diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/repository/CACertificateStoreRepository.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/repository/CACertificateStoreRepository.java index b1178d60..c04c1102 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/repository/CACertificateStoreRepository.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/keymanagerservice/repository/CACertificateStoreRepository.java @@ -39,6 +39,14 @@ public interface CACertificateStoreRepository extends JpaRepository getCaCertificateList( response.setResponse(partnerCertManagerService.getCaCertificateChain(certListRequestDto.getRequest())); return response; } + + /** + * To Download p7b file for a CA / Intermediate CA certificate along with the trust chain + * + * @param caCertId {@link CACertificateTrustPathRequestDto} request + * @return {@link CACertificateTrustPathResponseDto} p7b data + */ + @Operation(summary = "To Download p7b file for a CA / Intermediate CA certificate along with the trust chain.", + description = "To Download p7b file for a CA / Intermediate CA certificate along with the trust chain.", tags = { "cacertmanager" }) + @ApiResponses(value = { + @ApiResponse(responseCode = "200", description = "Success or you may find errors in error array in response"), + @ApiResponse(responseCode = "401", description = "Unauthorized", content = @Content(schema = @Schema(hidden = true))), + @ApiResponse(responseCode = "403", description = "Forbidden", content = @Content(schema = @Schema(hidden = true))), + @ApiResponse(responseCode = "404", description = "Not Found", content = @Content(schema = @Schema(hidden = true))) }) + @ResponseFilter + @PreAuthorize("hasAnyRole(@keyManAuthRoles.getGetcacertificatetrustpath())") + @GetMapping(value = "/getCACertificateTrustPath/{caCertId}") + public ResponseWrapper getCACertificateTrustPath( + @ApiParam("To Download p7b file CA certificate along with trust.") @PathVariable("caCertId") String caCertId) { + CACertificateTrustPathRequestDto caCertificateTrustPathRequestDto = new CACertificateTrustPathRequestDto(); + caCertificateTrustPathRequestDto.setCaCertId(caCertId); + ResponseWrapper response = new ResponseWrapper<>(); + response.setResponse(partnerCertManagerService.getCACertificateTrustPath(caCertificateTrustPathRequestDto)); + return response; + } + } \ No newline at end of file diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/dto/AuthorizedRolesDTO.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/dto/AuthorizedRolesDTO.java index 98b7a2c7..2dad1a71 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/dto/AuthorizedRolesDTO.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/dto/AuthorizedRolesDTO.java @@ -28,4 +28,5 @@ public class AuthorizedRolesDTO { private List postgetcacertificates; + private List getcacertificatetrustpath; } \ No newline at end of file diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/dto/CACertificateTrustPathRequestDto.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/dto/CACertificateTrustPathRequestDto.java new file mode 100644 index 00000000..774fd23c --- /dev/null +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/dto/CACertificateTrustPathRequestDto.java @@ -0,0 +1,23 @@ +package io.mosip.kernel.partnercertservice.dto; + +import io.mosip.kernel.keymanagerservice.constant.KeymanagerConstant; +import io.swagger.annotations.ApiModel; +import io.swagger.annotations.ApiModelProperty; +import jakarta.validation.constraints.NotBlank; +import lombok.AllArgsConstructor; +import lombok.Data; +import lombok.NoArgsConstructor; + +@Data +@AllArgsConstructor +@NoArgsConstructor +@ApiModel(description = "Model representing request to download p7b file for ca certificate") +public class CACertificateTrustPathRequestDto { + + /** + * Certificate ID of CA Certificate + */ + @ApiModelProperty(notes = "CA Certificate ID", required = true) + @NotBlank(message = KeymanagerConstant.INVALID_REQUEST) + String caCertId; +} diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/dto/CACertificateTrustPathResponseDto.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/dto/CACertificateTrustPathResponseDto.java new file mode 100644 index 00000000..50b628b4 --- /dev/null +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/dto/CACertificateTrustPathResponseDto.java @@ -0,0 +1,31 @@ +package io.mosip.kernel.partnercertservice.dto; + +import lombok.AllArgsConstructor; +import lombok.Data; +import lombok.NoArgsConstructor; + +import java.time.LocalDateTime; + +/** + * DTO class for download of p7b File for CA Certificate. + */ +@Data +@AllArgsConstructor +@NoArgsConstructor +public class CACertificateTrustPathResponseDto { +// +// /** +// * format of certificate +// */ +// +// private String Format; + /** + * CA Certificate Data + */ + private String p7bFile; + + /** + * Response Timestamp + */ + private LocalDateTime timestamp; +} diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/helper/PartnerCertManagerDBHelper.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/helper/PartnerCertManagerDBHelper.java index 1e18d169..dd9e5fa8 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/helper/PartnerCertManagerDBHelper.