Re: [PR] NIFI-12272 Add Formatter for Certificate Distinguished Names [nifi]
asfgit closed pull request #7931: NIFI-12272 Add Formatter for Certificate Distinguished Names URL: https://github.com/apache/nifi/pull/7931 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-unsubscr...@nifi.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
Re: [PR] NIFI-12272 Add Formatter for Certificate Distinguished Names [nifi]
ChrisSamo632 commented on code in PR #7931:
URL: https://github.com/apache/nifi/pull/7931#discussion_r1372192264
##
nifi-commons/nifi-security-cert/src/main/java/org/apache/nifi/security/cert/StandardPrincipalFormatter.java:
##
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.security.cert;
+
+import javax.security.auth.x500.X500Principal;
+import java.security.cert.X509Certificate;
+import java.util.Objects;
+
+/**
+ * Standard Principal Formatter implementation returns Subject and Issuer
formatted according to RFC 1779 following the convention of getSubjectDN and
getIssuerDN methods
+ */
+public class StandardPrincipalFormatter implements PrincipalFormatter {
+private static final PrincipalFormatter INSTANCE = new
StandardPrincipalFormatter();
+
+private StandardPrincipalFormatter() {
+
+}
+
+/**
+ * Get singleton instance of Principal Formatter
+ *
+ * @return Standard Principal Formatter
+ */
+public static PrincipalFormatter getInstance() {
+return INSTANCE;
+}
+
+/**
+ * Get Subject Distinguished Name formatted as a string according to RFC
1779 with spaces between elements
+ *
+ * @param certificate X.509 Certificate
+ * @return Subject Distinguished Name formatted according to RFC 1779
+ */
+@Override
+public String getSubject(final X509Certificate certificate) {
+Objects.requireNonNull(certificate, "Certificate required");
+return getFormatted(certificate.getSubjectX500Principal());
+}
+
+/**
+ * Get Issuer Distinguished Name formatted as a string according to RFC
1779 with spaces between elements
+ *
+ * @param certificate X.509 Certificate
+ * @return Issuer Distinguished Name formatted according to RFC 1779
+ */
+@Override
+public String getIssuer(final X509Certificate certificate) {
+Objects.requireNonNull(certificate, "Certificate required");
+return getFormatted(certificate.getIssuerX500Principal());
+}
+
+private String getFormatted(final X500Principal principal) {
+return principal.getName(X500Principal.RFC1779);
Review Comment:
That makes sense - a separate implementation of the interface for a
different formatting if/when needed in future is fine
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscr...@nifi.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
Re: [PR] NIFI-12272 Add Formatter for Certificate Distinguished Names [nifi]
exceptionfactory commented on code in PR #7931:
URL: https://github.com/apache/nifi/pull/7931#discussion_r1372130153
##
nifi-commons/nifi-security-cert/src/main/java/org/apache/nifi/security/cert/StandardPrincipalFormatter.java:
##
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.security.cert;
+
+import javax.security.auth.x500.X500Principal;
+import java.security.cert.X509Certificate;
+import java.util.Objects;
+
+/**
+ * Standard Principal Formatter implementation returns Subject and Issuer
formatted according to RFC 1779 following the convention of getSubjectDN and
getIssuerDN methods
+ */
+public class StandardPrincipalFormatter implements PrincipalFormatter {
+private static final PrincipalFormatter INSTANCE = new
StandardPrincipalFormatter();
+
+private StandardPrincipalFormatter() {
+
+}
+
+/**
+ * Get singleton instance of Principal Formatter
+ *
+ * @return Standard Principal Formatter
+ */
+public static PrincipalFormatter getInstance() {
+return INSTANCE;
+}
+
+/**
+ * Get Subject Distinguished Name formatted as a string according to RFC
1779 with spaces between elements
+ *
+ * @param certificate X.509 Certificate
+ * @return Subject Distinguished Name formatted according to RFC 1779
+ */
+@Override
+public String getSubject(final X509Certificate certificate) {
+Objects.requireNonNull(certificate, "Certificate required");
