Java 类java.security.Security 实例源码

public static void main(String[] args) throws Exception {
    Provider p = Security.getProvider("SunJCE");
    for (String alg : ALGORITHMS) {
        for (int keyStrength : KEY_STRENGTHS) {
            if (keyStrength > Cipher.getMaxAllowedKeyLength(alg)) {
                // skip this if this key length is larger than what's
                // configured in the JCE jurisdiction policy files
                continue;
            }
            for (int textLength : TEXT_LENGTHS) {
                for (int AADLength : AAD_LENGTHS) {
                    Encrypt test = new Encrypt(p, alg,
                            "GCM", "NoPadding", keyStrength, textLength,
                            AADLength);
                    Cipher cipher = test.createCipher(Cipher.ENCRYPT_MODE,
                            null);
                    AlgorithmParameters params = cipher.getParameters();
                    test.doTest(params);
                    System.out.println("Test " + alg + ":"
                            + keyStrength + ":" + textLength + ":"
                            + AADLength + " passed");
                }
            }
        }
    }
}

public static void main(String[] args) throws Exception {
    Provider provider = Security.getProvider("SunJCE");
    if (provider == null) {
        throw new RuntimeException("SunJCE provider not exist");
    }
    // generate no-padding cipher with secret key
    Cipher c = Cipher.getInstance("DES/CBC/NoPadding", provider);
    KeyGenerator kgen = KeyGenerator.getInstance("DES", provider);
    SecretKey skey = kgen.generateKey();
    // this is the improperly padded plaintext

    c.init(Cipher.ENCRYPT_MODE, skey);
    // encrypt plaintext
    byte[] cipher = c.doFinal(PLAIN_TEXT);
    AlgorithmParameters params = c.getParameters();
    // generate cipher that enforces PKCS5 padding
    c = Cipher.getInstance("DES/CBC/PKCS5Padding", provider);
    c.init(Cipher.DECRYPT_MODE, skey, params);
    try {
        c.doFinal(cipher);
        throw new RuntimeException(
                "ERROR: Expected BadPaddingException not thrown");
    } catch (BadPaddingException expected) {
        out.println("Expected BadPaddingException thrown");
    }

}

public static void main(String[] args) throws Exception {
    // reserve the security properties
    String reservedSSFacProvider =
        Security.getProperty("ssl.ServerSocketFactory.provider");

    try {
        Security.setProperty("ssl.ServerSocketFactory.provider", "oops");
        ServerSocketFactory ssocketFactory =
                    SSLServerSocketFactory.getDefault();
        SSLServerSocket sslServerSocket =
                    (SSLServerSocket)ssocketFactory.createServerSocket();
    } catch (Exception e) {
        if (!(e.getCause() instanceof ClassNotFoundException)) {
            throw e;
        }
        // get the expected exception
    } finally {
        // restore the security properties
        if (reservedSSFacProvider == null) {
            reservedSSFacProvider = "";
        }
        Security.setProperty("ssl.ServerSocketFactory.provider",
                                                reservedSSFacProvider);
    }
}

public static b a(String str) {
    HttpParams basicHttpParams = new BasicHttpParams();
    HttpProtocolParams.setVersion(basicHttpParams, HttpVersion.HTTP_1_1);
    HttpProtocolParams.setUseExpectContinue(basicHttpParams, false);
    HttpConnectionParams.setStaleCheckingEnabled(basicHttpParams, false);
    HttpConnectionParams.setConnectionTimeout(basicHttpParams, 20000);
    HttpConnectionParams.setSoTimeout(basicHttpParams, 30000);
    HttpConnectionParams.setSocketBufferSize(basicHttpParams, 8192);
    HttpClientParams.setRedirecting(basicHttpParams, true);
    HttpClientParams.setAuthenticating(basicHttpParams, false);
    HttpProtocolParams.setUserAgent(basicHttpParams, str);
    SchemeRegistry schemeRegistry = new SchemeRegistry();
    schemeRegistry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80));
    schemeRegistry.register(new Scheme(com.alipay.sdk.cons.b.a, SSLCertificateSocketFactory.getHttpSocketFactory(30000, null), WebSocket.DEFAULT_WSS_PORT));
    ClientConnectionManager threadSafeClientConnManager = new ThreadSafeClientConnManager(basicHttpParams, schemeRegistry);
    ConnManagerParams.setTimeout(basicHttpParams, 60000);
    ConnManagerParams.setMaxConnectionsPerRoute(basicHttpParams, new ConnPerRouteBean(10));
    ConnManagerParams.setMaxTotalConnections(basicHttpParams, 50);
    Security.setProperty("networkaddress.cache.ttl", "-1");
    HttpsURLConnection.setDefaultHostnameVerifier(SSLSocketFactory.STRICT_HOSTNAME_VERIFIER);
    return new b(threadSafeClientConnManager, basicHttpParams);
}

