org.apache.nifi.ssl

Class StandardSSLContextService

java.lang.Object

org.apache.nifi.components.AbstractConfigurableComponent

org.apache.nifi.controller.AbstractControllerService

org.apache.nifi.ssl.StandardSSLContextService

All Implemented Interfaces:

ConfigurableComponent, ControllerService, SSLContextService

Direct Known Subclasses:

StandardRestrictedSSLContextService

@Tags(value={"ssl","secure","certificate","keystore","truststore","jks","p12","pkcs12","pkcs","tls"})
 @CapabilityDescription(value="Standard implementation of the SSLContextService. Provides the ability to configure keystore and/or truststore properties once and reuse that configuration throughout the application. This service can be used to communicate with both legacy and modern systems. If you only need to communicate with non-legacy systems, then the StandardRestrictedSSLContextService is recommended as it only allows a specific set of SSL protocols to be chosen.")
public class StandardSSLContextService
extends AbstractControllerService
implements SSLContextService

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	StandardSSLContextService.KeystoreValidationGroup

Nested classes/interfaces inherited from interface org.apache.nifi.ssl.SSLContextService

SSLContextService.ClientAuth

Field Summary

Fields

Modifier and Type	Field and Description
protected ConfigurationContext	configContext
private static DeprecationLogger	deprecationLogger
private boolean	isValidated
(package private) static PropertyDescriptor	KEY_PASSWORD
static PropertyDescriptor	KEYSTORE
static PropertyDescriptor	KEYSTORE_PASSWORD
static PropertyDescriptor	KEYSTORE_TYPE
private static List<PropertyDescriptor>	properties
static PropertyDescriptor	SSL_ALGORITHM
static PropertyDescriptor	TRUSTSTORE
static PropertyDescriptor	TRUSTSTORE_PASSWORD
static PropertyDescriptor	TRUSTSTORE_TYPE
private static int	VALIDATION_CACHE_EXPIRATION
private int	validationCacheCount

Constructor Summary

Constructors

Constructor and Description
StandardSSLContextService()

Method Summary

Modifier and Type	Method and Description
private static int	countNulls(Object... objects) Returns the count of null objects in the parameters.
SSLContext	createContext() Create and initialize SSLContext using configured properties.
SSLContext	createSSLContext(ClientAuth clientAuth) Deprecated. The createContext() method should be used instead
SSLContext	createSSLContext(SSLContextService.ClientAuth clientAuth) Deprecated. The createContext() method should be used instead
TlsConfiguration	createTlsConfiguration() Returns a TlsConfiguration configured with the current properties of the controller service.
X509TrustManager	createTrustManager() Create X.509 Trust Manager using configured properties
protected Collection<ValidationResult>	customValidate(ValidationContext validationContext)
private Map<PropertyDescriptor,String>	evaluateProperties(PropertyContext context)
String	getKeyPassword()
String	getKeyStoreFile()
String	getKeyStorePassword()
String	getKeyStoreType()
private static AllowableValue[]	getProtocolAllowableValues()
String	getSslAlgorithm()
protected List<PropertyDescriptor>	getSupportedPropertyDescriptors()
String	getTrustStoreFile()
String	getTrustStorePassword()
String	getTrustStoreType()
protected int	getValidationCacheExpiration()
boolean	isKeyStoreConfigured()
boolean	isTrustStoreConfigured()
private static boolean	keystorePropertiesEmpty(Map<PropertyDescriptor,String> properties)
void	onConfigured(ConfigurationContext context)
void	onPropertyModified(PropertyDescriptor descriptor, String oldValue, String newValue)
private void	resetValidationCache()
String	toString()
private static boolean	truststorePropertiesEmpty(Map<PropertyDescriptor,String> properties)
private static List<ValidationResult>	validateKeystore(Map<PropertyDescriptor,String> properties) Returns a list of ValidationResults for keystore validity checking.
private static List<ValidationResult>	validateKeystoreFile(String filename, String password, String keyPassword, String type) Returns a list of ValidationResults when validating an actual keystore file on disk.
private static Collection<ValidationResult>	validateStore(Map<PropertyDescriptor,String> properties, StandardSSLContextService.KeystoreValidationGroup keyStoreOrTrustStore) Returns a list of ValidationResults for the provided keystore/truststore properties.
private static List<ValidationResult>	validateTruststore(Map<PropertyDescriptor,String> properties) Returns a list of ValidationResults for truststore validity checking.
private static List<ValidationResult>	validateTruststoreFile(String filename, String password, String type) Returns a list of ValidationResults when validating an actual truststore file on disk.

