test_class.declarator: BOUNCY_CASTLE_PROVIDER = new BouncyCastleProvider()
test_class.modifier: private static final
test_class.original_string: private static final BouncyCastleProvider BOUNCY_CASTLE_PROVIDER = new BouncyCastleProvider();
test_class.type: BouncyCastleProvider
test_class.var_name: BOUNCY_CASTLE_PROVIDER
test_class.file: services/src/test/java/org/keycloak/authentication/authenticators/x509/CertificateValidatorTest.java
test_class.identifier: CertificateValidatorTest
test_case.body: @Test
      public void testValidityOfCertificatesHasExpired() throws GeneralSecurityException {
          KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
          kpg.initialize(512);
          KeyPair keyPair = kpg.generateKeyPair();
          X509Certificate certificate =
              createCertificate("CN=keycloak-test", new Date(System.currentTimeMillis() - 1000L * 60 * 2),
                  new Date(System.currentTimeMillis() - 1000L * 60), keyPair);
  
          CertificateValidator.CertificateValidatorBuilder builder =
              new CertificateValidator.CertificateValidatorBuilder();
          CertificateValidator validator = builder.build(new X509Certificate[] { certificate });
          try {
              validator.validateTimestamps(true);
              Assert.fail("certificate validation must fail for certificate has expired");
          } catch (Exception ex) {
              MatcherAssert.assertThat(ex.getMessage(), Matchers.containsString("has expired"));
              Assert.assertEquals(GeneralSecurityException.class, ex.getClass());
          }
      }
test_case.class_method_signature: CertificateValidatorTest.testValidityOfCertificatesHasExpired()
test_case.full_signature: @Test public void testValidityOfCertificatesHasExpired()
test_case.identifier: testValidityOfCertificatesHasExpired
test_case.invocations: getInstance initialize generateKeyPair createCertificate currentTimeMillis currentTimeMillis build validateTimestamps fail assertThat getMessage containsString assertEquals getClass
test_case.modifiers: @Test public
test_case.parameters: ()
test_case.return: void
test_case.signature: void testValidityOfCertificatesHasExpired()
focal_class.declarator: logger = ServicesLogger.LOGGER
focal_class.modifier: private static final
focal_class.original_string: private static final ServicesLogger logger = ServicesLogger.LOGGER;
focal_class.type: ServicesLogger
focal_class.var_name: logger
focal_class.declarator: session
focal_class.original_string: KeycloakSession session;
focal_class.type: KeycloakSession
focal_class.var_name: session
focal_class.declarator: _certChain
focal_class.original_string: X509Certificate[] _certChain;
focal_class.type: X509Certificate[]
focal_class.var_name: _certChain
focal_class.declarator: _keyUsageBits
focal_class.original_string: int _keyUsageBits;
focal_class.type: int
focal_class.var_name: _keyUsageBits
focal_class.declarator: _extendedKeyUsage
focal_class.original_string: List<String> _extendedKeyUsage;
focal_class.type: List<String>
focal_class.var_name: _extendedKeyUsage
focal_class.declarator: _crlCheckingEnabled
focal_class.original_string: boolean _crlCheckingEnabled;
focal_class.type: boolean
focal_class.var_name: _crlCheckingEnabled
focal_class.declarator: _crldpEnabled
focal_class.original_string: boolean _crldpEnabled;
focal_class.type: boolean
focal_class.var_name: _crldpEnabled
focal_class.declarator: _crlLoader
focal_class.original_string: CRLLoaderImpl _crlLoader;
focal_class.type: CRLLoaderImpl
focal_class.var_name: _crlLoader
focal_class.declarator: _ocspEnabled
focal_class.original_string: boolean _ocspEnabled;
focal_class.type: boolean
focal_class.var_name: _ocspEnabled
focal_class.declarator: ocspChecker
focal_class.original_string: OCSPChecker ocspChecker;
focal_class.type: OCSPChecker
focal_class.var_name: ocspChecker
focal_class.file: services/src/main/java/org/keycloak/authentication/authenticators/x509/CertificateValidator.java
focal_class.identifier: CertificateValidator
focal_class.class_method_signature: CertificateValidator.CertificateValidator()
focal_class.full_signature: public  CertificateValidator()
focal_class.identifier: CertificateValidator
focal_class.modifiers: public
focal_class.parameters: ()
focal_class.signature:  CertificateValidator()
focal_class.class_method_signature: CertificateValidator.CertificateValidator(X509Certificate[] certChain,
                           int keyUsageBits, List<String> extendedKeyUsage,
                                     boolean cRLCheckingEnabled,
                                     boolean cRLDPCheckingEnabled,
