Skip to content

Commit 7420458

Browse files
maximthomasmaximthomas
authored
Shade BC libs to avoid conflict with BC FIPS (#930)
1 parent 4254b34 commit 7420458

File tree

5 files changed

+170
-37
lines changed
  • bcpkix-shaded
  • openam-authentication/openam-auth-oauth2
    • pom.xml
    • src
      • main/java/org/forgerock/openam/authentication/modules/oauth2/service/esia
      • test/java/org/forgerock/openam/authentication/modules/oauth2
  • pom.xml

5 files changed

+170
-37
lines changed

‎bcpkix-shaded/pom.xml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
* The contents of this file are subject to the terms of the Common Development and
4+
* Distribution License (the License). You may not use this file except in compliance with the
5+
* License.
6+
*
7+
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
8+
* specific language governing permission and limitations under the License.
9+
*
10+
* When distributing Covered Software, include this CDDL Header Notice in each file and include
11+
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
12+
* Header, with the fields enclosed by brackets [] replaced by your own identifying
13+
* information: "Portions copyright [year] [name of copyright owner]".
14+
*
15+
* Copyright 2025 3A Systems LLC.
16+
-->
17+
<project xmlns="http://maven.apache.org/POM/4.0.0"
18+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
19+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
20+
<modelVersion>4.0.0</modelVersion>
21+
<parent>
22+
<groupId>org.openidentityplatform.openam</groupId>
23+
<artifactId>openam</artifactId>
24+
<version>16.0.0-SNAPSHOT</version>
25+
</parent>
26+
27+
<artifactId>bcpkix-shaded</artifactId>
28+
<version>${bouncycastle.version}</version>
29+
<build>
30+
<plugins>
31+
<plugin>
32+
<artifactId>maven-shade-plugin</artifactId>
33+
<version>3.6.1</version>
34+
<executions>
35+
<execution>
36+
<id>shade-bouncycastle-classes</id>
37+
<phase>package</phase>
38+
<goals>
39+
<goal>shade</goal>
40+
</goals>
41+
<configuration>
42+
<artifactSet>
43+
<includes>
44+
<include>org.bouncycastle:bcpkix-jdk18on</include>
45+
<include>org.bouncycastle:bcutil-jdk18on</include>
46+
<include>org.bouncycastle:bcprov-jdk18on</include>
47+
</includes>
48+
</artifactSet>
49+
<relocations>
50+
<relocation>
51+
<pattern>org.bouncycastle</pattern>
52+
<shadedPattern>org.openidentityplatform.bouncycastle</shadedPattern>
53+
</relocation>
54+
</relocations>
55+
<filters>
56+
<filter>
57+
<artifact>org.bouncycastle:*</artifact>
58+
<excludes>
59+
<exclude>META-INF/**</exclude>
60+
</excludes>
61+
</filter>
62+
</filters>
63+
<createSourcesJar>true</createSourcesJar>
64+
<shadeSourcesContent>true</shadeSourcesContent>
65+
</configuration>
66+
</execution>
67+
</executions>
68+
</plugin>
69+
<plugin>
70+
<groupId>org.apache.maven.plugins</groupId>
71+
<artifactId>maven-dependency-plugin</artifactId>
72+
<executions>
73+
<execution>
74+
<id>unpack</id>
75+
<phase>process-classes</phase>
76+
<goals>
77+
<goal>unpack</goal>
78+
</goals>
79+
<configuration>
80+
<artifactItems>
81+
<artifactItem>
82+
<groupId>org.bouncycastle</groupId>
83+
<artifactId>bcpkix-jdk18on</artifactId>
84+
<version>${bouncycastle.version}</version>
85+
<outputDirectory>${project.build.outputDirectory}</outputDirectory>
86+
</artifactItem>
87+
<artifactItem>
88+
<groupId>org.bouncycastle</groupId>
89+
<artifactId>bcutil-jdk18on</artifactId>
90+
<version>${bouncycastle.version}</version>
91+
<outputDirectory>${project.build.outputDirectory}</outputDirectory>
92+
</artifactItem>
93+
<artifactItem>
94+
<groupId>org.bouncycastle</groupId>
95+
<artifactId>bcprov-jdk18on</artifactId>
96+
<version>${bouncycastle.version}</version>
97+
<outputDirectory>${project.build.outputDirectory}</outputDirectory>
98+
</artifactItem>
99+
</artifactItems>
100+
<excludes>META-INF/*.SF,META-INF/*.DSA,META-INF/*.RSA</excludes>
101+
</configuration>
102+
</execution>
103+
</executions>
104+
</plugin>
105+
</plugins>
106+
</build>
107+
108+
</project>

‎openam-authentication/openam-auth-oauth2/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,8 @@
5454
<artifactId>esapi</artifactId>
5555
</dependency>
5656
<dependency>
57-
<groupId>org.bouncycastle</groupId>
58-
<artifactId>bcpkix-jdk18on</artifactId>
57+
<groupId>org.openidentityplatform.openam</groupId>
58+
<artifactId>bcpkix-shaded</artifactId>
5959
<version>1.81</version>
6060
</dependency>
6161
<dependency>

