NFC-46 Format version constant to private. Update format version exception message. Inline createCertTrustValidators. Remove final from AuthTokenV11Validator. Use constants for supported signature algorithms. Replace NFC with V11 in tests. Format code. Simplify supports() in AuthTokenValidatorImpl.

Author: SanderKondratjevNortal

src/main/java/eu/webeid/security/validator/AuthTokenV11Validator.java

@@ -17,27 +17,33 @@
 
 import static eu.webeid.security.util.Strings.isNullOrEmpty;
 
-final class AuthTokenV11Validator extends AuthTokenV1Validator {
+class AuthTokenV11Validator extends AuthTokenV1Validator {
 
     private static final String SUPPORTED_PREFIX = "web-eid:1.1";
+    private static final Set<String> SUPPORTED_CRYPTO_ALGORITHMS = Set.of("ECC", "RSA");
+    private static final Set<String> SUPPORTED_PADDING_SCHEMES = Set.of("NONE", "PKCS1.5", "PSS");
+    private static final Set<String> SUPPORTED_HASH_FUNCTIONS = Set.of(
+        "SHA-224", "SHA-256", "SHA-384", "SHA-512",
+        "SHA3-224", "SHA3-256", "SHA3-384", "SHA3-512"
+    );
 
     public AuthTokenV11Validator(
-            SubjectCertificateValidatorBatch simpleSubjectCertificateValidators,
-            Set<TrustAnchor> trustedCACertificateAnchors,
-            CertStore trustedCACertificateCertStore,
-            AuthTokenSignatureValidator authTokenSignatureValidator,
-            AuthTokenValidationConfiguration configuration,
-            OcspClient ocspClient,
-            OcspServiceProvider ocspServiceProvider
+        SubjectCertificateValidatorBatch simpleSubjectCertificateValidators,
+        Set<TrustAnchor> trustedCACertificateAnchors,
+        CertStore trustedCACertificateCertStore,
+        AuthTokenSignatureValidator authTokenSignatureValidator,
+        AuthTokenValidationConfiguration configuration,
+        OcspClient ocspClient,
+        OcspServiceProvider ocspServiceProvider
     ) {
         super(
-                simpleSubjectCertificateValidators,
-                trustedCACertificateAnchors,
-                trustedCACertificateCertStore,
-                authTokenSignatureValidator,
-                configuration,
-                ocspClient,
-                ocspServiceProvider
+            simpleSubjectCertificateValidators,
+            trustedCACertificateAnchors,
+            trustedCACertificateCertStore,
+            authTokenSignatureValidator,
+            configuration,
+            ocspClient,
+            ocspServiceProvider
         );
     }
 
@@ -74,28 +80,13 @@ public X509Certificate validate(WebEidAuthToken token, String currentChallengeNo
 
     private static void validateSupportedSignatureAlgorithms(List<SupportedSignatureAlgorithm> algorithms) throws AuthTokenParseException {
         boolean hasInvalid = algorithms.stream().anyMatch(supportedSignatureAlgorithm ->
-                !isValidCryptoAlgorithm(supportedSignatureAlgorithm.getCryptoAlgorithm())
-                        || !isValidHashFunction(supportedSignatureAlgorithm.getHashFunction())
-                        || !isValidPaddingScheme(supportedSignatureAlgorithm.getPaddingScheme())
+            !SUPPORTED_CRYPTO_ALGORITHMS.contains(supportedSignatureAlgorithm.getCryptoAlgorithm()) ||
+                !SUPPORTED_HASH_FUNCTIONS.contains(supportedSignatureAlgorithm.getHashFunction()) ||
+                !SUPPORTED_PADDING_SCHEMES.contains(supportedSignatureAlgorithm.getPaddingScheme())
         );
 
