--- a/bin/rwsbt	Fri Oct 28 00:35:16 2011 +0200
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,25 +0,0 @@
-#!/bin/bash 
-
-KS=keys/KEYSTORE.jks
-while [ $# -gt 0 ] 
-do 
- case $1 in 
-  -d) PROPS="$PROPS -Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5005"
-   ;; 
-  -n) PROPS="$PROPS -Dnetty.ssl.keyStoreType=JKS -Dnetty.ssl.keyStore=$KS -Dnetty.ssl.keyStorePassword=secret" 
-   ;;
-  -j) PROPS="$PROPS -Djetty.ssl.keyStoreType=JKS -Djetty.ssl.keyStore=$KS -Djetty.ssl.keyStorePassword=secret"
-   ;;
-  -sslUnsafe) PROPS="$PROPS -Dsun.security.ssl.allowUnsafeRenegotiation=true"
-   ;; # see: http://download.oracle.com/javase/7/docs/technotes/guides/security/jsse/JSSERefGuide.html#workarounds
-  -sslLegacy) PROPS="$PROPS -Dsun.security.ssl.allowLegacyHelloMessages=true"
-   ;;
-  *) echo the arguments to use are -d
-   ;;
-  esac
-  shift 1
- done
-
-
-export SBT_PROPS=$PROPS
-xsbt 

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/bin/rwsbt.sh	Sun Oct 30 20:42:26 2011 +0100
@@ -0,0 +1,27 @@
+#!/bin/bash 
+
+KS=src/test/resources/KEYSTORE.jks
+while [ $# -gt 0 ] 
+do 
+ case $1 in 
+  -d) PROPS="$PROPS -Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5005"
+   ;; 
+  -n) PROPS="$PROPS -Dnetty.ssl.keyStoreType=JKS -Dnetty.ssl.keyStore=$KS -Dnetty.ssl.keyStorePassword=secret" 
+   ;;
+  -j) PROPS="$PROPS -Djetty.ssl.keyStoreType=JKS -Djetty.ssl.keyStore=$KS -Djetty.ssl.keyStorePassword=secret"
+   ;;
+  -sslUnsafe) PROPS="$PROPS -Dsun.security.ssl.allowUnsafeRenegotiation=true"
+   ;; # see: http://download.oracle.com/javase/7/docs/technotes/guides/security/jsse/JSSERefGuide.html#workarounds
+  -sslLegacy) PROPS="$PROPS -Dsun.security.ssl.allowLegacyHelloMessages=true"
+   ;;
+  -sslDebug) PROPS="$PROPS -Djavax.net.debug=all"
+   ;; # see http://download.oracle.com/javase/1,5,0/docs/guide/security/jsse/ReadDebug.html
+  *) echo the arguments to use are -d
+   ;;
+  esac
+  shift 1
+ done
+
+
+export SBT_PROPS=$PROPS
+xsbt 

Binary file keys/KEYSTORE.jks has changed

--- a/project/build.scala	Fri Oct 28 00:35:16 2011 +0200
+++ b/project/build.scala	Sun Oct 30 20:42:26 2011 +0100
@@ -23,14 +23,18 @@
   val arq = "com.hp.hpl.jena" % "arq" % "2.8.8"
   val grizzled = "org.clapper" %% "grizzled-scala" % "1.0.8" % "test"
   val scalaz = "org.scalaz" %% "scalaz-core" % "6.0.2"
-  val jsslutils = "org.jsslutils" % "jsslutils" % "1.0.7"
+
   val argot =  "org.clapper" %% "argot" % "0.3.5"
   val guava =  "com.google.guava" % "guava" % "10.0.1"
+//  val restlet = "org.restlet.dev" % "org.restlet" % "2.1-SNAPSHOT"
+//  val restlet_ssl = "org.restlet.dev" % "org.restlet.ext.ssl" % "2.1-SNAPSHOT"
+  val jsslutils = "org.jsslutils" % "jsslutils" % "1.0.5"
 }
 
 // some usefull repositories
 object Resolvers {
   val novus = "repo.novus snaps" at "http://repo.novus.com/snapshots/"
+  val mavenLocal = "Local Maven Repository" at "file://" + (Path.userHome / ".m2" / "repository").absolutePath
 }
 