                                     CRLLoaderImpl crlLoader,
                                     boolean oCSPCheckingEnabled,
                                     OCSPChecker ocspChecker,
                                     KeycloakSession session)
focal_class.full_signature: protected  CertificateValidator(X509Certificate[] certChain,
                           int keyUsageBits, List<String> extendedKeyUsage,
                                     boolean cRLCheckingEnabled,
                                     boolean cRLDPCheckingEnabled,
                                     CRLLoaderImpl crlLoader,
                                     boolean oCSPCheckingEnabled,
                                     OCSPChecker ocspChecker,
                                     KeycloakSession session)
focal_class.identifier: CertificateValidator
focal_class.modifiers: protected
focal_class.parameters: (X509Certificate[] certChain,
                           int keyUsageBits, List<String> extendedKeyUsage,
                                     boolean cRLCheckingEnabled,
                                     boolean cRLDPCheckingEnabled,
                                     CRLLoaderImpl crlLoader,
                                     boolean oCSPCheckingEnabled,
                                     OCSPChecker ocspChecker,
                                     KeycloakSession session)
focal_class.signature:  CertificateValidator(X509Certificate[] certChain,
                           int keyUsageBits, List<String> extendedKeyUsage,
                                     boolean cRLCheckingEnabled,
                                     boolean cRLDPCheckingEnabled,
                                     CRLLoaderImpl crlLoader,
                                     boolean oCSPCheckingEnabled,
                                     OCSPChecker ocspChecker,
                                     KeycloakSession session)
focal_class.class_method_signature: CertificateValidator.validateKeyUsage(X509Certificate[] certs, int expected)
focal_class.full_signature: private static void validateKeyUsage(X509Certificate[] certs, int expected)
focal_class.identifier: validateKeyUsage
focal_class.modifiers: private static
focal_class.parameters: (X509Certificate[] certs, int expected)
focal_class.return: void
focal_class.signature: void validateKeyUsage(X509Certificate[] certs, int expected)
focal_class.class_method_signature: CertificateValidator.validateExtendedKeyUsage(X509Certificate[] certs, List<String> expectedEKU)
focal_class.full_signature: private static void validateExtendedKeyUsage(X509Certificate[] certs, List<String> expectedEKU)
focal_class.identifier: validateExtendedKeyUsage
focal_class.modifiers: private static
focal_class.parameters: (X509Certificate[] certs, List<String> expectedEKU)
focal_class.return: void
focal_class.signature: void validateExtendedKeyUsage(X509Certificate[] certs, List<String> expectedEKU)
focal_class.class_method_signature: CertificateValidator.validateKeyUsage()
focal_class.full_signature: public CertificateValidator validateKeyUsage()
focal_class.identifier: validateKeyUsage
focal_class.modifiers: public
focal_class.parameters: ()
focal_class.return: CertificateValidator
focal_class.signature: CertificateValidator validateKeyUsage()
focal_class.class_method_signature: CertificateValidator.validateExtendedKeyUsage()
focal_class.full_signature: public CertificateValidator validateExtendedKeyUsage()
focal_class.identifier: validateExtendedKeyUsage
focal_class.modifiers: public
focal_class.parameters: ()
focal_class.return: CertificateValidator
focal_class.signature: CertificateValidator validateExtendedKeyUsage()
focal_class.class_method_signature: CertificateValidator.validateTimestamps(boolean isValidationEnabled)
focal_class.full_signature: public CertificateValidator validateTimestamps(boolean isValidationEnabled)
focal_class.identifier: validateTimestamps
focal_class.modifiers: public
focal_class.parameters: (boolean isValidationEnabled)
focal_class.return: CertificateValidator
focal_class.signature: CertificateValidator validateTimestamps(boolean isValidationEnabled)
focal_class.class_method_signature: CertificateValidator.findCAInTruststore(X500Principal issuer)
focal_class.full_signature: private X509Certificate findCAInTruststore(X500Principal issuer)
focal_class.identifier: findCAInTruststore
focal_class.modifiers: private
focal_class.parameters: (X500Principal issuer)
focal_class.return: X509Certificate
focal_class.signature: X509Certificate findCAInTruststore(X500Principal issuer)