Methods inherited from class org.apache.nifi.controller.AbstractControllerService

abstractClearConfigContext, abstractStoreConfigContext, disabled, enabled, getConfigurationContext, getControllerServiceLookup, getIdentifier, getLogger, getNodeTypeProvider, getProperty, getStateManager, init, initialize, isEnabled

Methods inherited from class org.apache.nifi.components.AbstractConfigurableComponent

equals, getPropertyDescriptor, getPropertyDescriptors, getSupportedDynamicPropertyDescriptor, hashCode, validate

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface org.apache.nifi.controller.ControllerService

initialize, isStateful

Methods inherited from interface org.apache.nifi.components.ConfigurableComponent

getIdentifier, getPropertyDescriptor, getPropertyDescriptors, validate

Field Detail

TRUSTSTORE

public static final PropertyDescriptor TRUSTSTORE

TRUSTSTORE_TYPE

public static final PropertyDescriptor TRUSTSTORE_TYPE

TRUSTSTORE_PASSWORD

public static final PropertyDescriptor TRUSTSTORE_PASSWORD

KEYSTORE

public static final PropertyDescriptor KEYSTORE

KEYSTORE_TYPE

public static final PropertyDescriptor KEYSTORE_TYPE

KEYSTORE_PASSWORD

public static final PropertyDescriptor KEYSTORE_PASSWORD

KEY_PASSWORD

static final PropertyDescriptor KEY_PASSWORD

SSL_ALGORITHM

public static final PropertyDescriptor SSL_ALGORITHM

deprecationLogger

private static final DeprecationLogger deprecationLogger

properties

private static final List<PropertyDescriptor> properties

configContext

protected ConfigurationContext configContext

isValidated

private boolean isValidated

VALIDATION_CACHE_EXPIRATION

private static final int VALIDATION_CACHE_EXPIRATION

See Also:

Constant Field Values

validationCacheCount

private int validationCacheCount

Constructor Detail

StandardSSLContextService

public StandardSSLContextService()

Method Detail

onConfigured

@OnEnabled
public void onConfigured(ConfigurationContext context)
                             throws InitializationException

Throws:

InitializationException

onPropertyModified

public void onPropertyModified(PropertyDescriptor descriptor,
                               String oldValue,
                               String newValue)

Specified by:

onPropertyModified in interface ConfigurableComponent

Overrides:

onPropertyModified in class AbstractConfigurableComponent

getSupportedPropertyDescriptors

protected List<PropertyDescriptor> getSupportedPropertyDescriptors()

Overrides:

getSupportedPropertyDescriptors in class AbstractConfigurableComponent

customValidate

protected Collection<ValidationResult> customValidate(ValidationContext validationContext)

Overrides:

customValidate in class AbstractConfigurableComponent

evaluateProperties

private Map<PropertyDescriptor,String> evaluateProperties(PropertyContext context)

resetValidationCache

private void resetValidationCache()

getValidationCacheExpiration

protected int getValidationCacheExpiration()

createTlsConfiguration

public TlsConfiguration createTlsConfiguration()

Returns a TlsConfiguration configured with the current properties of the controller service. This is useful for transferring the TLS configuration values between services.

Specified by:

createTlsConfiguration in interface SSLContextService

Returns:

the populated TlsConfiguration

createContext

public SSLContext createContext()

Create and initialize SSLContext using configured properties. This method is preferred over deprecated methods due to not requiring a client authentication policy. Invokes createTlsConfiguration() to prepare properties for processing.

Specified by:

createContext in interface SSLContextService

Returns:

SSLContext initialized using configured properties

createSSLContext

@Deprecated
public SSLContext createSSLContext(ClientAuth clientAuth)
                                        throws ProcessException

Deprecated. The createContext() method should be used instead

Returns a configured SSLContext from the populated configuration values. This method is deprecated due to the Client Authentication policy not being applicable when initializing the SSLContext

Specified by:

createSSLContext in interface SSLContextService

Parameters:

clientAuth - the desired level of client authentication

Returns:

the configured SSLContext

Throws:

ProcessException - if there is a problem configuring the context

createSSLContext

@Deprecated
public SSLContext createSSLContext(SSLContextService.ClientAuth clientAuth)
                                        throws ProcessException

Deprecated. The createContext() method should be used instead

Returns a configured SSLContext from the populated configuration values. This method is deprecated due to the use of the deprecated ClientAuth enum createContext() method is preferred.

