Home.... | log in.... | Pub my question! | Sign-up....
Java-index >> Security >> Cryptography

KestoreLoginModule: Unable to find X.509 certificate chain in keystore

Hi,

I'm work with SmartCard, and I want use JAAS method to authenticate. So, my config file is that:

SmartCardLogin {

com.sun.security.auth.module.KeyStoreLoginModule required debug=true

keyStoreURL="NONE"

keyStoreType="PKCS11"

keyStoreProvider="SunPKCS11-ceres";

};

and the login context initialize is:

CallHandler=new ImpCallBackHandler(ent);

lc=new LoginContext("SmartCardLogin",CallHandler);

then, I'm login keystore :

lc.login();-->provoke a FailedLoginException.

javax.security.auth.login.FailedLoginException: Unable to find X.509 certificate chain in keystoreat com.sun.security.auth.module.KeyStoreLoginModule.getKeyStoreInfo(KeyStoreLoginModule.java:607)

at com.sun.security.auth.module.KeyStoreLoginModule.login(KeyStoreLoginModule.java:302)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

at java.lang.reflect.Method.invoke(Method.java:585)

at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)

at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)

at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)

at java.security.AccessController.doPrivileged(Native Method)

at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)

at javax.security.auth.login.LoginContext.login(LoginContext.java:579)

So, somebody know any solutions?

Thanks,

[1679 byte] By [alexhora] at [2007-10-3 4:45:40]
«« Where is JCOP update site?
»» Displaytag Error
# 1

I have not worked with JAAS, so I may be off-base on this, but if the underlying code is expecting to find the entire certificate-chain on the smartcard, it is not likely to find it - and that may be the problem.

Depending on the type of smartcard being used, they can contain very little storage space; so in the past, application vendors dealt with it by storing only the key-pair of the end-entity and their one certificate on the smartcard, and going to the computer's certificate-store for the end-entity's certificate-chain.Some browsers require that the EE certificate also be on the computer's cert-store for this to work (but the private key may still be on the card).

If the underlying Sun code in JAAS does not follow the same paradigm (and I don't think it does), it will not work as long as you don't have the entire cert-chain on the card. However, you can get cards today with more memory than was available 10 years ago. So, if you have a 32K-128K card, you can easily put a key-pair, the end-entity certificate, plus the EE cert-chain on the card (assuming that the cert-chain is not very deep - perhaps 2-3 CA certificates) and then try your test again.

arshad.noora at 2007-7-14 22:49:59 > top of Java-index,Security,Cryptography...
Security
Cryptography

Security New Topic

Security Hot Topic

Security

All Classified