         if (hasInvalid) {
             throw new AuthTokenParseException("Unsupported signature algorithm");
         }
     }
-
-    private static boolean isValidCryptoAlgorithm(String value) {
-        return "RSA".equals(value) || "ECC".equals(value);
-    }
-
-    private static boolean isValidHashFunction(String value) {
-        return Set.of(
-                "SHA-224", "SHA-256", "SHA-384", "SHA-512",
-                "SHA3-224", "SHA3-256", "SHA3-384", "SHA3-512"
-        ).contains(value);
-    }
-
-    private static boolean isValidPaddingScheme(String value) {
-        return "NONE".equals(value) || "PKCS1.5".equals(value) || "PSS".equals(value);
-    }
 }

src/main/java/eu/webeid/security/validator/AuthTokenV1Validator.java

@@ -19,7 +19,7 @@
 
 class AuthTokenV1Validator implements AuthTokenValidator {
 
-    protected static final String SUPPORTED_TOKEN_FORMAT_VERSION = "web-eid:1";
+    private static final String SUPPORTED_TOKEN_FORMAT_VERSION = "web-eid:1";
 
     private final SubjectCertificateValidatorBatch simpleSubjectCertificateValidators;
     private final Set<TrustAnchor> trustedCACertificateAnchors;
@@ -81,7 +81,14 @@ public X509Certificate validate(WebEidAuthToken token, String currentChallengeNo
         final X509Certificate subjectCertificate = CertificateLoader.decodeCertificateFromBase64(token.getUnverifiedCertificate());
 
         simpleSubjectCertificateValidators.executeFor(subjectCertificate);
-        getCertTrustValidators().executeFor(subjectCertificate);
+
+        createCertTrustValidators(
+            configuration,
+            trustedCACertificateAnchors,
+            trustedCACertificateCertStore,
+            ocspClient,
+            ocspServiceProvider
+        ).executeFor(subjectCertificate);
 
         // It is guaranteed that if the signature verification succeeds, then the origin and challenge
         // have been implicitly and correctly verified without the need to implement any additional checks.
@@ -103,16 +110,6 @@ public X509Certificate validate(WebEidAuthToken token, String currentChallengeNo
      *
      * @return certificate trust validator batch
      */
-    private SubjectCertificateValidatorBatch getCertTrustValidators() {
-        return createCertTrustValidators(
-            configuration,
-            trustedCACertificateAnchors,
-            trustedCACertificateCertStore,
-            ocspClient,
-            ocspServiceProvider
-        );
-    }
-
     public static SubjectCertificateValidatorBatch createCertTrustValidators(
         AuthTokenValidationConfiguration configuration,
         Set<TrustAnchor> trustedCACertificateAnchors,

src/main/java/eu/webeid/security/validator/AuthTokenValidatorFactory.java

@@ -4,19 +4,21 @@
 
 import java.util.List;
 
-import static eu.webeid.security.validator.AuthTokenV1Validator.SUPPORTED_TOKEN_FORMAT_VERSION;
-
 public final class AuthTokenValidatorFactory {
     private final List<AuthTokenValidator> validators;
 
     public AuthTokenValidatorFactory(List<AuthTokenValidator> validators) {
         this.validators = List.copyOf(validators);
     }
 
+    public boolean supports(String format) {
+        return validators.stream().anyMatch(v -> v.supports(format));
+    }
+
     public AuthTokenValidator requireFor(String format) throws AuthTokenParseException {
         return validators.stream()
-                .filter(v -> v.supports(format))
-                .findFirst()
-                .orElseThrow(() -> new AuthTokenParseException("Only token format version '" + SUPPORTED_TOKEN_FORMAT_VERSION + "' is currently supported"));
+            .filter(v -> v.supports(format))
+            .findFirst()
+            .orElseThrow(() -> new AuthTokenParseException("Token format version '" + format + "' is currently not supported"));
     }
 }

src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java

@@ -60,38 +60,38 @@ final class AuthTokenValidatorImpl implements AuthTokenValidator {
     private final AuthTokenValidatorFactory tokenValidatorFactory;
 