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/helper/PartnerCertManagerDBHelper.java @@ -177,4 +177,9 @@ public void getCertThumbprints(String appId, Optional refId, List certList = null; + if (!PartnerCertificateManagerUtil.isSelfSignedCertificate(caCertificate)){ + certList = getCertificateTrustPath(caCertificate, partnerDomain); + } + + + List chain = new ArrayList<>(); + chain.add(caCertificate); + if (certList != null) { + chain.addAll(certList); + } + String buildTrustPath = PartnerCertificateManagerUtil.buildp7bFile(chain.toArray(new Certificate[0])); + + CACertificateTrustPathResponseDto responseDto = new CACertificateTrustPathResponseDto(); + responseDto.setP7bFile(buildTrustPath); + responseDto.setTimestamp(timestamp); + return responseDto; + } + + private CACertificateStore getCACertificate(String caCertId) { + LOGGER.info(PartnerCertManagerConstants.SESSIONID, PartnerCertManagerConstants.GET_CA_CERT, PartnerCertManagerConstants.EMPTY, + "Request to get CA Certificate for caCertId: " + caCertId); + + if (!PartnerCertificateManagerUtil.isValidCertificateID(caCertId)) { + LOGGER.error(PartnerCertManagerConstants.SESSIONID, PartnerCertManagerConstants.GET_CA_CERT, + PartnerCertManagerConstants.EMPTY, "Invalid CA Certificate ID provided to get the CA Certificate."); + throw new PartnerCertManagerException( + PartnerCertManagerErrorConstants.INVALID_CERTIFICATE_ID.getErrorCode(), + PartnerCertManagerErrorConstants.INVALID_CERTIFICATE_ID.getErrorMessage()); + } + CACertificateStore caCertificateStore = certDBHelper.getCACert(caCertId); + if (Objects.isNull(caCertificateStore)) { + LOGGER.error(PartnerCertManagerConstants.SESSIONID, PartnerCertManagerConstants.GET_CA_CERT, + PartnerCertManagerConstants.EMPTY, "CA Certificate not found for the provided ID."); + throw new PartnerCertManagerException( + PartnerCertManagerErrorConstants.CA_CERT_ID_NOT_FOUND.getErrorCode(), + PartnerCertManagerErrorConstants.CA_CERT_ID_NOT_FOUND.getErrorMessage()); + } + return caCertificateStore; + } + private PartnerCertificateStore getPartnerCertificate(String partnetCertId) { LOGGER.info(PartnerCertManagerConstants.SESSIONID, PartnerCertManagerConstants.GET_PARTNER_CERT, PartnerCertManagerConstants.EMPTY, "Request to get Certificate for partnerId: " + partnetCertId); diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/service/spi/PartnerCertificateManagerService.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/service/spi/PartnerCertificateManagerService.java index 350e0e2e..efeb5674 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/service/spi/PartnerCertificateManagerService.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/service/spi/PartnerCertificateManagerService.java @@ -77,4 +77,13 @@ public interface PartnerCertificateManagerService { * @return {@link CaCertificateChainResponseDto} response */ public CaCertificateChainResponseDto getCaCertificateChain(CaCertTypeListRequestDto certListRequestDto); + + /** + * Function to Download p7b file for CA Certificates along with trust + * + * @param caCertificateTrustPathRequestDto p7bFileDownloadRequestDto + * @return {@link CACertificateTrustPathResponseDto} respponse + */ + public CACertificateTrustPathResponseDto getCACertificateTrustPath(CACertificateTrustPathRequestDto caCertificateTrustPathRequestDto); + } \ No newline at end of file diff --git a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/util/PartnerCertificateManagerUtil.java b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/util/PartnerCertificateManagerUtil.java index 45ec2a2f..1c21f3bd 100644 --- a/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/util/PartnerCertificateManagerUtil.java +++ b/kernel/kernel-keymanager-service/src/main/java/io/mosip/kernel/partnercertservice/util/PartnerCertificateManagerUtil.java @@ -240,6 +240,10 @@ public static String buildP7BCertificateChain(List certLi return buildCertChain(chain.toArray(new Certificate[0])); } + public static String buildp7bFile(Certificate[] chain) { + return buildCertChain(chain); + } + private static String buildCertChain(Certificate[] chain) { try { diff --git a/kernel/kernel-keymanager-service/src/main/resources/application-local.properties b/kernel/kernel-keymanager-service/src/main/resources/application-local.properties index 9fa6d2c3..ca0cf304 100644 --- a/kernel/kernel-keymanager-service/src/main/resources/application-local.properties +++ b/kernel/kernel-keymanager-service/src/main/resources/application-local.properties @@ -159,4 +159,5 @@ mosip.role.keymanager.getuinpartnercode=ZONAL_ADMIN,GLOBAL_ADMIN,ID_AUTHENTICATI mosip.role.keymanager.postzkencrypt=ZONAL_ADMIN,GLOBAL_ADMIN,INDIVIDUAL,ID_AUTHENTICATION,TEST,REGISTRATION_ADMIN,REGISTRATION_SUPERVISOR,REGISTRATION_OFFICER,REGISTRATION_PROCESSOR,PRE_REGISTRATION_ADMIN,RESIDENT mosip.role.keymanager.postzkdecrypt=ZONAL_ADMIN,GLOBAL_ADMIN,INDIVIDUAL,ID_AUTHENTICATION,TEST,REGISTRATION_ADMIN,REGISTRATION_SUPERVISOR,REGISTRATION_OFFICER,REGISTRATION_PROCESSOR,PRE_REGISTRATION_ADMIN,RESIDENT mosip.role.keymanager.postzkreencryptrandomkey=ZONAL_ADMIN,GLOBAL_ADMIN,INDIVIDUAL,ID_AUTHENTICATION,TEST,REGISTRATION_ADMIN,REGISTRATION_SUPERVISOR,REGISTRATION_OFFICER,REGISTRATION_PROCESSOR,PRE_REGISTRATION_ADMIN,RESIDENT -mosip.role.keymanager.postgetcacertificates=ZONAL_ADMIN,GLOBAL_ADMIN,PMS_ADMIN,PMS_USER \ No newline at end of file +mosip.role.keymanager.postgetcacertificates=PARTNER_ADMIN +mosip.role.keymanager.getcacertificatetrustpath=PARTNER_ADMIN