[MNG-5583] per endpoint support for PKI authentication #67

spyhunter99 · 2020-05-18T22:29:10Z

This change provides some additional functionality for authenticating to a maven repository that requires HTTP Client Certificate authentication as part of the SSL hand shake.

see also apache/maven-resolver#51
apache/maven#345

…tion settings

wagon-provider-api/src/main/java/org/apache/maven/wagon/authentication/AuthenticationInfo.java

mthmulders · 2020-05-19T06:01:23Z

wagon-provider-api/src/main/java/org/apache/maven/wagon/authentication/AuthenticationInfo.java

+     *
+     *
+     */
+    private String trustStorePassword;


This field contains a password. We must convert it to char[] later on, so can't we store it as a char[]?

The upstream model does not allow that. Given that other password fields are strings too, this is acceptable, but not ideal.

i agree with @michael-o otherwise i would have used char[]

mthmulders · 2020-05-19T06:01:28Z

wagon-provider-api/src/main/java/org/apache/maven/wagon/authentication/AuthenticationInfo.java

+     *
+     * .
+     */
+    private String keyStorePassword;


This field contains a password. We must convert it to char[] later on, so can't we store it as a char[]?

wagon-provider-api/src/main/java/org/apache/maven/wagon/authentication/AuthenticationInfo.java

...on-http-shared/src/main/java/org/apache/maven/wagon/shared/http/AbstractHttpClientWagon.java

mthmulders · 2020-05-19T06:07:23Z

...on-http-shared/src/main/java/org/apache/maven/wagon/shared/http/AbstractHttpClientWagon.java

+                            alias = null;
+                        }
+                    } 
+                    else if ( keystore.containsAlias( alias.toLowerCase() ) ) 


Why this additional check on the lower-cased variant?

this was borrowed from tomcat's code base, apparently in certain situational, key aliases are case folded. i've never seen it in the wild either, it's always been case sensitive but i figured there was a reason for this. lmk if you want it stricken from the record

here's the link
https://github.com/apache/tomcat/blob/a6aad15a470f6f69bcc58c53729dc4e787a536ed/java/org/apache/tomcat/util/net/SSLUtilBase.java#L371

...on-http-shared/src/main/java/org/apache/maven/wagon/shared/http/AbstractHttpClientWagon.java

wagon-provider-api/src/main/java/org/apache/maven/wagon/authentication/AuthenticationInfo.java

wagon-provider-api/src/main/java/org/apache/maven/wagon/AbstractWagon.java

wagon-provider-api/src/main/java/org/apache/maven/wagon/authentication/AuthenticationInfo.java

michael-o · 2020-05-19T20:41:32Z

wagon-provider-api/src/main/java/org/apache/maven/wagon/authentication/AuthenticationInfo.java

+     *
+     *
+     */
+    private String trustStorePassword;


The upstream model does not allow that. Given that other password fields are strings too, this is acceptable, but not ideal.

...on-http-shared/src/main/java/org/apache/maven/wagon/shared/http/AbstractHttpClientWagon.java

spyhunter99 · 2020-05-20T00:41:51Z

FYI i'm going to try and add some new unit tests for this to have a more reproducible setup rather than the hacked up sonatype nexus server i'm testing against

wagon-provider-api/src/main/java/org/apache/maven/wagon/repository/Repository.java

...on-http-shared/src/main/java/org/apache/maven/wagon/shared/http/AbstractHttpClientWagon.java

spyhunter99 · 2020-05-21T22:25:22Z

regarding unit tests, whats the difference between the regular http wagon and the light weight version?

michael-o · 2020-05-21T22:48:34Z

regarding unit tests, whats the difference between the regular http wagon and the light weight version?

Bad naming. HttpWagon uses Apache HttpClient, LightweightClient uses HttpURLConnection.

spyhunter99 · 2020-05-22T00:18:26Z

regarding unit tests, whats the difference between the regular http wagon and the light weight version?

Bad naming. HttpWagon uses Apache HttpClient, LightweightClient uses HttpURLConnection.

perhaps i asked the wrong question. In what context is the lightweight version used vs the httpwagon version? i'm trying to figure out if i need to (or should) add the pki support mechanisms to the lightweight setup

…address additional pr issues

michael-o · 2020-05-22T07:08:56Z

regarding unit tests, whats the difference between the regular http wagon and the light weight version?

Bad naming. HttpWagon uses Apache HttpClient, LightweightClient uses HttpURLConnection.

perhaps i asked the wrong question. In what context is the lightweight version used vs the httpwagon version? i'm trying to figure out if i need to (or should) add the pki support mechanisms to the lightweight setup

Not in Maven itself. It is a user desicion to swap the HTTP client backend for Wagon. The LightweightWagon has flaws as documented in JIRA.

spyhunter99 · 2020-05-24T20:58:13Z

anything else that needs to changed on this PR?

mthmulders · 2020-05-25T06:35:17Z

...iders/wagon-http-shared/src/main/java/org/apache/maven/wagon/shared/http/JSSEKeyManager.java

+import javax.net.ssl.X509KeyManager;
+
+/**
+ * This was borrowed from Apache Tomcat


Does Tomcat also have a unit test for this class? If so, I think we might want to borrow that as well.