‎openam-authentication/openam-auth-oauth2/src/main/java/org/forgerock/openam/authentication/modules/oauth2/service/esia/Signer.java‎

Lines changed: 33 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,41 @@
1+
/*
2+
* The contents of this file are subject to the terms of the Common Development and
3+
* Distribution License (the License). You may not use this file except in compliance with the
4+
* License.
5+
*
6+
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
7+
* specific language governing permission and limitations under the License.
8+
*
9+
* When distributing Covered Software, include this CDDL Header Notice in each file and include
10+
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
11+
* Header, with the fields enclosed by brackets [] replaced by your own identifying
12+
* information: "Portions copyright [year] [name of copyright owner]".
13+
*
14+
* Copyright 2018-2025 3A Systems LLC.
15+
*/
16+
117
package org.forgerock.openam.authentication.modules.oauth2.service.esia;
218

319
import com.google.common.cache.Cache;
420
import com.google.common.cache.CacheBuilder;
521
import com.iplanet.am.util.SystemProperties;
622
import org.apache.commons.codec.binary.Base64;
7-
import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
8-
import org.bouncycastle.cert.X509CertificateHolder;
9-
import org.bouncycastle.cert.jcajce.JcaCertStore;
10-
import org.bouncycastle.cms.CMSProcessableByteArray;
11-
import org.bouncycastle.cms.CMSSignedData;
12-
import org.bouncycastle.cms.CMSSignedDataGenerator;
13-
import org.bouncycastle.cms.CMSTypedData;
14-
import org.bouncycastle.cms.jcajce.JcaSignerInfoGeneratorBuilder;
15-
import org.bouncycastle.jce.provider.BouncyCastleProvider;
16-
import org.bouncycastle.openssl.PEMKeyPair;
17-
import org.bouncycastle.openssl.PEMParser;
18-
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
19-
import org.bouncycastle.operator.ContentSigner;
20-
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
21-
import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
22-
import org.bouncycastle.util.Store;
23+
import org.openidentityplatform.bouncycastle.asn1.pkcs.PrivateKeyInfo;
24+
import org.openidentityplatform.bouncycastle.cert.X509CertificateHolder;
25+
import org.openidentityplatform.bouncycastle.cert.jcajce.JcaCertStore;
26+
import org.openidentityplatform.bouncycastle.cms.CMSProcessableByteArray;
27+
import org.openidentityplatform.bouncycastle.cms.CMSSignedData;
28+
import org.openidentityplatform.bouncycastle.cms.CMSSignedDataGenerator;
29+
import org.openidentityplatform.bouncycastle.cms.CMSTypedData;
30+
import org.openidentityplatform.bouncycastle.cms.jcajce.JcaSignerInfoGeneratorBuilder;
31+
import org.openidentityplatform.bouncycastle.jce.provider.BouncyCastleProvider;
32+
import org.openidentityplatform.bouncycastle.openssl.PEMKeyPair;
33+
import org.openidentityplatform.bouncycastle.openssl.PEMParser;
34+
import org.openidentityplatform.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
35+
import org.openidentityplatform.bouncycastle.operator.ContentSigner;
36+
import org.openidentityplatform.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
37+
import org.openidentityplatform.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
38+
import org.openidentityplatform.bouncycastle.util.Store;
2339
import org.slf4j.Logger;
2440
import org.slf4j.LoggerFactory;
2541

@@ -35,7 +51,7 @@ public class Signer {
3551

3652
final static Logger logger = LoggerFactory.getLogger(Signer.class);
3753
static {
38-
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
54+
Security.addProvider(new org.openidentityplatform.bouncycastle.jce.provider.BouncyCastleProvider());
3955
}
4056

4157
private static final Cache<String, X509CertificateHolder> certificateHolderCache = CacheBuilder.newBuilder().maximumSize(10)

‎openam-authentication/openam-auth-oauth2/src/test/java/org/forgerock/openam/authentication/modules/oauth2/ESIATest.java‎

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,22 @@
1+
/*
2+
* The contents of this file are subject to the terms of the Common Development and
3+
* Distribution License (the License). You may not use this file except in compliance with the
4+
* License.
5+
*
6+
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
7+
* specific language governing permission and limitations under the License.
8+
*
9+
* When distributing Covered Software, include this CDDL Header Notice in each file and include
10+
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
11+
* Header, with the fields enclosed by brackets [] replaced by your own identifying
12+
* information: "Portions copyright [year] [name of copyright owner]".
13+
*
14+
* Copyright 2018-2025 3A Systems LLC.
15+
*/
16+
117
package org.forgerock.openam.authentication.modules.oauth2;
218