     AuthTokenValidatorImpl(AuthTokenValidationConfiguration configuration, OcspClient ocspClient) throws JceException {
-        final AuthTokenValidationConfiguration copiedConfig = configuration.copy();
+        final AuthTokenValidationConfiguration validationConfig = configuration.copy();
 
-        final Set<TrustAnchor> trustedCACertificateAnchors = CertificateValidator.buildTrustAnchorsFromCertificates(copiedConfig.getTrustedCACertificates());
-        final CertStore trustedCACertificateCertStore = CertificateValidator.buildCertStoreFromCertificates(copiedConfig.getTrustedCACertificates());
+        final Set<TrustAnchor> trustedCACertificateAnchors = CertificateValidator.buildTrustAnchorsFromCertificates(validationConfig.getTrustedCACertificates());
+        final CertStore trustedCACertificateCertStore = CertificateValidator.buildCertStoreFromCertificates(validationConfig.getTrustedCACertificates());
 
         final SubjectCertificateValidatorBatch simpleSubjectCertificateValidators = SubjectCertificateValidatorBatch.createFrom(
             SubjectCertificatePurposeValidator::validateCertificatePurpose,
-            new SubjectCertificatePolicyValidator(copiedConfig.getDisallowedSubjectCertificatePolicies())::validateCertificatePolicies
+            new SubjectCertificatePolicyValidator(validationConfig.getDisallowedSubjectCertificatePolicies())::validateCertificatePolicies
         );
 
         // OcspClient uses built-in HttpClient internally by default.
         // A single HttpClient instance is reused for all HTTP calls to utilize connection and thread pools.
-        if (copiedConfig.isUserCertificateRevocationCheckWithOcspEnabled()) {
+        if (validationConfig.isUserCertificateRevocationCheckWithOcspEnabled()) {
             Objects.requireNonNull(ocspClient, "OCSP client must not be null when OCSP check is enabled");
             ocspServiceProvider = new OcspServiceProvider(
-                copiedConfig.getDesignatedOcspServiceConfiguration(),
+                validationConfig.getDesignatedOcspServiceConfiguration(),
                 new AiaOcspServiceConfiguration(
-                    copiedConfig.getNonceDisabledOcspUrls(),
+                    validationConfig.getNonceDisabledOcspUrls(),
                     trustedCACertificateAnchors,
                     trustedCACertificateCertStore));
         }
 
         final AuthTokenSignatureValidator authTokenSignatureValidator =
-            new AuthTokenSignatureValidator(copiedConfig.getSiteOrigin());
+            new AuthTokenSignatureValidator(validationConfig.getSiteOrigin());
 
         this.tokenValidatorFactory = new AuthTokenValidatorFactory(List.of(
             new AuthTokenV11Validator(
                 simpleSubjectCertificateValidators,
                 trustedCACertificateAnchors,
                 trustedCACertificateCertStore,
                 authTokenSignatureValidator,
-                copiedConfig,
+                validationConfig,
                 ocspClient,
                 ocspServiceProvider
             ),
@@ -100,7 +100,7 @@ final class AuthTokenValidatorImpl implements AuthTokenValidator {
                 trustedCACertificateAnchors,
                 trustedCACertificateCertStore,
                 authTokenSignatureValidator,
-                copiedConfig,
+                validationConfig,
                 ocspClient,
                 ocspServiceProvider
             )
@@ -109,12 +109,7 @@ final class AuthTokenValidatorImpl implements AuthTokenValidator {
 
     @Override
     public boolean supports(String format) {
-        try {
-            tokenValidatorFactory.requireFor(format);
-            return true;
-        } catch (AuthTokenParseException e) {
-            return false;
-        }
+        return tokenValidatorFactory.supports(format);
     }
 
