@ SneakyThrows private static Credential getEncryptionCredential ( final WsFederationConfiguration config ) { LOGGER . debug ( "Locating encryption credential private key [{}]" , config . getEncryptionPrivateKey ( ) ) ; val br = new BufferedReader ( new InputStreamReader ( config . getEncryptionPrivateKey ( ) . getInputStream ( ) , StandardCharsets . UTF_8 ) ) ; Security . addProvider ( new BouncyCastleProvider ( ) ) ; LOGGER . debug ( "Parsing credential private key" ) ; try ( val pemParser = new PEMParser ( br ) ) { val privateKeyPemObject = pemParser . readObject ( ) ; val converter = new JcaPEMKeyConverter ( ) . setProvider ( new BouncyCastleProvider ( ) ) ; val kp = FunctionUtils . doIf ( Predicates . instanceOf ( PEMEncryptedKeyPair . class ) , Unchecked . supplier ( ( ) -> { LOGGER . debug ( "Encryption private key is an encrypted keypair" ) ; val ckp = ( PEMEncryptedKeyPair ) privateKeyPemObject ; val decProv = new JcePEMDecryptorProviderBuilder ( ) . build ( config . getEncryptionPrivateKeyPassword ( ) . toCharArray ( ) ) ; LOGGER . debug ( "Attempting to decrypt the encrypted keypair based on the provided encryption private key password" ) ; return converter . getKeyPair ( ckp . decryptKeyPair ( decProv ) ) ; } ) , Unchecked . supplier ( ( ) -> { LOGGER . debug ( "Extracting a keypair from the private key" ) ; return converter . getKeyPair ( ( PEMKeyPair ) privateKeyPemObject ) ; } ) ) . apply ( privateKeyPemObject ) ; val certParser = new X509CertParser ( ) ; LOGGER . debug ( "Locating encryption certificate [{}]" , config . getEncryptionCertificate ( ) ) ; certParser . engineInit ( config . getEncryptionCertificate ( ) . getInputStream ( ) ) ; LOGGER . debug ( "Invoking certificate engine to parse the certificate [{}]" , config . getEncryptionCertificate ( ) ) ; val cert = ( X509CertificateObject ) certParser . engineRead ( ) ; LOGGER . debug ( "Creating final credential based on the certificate [{}] and the private key" , cert . getIssuerDN ( ) ) ; return new BasicX509Credential ( cert , kp . getPrivate ( ) ) ; } }
Gets encryption credential . The encryption private key will need to contain the private keypair in PEM format . The encryption certificate is shared with ADFS in DER format i . e certificate . crt .