private void run() throws Exception {
    Provider[] providers = Security.getProviders();
    for (Provider p : providers) {
        String prvName = p.getName();
        if (prvName.startsWith("SunJCE")
                || prvName.startsWith("SunPKCS11-")) {
            for (String algorithm : ALGORITHM_ARR) {
                if (!runTest(p, algorithm)) {
                    throw new RuntimeException(
                            "Test failed with provider/algorithm:"
                                    + p.getName() + "/" + algorithm);
                } else {
                    out.println("Test passed with provider/algorithm:"
                            + p.getName() + "/" + algorithm);
                }
            }
        }
    }
}

/**
 * 打jre中印算法提供者列表
 */
private static void printProviders() {
    log.info("Providers List:");
    Provider[] providers = Security.getProviders();
    for (int i = 0; i < providers.length; i++) {
        log.info(i + 1 + "." + providers[i].getName());
    }
}

private void runTest(String[] args) {
    if (!KeyStore.getDefaultType().
            equalsIgnoreCase(DEFAULT_KEY_STORE_TYPE)) {
        throw new RuntimeException(String.format("Default keystore type "
                + "Expected '%s' . Actual: '%s' ", DEFAULT_KEY_STORE_TYPE,
                KeyStore.getDefaultType()));
    }
    for (String ksDefaultType : KEY_STORE_TYPES) {
        Security.setProperty("keystore.type", ksDefaultType);
        if (!KeyStore.getDefaultType().equals(ksDefaultType)) {
            throw new RuntimeException(String.format(
                    "Keystore default type value: '%s' cannot be set up via"
                    + " keystore.type "
                    + "security property, Actual: '%s'",
                    ksDefaultType, KeyStore.getDefaultType()));
        }
    }
    out.println("Test Passed");
}

public static void main(String[] args) throws Exception {

        new OneKDC(null) {
            protected byte[] processAsReq(byte[] in) throws Exception {
                kdcTouched = true;
                return super.processAsReq(in);
            }
        }.writeJAASConf();
        Security.setProperty("auth.login.defaultCallbackHandler",
                "LoginNoPass$CallbackForClient");
        System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");

        try {
            Context c;
            c = Context.fromJAAS("client");
            c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
            c.take(new byte[0]);
        } catch (Exception e) {
            e.printStackTrace(System.out);
            // OK
        }
        if (kdcTouched) {
            throw new Exception("Failed");
        }
    }

public static void main(String[] args) throws Exception {
    // reset the security property to make sure that the algorithms
    // and keys used in this test are not disabled.
    Security.setProperty("jdk.certpath.disabledAlgorithms", "MD2");
    Security.setProperty("jdk.tls.disabledAlgorithms",
            "SSLv3, RC4, DH keySize < 768");

    if (debug) {
        System.setProperty("javax.net.debug", "all");
    }

    /*
     * Get the customized arguments.
     */
    parseArguments(args);

    /*
     * Start the tests.
     */
    new ShortRSAKeyGCM();
}

static byte[] crypt(
    boolean encrypt,
    String provider,
    byte[] bytes,
    char[] password,
    String dekAlgName,
    byte[] iv)
    throws IOException
{
    Provider prov = null;
    if (provider != null)
    {
        prov = Security.getProvider(provider);
        if (prov == null)
        {
            throw new EncryptionException("cannot find provider: " + provider);
        }
    }

    return crypt(encrypt, prov, bytes, password, dekAlgName, iv);
}

public static void main(final String... args) throws IOException {
    if (args.length == 0) {
        System.out.println(USAGE);
        return;
    }

