MikeThomsen commented on a change in pull request #4173:
URL: https://github.com/apache/nifi/pull/4173#discussion_r432075546
##########
File path:
nifi-nar-bundles/nifi-standard-services/nifi-oauth2-provider-bundle/nifi-oauth2-provider-service/src/main/java/org/apache/nifi/oauth2/Util.java
##########
@@ -0,0 +1,122 @@
+package org.apache.nifi.oauth2;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import okhttp3.OkHttpClient;
+import org.apache.nifi.processor.exception.ProcessException;
+import org.apache.nifi.ssl.SSLContextService;
+import org.apache.nifi.util.StringUtils;
+
+import javax.net.ssl.*;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.security.*;
+import java.security.cert.CertificateException;
+import java.util.Map;
+
+public class Util {
+ private static final ObjectMapper MAPPER = new ObjectMapper();
+
+ /**
+ * This code as taken from the InvokeHttp processor from Apache NiFi
1.10-SNAPSHOT found here:
+ *
+ *
https://github.com/apache/nifi/blob/1cadc722229ad50cf569ee107eaeeb95dc216ea2/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/main/java/org/apache/nifi/processors/standard/InvokeHTTP.java
+ * @param okHttpClientBuilder
+ * @param sslService
+ * @param sslContext
+ * @param setAsSocketFactory
+ * @throws IOException
+ * @throws KeyStoreException
+ * @throws CertificateException
+ * @throws NoSuchAlgorithmException
+ * @throws UnrecoverableKeyException
+ * @throws KeyManagementException
+ */
+ public static void setSslSocketFactory(OkHttpClient.Builder
okHttpClientBuilder, SSLContextService sslService, SSLContext sslContext,
boolean setAsSocketFactory)
+ throws IOException, KeyStoreException, CertificateException,
NoSuchAlgorithmException, UnrecoverableKeyException, KeyManagementException {
+
+ final KeyManagerFactory keyManagerFactory =
KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+ final TrustManagerFactory trustManagerFactory =
TrustManagerFactory.getInstance("X509");
+ // initialize the KeyManager array to null and we will overwrite later
if a keystore is loaded
+ KeyManager[] keyManagers = null;
+
+ // we will only initialize the keystore if properties have been
supplied by the SSLContextService
+ if (sslService.isKeyStoreConfigured()) {
+ final String keystoreLocation = sslService.getKeyStoreFile();
+ final String keystorePass = sslService.getKeyStorePassword();
+ final String keystoreType = sslService.getKeyStoreType();
+
+ // prepare the keystore
+ final KeyStore keyStore = KeyStore.getInstance(keystoreType);
+
+ try (FileInputStream keyStoreStream = new
FileInputStream(keystoreLocation)) {
+ keyStore.load(keyStoreStream, keystorePass.toCharArray());
+ }
+
+ keyManagerFactory.init(keyStore, keystorePass.toCharArray());
+ keyManagers = keyManagerFactory.getKeyManagers();
+ }
+
+ // we will only initialize the truststure if properties have been
supplied by the SSLContextService
+ if (sslService.isTrustStoreConfigured()) {
+ // load truststore
+ final String truststoreLocation = sslService.getTrustStoreFile();
+ final String truststorePass = sslService.getTrustStorePassword();
+ final String truststoreType = sslService.getTrustStoreType();
+
+ KeyStore truststore = KeyStore.getInstance(truststoreType);
+ truststore.load(new FileInputStream(truststoreLocation),
truststorePass.toCharArray());
+ trustManagerFactory.init(truststore);
+ }
+
+ /*
+ TrustManagerFactory.getTrustManagers returns a trust manager for
each type of trust material. Since we are getting a trust manager factory that
uses "X509"
+ as it's trust management algorithm, we are able to grab the first
(and thus the most preferred) and use it as our x509 Trust Manager
+
https://docs.oracle.com/javase/8/docs/api/javax/net/ssl/TrustManagerFactory.html#getTrustManagers--
+ */
+ final X509TrustManager x509TrustManager;
+ TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
+ if (trustManagers[0] != null) {
+ x509TrustManager = (X509TrustManager) trustManagers[0];
+ } else {
+ throw new IllegalStateException("List of trust managers is null");
+ }
+
+ // if keystore properties were not supplied, the keyManagers array
will be null
+ sslContext.init(keyManagers, trustManagerFactory.getTrustManagers(),
null);
+
+ final SSLSocketFactory sslSocketFactory =
sslContext.getSocketFactory();
+ okHttpClientBuilder.sslSocketFactory(sslSocketFactory,
x509TrustManager);
+ if (setAsSocketFactory) {
+ okHttpClientBuilder.socketFactory(sslSocketFactory);
+ }
+ }
Review comment:
@alopresto FWIW that was taken verbatim from 1.10's InvokeHttp
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