+return getFormatted(certificate.getSubjectX500Principal());
+}
+
+/**
+ * Get Issuer Distinguished Name formatted as a string according to RFC
1779 with spaces between elements
+ *
+ * @param certificate X.509 Certificate
+ * @return Issuer Distinguished Name formatted according to RFC 1779
+ */
+@Override
+public String getIssuer(final X509Certificate certificate) {
+Objects.requireNonNull(certificate, "Certificate required");
+return getFormatted(certificate.getIssuerX500Principal());
+}
+
+private String getFormatted(final X500Principal principal) {
+return principal.getName(X500Principal.RFC1779);
Review Comment:
Based on current references, making this configurable would probably create
more confusion, given the nature of identity mapping and FlowFile attribute
evaluation. However, this certainly doesn't rule out other approaches if needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscr...@nifi.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
Re: [PR] NIFI-12272 Add Formatter for Certificate Distinguished Names [nifi]
exceptionfactory commented on code in PR #7931:
URL: https://github.com/apache/nifi/pull/7931#discussion_r1372128301
##
nifi-commons/nifi-security-cert/src/main/java/org/apache/nifi/security/cert/StandardPrincipalFormatter.java:
##
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.security.cert;
+
+import javax.security.auth.x500.X500Principal;
+import java.security.cert.X509Certificate;
+import java.util.Objects;
+
+/**
+ * Standard Principal Formatter implementation returns Subject and Issuer
formatted according to RFC 1779 following the convention of getSubjectDN and
getIssuerDN methods
+ */
+public class StandardPrincipalFormatter implements PrincipalFormatter {
+private static final PrincipalFormatter INSTANCE = new
StandardPrincipalFormatter();
+
+private StandardPrincipalFormatter() {
+
+}
+
+/**
+ * Get singleton instance of Principal Formatter
+ *
+ * @return Standard Principal Formatter
+ */
+public static PrincipalFormatter getInstance() {
+return INSTANCE;
+}
+
+/**
+ * Get Subject Distinguished Name formatted as a string according to RFC
1779 with spaces between elements
+ *
+ * @param certificate X.509 Certificate
+ * @return Subject Distinguished Name formatted according to RFC 1779
+ */
+@Override
+public String getSubject(final X509Certificate certificate) {
+Objects.requireNonNull(certificate, "Certificate required");
+return getFormatted(certificate.getSubjectX500Principal());
+}
+
+/**
+ * Get Issuer Distinguished Name formatted as a string according to RFC
1779 with spaces between elements
+ *
+ * @param certificate X.509 Certificate
+ * @return Issuer Distinguished Name formatted according to RFC 1779
+ */
+@Override
+public String getIssuer(final X509Certificate certificate) {
+Objects.requireNonNull(certificate, "Certificate required");
+return getFormatted(certificate.getIssuerX500Principal());
+}
+
+private String getFormatted(final X500Principal principal) {
+return principal.getName(X500Principal.RFC1779);
Review Comment:
If there is a need for `RFC2253` in other contexts, that could be a separate
implementation of the `PrincipalFormatter` interface. The purpose of the
`StandardPrincipalFormatter` was to maintain historical consistency when it
comes to string representations, without ruling out the possibility of other
options in different contexts.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscr...@nifi.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
Re: [PR] NIFI-12272 Add Formatter for Certificate Distinguished Names [nifi]
ChrisSamo632 commented on code in PR #7931:
URL: https://github.com/apache/nifi/pull/7931#discussion_r1372121807
##
nifi-commons/nifi-security-cert/src/main/java/org/apache/nifi/security/cert/StandardPrincipalFormatter.java:
##
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.security.cert;
+
+import javax.security.auth.x500.X500Principal;
+import java.security.cert.X509Certificate;
+import java.util.Objects;
+
+/**
+ * Standard Principal Formatter implementation returns Subject and Issuer