    Security.addProvider(new BouncyCastleProvider());

    try {
        execute(args);
    } catch (final RuntimeException e) {
        System.err.println(e.toString());
        e.printStackTrace(System.out);
        System.err.println(e.getMessage());
        System.exit(1);
    }
}

/**
 * Calls run(args[]).
 * exit(1) if the test fails.
 **/
public static void main(String args[]) throws Exception {
    Security.setProperty("jdk.tls.disabledAlgorithms", "");

    try {
        MAX_GET_FREE_PORT_TRIES = Integer.parseInt(System.getProperty("test.getfreeport.max.tries", "10"));
    } catch (NumberFormatException ex) {
    }

    RmiBootstrapTest manager = new RmiBootstrapTest();
    try {
        manager.run(args);
    } catch (RuntimeException r) {
        System.out.println("Test Failed: "+ r.getMessage());
        System.exit(1);
    } catch (Throwable t) {
        System.out.println("Test Failed: "+ t);
        t.printStackTrace();
        System.exit(2);
    }
    System.out.println("**** Test  RmiBootstrap Passed ****");
}

public static void main(String args[]) throws Exception {
    // reset security properties to make sure that the algorithms
    // and keys used in this test are not disabled.
    Security.setProperty("jdk.tls.disabledAlgorithms", "");
    Security.setProperty("jdk.certpath.disabledAlgorithms", "");

    if (args.length != 4) {
        System.out.println(
            "Usage: java DHEKeySizing cipher-suite " +
            "exportable(true|false)\n" +
            "    size-of-server-hello-record size-of-client-key-exchange");
        throw new Exception("Incorrect usage!");
    }

    (new DHEKeySizing()).test(args[0],
            Boolean.parseBoolean(args[1]),
            Integer.parseInt(args[2]),
            Integer.parseInt(args[3]));
    System.out.println("Test Passed.");
}

public static void main(String[] args) throws Exception {
    Provider provider = Security.getProvider("SunJCE");

    KeyGenerator kg;

    kg = KeyGenerator.getInstance("SunTlsRsaPremasterSecret", provider);

    try {
        kg.generateKey();
        throw new Exception("no exception");
    } catch (IllegalStateException e) {
        System.out.println("OK: " + e);
    }

    int[] protocolVersions = {0x0300, 0x0301, 0x0302, 0x0400};
    for (int clientVersion : protocolVersions) {
        for (int serverVersion : protocolVersions) {
            test(kg, clientVersion, serverVersion);
            if (serverVersion >= clientVersion) {
                break;
            }
        }
    }

    System.out.println("Done.");
}

@Override
public void main(Provider p) throws Exception {

    /*
     * Use Solaris SPARC 11.2 or later to avoid an intermittent failure
     * when running SunPKCS11-Solaris (8044554)
     */
    if (p.getName().equals("SunPKCS11-Solaris") &&
        props.getProperty("os.name").equals("SunOS") &&
        props.getProperty("os.arch").equals("sparcv9") &&
        props.getProperty("os.version").compareTo("5.11") <= 0 &&
        getDistro().compareTo("11.2") < 0) {

        System.out.println("SunPKCS11-Solaris provider requires " +
            "Solaris SPARC 11.2 or later, skipping");
        return;
    }

    long start = System.currentTimeMillis();
    Providers.setAt(p, 1);
    try {
        String PROVIDER = p.getName();
        String javaHome = props.getProperty("java.home");
        String caCerts = javaHome + SEP + "lib" + SEP + "security" + SEP + "cacerts";
        KeyStore ks;
        try (InputStream in = new FileInputStream(caCerts)) {
            ks = KeyStore.getInstance(KeyStore.getDefaultType());
            ks.load(in, null);
        }
        for (Enumeration e = ks.aliases(); e.hasMoreElements(); ) {
            String alias = (String)e.nextElement();
            if (ks.isCertificateEntry(alias)) {
                System.out.println("* Testing " + alias + "...");
                X509Certificate cert = (X509Certificate)ks.getCertificate(alias);
                PublicKey key = cert.getPublicKey();
                String alg = key.getAlgorithm();
                if (alg.equals("RSA")) {
                    System.out.println("Signature algorithm: " + cert.getSigAlgName());
                    cert.verify(key, PROVIDER);
                } else {
                    System.out.println("Skipping cert with key: " + alg);
                }
            } else {
                System.out.println("Skipping alias " + alias);
            }
        }
        long stop = System.currentTimeMillis();
        System.out.println("All tests passed (" + (stop - start) + " ms).");
     } finally {
        Security.removeProvider(p.getName());
     }
}