 // general build settings
@@ -75,6 +79,7 @@
 
   val projectSettings =
     Seq(
+      resolvers += mavenLocal,
       resolvers += ScalaToolsReleases,
       resolvers += ScalaToolsSnapshots,
       libraryDependencies += specs,
@@ -97,6 +102,8 @@
       jarName in assembly := "read-write-web.jar"
     )
 
+
+
   lazy val project = Project(
     id = "read-write-web",
     base = file("."),

--- a/src/main/scala/ReadWriteWebMain.scala	Fri Oct 28 00:35:16 2011 +0200
+++ b/src/main/scala/ReadWriteWebMain.scala	Sun Oct 30 20:42:26 2011 +0100
@@ -10,10 +10,7 @@
 
 import org.clapper.argot._
 import ArgotConverters._
-import unfiltered.request.HttpRequest
-import unfiltered.Cycle
 import javax.servlet.http.{HttpServletResponse, HttpServletRequest}
-import unfiltered.filter.Plan
 
 trait ReadWriteWebArgs {
   val logger: Logger = LoggerFactory.getLogger(this.getClass)

--- a/src/main/scala/WebCache.scala	Fri Oct 28 00:35:16 2011 +0200
+++ b/src/main/scala/WebCache.scala	Sun Oct 30 20:42:26 2011 +0100
@@ -46,7 +46,6 @@
   def sanityCheck() = true  //cache dire exists? But is this needed for functioning?
 
   def resource(u : URL) = new org.w3.readwriteweb.Resource {
-
     def get() = {
       // note we prefer rdf/xml and turtle over html, as html does not always contain rdfa, and we prefer those over n3,
       // as we don't have a full n3 parser. Better would be to have a list of available parsers for whatever rdf framework is
@@ -63,10 +62,10 @@
             case None => RDFXML  // it would be better to try to do a bit of guessing in this case by looking at content
           }
           val loc = headers("Content-Location").headOption match {
-            case Some(loc) => new URL(u,loc)
+            case Some(loc) =>  new URL(u,loc)
             case None => new URL(u.getProtocol,u.getAuthority,u.getPort,u.getPath)
           }
-          res>>{ in=>modelFromInputStream(in,loc,encoding) }
+          res>>{ in=> modelFromInputStream(in,loc,encoding) }
 
         }
       })

--- a/src/main/scala/auth/Authz.scala	Fri Oct 28 00:35:16 2011 +0200
+++ b/src/main/scala/auth/Authz.scala	Sun Oct 30 20:42:26 2011 +0100
@@ -171,12 +171,14 @@
         if (agentsAllowed.size > 0) {
           if (agentsAllowed.exists( pair =>  pair._2 == foafAgent )) true
           else subj() match {
-            case Some(s) => agentsAllowed.exists{ 
-              p =>  s.getPrincipals(classOf[WebIdPrincipal]).
-                exists(id=> {
-                val ps = if (p._1 != null) p._1.toString else null;
-                ps == id.webid
-              })
+            case Some(s) => {
+              agentsAllowed.exists{
+                p =>  s.getPrincipals(classOf[WebIdPrincipal]).
+                  exists(id=> {
+                  val ps = if (p._1 != null) p._1.toString else null;
+                  ps == id.webid
+                })
+              }
             }
             case None => false
           }

--- a/src/main/scala/auth/X509Cert.scala	Fri Oct 28 00:35:16 2011 +0200
+++ b/src/main/scala/auth/X509Cert.scala	Sun Oct 30 20:42:26 2011 +0100
@@ -24,17 +24,35 @@
 package org.w3.readwriteweb.auth
 
 import javax.servlet.http.HttpServletRequest
-import unfiltered.request.HttpRequest
 import unfiltered.netty.ReceivedMessage
-import java.security.cert.{X509Certificate}
-import java.security.cert.Certificate
 import java.util.Date
 import java.math.BigInteger
-import java.security.{SecureRandom, KeyPair}
 import java.net.URL
+import unfiltered.request.{UserAgent, HttpRequest}
+import java.security.cert.{X509Certificate, Certificate}
+import java.security._
+import interfaces.RSAPublicKey
+import unfiltered.util.IO
 import sun.security.x509._
 
