith(SECRET_ALIAS_PREFIX)) {
                    value = value.split(SECRET_ALIAS_PREFIX)[1];
                }
                if (secretResolver.isTokenProtected(value)) {
                    environment.put(key.toString(), secretResolver.resolve(value));
                }
            }
        }
    }
}
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
/**
 * There can be sensitive information like passwords in configuration file. If they are encrypted using secure
 * vault, this method will resolve them and replace with original values.
 */
private static void resolveSecrets(Properties properties) {

    String protectedTokens = (String) properties.get(PROTECTED_TOKENS);

    if (StringUtils.isNotBlank(protectedTokens)) {
        String secretProvider = (String) properties.get(SECRET_PROVIDER);
        SecretResolver secretResolver;

        if (StringUtils.isBlank(secretProvider)) {
            properties.put(SECRET_PROVIDER, DEFAULT_CALLBACK_HANDLER);
        }

        secretResolver = SecretResolverFactory.create(properties, "");
        StringTokenizer st = new StringTokenizer(protectedTokens, ",");

        while (st.hasMoreElements()) {
            String element = st.nextElement().toString().trim();

            if (secretResolver.isTokenProtected(element)) {
                if (log.isDebugEnabled()) {
                    log.debug("Resolving and replacing secret for " + element);
                }
                // Replaces the original encrypted property with resolved property
                properties.put(element, secretResolver.resolve(element));
            } else {
                if (log.isDebugEnabled()) {
                    log.debug("No encryption done for value with key :" + element);
                }
            }
        }
    } else {
        if (log.isDebugEnabled()) {
            log.debug("Secure vault encryption ignored since no protected tokens available");
        }
    }
}
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
/**
 * There can be sensitive information like passwords in configuration file. If they are encrypted using secure
 * vault, this method will resolve them and replace with original values.
 */
private void resolveSecrets() {

    SecretResolver secretResolver = SecretResolverFactory.create(notificationMgtConfigProperties);
    Enumeration propertyNames = notificationMgtConfigProperties.propertyNames();
    if (secretResolver != null && secretResolver.isInitialized()) {
        // Iterate through whole config file and find encrypted properties and resolve them
        while (propertyNames.hasMoreElements()) {
            String key = (String) propertyNames.nextElement();
            if (secretResolver.isTokenProtected(key)) {
                if (log.isDebugEnabled()) {
                    log.debug("Resolving and replacing secret for " + key);
                }
                // Resolving the secret password.
                String value = secretResolver.resolve(key);
                // Replaces the original encrypted property with resolved property
                notificationMgtConfigProperties.put(key, value);
            } else {
                if (log.isDebugEnabled()) {
                    log.debug("No encryption done for value with key :" + key);
                }
            }
        }
    } else {
        if(log.isDebugEnabled()){
            log.debug("Secret Resolver is not present. Will not resolve encryptions in config file");
        }
    }
}
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
private static void resolveSecrets(Properties properties) {

        SecretResolver secretResolver = SecretResolverFactory.create(properties);
        Enumeration propertyNames = properties.propertyNames();
        if (secretResolver != null && secretResolver.isInitialized()) {
            // Iterate through config file, find encrypted properties and resolve them
            while (propertyNames.hasMoreElements()) {
                String key = (String) propertyNames.nextElement();
                if (StringUtils
                        .startsWith(properties.getProperty(key), IdentityManagementEndpointConstants.SECRET_ALIAS)) {
                    String secretAlias = properties.getProperty(key)
                                                   .split(IdentityManagementEndpointConstants.SECRET_ALIAS_SEPARATOR,
                                                          2)[1];
                    if (secretResolver.isTokenProtected(secretAlias)) {
                        if (log.isDebugEnabled()) {
                            log.debug("Resolving and replacing secret for " + secretAlias);
                        }
                        // Resolving the secret password.
                        String value = secretResolver.resolve(secretAlias);
                        // Replaces the original encrypted property with resolved property
                        properties.put(key, value);
                    } else {
                        if (log.isDebugEnabled()) {
                            log.debug("No encryption done for value with key :" + key);
                        }
                    }
                }
            }
        } else {
            log.warn("Secret Resolver is not present. Failed to resolve encryption in " +
                     IdentityManagementEndpointConstants.SERVICE_CONFIG_FILE_NAME + " file");
        }
    }
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
/**
 * Initialize analytics common configurations
 *
 * @param secretResolver
 * @param tAnalyticServer
 */
private void initAnalytics(SecretResolver secretResolver, TAnalyticServer tAnalyticServer) {
    // Get Enabled
    //this.analyticsEnabled = tAnalyticServer.getEnabled();
    if (this.isAnalyticsDashboardEnabled()) {
        // Get URL
        if (tAnalyticServer.getDASServerUrl().endsWith("/")) {
            this.analyticsServerURL = tAnalyticServer.getDASServerUrl().substring(0, tAnalyticServer.getDASServerUrl()
                                                                                          .length() - 1);
        } else {
            this.analyticsServerURL = tAnalyticServer.getDASServerUrl();
        }
        // Get Username
        this.analyticsServerUsername = tAnalyticServer.getUsername();
        // Get Password
        if (secretResolver != null && secretResolver.isInitialized()
            && secretResolver.isTokenProtected(BPMNAnalyticsCoreConstants.ANALYTICS_SERVER_PASSWORD_SECRET_ALIAS)) {
            this.analyticsServerPassword = secretResolver.resolve(BPMNAnalyticsCoreConstants
                                                                          .ANALYTICS_SERVER_PASSWORD_SECRET_ALIAS);
            if (log.isDebugEnabled()) {
                log.debug("Loaded  analytics  password from secure vault");
            }
        } else {
            if (tAnalyticServer.getPassword() != null) {
                this.analyticsServerPassword = tAnalyticServer.getPassword();
            }
        }
    }
}
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
/**
 * There can be sensitive information like passwords in configuration file. If they are encrypted using secure
 * vault, this method will resolve them and replace with original values.
 */
private static void resolveSecrets(Properties properties) {