/**
 * Register security provider mechanisms
 */
private void registerSaslServers() {
    // create PLAIN SaslServer builder
    PlainSaslServerBuilder plainSaslServerBuilder = new PlainSaslServerBuilder();
    saslMechanisms.put(plainSaslServerBuilder.getMechanismName(), plainSaslServerBuilder);
    // Register given Sasl Server factories
    if (Security
            .insertProviderAt(new BrokerSecurityProvider(BrokerSecurityConstants.PROVIDER_NAME, saslMechanisms), 1)
            == -1) {
        LOGGER.error("Unable to load AMQ security authentication providers.");
    } else {
        if (LOGGER.isDebugEnabled()) {
            LOGGER.debug("AMQ security authentication mechanisms providers successfully registered.");
        }
    }
}

/**
 * Set the proper security property
 * @param properties the package.* property.
 */
private final void setSecurityProperty(String properties, String packageList){
    if (System.getSecurityManager() != null){
        String definition = Security.getProperty(properties);
        if( definition != null && definition.length() > 0 ){
            if (packageList.length() > 0) {
                definition = definition + ',' + packageList;
            }
        } else {
            definition = packageList;
        }

        Security.setProperty(properties, definition);
    }
}

/**
 * Registers Bouncy Castle as first security provider before any other providers 
 * coming with the java runtime.
 * </br>ATS calls this method internally when it is supposed to be needed.
 * 
 * </br></br><b>Note:</b> This is a static operation. All working threads will be affected. 
 * The method itself is not thread-safe.
 * 
 * </br></br><b>Note:</b> It does not duplicate if already available.
 */
public static void registerBCProvider() {

    boolean needToInsert = true;
    boolean needToRemove = false;

    Provider bcProvider = new BouncyCastleProvider();
    Provider[] providers = Security.getProviders();

    for (int i = 0; i < providers.length; i++) {
        if (providers[i].getName().equalsIgnoreCase(bcProvider.getName())) {
            if (i == 0) {
                needToInsert = false;
            } else {
                needToRemove = true;
            }
            break;
        }
    }

    if (needToInsert) {
        if (needToRemove) {
            Security.removeProvider(bcProvider.getName());
        }
        Security.insertProviderAt(bcProvider, 1);

        log.info("Bouncy Castle security provider is registered as first in the list of available providers");
    }
}

/**
 * Unregisters Bouncy Castle security provider
 */
public static void unregisterBCProvider() {

    final String bcProviderName = new BouncyCastleProvider().getName();
    Provider[] providers = Security.getProviders();

    for (int i = 0; i < providers.length; i++) {
        if (providers[i].getName().equalsIgnoreCase(bcProviderName)) {
            Security.removeProvider(bcProviderName);
            log.info("Bouncy Castle security provider is unregistered from the list of available providers");
            return;
        }
    }
}

public static SSLSocketFactory createSocketFactory(
    final String caCertificateFileName, 
    final String clientCertificateFileName, 
    final String clientKeyFileName) throws Exception
{
    // Creates a TLS socket factory with the given 
    // CA certificate file, client certificate, client key
    // In this case, we are working without a client key password
    final String clientKeyPassword = "";
    try
    {
        Security.addProvider(new BouncyCastleProvider());
        final KeyManager[] keyManagers = createKeyManagerFactory(clientCertificateFileName, clientKeyFileName, clientKeyPassword).getKeyManagers();
        final TrustManager[] trustManagers = createTrustManagerFactory(caCertificateFileName).getTrustManagers();

