Class KeyStoreSecretStore

java.lang.Object
org.forgerock.secrets.keystore.KeyStoreSecretStore
All Implemented Interfaces:
SecretStore<Secret>

public class KeyStoreSecretStore extends Object implements SecretStore<Secret>
A secret store for cryptographic keys based on a standard Java KeyStore. Typically this will either be a file-based PKCS#12 keystore or a PKCS#11 Hardware Security Module (HSM). Legacy proprietary key store formats such as JKS and JCEKS are also supported, but should not be used for any new functionality as they implement weak encryption and integrity protection mechanisms.

The password for the keystore and for all entries within the keystore can be provided as a GenericSecret allowing it to come from another secrets backend, such as an environment variable, encrypted file, KMS, etc.

  • Constructor Details

  • Method Details

    • setKeysForPurposes

      public void setKeysForPurposes(Map<String,List<KeyStoreSecretStore.AliasSpec>> keysForPurposes)
      Set the keys that are used for different purposes.
      Parameters:
      keysForPurposes - a map from purpose label to a list of key aliases.
    • setAliasSpecProviderForPurposes

      public void setAliasSpecProviderForPurposes(Map<String,KeyStoreSecretStore.AliasSpecProvider> keysForPurposes)
      Set the keys that are used for different purposes.
      Parameters:
      keysForPurposes - a map from purpose label to a provider of aliases.
    • rotate

      public void rotate(Purpose<? extends Secret> purpose, String newAlias)
      Rotates the key associated with a given purpose.
      Specified by:
      rotate in interface SecretStore<Secret>
      Parameters:
      purpose - the purpose to install a new key for.
      newAlias - the new key alias.
    • retire

      public void retire(Purpose<? extends Secret> purpose, String oldAlias)
      Retires a key previously used for a given purpose. The key will no longer be used for that purpose.
      Specified by:
      retire in interface SecretStore<Secret>
      Parameters:
      purpose - the key purpose.
      oldAlias - the key alias.
    • revoke

      public void revoke(String alias)
      Revokes a key from all purposes. The given key will no longer be usable for any purpose within this store.
      Specified by:
      revoke in interface SecretStore<Secret>
      Parameters:
      alias - the alias to remove.
    • getStoredType

      public Class<Secret> getStoredType()
      Description copied from interface: SecretStore
      The top-level class that this store is capable of storing. This is a reification of the type parameter and can be used to lookup stores for a given type.
      Specified by:
      getStoredType in interface SecretStore<Secret>
      Returns:
      the top-most type that this store is capable of storing, typically either CryptoKey for key-stores, GenericSecret for password stores, or Secret if the store is capable of storing any type of secret.
    • refresh

      public void refresh()
      Description copied from interface: SecretStore
      Indicates that the store should refresh its secrets from the backing storage mechanism. This can be used to cause reload of a store after a secret rotation if the backend does not automatically detect such changes. Refresh may be an asynchronous operation and no guarantees are made about when clients of this secret store may see updated secrets after a call to refresh.
      Specified by:
      refresh in interface SecretStore<Secret>
    • getActive

      public <S extends Secret> Promise<S,NoSuchSecretException> getActive(Purpose<S> purpose)
      Description copied from interface: SecretStore
      Returns the active secret for the given purpose.
      Specified by:
      getActive in interface SecretStore<Secret>
      Type Parameters:
      S - the type of secret.
      Parameters:
      purpose - the purpose for which a secret is required.
      Returns:
      the active secret from this store.
    • getNamed

      public <S extends Secret> Promise<S,NoSuchSecretException> getNamed(Purpose<S> purpose, String id)
      Description copied from interface: SecretStore
      Returns the named secret from this store. The default implementation calls SecretStore.getValid(Purpose) and then returns the first valid key with a matching stable ID.
      Specified by:
      getNamed in interface SecretStore<Secret>
      Type Parameters:
      S - the type of secret.
      Parameters:
      purpose - the secret purpose.
      id - the name (stable id) of the secret.
      Returns:
      a promise for the named secret, or a NoSuchSecretException promise if no such secret exists.
    • getValid

      public <S extends Secret> Promise<Stream<S>,NeverThrowsException> getValid(Purpose<S> purpose)
      Description copied from interface: SecretStore
      Returns all valid secrets for the given purpose from this store.
      Specified by:
      getValid in interface SecretStore<Secret>
      Type Parameters:
      S - the type of secret.
      Parameters:
      purpose - the purpose.
      Returns:
      a stream of all valid secrets of the given type from this store, or an empty stream if none exist.
    • toString

      public String toString()
      Overrides:
      toString in class Object