-object X509Cert {
+
+object X509CertSigner {
+
+  def apply(keyStoreLoc: URL, keyStoreType: String, password: String, alias: String) = {
+    val keystore =  KeyStore.getInstance(keyStoreType)
+
+    IO.use(keyStoreLoc.openStream()) { in =>
+      keystore.load(in, password.toCharArray)
+    }
+    val privateKey = keystore.getKey(alias, password.toCharArray).asInstanceOf[PrivateKey]
+    val certificate = keystore.getCertificate(alias).asInstanceOf[X509Certificate]
+    //one could verify that indeed this is the private key corresponding to the public key in the cert.
+
+    new X509CertSigner(certificate,privateKey)
+  }
+}
+
+class X509CertSigner(signingCert: X509Certificate, signingKey: PrivateKey ) {
   val WebID_DN="""O=FOAF+SSL, OU=The Community of Self Signers, CN=Not a Certification Authority"""
 
   /**
@@ -43,41 +61,84 @@
    * have these classes don't need to download the code. It should be easy in scala to create a build that can decide
    * if these need to be added to the classpath. I think the code just looks better than bouncycastle too.
    *
+   * WARNING THIS IS   in construction
+   *
    * Create a self-signed X.509 Certificate
-   * @param issuerDN the X.509 Distinguished Name, eg "CN=Test, L=London, C=GB"
+   * @param subjectDN the X.509 Distinguished Name, eg "CN=Test, L=London, C=GB"
    * @param pair the KeyPair
    * @param days how many days from now the Certificate is valid for
    * @param algorithm the signing algorithm, eg "SHA1withRSA"
    */
-    def generate_self_signed(issuerDN: String,
-                 pair: KeyPair,
+    def generate(subjectDN: String,
+                 subjectKey: RSAPublicKey,
                  days: Int,
-                 webId: URL,
-                 algorithm: String="SHA1withRSA"): X509Certificate = {
+                 webId: URL): X509Certificate = {   //todo: the algorithm should be deduced from private key in part
+
+
       var info = new X509CertInfo
-      val from = new Date
+      val from = new Date(System.currentTimeMillis()-10*1000*60) //start 10 minutes ago, to avoid network trouble
       val to = new Date(from.getTime + days*24*60*60*1000) 
       val interval = new CertificateValidity(from, to)
-      val sn = new BigInteger(64, new SecureRandom)
-      val owner = new X500Name(issuerDN)
+      val serialNumber = new BigInteger(64, new SecureRandom)
+      val subjectXN = new X500Name(subjectDN)
+      val issuerXN = new X500Name(signingCert.getSubjectDN.toString)
+
       info.set(X509CertInfo.VALIDITY, interval)
-      info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(sn))
-      info.set(X509CertInfo.SUBJECT, new CertificateSubjectName(owner))
-      info.set(X509CertInfo.ISSUER, new CertificateIssuerName(owner))
-      info.set(X509CertInfo.KEY, new CertificateX509Key(pair.getPublic))
+      info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(serialNumber))
+      info.set(X509CertInfo.SUBJECT, new CertificateSubjectName(subjectXN))
+      info.set(X509CertInfo.ISSUER, new CertificateIssuerName(issuerXN))
+      info.set(X509CertInfo.KEY, new CertificateX509Key(subjectKey))
       info.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3))
+
+      //
+      //extensions
+      //
       val extensions = new CertificateExtensions();
-      val san = new SubjectAlternativeNameExtension(new GeneralNames().add(new GeneralName(new URIName(webId.toExternalForm))))
+
+      val san = new SubjectAlternativeNameExtension(true, new GeneralNames().add(new GeneralName(new URIName(webId.toExternalForm))))
       extensions.set(san.getName,san)
+
+      val basicCstrExt = new BasicConstraintsExtension(false,1)
+      extensions.set(basicCstrExt.getName,basicCstrExt)
+
+      { import KeyUsageExtension._
+        val keyUsage = new KeyUsageExtension()
+        List(DIGITAL_SIGNATURE, NON_REPUDIATION, KEY_ENCIPHERMENT, KEY_AGREEMENT, KEY_CERTSIGN).foreach {
+           usage => keyUsage.set(usage,true)
+        }
+        extensions.set(keyUsage.getName,keyUsage)
+      }
+
+      { import NetscapeCertTypeExtension._
+      val netscapeExt = new NetscapeCertTypeExtension()
+       List(SSL_CLIENT, S_MIME) foreach { ext => netscapeExt.set(ext,true) }
+        extensions.set(netscapeExt.getName, new NetscapeCertTypeExtension(false,netscapeExt.getValue))
+      }
+      
+      val subjectKeyExt = new SubjectKeyIdentifierExtension(new KeyIdentifier(subjectKey).getIdentifier)
+      extensions.set(subjectKeyExt.getName,subjectKeyExt)
+      
       info.set(X509CertInfo.EXTENSIONS,extensions)
-      val algo = new AlgorithmId(AlgorithmId.md5WithRSAEncryption_oid)
+
+      val algo = signingCert.getPublicKey.getAlgorithm match {
+        case "DSA" =>  new AlgorithmId(AlgorithmId.sha1WithDSA_oid )
+        case "RSA" =>  new AlgorithmId(AlgorithmId.sha1WithRSAEncryption_oid)
+        case _ => throw new RuntimeException("Don't know how to sign with this type of key")  
+      }
+
       info.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algo))
-      var cert = new X509CertImpl(info)
-      cert.sign(pair.getPrivate, algorithm)
-      val sigAlgo = cert.get(X509CertImpl.SIG_ALG).asInstanceOf[AlgorithmId]
+
+      // Sign the cert to identify the algorithm that's used.
+      val tmpCert = new X509CertImpl(info)
+      tmpCert.sign(signingKey,algo.getName)
+
+      //update the algorithm and re-sign
+      val sigAlgo = tmpCert.get(X509CertImpl.SIG_ALG).asInstanceOf[AlgorithmId]
       info.set(CertificateAlgorithmId.NAME + "." + CertificateAlgorithmId.ALGORITHM, sigAlgo)
-      cert = new X509CertImpl(info)
-      cert.sign(pair.getPrivate, algorithm)
+      val cert = new X509CertImpl(info)
+      cert.sign(signingKey,algo.getName)
+      
+      cert.verify(signingCert.getPublicKey)
       return cert
     }
 
