O projeto consiste de DispatchActions, Servlets e Applets.
Os testes foram feitos com o token EPASS2000 da Pronova. Onde o funcionamento depende de dois arquivos principais: pkcs11.cfg (arquivo de configuração) e ngp11v211.dll.
Aqui eu separo os elementos do projeto em várias partes, caso o link de download fique quebrado.
Applet
O módulo de applet está com as classes SignatureManager e TokenSignerApplet.
package br.com.certificacao;
import java.applet.Applet;
import java.io.File;
import java.io.FileOutputStream;
import java.io.FileWriter;
import java.io.IOException;
import java.io.InputStream;
import java.net.HttpURLConnection;
import java.net.MalformedURLException;
import java.net.URL;
import java.security.GeneralSecurityException;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.Provider;
import java.security.Security;
import java.security.cert.Certificate;
import java.util.Enumeration;
/**
* Classe responsável por gerenciar a assinatura contida em
* um token. É necessário efetuar o login no dispositivo
* antes de utilizá-lo.
*/
public class SignatureManager {
private KeyStore keyStore;
private char[] PIN;
private final String CONFIG_DIR_NAME = "C:\\assinatura\\";
private final String CONFIG_FILE_NAME = "pkcs11.cfg";
private final String WINDOWS_DIR_NAME = "C:\\Windows\\System32\\";
private final String DLL_FILE_NAME = "ngp11v211.dll";
private String arquivoDLLApp = "";
public void createTokenFiles(String urlApp){
criarDiretorio();
criarDLL(urlApp);
createConfigFile();
}
private void criarDiretorio(){
try {
File dir = new File(CONFIG_DIR_NAME);
if (!dir.exists()){
dir.mkdirs();
}
}catch (Exception e) {
}
}
private void createConfigFile(){
try {
File file = new File(CONFIG_DIR_NAME + CONFIG_FILE_NAME);
file.createNewFile();
FileWriter writer = new FileWriter(file);
writer.write("name = PKCS11\n");
writer.write("library = " + arquivoDLLApp + "\n");
writer.write("slot = 1\n");
writer.write("disabledMechanisms = {\n");
writer.write(" CKM_SHA1_RSA_PKCS\n");
writer.write("}\n");
writer.flush();
writer.close();
} catch (IOException e) {
e.printStackTrace();
}
}
/**
* Metodo que verifica a situação da DLL do Token e-Pass da Pronova.
* Verifica se a DLL já está criada na pasta Windows\System32.
* Se o arquivo não existir, cria uma cópia na pasta apontada pela variável CONFIG_DIR_NAME.
*
* @param urlApp
*/
private void criarDLL(String urlApp){
try {
File dllWindows = new File(WINDOWS_DIR_NAME + DLL_FILE_NAME);
if (dllWindows.exists()){
arquivoDLLApp = WINDOWS_DIR_NAME + DLL_FILE_NAME;
}else{
arquivoDLLApp = CONFIG_DIR_NAME + DLL_FILE_NAME;
URL url = new URL(urlApp+ "DLLServlet");
HttpURLConnection connectionGet = (HttpURLConnection) url.openConnection();
connectionGet.setRequestProperty("Request-Method", "GET");
connectionGet.setDoInput(true);
connectionGet.setDoOutput(false);
connectionGet.connect();
// imprime o numero do resultado
System.out.println("Resultado: "+ connectionGet.getResponseCode()+ "/"+ connectionGet.getResponseMessage());
InputStream input = connectionGet.getInputStream();
File file = new File(arquivoDLLApp);
file.createNewFile();
FileOutputStream output = new FileOutputStream(file);
int b = 0;
while (-1 != ((b = input.read()))) {
output.write(b);
}
output.close();
}
} catch (MalformedURLException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
}
}
/**
* @param password representa o PIN informado pelo usuário
* @return true se houve sucesso no login ou false se ocorreu
* algum erro
*/
public boolean login(String password, Applet applet)throws Exception{
boolean status = true;
try {
PIN = password.toCharArray();
//A configuracao do provider eh possivel diante de tres opcoes:
//1.Configuracao do java.security
// p. ex:security.provider.10=sun.security.pkcs11.SunPKCS11 D:\\desenvolvimento\\projetos\\funasa\\pkcs11.cfg
//2.Pedindo para o usuario fornecer o arquivo de configuracao, através de um uploader (argh!!)