        // Create the TLS socket factory for the desired TLS version
        final SSLContext context = SSLContext.getInstance(TLS_VERSION);

        context.init(keyManagers, trustManagers, new SecureRandom());
        //context.init(keyManagers, trustManagers, null);

        return context.getSocketFactory();          
    }
    catch (Exception e)
    {
        throw new Exception("I cannot create the TLS socket factory.", e);
    }       
}

public static void main(String[] args) throws Exception {
    // reset security properties to make sure that the algorithms
    // and keys used in this test are not disabled.
    Security.setProperty("jdk.tls.disabledAlgorithms", "");
    Security.setProperty("jdk.certpath.disabledAlgorithms", "");

    if (debug) {
        System.setProperty("javax.net.debug", "all");
    }

    ProvidersSnapshot snapshot = ProvidersSnapshot.create();
    try {
        main0(args);
    } finally {
        snapshot.restore();
    }
}

public static void main(String args[]) throws Exception {
    // MD5 is used in this test case, don't disable MD5 algorithm.
    Security.setProperty("jdk.certpath.disabledAlgorithms",
            "MD2, RSA keySize < 1024");
    Security.setProperty("jdk.tls.disabledAlgorithms",
            "SSLv3, RC4, DH keySize < 768");

    if (debug)
        System.setProperty("javax.net.debug", "all");


    /*
     * Get the customized arguments.
     */
    parseArguments(args);

    /*
     * Start the tests.
     */
    new SelfIssuedCert();
}

private static RevocationProperties getRevocationProperties() {
    return AccessController.doPrivileged(
        new PrivilegedAction<RevocationProperties>() {
            public RevocationProperties run() {
                RevocationProperties rp = new RevocationProperties();
                String onlyEE = Security.getProperty(
                    "com.sun.security.onlyCheckRevocationOfEECert");
                rp.onlyEE = onlyEE != null
                            && onlyEE.equalsIgnoreCase("true");
                String ocspEnabled = Security.getProperty("ocsp.enable");
                rp.ocspEnabled = ocspEnabled != null
                                 && ocspEnabled.equalsIgnoreCase("true");
                rp.ocspUrl = Security.getProperty("ocsp.responderURL");
                rp.ocspSubject
                    = Security.getProperty("ocsp.responderCertSubjectName");
                rp.ocspIssuer
                    = Security.getProperty("ocsp.responderCertIssuerName");
                rp.ocspSerial
                    = Security.getProperty("ocsp.responderCertSerialNumber");
                rp.crlDPEnabled
                    = Boolean.getBoolean("com.sun.security.enableCRLDP");
                return rp;
            }
        }
    );
}

public static void main(String args[]) throws Exception {
    // MD5 is used in this test case, don't disable MD5 algorithm.
    Security.setProperty(
            "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024");

    CertPath path = generateCertificatePath();
    Set<TrustAnchor> anchors = generateTrustAnchors();
    CertStore crls = generateCertificateStore();

    PKIXParameters params = new PKIXParameters(anchors);

    // add the CRL store
    params.addCertStore(crls);

    // Activate certificate revocation checking
    params.setRevocationEnabled(true);

    // Activate OCSP
    Security.setProperty("ocsp.enable", "true");
    System.setProperty("com.sun.security.enableCRLDP", "true");

    // Ensure that the ocsp.responderURL property is not set.
    if (Security.getProperty("ocsp.responderURL") != null) {
        throw new
            Exception("The ocsp.responderURL property must not be set");
    }

    CertPathValidator validator = CertPathValidator.getInstance("PKIX");

    try {
        validator.validate(path, params);
    } catch (CertPathValidatorException cpve) {
        if (cpve.getReason() != BasicReason.REVOKED) {
            throw new Exception(
                "unexpected exception, should be a REVOKED CPVE", cpve);
        }
    }
}

public static void setAt(Provider p, int pos) throws Exception {
    if (Security.getProvider(p.getName()) != null) {
        Security.removeProvider(p.getName());
    }
    if (Security.insertProviderAt(p, pos) == -1) {
        throw new Exception("cannot setAt");
    }
}