     @Override

src/test/java/eu/webeid/security/testutil/AbstractTestWithValidator.java

@@ -44,7 +44,7 @@ public abstract class AbstractTestWithValidator {
         "\"signature\":\"0Ov7ME6pTY1K2GXMj8Wxov/o2fGIMEds8OMY5dKdkB0nrqQX7fG1E5mnsbvyHpMDecMUH6Yg+p1HXdgB/lLqOcFZjt/OVXPjAAApC5d1YgRYATDcxsR1zqQwiNcHdmWn\"," +
         "\"format\":\"web-eid:1.0\"}";
 
-    public static final String VALID_NFC_AUTH_TOKEN = "{\"algorithm\":\"ES384\"," +
+    public static final String VALID_V11_AUTH_TOKEN = "{\"algorithm\":\"ES384\"," +
         "\"unverifiedCertificate\":\"MIIEBDCCA2WgAwIBAgIQY5OGshxoPMFg+Wfc0gFEaTAKBggqhkjOPQQDBDBgMQswCQYDVQQGEwJFRTEbMBkGA1UECgwSU0sgSUQgU29sdXRpb25zIEFTMRcwFQYDVQRhDA5OVFJFRS0xMDc0NzAxMzEbMBkGA1UEAwwSVEVTVCBvZiBFU1RFSUQyMDE4MB4XDTIxMDcyMjEyNDMwOFoXDTI2MDcwOTIxNTk1OVowfzELMAkGA1UEBhMCRUUxKjAoBgNVBAMMIUrDlUVPUkcsSkFBSy1LUklTVEpBTiwzODAwMTA4NTcxODEQMA4GA1UEBAwHSsOVRU9SRzEWMBQGA1UEKgwNSkFBSy1LUklTVEpBTjEaMBgGA1UEBRMRUE5PRUUtMzgwMDEwODU3MTgwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQmwEKsJTjaMHSaZj19hb9EJaJlwbKc5VFzmlGMFSJVk4dDy+eUxa5KOA7tWXqzcmhh5SYdv+MxcaQKlKWLMa36pfgv20FpEDb03GCtLqjLTRZ7649PugAQ5EmAqIic29CjggHDMIIBvzAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIDiDBHBgNVHSAEQDA+MDIGCysGAQQBg5EhAQIBMCMwIQYIKwYBBQUHAgEWFWh0dHBzOi8vd3d3LnNrLmVlL0NQUzAIBgYEAI96AQIwHwYDVR0RBBgwFoEUMzgwMDEwODU3MThAZWVzdGkuZWUwHQYDVR0OBBYEFPlp/ceABC52itoqppEmbf71TJz6MGEGCCsGAQUFBwEDBFUwUzBRBgYEAI5GAQUwRzBFFj9odHRwczovL3NrLmVlL2VuL3JlcG9zaXRvcnkvY29uZGl0aW9ucy1mb3ItdXNlLW9mLWNlcnRpZmljYXRlcy8TAkVOMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAfBgNVHSMEGDAWgBTAhJkpxE6fOwI09pnhClYACCk+ezBzBggrBgEFBQcBAQRnMGUwLAYIKwYBBQUHMAGGIGh0dHA6Ly9haWEuZGVtby5zay5lZS9lc3RlaWQyMDE4MDUGCCsGAQUFBzAChilodHRwOi8vYy5zay5lZS9UZXN0X29mX0VTVEVJRDIwMTguZGVyLmNydDAKBggqhkjOPQQDBAOBjAAwgYgCQgDCAgybz0u3W+tGI+AX+PiI5CrE9ptEHO5eezR1Jo4j7iGaO0i39xTGUB+NSC7P6AQbyE/ywqJjA1a62jTLcS9GHAJCARxN4NO4eVdWU3zVohCXm8WN3DWA7XUcn9TZiLGQ29P4xfQZOXJi/z4PNRRsR4plvSNB3dfyBvZn31HhC7my8woi\"," +