@@ -117,7 +178,11 @@
         case e => {
           // request a certificate from the user
           sslh.setEnableRenegotiation(true)
-          sslh.getEngine.setWantClientAuth(true)
+          r match {
+            case UserAgent(agent) if needAuth(agent) => sslh.getEngine.setNeedClientAuth(true)
+            case _ => sslh.getEngine.setWantClientAuth(true)  
+          }
+          
           val future = sslh.handshake()
           future.await(30000) //that's certainly way too long.
           if (future.isDone) {
@@ -137,5 +202,18 @@
     }
 
   }
+
+ /**
+  *  Some agents do not send client certificates unless required. This is a problem for them, as it ends up breaking the
+  *  connection for those agents if the client does not have a certificate...
+  *
+  *  It would be useful if this could be updated by server from time to  time from a file on the internet,
+  *  so that changes to browsers could update server behavior
+  *
+  */
+  def needAuth(agent: String): Boolean = {
+    agent.contains("Java")
+  }
+  
 }
 

--- a/src/main/scala/netty/SslLoginTest.scala	Fri Oct 28 00:35:16 2011 +0200
+++ b/src/main/scala/netty/SslLoginTest.scala	Sun Oct 30 20:42:26 2011 +0100
@@ -58,7 +58,8 @@
        req.underlying.context.getPipeline.get(classOf[org.jboss.netty.handler.ssl.SslHandler])  match {
           case sslh: SslHandler => {
             sslh.setEnableRenegotiation(true)
-            sslh.getEngine.setWantClientAuth(true)
+            sslh.getEngine.setNeedClientAuth(true)
+//            sslh.getEngine.setWantClientAuth(true)
             val future = sslh.handshake()
             future.await(5000)
             val res = if (future.isDone) {

--- a/src/main/scala/plan.scala	Fri Oct 28 00:35:16 2011 +0200
+++ b/src/main/scala/plan.scala	Sun Oct 30 20:42:26 2011 +0100
@@ -16,12 +16,10 @@
               QueryTypeConstruct => CONSTRUCT,
               QueryTypeDescribe => DESCRIBE}
 
-import scalaz.{Resource=>SzResource,_}
-import unfiltered.filter.Plan
-import javax.servlet.http.{HttpServletResponse, HttpServletRequest}
+import scalaz.{Resource=>SzResource}
 import unfiltered.request._
+import unfiltered.Cycle
 import unfiltered.response._
-import unfiltered.Cycle
 
 //object ReadWriteWeb {
 //
@@ -77,7 +75,7 @@
    */
   def rwwIntent  =  (req: HttpRequest[Req]) => {
 