//3.Manualmente, no codigo da applet
//Foi escolhida a forma manual.
Provider p = new sun.security.pkcs11.SunPKCS11(CONFIG_DIR_NAME + CONFIG_FILE_NAME);
Security.addProvider(p);
keyStore = KeyStore.getInstance("PKCS11");
keyStore.load(null, PIN);
}catch(Exception e){
throw new Exception(e);
}
return status;
}
/**
* @return chain representa o certificado armazenado no token
*/
public Certificate[] getCertificate(){
Certificate[] chain = null;
try {
Enumeration aliasesEnum = keyStore.aliases();
while (aliasesEnum.hasMoreElements()){
String alias = aliasesEnum.nextElement();
if(keyStore.isKeyEntry(alias)){
chain = keyStore.getCertificateChain(alias);
break;
}
}
} catch (GeneralSecurityException e) {
e.printStackTrace();
}
return chain;
}
/**
* @return privateKey representa a chave privada armazenada no Token
*/
public PrivateKey getPrivateKey() {
PrivateKey privateKey = null;
try {
Enumeration aliasesEnum = keyStore.aliases();
while (aliasesEnum.hasMoreElements()){
String alias = aliasesEnum.nextElement();
if(keyStore.isKeyEntry(alias)){
privateKey = (PrivateKey)keyStore.getKey(alias, PIN);
keyStore.getCertificateChain(alias);
break;
}
}
} catch (GeneralSecurityException e) {
e.printStackTrace();
}
return privateKey;
}
}
package br.com.certificacao;
import java.applet.Applet;
import java.awt.Button;
import java.awt.Color;
import java.awt.Dimension;
import java.awt.event.ActionEvent;
import java.awt.event.ActionListener;
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.util.Calendar;
import javax.swing.JOptionPane;
import netscape.javascript.JSObject;
import com.lowagie.text.pdf.PdfReader;
import com.lowagie.text.pdf.PdfSignatureAppearance;
import com.lowagie.text.pdf.PdfStamper;
public class TokenSignerApplet extends Applet {
private static final long serialVersionUID = 4023705496194390163L;
private static final String PIN_CODE_PARAM = "pinCodeField";
private static final String NOME_PARAM = "nomeField";
private static final String APP_URL_PARAM = "appUrlField";
private static final String SIGN_BUTTON_CAPTION_PARAM = "signButtonCaption";
private Button mSignButton;
private SignatureManager manager = new SignatureManager();
/**
* Cria e inicializa a interface grafica da applet.
*/
public void init() {
criarArquivoToken();
String signButtonCaption = this.getParameter(SIGN_BUTTON_CAPTION_PARAM);
mSignButton = new Button(signButtonCaption);
mSignButton.setLocation(0, 0);
Dimension appletSize = this.getSize();
mSignButton.setSize(appletSize);
mSignButton.setBackground(new Color(190, 1, 1));
mSignButton.setForeground(new Color(255,255,255));
mSignButton.addActionListener(new ActionListener(){
public void actionPerformed(ActionEvent e) {
assinaStream();
}
});
this.setLayout(null);
this.add(mSignButton);
}
public void assinaStream(){
JSObject browserWindow = JSObject.getWindow(this);
JSObject mainForm = (JSObject)browserWindow.eval("document.forms[0]");
String pinCodeParam = getParameter(PIN_CODE_PARAM);
JSObject pinCodeField = (JSObject)mainForm.getMember(pinCodeParam);
String pinCode = (String)pinCodeField.getMember("value");
String nomeParam = getParameter(NOME_PARAM);
JSObject nomeField = (JSObject)mainForm.getMember(nomeParam);
String nome = (String)nomeField.getMember("value");
String appParam = this.getParameter(APP_URL_PARAM);
JSObject appField = (JSObject) mainForm.getMember(appParam);
String appUrl = (String) appField.getMember("value");
try{
//Chama o servlet para leitura do pdf.