         "\"unverifiedSigningCertificate\":\"MIIEBDCCA2WgAwIBAgIQY5OGshxoPMFg+Wfc0gFEaTAKBggqhkjOPQQDBDBgMQswCQYDVQQGEwJFRTEbMBkGA1UECgwSU0sgSUQgU29sdXRpb25zIEFTMRcwFQYDVQRhDA5OVFJFRS0xMDc0NzAxMzEbMBkGA1UEAwwSVEVTVCBvZiBFU1RFSUQyMDE4MB4XDTIxMDcyMjEyNDMwOFoXDTI2MDcwOTIxNTk1OVowfzELMAkGA1UEBhMCRUUxKjAoBgNVBAMMIUrDlUVPUkcsSkFBSy1LUklTVEpBTiwzODAwMTA4NTcxODEQMA4GA1UEBAwHSsOVRU9SRzEWMBQGA1UEKgwNSkFBSy1LUklTVEpBTjEaMBgGA1UEBRMRUE5PRUUtMzgwMDEwODU3MTgwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQmwEKsJTjaMHSaZj19hb9EJaJlwbKc5VFzmlGMFSJVk4dDy+eUxa5KOA7tWXqzcmhh5SYdv+MxcaQKlKWLMa36pfgv20FpEDb03GCtLqjLTRZ7649PugAQ5EmAqIic29CjggHDMIIBvzAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIDiDBHBgNVHSAEQDA+MDIGCysGAQQBg5EhAQIBMCMwIQYIKwYBBQUHAgEWFWh0dHBzOi8vd3d3LnNrLmVlL0NQUzAIBgYEAI96AQIwHwYDVR0RBBgwFoEUMzgwMDEwODU3MThAZWVzdGkuZWUwHQYDVR0OBBYEFPlp/ceABC52itoqppEmbf71TJz6MGEGCCsGAQUFBwEDBFUwUzBRBgYEAI5GAQUwRzBFFj9odHRwczovL3NrLmVlL2VuL3JlcG9zaXRvcnkvY29uZGl0aW9ucy1mb3ItdXNlLW9mLWNlcnRpZmljYXRlcy8TAkVOMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAfBgNVHSMEGDAWgBTAhJkpxE6fOwI09pnhClYACCk+ezBzBggrBgEFBQcBAQRnMGUwLAYIKwYBBQUHMAGGIGh0dHA6Ly9haWEuZGVtby5zay5lZS9lc3RlaWQyMDE4MDUGCCsGAQUFBzAChilodHRwOi8vYy5zay5lZS9UZXN0X29mX0VTVEVJRDIwMTguZGVyLmNydDAKBggqhkjOPQQDBAOBjAAwgYgCQgDCAgybz0u3W+tGI+AX+PiI5CrE9ptEHO5eezR1Jo4j7iGaO0i39xTGUB+NSC7P6AQbyE/ywqJjA1a62jTLcS9GHAJCARxN4NO4eVdWU3zVohCXm8WN3DWA7XUcn9TZiLGQ29P4xfQZOXJi/z4PNRRsR4plvSNB3dfyBvZn31HhC7my8woi\"," +
         "\"supportedSignatureAlgorithms\":[{\"cryptoAlgorithm\":\"RSA\",\"hashFunction\":\"SHA-256\",\"paddingScheme\":\"PKCS1.5\"}]," +
@@ -55,14 +55,14 @@ public abstract class AbstractTestWithValidator {
 