/**
 * Set the proper security property
 * @param properties the package.* property.
 */
private final void setSecurityProperty(String properties, String packageList){
    if (System.getSecurityManager() != null){
        String definition = Security.getProperty(properties);
        if( definition != null && definition.length() > 0 ){
            definition += ",";
        }

        Security.setProperty(properties,
            // FIX ME package "javax." was removed to prevent HotSpot
            // fatal internal errors
            definition + packageList);      
    }
}

/**
 * Set the proper security property
 * 
 * @param properties
 *            the package.* property.
 */
private final void setSecurityProperty(String properties, String packageList) {
    if (System.getSecurityManager() != null) {
        String definition = Security.getProperty(properties);
        if (definition != null && definition.length() > 0) {
            if (packageList.length() > 0) {
                definition = definition + ',' + packageList;
            }
        } else {
            definition = packageList;
        }

        Security.setProperty(properties, definition);
    }
}

public static void main(String arg[]) throws Exception{

        boolean failure = false;

        for (Provider p: Security.getProviders()) {
            System.out.print(p.getName() + " ");
            if (p.getVersion() != 1.8d) {
                System.out.println("failed. " + "Version received was " +
                        p.getVersion());
                failure = true;
            } else {
                System.out.println("passed.");
            }
        }

        if (failure) {
            throw new Exception("Provider(s) failed to have the expected " +
                    "version value.");
        }
    }

/**
 * Determines the boolean value of the security property whose name was
 * specified in the constructor.
 *
 * @return the <code>Boolean</code> value of the security property.
 */
public Boolean run() {
    boolean b = false;
    try {
        String value = Security.getProperty(theProp);
        b = (value != null) && value.equalsIgnoreCase("true");
    } catch (NullPointerException e) {}
    return b;
}

/**
 * Obtains the default TrustManagerFactory algorithm name.
 *
 * <p>The default TrustManager can be changed at runtime by setting
 * the value of the {@code ssl.TrustManagerFactory.algorithm}
 * security property to the desired algorithm name.
 *
 * @see java.security.Security security properties
 * @return the default algorithm name as specified by the
 * {@code ssl.TrustManagerFactory.algorithm} security property, or an
 * implementation-specific default if no such property exists.
 */
public final static String getDefaultAlgorithm() {
    String type;
    type = AccessController.doPrivileged(new PrivilegedAction<String>() {
        @Override
        public String run() {
            return Security.getProperty(
                "ssl.TrustManagerFactory.algorithm");
        }
    });
    if (type == null) {
        type = "SunX509";
    }
    return type;
}

public static void main(String args[]) throws Exception {
    // MD5 is used in this test case, don't disable MD5 algorithm.
    Security.setProperty("jdk.certpath.disabledAlgorithms",
            "MD2, RSA keySize < 1024");
    Security.setProperty("jdk.tls.disabledAlgorithms",
            "SSLv3, RC4, DH keySize < 768");

    if (debug)
        System.setProperty("javax.net.debug", "all");

    /*
     * Start the tests.
     */
    new IPIdentities();
}

/**
 * Create new provider entry through java.security file extension.
 * New provider entry will be the last entry inside the JRE.
 */
private static void createJavaSecurityFileExtn(boolean useName) {
    int insertAt = Security.getProviders().length + 1;
    String provider = (useName ? "TestProvider" : P_TYPE);
    try {
        Files.write(SEC_FILE, String.format("security.provider.%s=%s",
                insertAt, provider).getBytes("UTF-8"));
    } catch (IOException e) {
        throw new RuntimeException(e);
    }
    System.out.printf("Security property file created at: %s with value:"
            + " %s%n", SEC_FILE, provider);
}

static void prepareECCurve(MPCGlobals mpcParams) {
    mpcParams.p = new BigInteger(Util.bytesToHex(SecP256r1.p), 16);
    mpcParams.a = new BigInteger(Util.bytesToHex(SecP256r1.a), 16);
    mpcParams.b = new BigInteger(Util.bytesToHex(SecP256r1.b), 16);
    mpcParams.curve = new ECCurve.Fp(mpcParams.p, mpcParams.a, mpcParams.b);
    mpcParams.G = Util.ECPointDeSerialization(mpcGlobals.curve, SecP256r1.G, 0);
    mpcParams.n = new BigInteger(Util.bytesToHex(SecP256r1.r), 16); // also noted as r
    mpcParams.ecSpec = new ECParameterSpec(mpcParams.curve, mpcParams.G, mpcParams.n);
    Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
}