Specified by:

createSSLContext in interface SSLContextService

Parameters:

clientAuth - the desired level of client authentication

Returns:

the configured SSLContext

Throws:

ProcessException - if there is a problem configuring the context

createTrustManager

public X509TrustManager createTrustManager()

Create X.509 Trust Manager using configured properties

Specified by:

createTrustManager in interface SSLContextService

Returns:

X509TrustManager initialized using configured properties

getTrustStoreFile

public String getTrustStoreFile()

Specified by:

getTrustStoreFile in interface SSLContextService

getTrustStoreType

public String getTrustStoreType()

Specified by:

getTrustStoreType in interface SSLContextService

getTrustStorePassword

public String getTrustStorePassword()

Specified by:

getTrustStorePassword in interface SSLContextService

isTrustStoreConfigured

public boolean isTrustStoreConfigured()

Specified by:

isTrustStoreConfigured in interface SSLContextService

getKeyStoreFile

public String getKeyStoreFile()

Specified by:

getKeyStoreFile in interface SSLContextService

getKeyStoreType

public String getKeyStoreType()

Specified by:

getKeyStoreType in interface SSLContextService

getKeyStorePassword

public String getKeyStorePassword()

Specified by:

getKeyStorePassword in interface SSLContextService

getKeyPassword

public String getKeyPassword()

Specified by:

getKeyPassword in interface SSLContextService

isKeyStoreConfigured

public boolean isKeyStoreConfigured()

Specified by:

isKeyStoreConfigured in interface SSLContextService

getSslAlgorithm

public String getSslAlgorithm()

Specified by:

getSslAlgorithm in interface SSLContextService

validateStore

private static Collection<ValidationResult> validateStore(Map<PropertyDescriptor,String> properties,
                                                          StandardSSLContextService.KeystoreValidationGroup keyStoreOrTrustStore)

Returns a list of ValidationResults for the provided keystore/truststore properties. Called during customValidate(ValidationContext).

Parameters:

properties - the map of component properties

keyStoreOrTrustStore - an enum StandardSSLContextService.KeystoreValidationGroup indicating keystore or truststore because logic is different

Returns:

the list of validation results (empty means valid)

keystorePropertiesEmpty

private static boolean keystorePropertiesEmpty(Map<PropertyDescriptor,String> properties)

truststorePropertiesEmpty

private static boolean truststorePropertiesEmpty(Map<PropertyDescriptor,String> properties)

countNulls

private static int countNulls(Object... objects)

Returns the count of null objects in the parameters. Used for keystore/truststore validation.

Parameters:

objects - a variable array of objects, some of which can be null

Returns:

the count of provided objects which were null

validateKeystore

private static List<ValidationResult> validateKeystore(Map<PropertyDescriptor,String> properties)

Returns a list of ValidationResults for keystore validity checking. Ensures none or all of the properties are populated; if populated, validates the keystore file on disk and password as well.

Parameters:

properties - the component properties

Returns:

the list of validation results (empty is valid)

validateTruststore

private static List<ValidationResult> validateTruststore(Map<PropertyDescriptor,String> properties)

Returns a list of ValidationResults for truststore validity checking. Ensures none of the properties are populated or at least filename and type are populated; if populated, validates the truststore file on disk and password as well.

Parameters:

properties - the component properties

Returns:

the list of validation results (empty is valid)

validateTruststoreFile

private static List<ValidationResult> validateTruststoreFile(String filename,
                                                             String password,
                                                             String type)

Returns a list of ValidationResults when validating an actual truststore file on disk. Verifies the file permissions and existence, and attempts to open the file given the provided password.

Parameters:

filename - the path of the file on disk

password - the file password

type - the truststore type

Returns:

the list of validation results (empty is valid)

validateKeystoreFile

private static List<ValidationResult> validateKeystoreFile(String filename,
                                                           String password,
                                                           String keyPassword,
                                                           String type)

Returns a list of ValidationResults when validating an actual keystore file on disk. Verifies the file permissions and existence, and attempts to open the file given the provided (keystore or key) password.

Parameters:

filename - the path of the file on disk

password - the file password

keyPassword - the (optional) key-specific password

type - the keystore type

Returns:

the list of validation results (empty is valid)

toString

public String toString()

Overrides:

toString in class AbstractConfigurableComponent

getProtocolAllowableValues

private static AllowableValue[] getProtocolAllowableValues()