1 package org.apache.geronimo.tomcat;
2
3 import java.util.Map;
4 import javax.net.ssl.KeyManagerFactory;
5
6 import org.apache.geronimo.management.geronimo.SecureConnector;
7 import org.apache.geronimo.management.geronimo.WebManager;
8 import org.apache.geronimo.system.serverinfo.ServerInfo;
9 import org.apache.geronimo.gbean.GBeanInfo;
10 import org.apache.geronimo.gbean.GBeanInfoBuilder;
11
12 /**
13 * A wrapper around a connector for the HTTPS protocol for Tomcat. The
14 * functionality is not different than the standard ConnectorGBean, but
15 * there's an additional set of HTTPS attributes exposed.
16 *
17 * @version $Revision: 1.0$
18 */
19 public class HttpsConnectorGBean extends ConnectorGBean implements TomcatSecureConnector {
20 private final ServerInfo serverInfo;
21 private String keystoreFileName;
22 private String truststoreFileName;
23 private String algorithm;
24
25 public HttpsConnectorGBean(String name, String protocol, String host, int port, TomcatContainer container, ServerInfo serverInfo) throws Exception {
26 super(name, protocol, host, port, container);
27
28 if (serverInfo == null){
29 throw new IllegalArgumentException("serverInfo cannot be null.");
30 }
31
32 this.serverInfo = serverInfo;
33 }
34
35 /**
36 * Adds any special parameters before constructing the connector.
37 *
38 * @param protocol Should be one of the constants from WebContainer.
39 * @param params The map of parameters that will be used to initialize the connector.
40 */
41 protected void initializeParams(String protocol, Map params) {
42 super.initializeParams(protocol, params);
43 params.put("scheme", "https");
44 params.put("secure", "true");
45 }
46
47 /**
48 * Ensures that this implementation can handle the requested protocol.
49 *
50 * @param protocol
51 */
52 protected void validateProtocol(String protocol) {
53 if(protocol != null && !protocol.equals(WebManager.PROTOCOL_HTTPS)) {
54 throw new IllegalStateException("HttpsConnectorGBean only supports "+WebManager.PROTOCOL_HTTPS);
55 }
56 }
57
58 /**
59 * Gets the name of the keystore file that holds the server certificate
60 * (and by default, the trusted CA certificates used for client certificate
61 * authentication). This is relative to the Geronimo home directory.
62 */
63 public String getKeystoreFileName() {
64 return keystoreFileName;
65 }
66
67 /**
68 * Sets the name of the keystore file that holds the server certificate
69 * (and by default, the trusted CA certificates used for client certificate
70 * authentication). This is relative to the Geronimo home directory.
71 */
72 public void setKeystoreFileName(String name) {
73 keystoreFileName = name;
74 connector.setAttribute("keystoreFile", serverInfo.resolveServerPath(keystoreFileName));
75 }
76
77 public String getTruststoreFileName() {
78 return truststoreFileName;
79 }
80
81 public void setTruststoreFileName(String name) {
82 truststoreFileName = name;
83 connector.setAttribute("truststoreFile", serverInfo.resolveServerPath(truststoreFileName));
84 }
85
86 /**
87 * Sets the password used to access the keystore, and by default, used to
88 * access the server private key inside the keystore. Not all connectors
89 * support configuring different passwords for those two features; if so,
90 * a separate PrivateKeyPassword should be defined in an
91 * implementation-specific connector interface.
92 */
93 public void setKeystorePassword(String password) {
94 connector.setAttribute("keystorePass", password);
95 }
96
97 public void setTruststorePassword(String password) {
98 connector.setAttribute("truststorePass", password);
99 }
100
101 /**
102 * Gets the format of the entries in the keystore. The default format for
103 * Java keystores is JKS, though some connector implementations support
104 * PCKS12 (and possibly other formats).
105 */
106 public String getKeystoreType() {
107 return (String)connector.getAttribute("keystoreType");
108 }
109
110 /**
111 * Sets the format of the entries in the keystore. The default format for
112 * Java keystores is JKS, though some connector implementations support
113 * PCKS12 (and possibly other formats).
114 */
115 public void setKeystoreType(String type) {
116 connector.setAttribute("keystoreType", type);
117 }
118
119 public String getTruststoreType() {
120 return (String)connector.getAttribute("truststoreType");
121 }
122
123 public void setTruststoreType(String type) {
124 connector.setAttribute("truststoreType", type);
125 }
126
127 /**
128 * Gets the certificate algorithm used to access the keystore. This may
129 * be different for different JVM vendors, but should not usually be
130 * changed otherwise.
