[BUG] jarsigner + jca fails to sign when key vault happens to include "certificates" in the name

[peter-griffiths]

Describe the bug
The key vault JCA library is unable to sign JARs using a certificate stored in an Azure Key Vault whose name contains the string "certificates". This is due to the library being unable to extract the correct certificate alias for certificates stored in the vault. The user facing result of this silent failure is the error jarsigner error: java.lang.RuntimeException: unable to instantiate keystore class: AZUREKEYVAULT not found

Exception or Stack Trace
Full command and verbose output for an attempt to sign the jar "myjar.jar" with the certificate "mycert" stored in the vault "mycertificates":

jarsigner \
-keystore NONE \
-storetype "AzureKeyVault" \
-signedjar signerjar.jar \
"myjar.jar" \
"mycert" \
-verbose  \
-storepass "" \
-J-Djava.security.properties=java.security \
-J--module-path="azure-security-keyvault-jca-2.8.2.jar" \
-J--add-modules="com.azure.security.keyvault.jca" \
-J-Dazure.keyvault.uri=https://mycertificates.vault.azure.net/ \
-J-Dazure.keyvault.tenant-id=<tenant_id> \
-J-Dazure.keyvault.client-id=<client_id> \
-J-Dazure.keyvault.client-secret=<client_secret>

Oct 02, 2024 1:43:24 PM com.azure.security.keyvault.jca.implementation.KeyVaultClient <init>
INFO: Using Azure Key Vault: https://mycertificates.vault.azure.net/
Oct 02, 2024 1:43:24 PM com.azure.security.keyvault.jca.implementation.utils.AccessTokenUtil getAccessToken
INFO: Getting access token using client ID / client secret
Oct 02, 2024 1:43:26 PM com.azure.security.keyvault.jca.implementation.KeyVaultClient getKey
INFO: Getting key for alias: vault.azure.net/certificates/mycert
Oct 02, 2024 1:43:26 PM com.azure.security.keyvault.jca.implementation.KeyVaultClient <init>
INFO: Using Azure Key Vault: https://mycertificates.vault.azure.net/
Oct 02, 2024 1:43:26 PM com.azure.security.keyvault.jca.implementation.utils.AccessTokenUtil getAccessToken
INFO: Getting access token using client ID / client secret
Oct 02, 2024 1:43:26 PM com.azure.security.keyvault.jca.implementation.KeyVaultClient getKey
INFO: Getting key for alias: vault.azure.net/certificates/mycert
Oct 02, 2024 1:43:26 PM com.azure.security.keyvault.jca.implementation.KeyVaultClient <init>
INFO: Using Azure Key Vault: https://mycertificates.vault.azure.net/
Oct 02, 2024 1:43:26 PM com.azure.security.keyvault.jca.implementation.utils.AccessTokenUtil getAccessToken
INFO: Getting access token using client ID / client secret
Oct 02, 2024 1:43:26 PM com.azure.security.keyvault.jca.implementation.KeyVaultClient getKey
INFO: Getting key for alias: vault.azure.net/certificates/mycert
jarsigner error: java.lang.RuntimeException: unable to instantiate keystore class: AZUREKEYVAULT not found

To Reproduce
Attempt to sign a JAR using a certificate stored in an Azure vault with a name containing "certificates", e.g. "mycertificates":

jarsigner \
-keystore NONE \
-storetype "AzureKeyVault" \
-signedjar signerjar.jar \
"myjar.jar" "mycert" \
-verbose  -storepass "" \
-J-Djava.security.properties=java.security \
-J--module-path="azure-security-keyvault-jca-2.8.2.jar" \
-J--add-modules="com.azure.security.keyvault.jca" \
-J-Dazure.keyvault.uri=https://mycertificates.vault.azure.net/ \
-J-Dazure.keyvault.tenant-id=<tenant_id> \
-J-Dazure.keyvault.client-id=<client_id> \
-J-Dazure.keyvault.client-secret=<client_secret>

Code Snippet
This line in KeyVaultClient.java:

String alias = id.substring(id.indexOf("certificates") + "certificates".length() + 1);
For the string https://mycertificates.vault.azure.net/certificates/mycert results in the invalid alias vault.azure.net/certificates/mycert rather than the expected mycert

Expected behavior
The key vault name should not have any impact on the ability to code sign using certificates stored in it.

Setup (please complete the following information):

• OS: Windows
• Library/Libraries: com.azure:azure-security-keyvault-jca:2.8.2
• Java version: 11/21

Information Checklist
Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report

• Bug Description Added
• Repro Steps Added
• Setup information Added

[github-actions]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[vcolin7]

Could you take a look at this issue when you get a chance @saragluna, @rujche? Thanks!

[rujche]

Could you take a look at this issue when you get a chance @saragluna, @rujche? Thanks!

@vcolin7
Sure, will do.