focal_class.class_method_signature: CertificateValidator.checkRevocationUsingOCSP(X509Certificate[] certs)
focal_class.full_signature: private void checkRevocationUsingOCSP(X509Certificate[] certs)
focal_class.identifier: checkRevocationUsingOCSP
focal_class.modifiers: private
focal_class.parameters: (X509Certificate[] certs)
focal_class.return: void
focal_class.signature: void checkRevocationUsingOCSP(X509Certificate[] certs)
focal_class.class_method_signature: CertificateValidator.checkRevocationStatusUsingCRL(X509Certificate[] certs, CRLLoaderImpl crLoader, KeycloakSession session)
focal_class.full_signature: private static void checkRevocationStatusUsingCRL(X509Certificate[] certs, CRLLoaderImpl crLoader, KeycloakSession session)
focal_class.identifier: checkRevocationStatusUsingCRL
focal_class.modifiers: private static
focal_class.parameters: (X509Certificate[] certs, CRLLoaderImpl crLoader, KeycloakSession session)
focal_class.return: void
focal_class.signature: void checkRevocationStatusUsingCRL(X509Certificate[] certs, CRLLoaderImpl crLoader, KeycloakSession session)
focal_class.class_method_signature: CertificateValidator.getCRLDistributionPoints(X509Certificate cert)
focal_class.full_signature: private static List<String> getCRLDistributionPoints(X509Certificate cert)
focal_class.identifier: getCRLDistributionPoints
focal_class.modifiers: private static
focal_class.parameters: (X509Certificate cert)
focal_class.return: List<String>
focal_class.signature: List<String> getCRLDistributionPoints(X509Certificate cert)
focal_class.class_method_signature: CertificateValidator.checkRevocationStatusUsingCRLDistributionPoints(X509Certificate[] certs, KeycloakSession session)
focal_class.full_signature: private static void checkRevocationStatusUsingCRLDistributionPoints(X509Certificate[] certs, KeycloakSession session)
focal_class.identifier: checkRevocationStatusUsingCRLDistributionPoints
focal_class.modifiers: private static
focal_class.parameters: (X509Certificate[] certs, KeycloakSession session)
focal_class.return: void
focal_class.signature: void checkRevocationStatusUsingCRLDistributionPoints(X509Certificate[] certs, KeycloakSession session)
focal_class.class_method_signature: CertificateValidator.checkRevocationStatus()
focal_class.full_signature: public CertificateValidator checkRevocationStatus()
focal_class.identifier: checkRevocationStatus
focal_class.modifiers: public
focal_class.parameters: ()
focal_class.return: CertificateValidator
focal_class.signature: CertificateValidator checkRevocationStatus()
focal_method.body: public CertificateValidator validateTimestamps(boolean isValidationEnabled) throws GeneralSecurityException {
          if (!isValidationEnabled) {
              return this;
          }
          for (int i = 0; i < _certChain.length; i++)
          {
              X509Certificate x509Certificate = _certChain[i];
              if (x509Certificate.getNotBefore().getTime() > Time.currentTimeMillis()) {
                  String serialNumber = x509Certificate.getSerialNumber().toString(16).replaceAll("..(?!$)",
                    "$0 ");
                  String message =
                    "certificate with serialnumber '" + serialNumber
                      + "' is not valid yet: " + x509Certificate.getNotBefore().toString();
                  throw new GeneralSecurityException(message);
              }
              if (x509Certificate.getNotAfter().getTime() < Time.currentTimeMillis()) {
                  String serialNumber = x509Certificate.getSerialNumber().toString(16).replaceAll("..(?!$)",
                    "$0 ");
                  String message = "certificate with serialnumber '" + serialNumber
                                     + "' has expired on: " + x509Certificate.getNotAfter().toString();
                  throw new GeneralSecurityException(message);
              }
          }
          return this;
      }
focal_method.class_method_signature: CertificateValidator.validateTimestamps(boolean isValidationEnabled)
focal_method.full_signature: public CertificateValidator validateTimestamps(boolean isValidationEnabled)
focal_method.identifier: validateTimestamps
focal_method.invocations: getTime getNotBefore currentTimeMillis replaceAll toString getSerialNumber toString getNotBefore getTime getNotAfter currentTimeMillis replaceAll toString getSerialNumber toString getNotAfter
focal_method.modifiers: public
focal_method.parameters: (boolean isValidationEnabled)
focal_method.return: CertificateValidator
focal_method.signature: CertificateValidator validateTimestamps(boolean isValidationEnabled)