-          val Authoritative(uri, representation) = req
+          val Authoritative(uri: URL, representation: Representation) = req
           val r: Resource = rm.resource(uri)
           val res: ResponseFunction[Res] = req match {
             case GET(_) if representation == HTMLRepr => {
@@ -93,10 +91,11 @@
                   case _ => Lang.default
                 }
               } yield {
-                req match {
+                val res = req match {
                   case GET(_) => Ok ~> ViaSPARQL ~> ContentType(lang.contentType) ~> ResponseModel(model, uri, lang)
                   case HEAD(_) => Ok ~> ViaSPARQL ~> ContentType(lang.contentType)
                 }
+                res ~> ContentLocation( uri.toString ) // without this netty (perhaps jetty too?) sends very weird headers, breaking tests
               }
             case PUT(_) & RequestLang(lang) if representation == DirectoryRepr => {
               for {

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/main/scala/util/SpyInputStream.scala	Sun Oct 30 20:42:26 2011 +0100
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2011 Henry Story (bblfish.net)
+ * under the MIT licence defined at
+ *    http://www.opensource.org/licenses/mit-license.html
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of 
+ * this software and associated documentation files (the "Software"), to deal in the
+ * Software without restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so, subject to the
+ * following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+ * INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+ * PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+package org.w3.readwriteweb.util
+
+import java.io.{IOException, OutputStream, InputStream}
+
+
+/**
+ * Wrap an inputstream and write everything that comes in here
+ * @author hjs
+ * @created: 30/10/2011
+ */
+
+class SpyInputStream(val in: InputStream, val out: OutputStream) extends InputStream {
+  var stopOut = false
+  
+  def read() ={
+
+    val i = try {
+       in.read()
+   } catch {
+      case ioe: IOException => {
+        out.close()
+        stopOut=true
+        throw ioe;
+      }
+    }
+    if (!stopOut) try {
+      out.write(i)
+    } catch {
+      case ioe: IOException => {
+        stopOut = true
+      }
+    }
+    i
+  }
+}
\ No newline at end of file

Binary file src/test/resources/KEYSTORE.jks has changed

--- a/src/test/scala/auth/CreateWebIDSpec.scala	Fri Oct 28 00:35:16 2011 +0200
+++ b/src/test/scala/auth/CreateWebIDSpec.scala	Sun Oct 30 20:42:26 2011 +0100
@@ -26,16 +26,14 @@
 import org.w3.readwriteweb.utiltest._
 
 import dispatch._
-import java.io.File
-import org.apache.http.conn.scheme.Scheme
-import java.lang.String
-import java.security.cert.{CertificateFactory, X509Certificate}
+import java.security.cert.X509Certificate
 import java.security._
 import interfaces.RSAPublicKey
-import org.w3.readwriteweb.{RDFXML, TURTLE}
 import java.net.{Socket, URL}
-import scala.collection.{mutable, immutable}
+import scala.collection.mutable
 import javax.net.ssl._
+import java.io.File
+import org.w3.readwriteweb.{Post, RDFXML, TURTLE}
 
 
 /**
@@ -86,21 +84,6 @@
   lazy val lambdaMeta = new File(lambdaDir,".meta.n3")
 
 
- val keyManager = new FlexiKeyManager();
-
-  val  sslContext = javax.net.ssl.SSLContext.getInstance("TLS");
-  sslContext.init(Array(keyManager.asInstanceOf[KeyManager]), Array[TrustManager](new X509TrustManager {
-    def checkClientTrusted(chain: Array[X509Certificate], authType: String) {}
-    def checkServerTrusted(chain: Array[X509Certificate], authType: String) {}
-    def getAcceptedIssuers = Array[X509Certificate]()
-  }),null); // we are not trying to test our trust of localhost server
-  {
-   import org.apache.http.conn.ssl._
-   val sf = new SSLSocketFactory(sslContext,SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER)
-   val  scheme = new Scheme("https", 443, sf);
-   Http.client.getConnectionManager.getSchemeRegistry.register(scheme)
-  }
-
 
   val foaf = """
        @prefix foaf: <http://xmlns.com/foaf/0.1/> .
@@ -109,17 +92,19 @@
        <> a foaf:PersonalProfileDocument;
           foaf:primaryTopic :me .
 