    SecretResolver secretResolver = SecretResolverFactory.create(properties);
    Enumeration propertyNames = properties.propertyNames();
    if (secretResolver != null && secretResolver.isInitialized()) {
        // Iterate through whole config file and find encrypted properties and resolve them
        while (propertyNames.hasMoreElements()) {
            String key = (String) propertyNames.nextElement();
            if (secretResolver.isTokenProtected(key)) {
                if (log.isDebugEnabled()) {
                    log.debug("Resolving and replacing secret for " + key);
                }
                // Resolving the secret password.
                String value = secretResolver.resolve(key);
                // Replaces the original encrypted property with resolved property
                properties.put(key, value);
            } else {
                if (log.isDebugEnabled()) {
                    log.debug("No encryption done for value with key :" + key);
                }
            }
        }
    } else {
        log.warn("Secret Resolver is not present. Will not resolve encryptions in " + Constants.TenantConstants
                .CONFIG_RELATIVE_PATH + " file");
    }
}
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
/**
 * Initialize analytics common configurations
 *
 * @param tAnalyticServer
 * @param secretResolver
 */
private void initAnalytics(SecretResolver secretResolver, TAnalyticServer tAnalyticServer) {

    // Get Auth URL Set
    this.analyticsAuthURLSet = tAnalyticServer.getAuthURLSet();

    // Get Receiver URL Set
    this.analyticsReceiverURLSet = tAnalyticServer.getReceiverURLSet();

    // Get Username
    this.analyticsServerUsername = tAnalyticServer.getUsername();
    // Get Password
    if (secretResolver != null && secretResolver.isInitialized()
            && secretResolver.isTokenProtected(AnalyticsPublisherConstants
            .BPS_BPMN_ANALYTICS_SERVER_PASSWORD_SECRET_ALIAS)) {
        this.analyticsServerPassword = secretResolver.resolve(AnalyticsPublisherConstants
                .BPS_BPMN_ANALYTICS_SERVER_PASSWORD_SECRET_ALIAS);
        if (log.isDebugEnabled()) {
            log.debug("Loaded analytics password from secure vault");
        }
    } else {
        if (tAnalyticServer.getPassword() != null) {
            this.analyticsServerPassword = tAnalyticServer.getPassword();
        }
    }

}
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
public static String getResolvedPassword(SecretResolver secretResolver,
                                         String configName, String password) {

    if (secretResolver != null && secretResolver.isInitialized()) {
        if (secretResolver.isTokenProtected("wso2registry." + configName + ".password")) {
            return secretResolver.resolve("wso2registry." + configName + ".password");
        } else {
            return password;
        }
    } else {
        return password;
    }
}
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
/**
 * Digest a AMQP CF definition from an axis2.xml 'Parameter' and construct
 *
 * @param parameter the axis2.xml 'Parameter' that defined the AMQP CF
 */
public RabbitMQConnectionFactory(Parameter parameter, SecretResolver secretResolver) {
    this.name = parameter.getName();
    ParameterIncludeImpl pi = new ParameterIncludeImpl();

    try {
        pi.deserializeParameters((OMElement) parameter.getValue());
    } catch (AxisFault axisFault) {
        handleException("Error reading parameters for RabbitMQ connection factory" + name, axisFault);
    }