String urlArquivoServlet = appUrl + "/ArquivoServlet";
URL url = new URL(urlArquivoServlet);
HttpURLConnection connectionGet = (HttpURLConnection)url.openConnection();
connectionGet.setRequestProperty("Request-Method", "GET");
connectionGet.setDoInput(true);
connectionGet.setDoOutput(false);
connectionGet.connect();
//Stream de LEITURA de dados do pdf
InputStream input = connectionGet.getInputStream();
SignatureManager manager = new SignatureManager();
if(manager.login(pinCode, this)){
java.security.PrivateKey key = manager.getPrivateKey();
java.security.cert.Certificate certificate[] = manager.getCertificate();
try{
PdfReader pdfReader = new PdfReader(input);
//Monta a conexao com o Servlet para escrever o arquivo assinado digitalmente
HttpURLConnection connectionPost = (HttpURLConnection)url.openConnection();
connectionPost.setRequestProperty("Content-Type", "application/pdf");
connectionPost.setDoOutput(true);
connectionPost.connect();
OutputStream output = connectionPost.getOutputStream();
//Assina PDF
PdfStamper stamper = PdfStamper.createSignature(pdfReader, output, '\0');
PdfSignatureAppearance signAppearance = stamper.getSignatureAppearance();
signAppearance.setCrypto(key, certificate, null, PdfSignatureAppearance.WINCER_SIGNED);
signAppearance.setReason("Empresa S/A");
signAppearance.setLocation("Sao Paulo - SP");
signAppearance.setSignDate(Calendar.getInstance());
signAppearance.setCertificationLevel(1);
stamper.close();
BufferedReader rd = new BufferedReader(new InputStreamReader(connectionPost.getInputStream()));
String line;
while((line = rd.readLine()) != null){
System.out.println(line);
}
output.close();
input.close();
rd.close();
//chamada de uma funcao javascript no jsp
browserWindow.call("chamaAction", new Object[] {nome});
}
catch(Exception e){
e.printStackTrace();
}
} else{
JOptionPane.showMessageDialog(this, "Erro ao assinar documento.");
}
input.close();
}
catch(Exception e)
{
e.printStackTrace();
}
}
private void criarArquivoToken(){
try {
JSObject browserWindow = JSObject.getWindow(this);
JSObject mainForm = (JSObject) browserWindow.eval("document.forms[0]");
String appParam = this.getParameter(APP_URL_PARAM);
JSObject appField = (JSObject) mainForm.getMember(appParam);
String app = (String) appField.getMember("value");
manager.createTokenFiles(app);
}catch (Exception e) {
e.printStackTrace();
}
}
}
<%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>
<html>
<head>
<title>Teste Token Signer Applet</title>
</head>
<body>
<script type="text/javascript">
function chamaAction(tarefa){
var forward = "./certificacao.do?method=doFimCertificacao" +
"&idTarefa=" + tarefa;
doSubmit(forward);
}
</script>
<form>
<input type="hidden" name="appUrl" value=${pageContext.request.contextPath}>
Código PIN:
<input type="text" width="100" size=80 name="pinCode">
<br>
Nome:
<input type="text" width="100" size=80 name="nome" value=${nome_request}>
</form>
<object
classid="clsid:8AD9C840-044E-11D1-B3E9-00805F499D93"
codebase="http://java.sun.com/update/1.5.0/jinstall-1_5-windows-i586.cab#Version=5,0,0,5"
width="130" height="25" name="TokenSignerApplet">
<param name="code" value="br.com.certificacao.TokenSignerApplet">
<param name="archive" value="TokenSignerApplet.jar , ./certificacao/bcprov-jdk14-138.jar , ./certificacao/iText-2.0.8.jar">
<param name="mayscript" value="true">
<param name="type" value="application/x-java-applet;version=1.5">
<param name="scriptable" value="false">
<param name="signButtonCaption" value="Assinar Documento">
<param name="appUrlField" value="appUrl">
<param name="pinCodeField" value="pinCode">
<param name="nomeField" value="nome">
<comment>
<embed
type="application/x-java-applet;version=1.5"
code="br.com.certificacao.TokenSignerApplet"
archive="TokenSignerApplet.jar , ./certificacao/bcprov-jdk14-138.jar , ./certificacao/iText-2.0.8.jar"
width="130" height="25" scriptable="true"
pluginspage="http://java.sun.com/products/plugin/index.html#download"
appUrlField="appUrl"
pinCodeField="pinCode"
signButtonCaption="Assinar Documento"
nomeField="nome">
</embed>
</comment>
</object>
</body>
</html>
Servlet
package br.com.servlet;
import java.io.BufferedOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
* Servlet que gerencia o armazenamento do arquivo assinado.
