How to get my TrustManagerFactory registered ?

Question

Hi all,
As a newbee in java security, I am probably missing a small detail somewhere.
I created my own TrustManagerFactory. I try to register it using my own Provider. To actually be able to debug, I also had to override Provider.Service.
Calling on the Provider.Service.newInstance method directly promptly returns my own LoginTrustManagerFactory. Using the JCE provider framework I see the debugger running through this method and returning my LoginTrustManagerFactory. However, some GetInstance class seems to think it is not a TrustManagerFactory:
java.security.NoSuchAlgorithmException: class configured for TrustManagerFactory: com.docner.auth.KeyStoreLoginAndSSLModule$LoginTrustManagerFactory not a TrustManagerFactory
at sun.security.jca.GetInstance.checkSuperClass(GetInstance.java:242)
at sun.security.jca.GetInstance.getInstance(GetInstance.java:221)
at sun.security.jca.GetInstance.getInstance(GetInstance.java:147)
at javax.net.ssl.TrustManagerFactory.getInstance(TrustManagerFactory.java:110)
at com.docner.auth.KeyStoreLoginAndSSLModule.testProvider(KeyStoreLoginAndSSLModule.java:397)
If anyone can help, please do.
Actually, I want a simple thing: I want to use a KeyStore on the classpath and not in a file for trust.
I use JAAS to log in a user and in this process, I add a LoginModule that reads public certificates from a jar on the class path and populates the Subject. Then I create a TrustManager that gets all certificates from the Subject using the AccessController. Works fine.
Now I need to get SSL to use my TrustManager. At first, I tried the SSLContext.init( ... ) way. This does not work for the JINI JERI invocation layer, as that creates a new SSLContext every time. But it reads the TrustManagerFactory using a specified algorithm name.
So these are my current steps:
- Create a LoginTrustProvider ( extends java.security.Provider ).
- Create a LoginTrustService ( extends java.security.Provider.Service ) which is added to the LoginTrustProvider in the provider's constructor
- This service's newInstance method disregards any arguments and simply creates my new factory
- The LoginTrustManagerFactory extends javax.net.ssl.TrustManagerFactory
- in its constructor, the factory creates a new LoginTrustManagerFactorySpi which is passed to the super class
- The LoginTrustManagerFactorySpi returns exactly 1 TrustManager, a new LoginTrustManager().
- The LoginTrustManager actually gets the Subject using Subject.getSubject( AccessController.getContext() ) and can check wether the credential that is supplied matches any known certificate. I have not even started thinking about actually verifying the whole path, this is just a basic setup.
Now everything works when I start debugging it, except for the fact that the GetInstance class decides that the LoginTrustManagerFactory is no TrustManagerFactory even when it directly extends TrustManagerFactory !!
I think I really need some help here. You might even wonder if there is a simpler way.

Answer 1

Maybe anyone could tell me what the GetInstance class is actually doing ?
The exception is thrown from the checkSuperClass method; what checks are done here ?
sun.security.jca.GetInstance.checkSuperClass(GetInstance.java:242)
And what specifically is it doing at line 242 and just before ?