Class Security

java.lang.Object

org.forgerock.opendj.setup.model.Security

public final class Security
extends Object

Utility class to create secure peer to peer communications settings in a newly set up OpenDJ instance.

Securing communications means providing:

• Certificate(s) which represent server identity
• The certificate of the CA signing all servers certificates
• Optionally a list of certificates of trusted servers

Different strategies can be used:

• Use the server's deployment ID. This is the default behavior and is suitable when the server is setup in a private network. In other words this strategy is not appropriate for public facing services for which a public CA certificate and SSL key-pair is generally needed
• Provide existing CA cert and SSL key-pair. This strategy is more complex to configure but should generally be used when implementing public facing services or when the network security policy mandates the use of externally acquired and approved SSL assets.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	Security.KeyStoreModel	Represents keystore data which will be used to secure the server instance to setup.
static class	Security.PasswordProvider	Represents a strategy to retrieve an existing password.
static class	Security.TrustStoreModel	Represents a truststore to trust remote server certificates.

Method Summary

Modifier and Type	Method	Description
static Security.TrustStoreModel	blindTrust()	Returns a Security.TrustStoreModel which will blindly trust all certificates.
static Security.PasswordProvider	clearTextPassword(String password)	Specifies that the password is the provided clear text String.
static Security.KeyStoreModel	fileBasedKeyStore(String keyStoreType, String keyStorePath, Security.PasswordProvider passwordProvider, KeyManagers.SecurityProvider securityProvider)	Specifies keystore data to use to secure the server instance to setup.
static Security.KeyStoreModel	fileBasedKeyStore(String keyStoreType, Path keyStorePath, Security.PasswordProvider passwordProvider, KeyManagers.SecurityProvider securityProvider)	Specifies keystore data to use to secure the server instance to setup.
static Security.PasswordProvider	fileBasedPassword(Path passwordFilePath)	Specifies that the password is located in the provided file Path.
static Security.TrustStoreModel	fileBasedTrustStore(String trustStoreType, Path trustStorePath, Security.PasswordProvider passwordProvider, KeyManagers.SecurityProvider securityProvider)	Returns a file based Security.TrustStoreModel.
static Security.TrustStoreModel	jvmTrustStore()	Returns a Security.TrustStoreModel which will use the JVM truststore.
static Security.KeyStoreModel	pkcs11KeyStore(Security.PasswordProvider passwordProvider, KeyManagers.SecurityProvider securityProvider)	Specifies keystore data to use to secure the server instance to setup.
static Security.TrustStoreModel	pkcs11TrustStore(Security.PasswordProvider passwordProvider, KeyManagers.SecurityProvider securityProvider)	Returns a PKCS#11 based Security.TrustStoreModel.
static Security.PasswordProvider	unprotected()	Specifies that the setup component is not protected by a password.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

unprotected

public static Security.PasswordProvider unprotected()

Specifies that the setup component is not protected by a password.

This provider can only be used for Security.KeyStoreModel or Security.ExistingTrustStoreModel.

Returns:

A Security.PasswordProvider to use when creating a setup component

clearTextPassword

public static Security.PasswordProvider clearTextPassword(String password)
                                                   throws com.forgerock.opendj.cli.ArgumentException

Specifies that the password is the provided clear text String.

The password will be stored in a dedicated file located in the instance

Parameters:

password - The clear text password

Returns:

A Security.PasswordProvider to use when creating a setup component

Throws:

com.forgerock.opendj.cli.ArgumentException - If the provided password is empty

fileBasedPassword

public static Security.PasswordProvider fileBasedPassword(Path passwordFilePath)
                                                   throws com.forgerock.opendj.cli.ArgumentException

Specifies that the password is located in the provided file Path.

The server configuration will refers to the provided file path

Parameters:

passwordFilePath - Path of the password

Returns:

A Security.PasswordProvider to use when creating a setup component

Throws:

com.forgerock.opendj.cli.ArgumentException - If the provided file does not exists or cannot be read

fileBasedKeyStore

public static Security.KeyStoreModel fileBasedKeyStore(String keyStoreType,
 String keyStorePath,
 Security.PasswordProvider passwordProvider,
 KeyManagers.SecurityProvider securityProvider)

Specifies keystore data to use to secure the server instance to setup.

If the keystore contains multiple aliases, aliases which should be used by the server must be listed as follow:

Security.fileBasedKeyStore("PKCS12",
                           "/path/to/keystore",
                           Security.clearTextStorePassword("somesecretphrase"),
                           securityProvider)
        .addCertificateAliases("example-com", "foo-com");

The unprotected() provider is not allowed to be used with this method.