formatted according to RFC 1779 following the convention of getSubjectDN and
getIssuerDN methods
+ */
+public class StandardPrincipalFormatter implements PrincipalFormatter {
+private static final PrincipalFormatter INSTANCE = new
StandardPrincipalFormatter();
+
+private StandardPrincipalFormatter() {
+
+}
+
+/**
+ * Get singleton instance of Principal Formatter
+ *
+ * @return Standard Principal Formatter
+ */
+public static PrincipalFormatter getInstance() {
+return INSTANCE;
+}
+
+/**
+ * Get Subject Distinguished Name formatted as a string according to RFC
1779 with spaces between elements
+ *
+ * @param certificate X.509 Certificate
+ * @return Subject Distinguished Name formatted according to RFC 1779
+ */
+@Override
+public String getSubject(final X509Certificate certificate) {
+Objects.requireNonNull(certificate, "Certificate required");
+return getFormatted(certificate.getSubjectX500Principal());
+}
+
+/**
+ * Get Issuer Distinguished Name formatted as a string according to RFC
1779 with spaces between elements
+ *
+ * @param certificate X.509 Certificate
+ * @return Issuer Distinguished Name formatted according to RFC 1779
+ */
+@Override
+public String getIssuer(final X509Certificate certificate) {
+Objects.requireNonNull(certificate, "Certificate required");
+return getFormatted(certificate.getIssuerX500Principal());
+}
+
+private String getFormatted(final X500Principal principal) {
+return principal.getName(X500Principal.RFC1779);
Review Comment:
Do you foresee a need for other formats in the future, e.g. `RFC2253`? If
so, should we make the format configurable for the client?
If there's no apparent need right now (I can't see an immediate one if the
LDAP connectivity wouldn't benefit from the new formatter/approach), then happy
for this to be something that can be added later if/when the need arises
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscr...@nifi.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
[PR] NIFI-12272 Add Formatter for Certificate Distinguished Names [nifi]
exceptionfactory opened a new pull request, #7931: URL: https://github.com/apache/nifi/pull/7931 # Summary [NIFI-12272](https://issues.apache.org/jira/browse/NIFI-12272) Adds a `PrincipalFormatter` interface and `StandardPrincipalFormatter` implementation that retrieves and formats Certificate Subject and Issuer Distinguished Names according to [RFC 1779](https://www.rfc-editor.org/rfc/rfc1779). This approach preserves compatibility with the historical `getSubjectDN()` and `getIssuerDN()` methods from `X509Certificate` while using the recommended `getSubjectX500Principal()` and `getIssuerX500Principal()` methods. These changes restore compatibility with existing NiFi versions, recently changed for [NIFI-12142](https://issues.apache.org/jira/browse/NIFI-12142). # Tracking Please complete the following tracking steps prior to pull request creation. ### Issue Tracking - [X] [Apache NiFi Jira](https://issues.apache.org/jira/browse/NIFI) issue created ### Pull Request Tracking - [X] Pull Request title starts with Apache NiFi Jira issue number, such as `NIFI-0` - [X] Pull Request commit message starts with Apache NiFi Jira issue number, as such `NIFI-0` ### Pull Request Formatting - [X] Pull Request based on current revision of the `main` branch - [X] Pull Request refers to a feature branch with one commit containing changes # Verification Please indicate the verification steps performed prior to pull request creation. ### Build - [X] Build completed using `mvn clean install -P contrib-check` - [X] JDK 21 ### Licensing - [ ] New dependencies are compatible with the [Apache License 2.0](https://apache.org/licenses/LICENSE-2.0) according to the [License Policy](https://www.apache.org/legal/resolved.html) - [ ] New dependencies are documented in applicable `LICENSE` and `NOTICE` files ### Documentation - [ ] Documentation formatting appears as expected in rendered files -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-unsubscr...@nifi.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