     protected AuthTokenValidator validator;
     protected WebEidAuthToken validAuthToken;
-    protected WebEidAuthToken validNfcAuthToken;
+    protected WebEidAuthToken validV11AuthToken;
 
     @BeforeEach
     protected void setup() {
         try {
             validator = AuthTokenValidators.getAuthTokenValidator();
             validAuthToken = validator.parse(VALID_AUTH_TOKEN);
-            validNfcAuthToken = validator.parse(VALID_NFC_AUTH_TOKEN);
+            validV11AuthToken = validator.parse(VALID_V11_AUTH_TOKEN);
         } catch (CertificateException | IOException | AuthTokenException e) {
             throw new RuntimeException(e);
         }
@@ -75,7 +75,7 @@ protected WebEidAuthToken replaceTokenField(String token, String field, String v
 
     protected WebEidAuthToken removeJsonField() throws Exception {
         ObjectMapper mapper = new ObjectMapper();
-        ObjectNode node = (ObjectNode) mapper.readTree(AbstractTestWithValidator.VALID_NFC_AUTH_TOKEN);
+        ObjectNode node = (ObjectNode) mapper.readTree(AbstractTestWithValidator.VALID_V11_AUTH_TOKEN);
         node.remove("supportedSignatureAlgorithms");
         return validator.parse(mapper.writeValueAsString(node));
     }

src/test/java/eu/webeid/security/validator/AuthTokenAlgorithmTest.java

@@ -60,7 +60,7 @@ void whenAlgorithmInvalid_thenParsingFails() throws AuthTokenException {
     }
 
     @Test
-    void whenNfcTokenMissingSupportedAlgorithms_thenValidationFails() throws Exception {
+    void whenV11TokenMissingSupportedAlgorithms_thenValidationFails() throws Exception {
         final WebEidAuthToken token = removeJsonField();
 
         assertThatThrownBy(() -> validator.validate(token, VALID_CHALLENGE_NONCE))
@@ -69,9 +69,9 @@ void whenNfcTokenMissingSupportedAlgorithms_thenValidationFails() throws Excepti
     }
 
     @Test
-    void whenNfcTokenHasInvalidCryptoAlgorithm_thenValidationFails() throws Exception {
+    void whenV11TokenHasInvalidCryptoAlgorithm_thenValidationFails() throws Exception {
         final WebEidAuthToken token = replaceTokenField(
-            VALID_NFC_AUTH_TOKEN,
+            VALID_V11_AUTH_TOKEN,
             "\"cryptoAlgorithm\":\"RSA\"",
             "\"cryptoAlgorithm\":\"INVALID\""
         );
@@ -82,9 +82,9 @@ void whenNfcTokenHasInvalidCryptoAlgorithm_thenValidationFails() throws Exceptio
     }
 
     @Test
-    void whenNfcTokenHasInvalidHashFunction_thenValidationFails() throws Exception {
+    void whenV11TokenHasInvalidHashFunction_thenValidationFails() throws Exception {
         final WebEidAuthToken token = replaceTokenField(
-            VALID_NFC_AUTH_TOKEN,
+            VALID_V11_AUTH_TOKEN,
             "\"hashFunction\":\"SHA-256\"",
             "\"hashFunction\":\"NOT_A_HASH\""
         );
@@ -95,9 +95,9 @@ void whenNfcTokenHasInvalidHashFunction_thenValidationFails() throws Exception {
     }
 
     @Test
-    void whenNfcTokenHasInvalidPaddingScheme_thenValidationFails() throws Exception {
+    void whenV11TokenHasInvalidPaddingScheme_thenValidationFails() throws Exception {
         final WebEidAuthToken token = replaceTokenField(
-            VALID_NFC_AUTH_TOKEN,
+            VALID_V11_AUTH_TOKEN,
             "\"paddingScheme\":\"PKCS1.5\"",
             "\"paddingScheme\":\"BAD_PADDING\""
         );
@@ -108,9 +108,9 @@ void whenNfcTokenHasInvalidPaddingScheme_thenValidationFails() throws Exception
     }
 
     @Test
-    void whenNfcTokenHasEmptySupportedAlgorithms_thenValidationFails() throws Exception {
+    void whenV11TokenHasEmptySupportedAlgorithms_thenValidationFails() throws Exception {
         final WebEidAuthToken token = replaceTokenField(
-            VALID_NFC_AUTH_TOKEN,
+            VALID_V11_AUTH_TOKEN,
             "\"supportedSignatureAlgorithms\":[{\"cryptoAlgorithm\":\"RSA\",\"hashFunction\":\"SHA-256\",\"paddingScheme\":\"PKCS1.5\"}]",
             "\"supportedSignatureAlgorithms\":[]"
         );