-       :jl a foaf:Person;
+       :jL a foaf:Person;
            foaf:name "Joe Lambda"@en .
   """
-  
+
+  val webID = new URL(webidProfile.secure.to_uri + "#jL")
+
+
   val updatePk = """
-       PREFIX foaf: <http://xmlns.com/foaf/0.1/>
        PREFIX cert: <http://www.w3.org/ns/auth/cert#>
        PREFIX rsa: <http://www.w3.org/ns/auth/rsa#>
        PREFIX : <#>
        INSERT DATA {
-         :j1 foaf:key [ rsa:modulus "%s"^^cert:hex;
+         :jL cert:key [ rsa:modulus "%s"^^cert:hex;
                         rsa:public_exponent "%s"^^cert:int ] .
        }
   """
@@ -128,21 +113,11 @@
        PREFIX foaf: <http://xmlns.com/foaf/0.1/>
        PREFIX : <#>
        INSERT DATA {
-          :j1 foaf:knows <%s> .
+          :jL foaf:knows <%s> .
        }
   """
 
-  val rsagen = KeyPairGenerator.getInstance("RSA")
-  rsagen.initialize(512)
-  val rsaKP = rsagen.generateKeyPair()
-  val certFct = CertificateFactory.getInstance("X.509")
-  val webID = new URL(webidProfile.secure.to_uri + "#me")
-  val testCert = X509Cert.generate_self_signed("CN=JoeLambda, OU=DIG, O=W3C", rsaKP, 1, webID)
 
-  val testCertPk = testCert.getPublicKey.asInstanceOf[RSAPublicKey]
-
-  keyManager.addClientCert("JoeLambda",Array(testCert),rsaKP.getPrivate)
-  
   "PUTing nothing on /people/" should {
        "return a 201" in {
          val httpCode = Http(peopleDirUri.secure.put(TURTLE, "") get_statusCode)
@@ -175,17 +150,47 @@
      }
    }
 
+
    "POSTing public key into the /people/Lambda/Joe profile" should {
-     "return a 200" in {
-       val updateQ = updatePk.format(
-                     testCertPk.getModulus.toString(16),
-                     testCertPk.getPublicExponent()
+
+     "first create signed WebID certificate and add it to local SSL keystore" in {
+       val keystore = getClass.getClassLoader.getResource("KEYSTORE.jks")
+       val signer = X509CertSigner(
+         keystore,
+         "JKS",
+         "secret",
+         "localhost"
        )
-       System.out.println(updateQ)
+
+       val rsagen = KeyPairGenerator.getInstance("RSA")
+       rsagen.initialize(512)
+       val rsaKP = rsagen.generateKeyPair()
+
+
+       val testCert = signer.generate("CN=JoeLambda, OU=DIG, O=W3C", rsaKP.getPublic.asInstanceOf[RSAPublicKey], 1, webID)
+       
+       testCert mustNotBe null
+
+       testKeyManager.addClientCert("JoeLambda",Array(testCert),rsaKP.getPrivate)
+    }
+
+     "return a 200 when POSTing relations to profile" in {
+       val joeCert = testKeyManager.getCertificateChain("JoeLambda")
+
+       joeCert mustNotBe null
+
+       val joeKey = joeCert(0).getPublicKey.asInstanceOf[RSAPublicKey]
+
+       val updateQStr = updatePk.format(
+                     joeKey.getModulus.toString(16),
+                     joeKey.getPublicExponent()
+       )
+
        val httpCode = Http(
-         webidProfile.secure.postSPARQL(updateQ) get_statusCode )
+         webidProfile.secure.postSPARQL(updateQStr) get_statusCode )
         httpCode must_== 200
      }
+
      "create 3 more relations" in {
        val model = Http(webidProfile.secure as_model(baseURI(webidProfile.secure), RDFXML))
        model.size() must_== 7
@@ -201,7 +206,7 @@
   :a1 a acl:Authorization;
      acl:accessTo <Joe>;
      acl:mode acl:Write;
-     acl:agent <%s> .
+     acl:agent <%s>, <http://bblfish.net/people/henry/card#me> .
 
