Package org.keycloak.common.crypto

Interface CryptoProvider

All Known Implementing Classes:

AuthzClientCryptoProvider

public interface CryptoProvider

Abstraction to handle differences between the APIs for non-fips and fips mode

Author:

Marek Posolda

Method Summary

Modifier and Type	Method	Description
ECParameterSpec	createECParams(String curveName)	Create the param spec for the EC curve
Cipher	getAesCbcCipher()
Cipher	getAesGcmCipher()
<T> T	getAlgorithmProvider(Class<T> clazz, String algorithm)	Get some algorithm provider implementation.
Provider	getBouncyCastleProvider()
CertificateUtilsProvider	getCertificateUtils()	Get CertificateUtils implementation.
CertPathBuilder	getCertPathBuilder()
CertStore	getCertStore(CollectionCertStoreParameters collectionCertStoreParameters)
ECDSACryptoProvider	getEcdsaCryptoProvider()
UserIdentityExtractorProvider	getIdentityExtractorProvider()
KeyFactory	getKeyFactory(String algorithm)
KeyPairGenerator	getKeyPairGen(String algorithm)
KeyStore	getKeyStore(KeystoreUtil.KeystoreFormat format)
<T> T	getOCSPProver(Class<T> clazz)
PemUtilsProvider	getPemUtils()	Get PEMUtils implementation.
SecretKeyFactory	getSecretKeyFact(String keyAlgorithm)
Signature	getSignature(String sigAlgName)
default Stream<KeystoreUtil.KeystoreFormat>	getSupportedKeyStoreTypes()
default String[]	getSupportedRsaKeySizes()
CertificateFactory	getX509CertFactory()
int	order()	Order of this provider.
SSLSocketFactory	wrapFactoryForTruststore(SSLSocketFactory delegate)	Wrap given SSLSocketFactory and decorate it with some additional functionality.

Method Details

getBouncyCastleProvider

Provider getBouncyCastleProvider()

Returns:

BouncyCastle security provider. Can be either non-FIPS or FIPS based provider

order

int order()

Order of this provider. This allows to specify which CryptoProvider will have preference in case that more of them are on the classpath. The higher number has preference over the lower number

getAlgorithmProvider

<T> T getAlgorithmProvider(Class<T> clazz,
 String algorithm)

Get some algorithm provider implementation. Returned implementation can be dependent according to if we have non-fips bouncycastle or fips bouncycastle on the classpath.

Parameters:

clazz - Returned class.

algorithm - Type of the algorithm, which we want to return

Returns:

getCertificateUtils

CertificateUtilsProvider getCertificateUtils()

Get CertificateUtils implementation. Returned implementation can be dependent according to if we have non-fips bouncycastle or fips bouncycastle on the classpath.

Returns:

getPemUtils

PemUtilsProvider getPemUtils()

Get PEMUtils implementation. Returned implementation can be dependent according to if we have non-fips bouncycastle or fips bouncycastle on the classpath.

Returns:

getOCSPProver

<T> T getOCSPProver(Class<T> clazz)

getIdentityExtractorProvider

UserIdentityExtractorProvider getIdentityExtractorProvider()

getEcdsaCryptoProvider

ECDSACryptoProvider getEcdsaCryptoProvider()

createECParams

ECParameterSpec createECParams(String curveName)

Create the param spec for the EC curve

Parameters:

curveName -

Returns:

getKeyPairGen

KeyPairGenerator getKeyPairGen(String algorithm)
                        throws NoSuchAlgorithmException,
NoSuchProviderException

Throws:

NoSuchAlgorithmException

NoSuchProviderException

getKeyFactory

KeyFactory getKeyFactory(String algorithm)
                  throws NoSuchAlgorithmException,
NoSuchProviderException

Throws:

NoSuchAlgorithmException

NoSuchProviderException

getAesCbcCipher

Cipher getAesCbcCipher()
                throws NoSuchAlgorithmException,
NoSuchProviderException,
NoSuchPaddingException

Throws:

NoSuchAlgorithmException

NoSuchProviderException

NoSuchPaddingException

getAesGcmCipher

Cipher getAesGcmCipher()
                throws NoSuchAlgorithmException,
NoSuchProviderException,
NoSuchPaddingException

Throws:

NoSuchAlgorithmException

NoSuchProviderException

NoSuchPaddingException

getSecretKeyFact

SecretKeyFactory getSecretKeyFact(String keyAlgorithm)
                           throws NoSuchAlgorithmException,
NoSuchProviderException

Throws:

NoSuchAlgorithmException

NoSuchProviderException

getKeyStore

KeyStore getKeyStore(KeystoreUtil.KeystoreFormat format)
              throws KeyStoreException,
NoSuchProviderException

Throws:

KeyStoreException

NoSuchProviderException

getSupportedKeyStoreTypes

default Stream<KeystoreUtil.KeystoreFormat> getSupportedKeyStoreTypes()

Returns:

Keystore types/algorithms supported by this CryptoProvider

getX509CertFactory

CertificateFactory getX509CertFactory()
                               throws CertificateException,
NoSuchProviderException

Throws:

CertificateException

NoSuchProviderException

getCertStore

CertStore getCertStore(CollectionCertStoreParameters collectionCertStoreParameters)
                throws InvalidAlgorithmParameterException,
NoSuchAlgorithmException,
NoSuchProviderException

Throws:

InvalidAlgorithmParameterException

NoSuchAlgorithmException

NoSuchProviderException

getCertPathBuilder

CertPathBuilder getCertPathBuilder()
                            throws NoSuchAlgorithmException,
NoSuchProviderException

Throws:

NoSuchAlgorithmException

NoSuchProviderException

getSignature

Signature getSignature(String sigAlgName)
                throws NoSuchAlgorithmException,
NoSuchProviderException

Throws:

NoSuchAlgorithmException

NoSuchProviderException

wrapFactoryForTruststore

SSLSocketFactory wrapFactoryForTruststore(SSLSocketFactory delegate)

Wrap given SSLSocketFactory and decorate it with some additional functionality. This method is used in the context of truststore (where Keycloak is SSL client)

Parameters:

delegate - The original factory to wrap. Usually default java SSLSocketFactory

Returns:

decorated factory

getSupportedRsaKeySizes

default String[] getSupportedRsaKeySizes()

Returns:

Allowed key sizes of RSA key modulus, which this cryptoProvider supports