    for (Parameter p : pi.getParameters()) {
        OMElement paramElement = p.getParameterElement();
        String propertyValue = p.getValue().toString();
        if (paramElement != null) {
            OMAttribute attribute = paramElement.getAttribute(
                    new QName(RabbitMQConstants.SECURE_VAULT_NAMESPACE, RabbitMQConstants.SECRET_ALIAS_ATTRIBUTE));
            if (attribute != null && attribute.getAttributeValue() != null
                && !attribute.getAttributeValue().isEmpty()) {
                if (secretResolver == null) {
                    throw new SecureVaultException("Axis2 Secret Resolver is null. Cannot resolve encrypted entry for " + p.getName());
                }
                if (secretResolver.isTokenProtected(attribute.getAttributeValue())) {
                    propertyValue = secretResolver.resolve(attribute.getAttributeValue());
                }
            }
        }
        parameters.put(p.getName(), propertyValue);
    }
    initConnectionFactory();
    log.info("RabbitMQ ConnectionFactory : " + name + " initialized");
}
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
public static String resolveSecret(final OMElement docElt, final OMElement elt) {
    // retrieve the value using secure vault
    SecretResolver secretResolver = SecretResolverFactory.create(docElt, false);

    String alias = elt.getAttributeValue(new QName(
            ALIAS_NAMESPACE, ALIAS_ATTRIBUTE, ALIAS_ATTRIBUTE_PREFIX));

    // retrieve the secured password
    if (secretResolver != null && secretResolver.isInitialized() &&
            secretResolver.isTokenProtected(alias)) {
        return secretResolver.resolve(alias);
    }
    return null;
}
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
/**
 * Decrypt properties with secure vault and maintain on a separate hashmap for cross-reference.
 *
 * @param filePath File path to the configuration file in question
 * @throws FileNotFoundException
 * @throws JaxenException
 * @throws XMLStreamException
 */
private static void decryptConfigurationFromFile(String filePath) throws FileNotFoundException, JaxenException, XMLStreamException {

    cipherValueMap = new ConcurrentHashMap<String, String>();

    StAXOMBuilder stAXOMBuilder = new StAXOMBuilder(new FileInputStream(new File(filePath)));
    OMElement dom = stAXOMBuilder.getDocumentElement();

    //Initialize the SecretResolver providing the configuration element.
    SecretResolver secretResolver = SecretResolverFactory.create(dom, false);

    AXIOMXPath xpathExpression = new AXIOMXPath("//*[@*[local-name() = 'secretAlias']]");
    List nodeList = xpathExpression.selectNodes(dom);

    for (Object o : nodeList) {

        String secretAlias = ((OMElement) o).getAttributeValue(SECURE_VAULT_QNAME);
        String decryptedValue = "";

        if (secretResolver != null && secretResolver.isInitialized()) {
            if (secretResolver.isTokenProtected(secretAlias)) {
                decryptedValue = secretResolver.resolve(secretAlias);
            }
        } else {
            log.warn("Error while trying to decipher secure property with secretAlias : " + secretAlias);
        }

        cipherValueMap.put(secretAlias, decryptedValue);
    }

}
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
/**
 * Check the given password is encrypted or not, if its encrypted resolve the password.
 *
 * @param dataService Data service object
 * @param password    Password before resolving
 * @return Resolved password
 */
public static String resolvePasswordValue(DataService dataService, String password) {
    SecretResolver secretResolver = dataService.getSecretResolver();
    if (secretResolver != null && secretResolver.isTokenProtected(password)) {
        return secretResolver.resolve(password);
    } else {
        return password;
    }
}
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
/**
 * Digest a JMS CF definition from an axis2.xml 'Parameter' and construct.
 * @param parameter the axis2.xml 'Parameter' that defined the JMS CF
 * @param secretResolver the SecretResolver to use to resolve secrets such as passwords
 */
public JMSConnectionFactory(Parameter parameter, SecretResolver secretResolver) {
    this.name = parameter.getName();
    ParameterIncludeImpl pi = new ParameterIncludeImpl();

    try {
        pi.deserializeParameters((OMElement) parameter.getValue());
    } catch (AxisFault axisFault) {
        handleException("Error reading parameters for JMS connection factory" + name, axisFault);
    }

    for (Parameter param : pi.getParameters()) {
        OMElement paramElement = param.getParameterElement();
        String propertyValue = param.getValue().toString();
        if (paramElement != null) {
            OMAttribute attribute = paramElement.getAttribute(JMSConstants.ALIAS_QNAME);
            if (attribute != null && attribute.getAttributeValue() != null
                    && !attribute.getAttributeValue().isEmpty()) {
                if (secretResolver == null) {
                    throw new SecureVaultException("Axis2 Secret Resolver is null. "
                            + "Cannot resolve encrypted entry for " + param.getName());
                }
                if (secretResolver.isTokenProtected(attribute.getAttributeValue())) {
                    propertyValue = secretResolver.resolve(attribute.getAttributeValue());
                }
            }
        }
        parameters.put(param.getName(), propertyValue);
    }
    digestCacheLevel();
    try {
        context = new InitialContext(parameters);
        conFactory = JMSUtils.lookup(context, ConnectionFactory.class,
            parameters.get(JMSConstants.PARAM_CONFAC_JNDI_NAME));
        if (parameters.get(JMSConstants.PARAM_DESTINATION) != null) {
            sharedDestination = JMSUtils.lookup(context, Destination.class,
                parameters.get(JMSConstants.PARAM_DESTINATION));
        }
        log.info("JMS ConnectionFactory : " + name + " initialized");