/**
 * Creates the KDC and starts it.
 * @param etype Encryption type, null if not specified
 * @throws java.lang.Exception if there's anything wrong
 */
public OneKDC(String etype) throws Exception {
    super(REALM, KDCHOST, 0, true);
    addPrincipal(USER, PASS);
    addPrincipal(USER2, PASS2);
    addPrincipalRandKey("krbtgt/" + REALM);
    addPrincipalRandKey(SERVER);
    addPrincipalRandKey(BACKEND);

    String extraConfig = "";
    if (etype != null) {
        extraConfig += "default_tkt_enctypes=" + etype
                + "\ndefault_tgs_enctypes=" + etype;
        if (etype.startsWith("des")) {
            extraConfig += "\nallow_weak_crypto = true";
        }
    }
    KDC.saveConfig(KRB5_CONF, this,
            "forwardable = true",
            "default_keytab_name = " + KTAB,
            extraConfig);
    System.setProperty("java.security.krb5.conf", KRB5_CONF);
    // Whatever krb5.conf had been loaded before, we reload ours now.
    Config.refresh();

    writeKtab(KTAB);
    Security.setProperty("auth.login.defaultCallbackHandler",
            "OneKDC$CallbackForClient");
}

public static void main(String[] args) throws Exception {
    // MD5 is used in this test case, don't disable MD5 algorithm.
    Security.setProperty(
            "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024");

    CertPathBuilder builder = CertPathBuilder.getInstance("PKIX");

    X509CertSelector selector = generateSelector(args[0]);

    Set<TrustAnchor> anchors = generateTrustAnchors();
    CertStore certs = generateCertificateStore();


    PKIXBuilderParameters params =
            new PKIXBuilderParameters(anchors, selector);
    params.addCertStore(certs);
    params.setRevocationEnabled(false);
    params.setDate(new Date(109, 7, 1));   // 2009-07-01
    Security.setProperty("ocsp.enable", "false");
    System.setProperty("com.sun.security.enableCRLDP", "false");

    PKIXCertPathBuilderResult result =
            (PKIXCertPathBuilderResult)builder.build(params);

    if (!match(args[0], result.getCertPath().getCertificates().get(0))) {
        throw new Exception("unexpected certificate");
    }
}

public static void main(String[] args) throws Exception {
    Oid mech;
    if (args[0].equals("spnego")) {
        mech = GSSUtil.GSS_SPNEGO_MECH_OID;
    } else if (args[0].contains("krb5")) {
        mech = GSSUtil.GSS_KRB5_MECH_OID;
    } else {
        throw new Exception("Unknown mech");
    }

    OneKDC kdc = new OneKDC(null);
    kdc.writeJAASConf();
    kdc.setOption(KDC.Option.PREAUTH_REQUIRED, false);
    Map<String,List<String>> map = new HashMap<>();
    map.put(OneKDC.SERVER + "@" + OneKDC.REALM, Arrays.asList(
            new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));
    kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
    kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
            new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));

    Context s, b;
    System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
    System.setProperty("java.security.auth.login.config", OneKDC.JAAS_CONF);
    File f = new File(OneKDC.JAAS_CONF);
    FileOutputStream fos = new FileOutputStream(f);
    fos.write((
            "com.sun.security.jgss.krb5.accept {\n" +
            "    com.sun.security.auth.module.Krb5LoginModule required\n" +
            "    principal=\"" + OneKDC.SERVER + "\"\n" +
            "    useKeyTab=true\n" +
            "    storeKey=true;\n};\n"
            ).getBytes());
    fos.close();
    Security.setProperty("auth.login.defaultCallbackHandler", "OneKDC$CallbackForClient");
    s = Context.fromThinAir();
    b = Context.fromThinAir();
    s.startAsServer(mech);