3-
import org.bouncycastle.openssl.jcajce.JcaPEMWriter;
19+
import org.openidentityplatform.bouncycastle.openssl.jcajce.JcaPEMWriter;
420
import org.forgerock.openam.authentication.modules.oauth2.service.ESIAServiceUrlProvider;
521
import org.forgerock.openam.authentication.modules.oauth2.service.esia.Signer;
622
import org.mockito.Matchers;
@@ -50,7 +66,7 @@ public void syncOffsetTest() throws Exception {
5066

5167
@Test
5268
public void testSigner() throws Exception {
53-
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
69+
Security.addProvider(new org.openidentityplatform.bouncycastle.jce.provider.BouncyCastleProvider());
5470

5571
KeyPairGenerator keygen = KeyPairGenerator.getInstance(algorithm, "BC");
5672
keygen.initialize(new ECGenParameterSpec(paramsSpec));
@@ -66,22 +82,22 @@ public void testSigner() throws Exception {
6682
}
6783

6884
private String generateTempCertificateFile(KeyPair keyPair)throws Exception {
69-
org.bouncycastle.asn1.x500.X500Name subject = new org.bouncycastle.asn1.x500.X500Name("CN=" + alias);
85+
org.openidentityplatform.bouncycastle.asn1.x500.X500Name subject = new org.openidentityplatform.bouncycastle.asn1.x500.X500Name("CN=" + alias);
7086
BigInteger serial = BigInteger.ONE;
7187
Date notBefore = new Date();
7288
Date notAfter = new Date(notBefore.getTime() + TimeUnit.DAYS.toMillis(365 * 10));
7389

74-
org.bouncycastle.cert.X509v3CertificateBuilder certificateBuilder = new org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder(
90+
org.openidentityplatform.bouncycastle.cert.X509v3CertificateBuilder certificateBuilder = new org.openidentityplatform.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder(
7591
subject, serial,
7692
notBefore, notAfter,
7793
subject, keyPair.getPublic()
7894
);
79-
org.bouncycastle.cert.X509CertificateHolder certificateHolder = certificateBuilder.build(
80-
new org.bouncycastle.operator.jcajce.JcaContentSignerBuilder(signatureAlgorithm)
95+
org.openidentityplatform.bouncycastle.cert.X509CertificateHolder certificateHolder = certificateBuilder.build(
96+
new org.openidentityplatform.bouncycastle.operator.jcajce.JcaContentSignerBuilder(signatureAlgorithm)
8197
.build(keyPair.getPrivate())
8298
);
83-
org.bouncycastle.cert.jcajce.JcaX509CertificateConverter certificateConverter
84-
= new org.bouncycastle.cert.jcajce.JcaX509CertificateConverter();
99+
org.openidentityplatform.bouncycastle.cert.jcajce.JcaX509CertificateConverter certificateConverter
100+
= new org.openidentityplatform.bouncycastle.cert.jcajce.JcaX509CertificateConverter();
85101

86102
X509Certificate certificate = certificateConverter.getCertificate(certificateHolder);
87103

‎pom.xml‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,7 @@
139139
<logback.version>1.3.15</logback.version>
140140
<netty.version>4.1.125.Final</netty.version>
141141
<netty-tcnative-boringssl.version>2.0.69.Final</netty-tcnative-boringssl.version>
142+
<bouncycastle.version>1.81</bouncycastle.version>
142143
<javadoc.opts>-Xdoclint:none</javadoc.opts>
143144
<java.surefire.options>
144145
-Xmx1g
@@ -241,6 +242,7 @@
241242
<excludeArtifact>org.restlet.ext.json</excludeArtifact>
242243
<excludeArtifact>org.restlet.ext.servlet</excludeArtifact>
243244
<excludeArtifact>org.restlet.ext.xml</excludeArtifact>
245+
<excludeArtifact>bcpkix-shaded</excludeArtifact>
244246
</excludeArtifacts>
245247
</configuration>
246248
</plugin>
@@ -253,6 +255,7 @@
253255
<modules>
254256
<!-- shaded libraries -->
255257
<module>jato-shaded</module>
258+
<module>bcpkix-shaded</module>
256259
<module>openam-http</module>
257260
<module>openam-ldap-utils</module>
258261
<module>openam-datastore</module>
@@ -405,16 +408,6 @@
405408
<groupId>org.openidentityplatform.opendj</groupId>
406409
<artifactId>opendj-core</artifactId>
407410
<version>${opendj.version}</version>
408-
<exclusions>
409-
<exclusion>
410-
<groupId>org.bouncycastle</groupId>
411-
<artifactId>bc-fips</artifactId>
412-
</exclusion>
413-
<exclusion>
414-
<groupId>org.bouncycastle</groupId>
415-
<artifactId>bctls-fips</artifactId>
416-
</exclusion>
417-
</exclusions>
418411
</dependency>
419412
<dependency>
420413
<groupId>org.mockito</groupId>

0 commit comments

Comments
 (0)