131 */
132 public String getAlgorithm() {
133 return algorithm;
134 }
135
136 /**
137 * Sets the certificate algorithm used to access the keystore. This may
138 * be different for different JVM vendors, but should not usually be
139 * changed otherwise.
140 */
141 public void setAlgorithm(String algorithm) {
142 this.algorithm = algorithm;
143 if ("default".equalsIgnoreCase(algorithm)) {
144 algorithm = KeyManagerFactory.getDefaultAlgorithm();
145 }
146 connector.setAttribute("algorithm", algorithm);
147 }
148
149 /**
150 * Gets the protocol used for secure communication. This should usually
151 * be TLS, though some JVM implementations (particularly some of IBM's)
152 * may not be compatible with popular browsers unless this is changed to
153 * SSL.
154 */
155 public String getSecureProtocol() {
156 return (String)connector.getAttribute("sslProtocol");
157 }
158
159 /**
160 * Gets the protocol used for secure communication. This should usually
161 * be TLS, though some JVM implementations (particularly some of IBM's)
162 * may not be compatible with popular browsers unless this is changed to
163 * SSL. Don't change it if you're not having problems.
164 */
165 public void setSecureProtocol(String protocol) {
166 connector.setAttribute("sslProtocol", protocol);
167 }
168
169 /**
170 * Checks whether clients are required to authenticate using client
171 * certificates in order to connect using this connector. If enabled,
172 * client certificates are validated using the trust store, which defaults
173 * to the same keystore file, keystore type, and keystore password as the
174 * regular keystore. Some connector implementations may allow you to
175 * configure those 3 values separately to use a different trust store.
176 */
177 public boolean isClientAuthRequired() {
178 Object value = connector.getAttribute("clientAuth");
179 return value == null ? false : new Boolean(value.toString()).booleanValue();
180 }
181
182 /**
183 * Checks whether clients are required to authenticate using client
184 * certificates in order to connect using this connector. If enabled,
185 * client certificates are validated using the trust store, which defaults
186 * to the same keystore file, keystore type, and keystore password as the
187 * regular keystore. Some connector implementations may allow you to
188 * configure those 3 values separately to use a different trust store.
189 */
190 public void setClientAuthRequired(boolean clientCert) {
191 connector.setAttribute("clientAuth", new Boolean(clientCert));
192 }
193
194 /**
195 * Gets a comma seperated list of the encryption ciphers that may be used. If not
196 * specified, then any available cipher may be used.
197 */
198 public String getCiphers() {
199 return (String)connector.getAttribute("ciphers");
200 }
201
202 /**
203 * Sets a comma seperated list of the encryption ciphers that may be used. If not
204 * specified, then any available cipher may be used.
205 */
206 public void setCiphers(String ciphers) {
207 connector.setAttribute("ciphers", ciphers);
208 }
209
210 public static final GBeanInfo GBEAN_INFO;
211
212 static {
213 GBeanInfoBuilder infoFactory = GBeanInfoBuilder.createStatic("Tomcat Connector", HttpsConnectorGBean.class, ConnectorGBean.GBEAN_INFO);
214 infoFactory.addAttribute("keystoreFileName", String.class, true, true);
215 infoFactory.addAttribute("truststoreFileName", String.class, true, true);
216 infoFactory.addAttribute("algorithm", String.class, true, true);
217 infoFactory.addAttribute("keystorePassword", String.class, true, true);
218 infoFactory.addAttribute("truststorePassword", String.class, true, true);
219
220
221 infoFactory.addAttribute("secureProtocol", String.class, true, true);
222 infoFactory.addAttribute("keystoreType", String.class, true, true);
223 infoFactory.addAttribute("truststoreType", String.class, true, true);
224 infoFactory.addAttribute("clientAuthRequired", boolean.class, true, true);
225 infoFactory.addAttribute("ciphers", String.class, true, true);
226 infoFactory.addInterface(TomcatSecureConnector.class);
227
228 infoFactory.addReference("ServerInfo", ServerInfo.class, "GBean");
229 infoFactory.setConstructor(new String[] { "name", "protocol", "host", "port", "TomcatContainer", "ServerInfo"});
230 GBEAN_INFO = infoFactory.getBeanInfo();
231 }
232
233 public static GBeanInfo getGBeanInfo() {
234 return GBEAN_INFO;
235 }
236 }