*
* @author marcelo.garcia
*
*/
public class ArquivoServlet extends HttpServlet {
private static final long serialVersionUID = 4102000674926121528L;
/**
* Recupera um arquivo e envia para o cliente (por ex. um applet)
*/
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
System.out.println("ArquivoServlet - doGet");
lerArquivo(request, response);
}
/**
* Recebe o arquivo assinado e grava em disco no servidor.
*/
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
System.out.println("ArquivoServlet - doPost");
try {
InputStream input = request.getInputStream();
File file = new File("D:\\temp\\ResumoServletCriado.pdf");
file.createNewFile();
FileOutputStream output = new FileOutputStream(file);
int b = 0;
while (-1 != ((b = input.read()))) {
output.write(b);
}
output.close();
} catch (IOException e) {
e.printStackTrace();
}
}
/**
* Recupera um arquivo pdf
*
* @param request
* @param response
* @throws ServletException
* @throws IOException
*/
private void lerArquivo (HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
System.out.println("ArquivoServlet - lerArquivo");
try {
response.setContentType("application/pdf");
InputStream is = new FileInputStream("D:\\temp\\Resumo.pdf");
geraOutput(response, is);
} catch (Exception e) {
e.printStackTrace();
}
}
/**
* Gera saída do arquivo PDF gerado
*
* @param response
* @param is
* @throws IOException
*/
private void geraOutput(HttpServletResponse response, InputStream is) throws IOException {
BufferedOutputStream out = new BufferedOutputStream(response.getOutputStream());
try {
response.setCharacterEncoding("iso-8859-1");
int c;
while ((c = is.read()) != -1) {
byte[] b = new byte[1];
b[0] = (byte)c;
out.write(b);
}
} finally {
if (is != null)
is.close();
if (out != null){
out.flush();
out.close();
}
}
}
}
package br.com.servlet;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
* Servlet que controla a DLL do token da pronova.
*
* @author marcelo.garcia
*/
public class DLLServlet extends HttpServlet {
private static final long serialVersionUID = -3363073130063055864L;
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
System.out.println("DO-post");
try {
InputStream url = this.getServletContext().getResourceAsStream("\\dll\\ngp11v211.dll");
OutputStream output = response.getOutputStream();
int b = 0;
while (-1 != ((b = url.read()))) {
output.write(b);
}
output.close();
url.close();
} catch (IOException e) {
e.printStackTrace();
}
}
protected void doPost(HttpServletRequest request, HttpServletResponse response)throws ServletException, IOException {
doGet(request, response);
}
}
Struts
package br.com.struts;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.struts.action.ActionForm;
import org.apache.struts.action.ActionForward;
import org.apache.struts.action.ActionMapping;
import org.apache.struts.actions.DispatchAction;
/**
*
* @author marcelo.garcia
* @version 1.0
*/
public class ActionCertificacao extends DispatchAction {
public ActionForward doInicioCertificacao(ActionMapping mapping, ActionForm actionForm, HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
System.out.println("Metodo inicial da certificacao");
return mapping.findForward("token");
}
/**
* Metodo que finaliza o processo de assinatura digital.
* Chamado por uma funcao javascript no token.jsp.
*
* @param mapping
* @param actionForm
* @param request
* @param response
* @return
* @throws IOException
* @throws ServletException
*/
public ActionForward doFimCertificacao(ActionMapping mapping, ActionForm actionForm, HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
System.out.println("Metodo final da certificacao ");
return null;
}
}
"-//Apache Software Foundation//DTD Struts Configuration 1.2//EN"
"http://jakarta.apache.org/struts/dtds/struts-config_1_2.dtd">
path="/certificacao"
type="br.com.struts.ActionCertificacao"
parameter="method"
scope="request"
name="formCertificacao"
validate="false">