Parameters:

keyStoreType - The keystore type (see KeyManagers.JKS, KeyManagers.JCEKS, KeyManagers.PKCS12, etc.)

keyStorePath - The keystore path

passwordProvider - The strategy to use to provide the keystore password

securityProvider - The key store file provider to use when loading the keystore. May be null to use the default.

Returns:

The created Security.KeyStoreModel object to use in Setup.useExistingCertificatesForTls(Security.KeyStoreModel, Security.TrustStoreModel)

Throws:

IllegalArgumentException - If the unprotected() password provider is used with this method

fileBasedKeyStore

public static Security.KeyStoreModel fileBasedKeyStore(String keyStoreType,
 Path keyStorePath,
 Security.PasswordProvider passwordProvider,
 KeyManagers.SecurityProvider securityProvider)

Specifies keystore data to use to secure the server instance to setup.

If the keystore contains multiple aliases, aliases which should be used by the server must be listed as follow:

Security.fileBasedKeyStore("PKCS12",
                           "/path/to/keystore",
                           Security.clearTextStorePassword("somesecretphrase"),
                           securityProvider)
        .addCertificateAliases("example-com", "foo-com");

The unprotected() provider is not allowed to be used with this method.

Parameters:

keyStoreType - The keystore type (see KeyManagers.JKS, KeyManagers.JCEKS, KeyManagers.PKCS12, etc.)

keyStorePath - The keystore path

passwordProvider - The strategy to use to provide the keystore password

securityProvider - The key store file provider to use when loading the keystore. May be null to use the default.

Returns:

The created Security.KeyStoreModel object to use in Setup.useExistingCertificatesForTls(Security.KeyStoreModel, Security.TrustStoreModel)

Throws:

IllegalArgumentException - If the unprotected() password provider is used with this method

pkcs11KeyStore

public static Security.KeyStoreModel pkcs11KeyStore(Security.PasswordProvider passwordProvider,
 KeyManagers.SecurityProvider securityProvider)

Specifies keystore data to use to secure the server instance to setup.

If the keystore contains multiple aliases, aliases which should be used by the server must be listed as follow: Security.pkcs11KeyStore(Security.clearTextStorePassword("somesecretphrase")) .addCertificateAliases("example-com", "foo-com");

Parameters:

passwordProvider - The strategy to use to provide the keystore password

securityProvider - The key store file provider to use when loading the keystore. May be null to use the default.

Returns:

The created Security.KeyStoreModel object to use in Setup.useExistingCertificatesForTls(Security.KeyStoreModel, Security.TrustStoreModel)

fileBasedTrustStore

public static Security.TrustStoreModel fileBasedTrustStore(String trustStoreType,
 Path trustStorePath,
 Security.PasswordProvider passwordProvider,
 KeyManagers.SecurityProvider securityProvider)
                                                    throws com.forgerock.opendj.cli.ArgumentException

Returns a file based Security.TrustStoreModel.

Parameters:

trustStoreType - The type of the truststore (JKS, JCE, PCKS12, etc.)

trustStorePath - JKS truststore file path

passwordProvider - The strategy to use to provide the truststore password

securityProvider - The key store file provider to use when loading the truststore. May be null to use the default provider.

Returns:

A Security.TrustStoreModel which represents a truststore file.

Throws:

com.forgerock.opendj.cli.ArgumentException - If the file based JKS truststore cannot be loaded

See Also:

• Setup.useExistingCertificatesForTls(KeyStoreModel, TrustStoreModel)

pkcs11TrustStore

public static Security.TrustStoreModel pkcs11TrustStore(Security.PasswordProvider passwordProvider,
 KeyManagers.SecurityProvider securityProvider)
                                                 throws com.forgerock.opendj.cli.ArgumentException

Returns a PKCS#11 based Security.TrustStoreModel.

Parameters:

passwordProvider - The strategy to use to provide the truststore password

securityProvider - The key store file provider to use when loading the truststore. May be null to use the default provider.

Returns:

A Security.TrustStoreModel which represents a PKCS#11 truststore.

Throws:

com.forgerock.opendj.cli.ArgumentException - If the PKCS#11 truststore cannot be loaded

See Also:

• Setup.useExistingCertificatesForTls(KeyStoreModel, TrustStoreModel)

jvmTrustStore

public static Security.TrustStoreModel jvmTrustStore()

Returns a Security.TrustStoreModel which will use the JVM truststore.

Returns:

a Security.TrustStoreModel which will use the JVM truststore

blindTrust

public static Security.TrustStoreModel blindTrust()

Returns a Security.TrustStoreModel which will blindly trust all certificates.

Returns:

a Security.TrustStoreModel which will blindly trust all certificates