    Context p = s.impersonate(OneKDC.USER);

    p.startAsClient(OneKDC.SERVER, mech);
    b.startAsServer(mech);
    Context.handshake(p, b);

    String n1 = p.x().getSrcName().toString().split("@")[0];
    String n2 = b.x().getSrcName().toString().split("@")[0];
    if (!n1.equals(OneKDC.USER) || !n2.equals(OneKDC.USER)) {
        throw new Exception("Delegation failed");
    }
}

/**
 * Obtains the default KeyManagerFactory algorithm name.
 *
 * <p>The default algorithm can be changed at runtime by setting
 * the value of the {@code ssl.KeyManagerFactory.algorithm}
 * security property to the desired algorithm name.
 *
 * @see java.security.Security security properties
 * @return the default algorithm name as specified by the
 *          {@code ssl.KeyManagerFactory.algorithm} security property, or an
 *          implementation-specific default if no such property exists.
 */
public final static String getDefaultAlgorithm() {
    String type;
    type = AccessController.doPrivileged(new PrivilegedAction<String>() {
        @Override
        public String run() {
            return Security.getProperty(
                "ssl.KeyManagerFactory.algorithm");
        }
    });
    if (type == null) {
        type = "SunX509";
    }
    return type;
}

public static void main(String[] args) throws Exception {

        Type t = Type.valueOf(args[0]);

        // We can't use the jtreg java.security.policy option to specify
        // the policy file because that causes the default JDK policy provider
        // to be set and once set, we cannot change it. So, instead we use the
        // policy.url security property.
        File file = new File(System.getProperty("test.src"), "test.policy");
        URL policyURL = file.toURI().toURL();
        Security.setProperty("policy.url.1", policyURL.toString());

        switch (t) {
            case CUSTOM:
                // Set policy.provider to our custom policy provider
                Security.setProperty("policy.provider", "CustomPolicy");
                break;
            case NOT_AVAIL:
                // Set policy.provider to a non-existent policy provider
                Security.setProperty("policy.provider", "NonExistentPolicy");
                break;
            case DEFAULT:
                // Don't set policy.provider (leave default)
                break;
            case NOT_SET:
                // Set policy.provider to empty string
                Security.setProperty("policy.provider", "");
                break;
        }

        System.setSecurityManager(new SecurityManager());
        Policy p = Policy.getPolicy();
        switch (t) {
            case CUSTOM:
                // check that the custom policy provider has been set
                if (!(p instanceof CustomPolicy)) {
                    throw new Exception("CustomPolicy was not set");
                }
                break;
            case NOT_AVAIL:
            case DEFAULT:
            case NOT_SET:
                // check that the default policy provider has been set
                if (!(p instanceof sun.security.provider.PolicyFile)) {
                    throw new Exception("default provider was not set");
                }
                break;
        }
    }

private Credential getEncryptionCredential(final WsFederationConfiguration config) {
    try {
        // This will need to contain the private keypair in PEM format
        final BufferedReader br = new BufferedReader(new InputStreamReader(config.getEncryptionPrivateKey().getInputStream()));
        Security.addProvider(new BouncyCastleProvider());
        final PEMParser pemParser = new PEMParser(br);

        final Object privateKeyPemObject = pemParser.readObject();
        final JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider(new BouncyCastleProvider());

        final KeyPair kp;
        if (privateKeyPemObject instanceof PEMEncryptedKeyPair) {
            final PEMEncryptedKeyPair ckp = (PEMEncryptedKeyPair) privateKeyPemObject;
            final PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder()
                    .build(config.getEncryptionPrivateKeyPassword().toCharArray());
            kp = converter.getKeyPair(ckp.decryptKeyPair(decProv));
        } else {
            kp = converter.getKeyPair((PEMKeyPair) privateKeyPemObject);
        }

        final X509CertParser certParser = new X509CertParser();
        // This is the certificate shared with ADFS in DER format, i.e certificate.crt
        certParser.engineInit(config.getEncryptionCertificate().getInputStream());
        final X509CertificateObject cert = (X509CertificateObject) certParser.engineRead();
        return new BasicX509Credential(cert, kp.getPrivate());
    } catch (final Exception e) {
        throw Throwables.propagate(e);
    }
}