Doesn't look like it. I'll see if I can whip one up. The purpose of the class is to force a selection for a specific certificate. The default JRE implementation will pick the first key pair that matches the server's criteria as part of the hand shake. If you have more than one that matches the criteria but only a specific one will allow access, you're hosed.

actually i'm glad you brought this up, definitely needs a test case. I shouldn't have copied tomcat's code without reading the details. It's purpose is to select the server certificate to for when a single tomcat server hosts multiple domains all in the same key store. We actually need the opposite, client certificate selection.

...ders/wagon-http-lightweight/src/test/java/org/apache/maven/wagon/providers/http/TckTest.java

michael-o · 2020-05-25T09:41:08Z

Since this is a massive change, I have to complete the current Wagon release first and then will pick this up in June.

spyhunter99 added 2 commits May 17, 2020 11:07

MGN-5593 adds key manager from tomcat and new repo specific configura…

6861204

…tion settings

MNG-5583 commit for supporting PKI authentication to nexus repositories.

77e8c6e

spyhunter99 mentioned this pull request May 18, 2020

MNG-5583 per endpoint support for PKI authentication to maven repos apache/maven-resolver#51

Closed

MNG-5583 resolves check styles issues and a NPE

0c21172

mthmulders reviewed May 19, 2020

View reviewed changes

wagon-provider-api/src/main/java/org/apache/maven/wagon/authentication/AuthenticationInfo.java Outdated Show resolved Hide resolved

mthmulders reviewed May 19, 2020

View reviewed changes

wagon-provider-api/src/main/java/org/apache/maven/wagon/authentication/AuthenticationInfo.java Show resolved Hide resolved

mthmulders reviewed May 19, 2020

View reviewed changes

...on-http-shared/src/main/java/org/apache/maven/wagon/shared/http/AbstractHttpClientWagon.java Outdated Show resolved Hide resolved

mthmulders reviewed May 19, 2020

View reviewed changes

...on-http-shared/src/main/java/org/apache/maven/wagon/shared/http/AbstractHttpClientWagon.java Outdated Show resolved Hide resolved

mthmulders reviewed May 19, 2020

View reviewed changes

...on-http-shared/src/main/java/org/apache/maven/wagon/shared/http/AbstractHttpClientWagon.java Outdated Show resolved Hide resolved

mthmulders reviewed May 19, 2020

View reviewed changes

wagon-provider-api/src/main/java/org/apache/maven/wagon/authentication/AuthenticationInfo.java Outdated Show resolved Hide resolved

spyhunter99 mentioned this pull request May 19, 2020

MNG-5583 new feature PKI authentication to nexus repositories apache/maven#345

Closed

8 tasks

michael-o requested changes May 19, 2020

View reviewed changes

MNG-5583 addressing most of the PR issues

842d279

mthmulders reviewed May 20, 2020

View reviewed changes

wagon-provider-api/src/main/java/org/apache/maven/wagon/repository/Repository.java Outdated Show resolved Hide resolved

mthmulders reviewed May 20, 2020

View reviewed changes

...on-http-shared/src/main/java/org/apache/maven/wagon/shared/http/AbstractHttpClientWagon.java Outdated Show resolved Hide resolved

spyhunter99 added 2 commits May 21, 2020 20:33

MNG-5583 adds a unit test suite for PKI authentication scenarios and …

96d88de

…address additional pr issues

MNG-5583 more pr issues

eb2fedd

mthmulders reviewed May 25, 2020

View reviewed changes

...ders/wagon-http-lightweight/src/test/java/org/apache/maven/wagon/providers/http/TckTest.java Outdated Show resolved Hide resolved

MNG-5583 removing unused import

a10301c

elharo changed the title ~~Feature/MNG-5583 per endpoint support for PKI authentication~~ [MNG-5583] per endpoint support for PKI authentication Feb 18, 2021

This pull request was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[MNG-5583] per endpoint support for PKI authentication #67

[MNG-5583] per endpoint support for PKI authentication #67

spyhunter99 commented May 18, 2020 •

edited

mthmulders May 19, 2020

michael-o May 19, 2020

spyhunter99 May 22, 2020

mthmulders May 19, 2020

mthmulders May 19, 2020

spyhunter99 May 19, 2020 •

edited

spyhunter99 May 22, 2020

michael-o May 19, 2020

spyhunter99 commented May 20, 2020

spyhunter99 commented May 21, 2020

michael-o commented May 21, 2020

spyhunter99 commented May 22, 2020

michael-o commented May 22, 2020

spyhunter99 commented May 24, 2020

mthmulders May 25, 2020

spyhunter99 May 25, 2020 •

edited

spyhunter99 May 25, 2020

michael-o commented May 25, 2020

[MNG-5583] per endpoint support for PKI authentication #67

[MNG-5583] per endpoint support for PKI authentication #67

Conversation

spyhunter99 commented May 18, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

spyhunter99 May 19, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

spyhunter99 commented May 20, 2020

spyhunter99 commented May 21, 2020

michael-o commented May 21, 2020

spyhunter99 commented May 22, 2020

michael-o commented May 22, 2020

spyhunter99 commented May 24, 2020

Choose a reason for hiding this comment

spyhunter99 May 25, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

michael-o commented May 25, 2020

spyhunter99 commented May 18, 2020 •

edited

spyhunter99 May 19, 2020 •

edited

spyhunter99 May 25, 2020 •

edited