    } catch (NamingException e) {
        throw new AxisJMSException("Cannot acquire JNDI context, JMS Connection factory : " +
            parameters.get(JMSConstants.PARAM_CONFAC_JNDI_NAME) + " or default destination : " +
            parameters.get(JMSConstants.PARAM_DESTINATION) +
            " for JMS CF : " + name + " using : " + JMSUtils.maskAxis2ConfigSensitiveParameters(parameters), e);
    }
    setMaxSharedJMSConnectionsCount();
}
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
private static void loadCredentials(final String fileName, final OMElement elt, final IaasProvider iaas, final OMElement iaasElt,
                                    final String xpath) {

    Iterator<?> it =
            iaasElt.getChildrenWithName(new QName(
                    CloudControllerConstants.CREDENTIAL_ELEMENT));

    if (it.hasNext()) {
        OMElement credentialElt = (OMElement) it.next();

        // retrieve the value using secure vault
        SecretResolver secretResolver = SecretResolverFactory.create(elt, false);
        String alias = credentialElt.getAttributeValue(new QName(
                CloudControllerConstants.ALIAS_NAMESPACE,
                CloudControllerConstants.ALIAS_ATTRIBUTE,
                CloudControllerConstants.ALIAS_ATTRIBUTE_PREFIX));

        // retrieve the secured password
        if (secretResolver != null && secretResolver.isInitialized() &&
                secretResolver.isTokenProtected(alias)) {
            iaas.setCredential(secretResolver.resolve(alias));
        }

        // if we still cannot find a value, we try to assign the value which
        // is specified
        // in the element, if any
        if (iaas.getCredential() == null) {
            log.warn("Unable to find a value for " + CloudControllerConstants.CREDENTIAL_ELEMENT +
                    " element from Secure Vault." +
                    "Hence we will try to assign the plain text value (if specified).");
            iaas.setCredential(credentialElt.getText());
        }
    }

    if (it.hasNext()) {
        log.warn(fileName + " contains more than one " +
                CloudControllerConstants.CREDENTIAL_ELEMENT + " elements!" +
                " Elements other than the first will be neglected.");
    }

    if (iaas.getCredential() == null) {
        String msg =
                "Essential '" + CloudControllerConstants.CREDENTIAL_ELEMENT + "' element" +
                        " has not specified in " + fileName;
        handleException(msg);
    }

}
 

import org.wso2.securevault.SecretResolver; //导入方法依赖的package包/类
private static void loadIdentity(final String fileName, final OMElement elt, final IaasProvider iaas, final OMElement iaasElt) {

        Iterator<?> it =
                iaasElt.getChildrenWithName(new QName(CloudControllerConstants.IDENTITY_ELEMENT));

        if (it.hasNext()) {
            OMElement identityElt = (OMElement) it.next();

            // retrieve the value using secure vault
            SecretResolver secretResolver = SecretResolverFactory.create(elt, false);
            String alias = identityElt.getAttributeValue(new QName(
                    CloudControllerConstants.ALIAS_NAMESPACE,
                    CloudControllerConstants.ALIAS_ATTRIBUTE,
                    CloudControllerConstants.ALIAS_ATTRIBUTE_PREFIX));

            // retrieve the secured password
            if (secretResolver != null && secretResolver.isInitialized() &&
                    secretResolver.isTokenProtected(alias)) {
                iaas.setIdentity(secretResolver.resolve(alias));
            }

            // if we still cannot find a value, we try to assign the value which
            // is specified
            // in the element, if any
            if (iaas.getIdentity() == null) {
                log.warn("Unable to find a value for " + CloudControllerConstants.IDENTITY_ELEMENT +
                        " element from Secure Vault." +
                        "Hence we will try to assign the plain text value (if specified).");
                iaas.setIdentity(identityElt.getText());
            }
        }

        if (it.hasNext()) {
            log.warn(fileName + " contains more than one " + CloudControllerConstants.IDENTITY_ELEMENT +
                    " elements!" + " Elements other than the first will be neglected.");
        }

        if (iaas.getIdentity() == null) {
            String msg =
                    "Essential '" + CloudControllerConstants.IDENTITY_ELEMENT + "' element" +
                            " has not specified in " + fileName;
            handleException(msg);
        }

    }