   :allRead a acl:Authorization;
      acl:accessTo <Joe>;
@@ -221,7 +226,7 @@
     }
     
     "everybody can still read the profile" in {
-      keyManager.setId(null)
+      testKeyManager.setId(null)
       val model = Http(webidProfile.secure as_model(baseURI(webidProfile.secure), RDFXML))
       model.size() must_== 7
     }
@@ -232,26 +237,38 @@
     }
 
     "access it as the user - allow him to add a friend" in {
-      keyManager.setId("JoeLambda")
-//      val scon =webidProfile.secure.to_uri.toURL.openConnection().asInstanceOf[HttpsURLConnection]
-//      scon.setSSLSocketFactory(sslContext.getSocketFactory)
-//      scon.setRequestProperty("Content-Type",TURTLE.contentType)
-//      scon.setRequestMethod("POST")
-//      val msg = updateFriend.format("http://bblfish.net/#hjs").getBytes("UTF-8")
-//      scon.setRequestProperty("Content-Length",msg.length.toString)
-//      scon.setDoOutput(true)
-//      scon.setDoInput(true)
-//
-//      val out = scon.getOutputStream
-//      out.write(msg)
-//      out.flush()
-//      out.close()
-//      scon.connect()
-//
-//      val httpCode = scon.getResponseCode
+      testKeyManager.setId("JoeLambda")
 
-      val httpCode = Http( webidProfile.secure.put(TURTLE, updateFriend.format("http://bblfish.net/#hjs")) get_statusCode )
-      httpCode must_== 201
+/*    The code below was very useful to help me debug this.
+      Sometimes it helps to get back to basics. So I will leave this here.
+
+      val scon =webidProfile.secure.to_uri.toURL.openConnection().asInstanceOf[HttpsURLConnection]
+      scon.setSSLSocketFactory(sslContext.getSocketFactory)
+      scon.setRequestProperty("Content-Type",Post.SPARQL)
+      scon.setRequestProperty("User-Agent" , "Java/1.7.0")
+      scon.setRequestMethod("POST")
+      val msg = updateFriend.format("http://bblfish.net/#hjs").getBytes("UTF-8")
+      scon.setRequestProperty("Content-Length",msg.length.toString)
+      scon.setDoOutput(true)
+      scon.setDoInput(true)
+
+      val out = scon.getOutputStream
+      out.write(msg)
+      out.flush()
+      out.close()
+      scon.connect()
+
+      val httpCode = scon.getResponseCode
+*/
+
+      val req =webidProfile.secure.PUT <:< Map("User-Agent" -> "Java/1.7.0","Content-Type"->Post.SPARQL)
+      val req2 = req.copy(
+              method="POST",
+              body=Some(new RefStringEntity(updateFriend.format(webID.toExternalForm),Post.SPARQL,"UTF-8"))
+            )
+
+      val httpCode = Http( req2 get_statusCode )
+      httpCode must_== 200
     }
 
     "and so have one more relation in the foaf" in {

--- a/src/test/scala/auth/SecureReadWriteWebSpec.scala	Fri Oct 28 00:35:16 2011 +0200
+++ b/src/test/scala/auth/SecureReadWriteWebSpec.scala	Sun Oct 30 20:42:26 2011 +0100
@@ -31,8 +31,12 @@
  */
 
 object SecureReadWriteWebSpec extends Specification {
+  try {
   "The Secure Read Write Web".isSpecifiedBy(
      CreateWebIDSpec
    )
+  } catch {
+    case e => e.printStackTrace(System.out)
+  }
 
 }
\ No newline at end of file

--- a/src/test/scala/auth/secure_specs.scala	Fri Oct 28 00:35:16 2011 +0200
+++ b/src/test/scala/auth/secure_specs.scala	Sun Oct 30 20:42:26 2011 +0100
@@ -26,12 +26,15 @@
 import unfiltered.spec.netty.Started
 import org.specs.Specification
 import unfiltered.netty.{ReceivedMessage, ServerErrorResponse, cycle}
-import org.w3.readwriteweb.auth.RDFAuthZ
 import java.io.File
 import org.w3.readwriteweb._
 import grizzled.file.GrizzledFile._
 
-import org.specs.specification.BeforeAfter
+import java.security.cert.X509Certificate
+import org.apache.http.conn.scheme.Scheme
+import dispatch.Http
+import org.apache.http.client.HttpClient
+import javax.net.ssl.{SSLContext, X509TrustManager, KeyManager}
 
 /**
  * @author hjs
@@ -42,9 +45,21 @@
 trait SecureServed extends Started {
   import org.w3.readwriteweb.netty._
 
+  //todo: replace this with non property method of setting this.
+  System.setProperty("netty.ssl.keyStore",getClass.getClassLoader.getResource("KEYSTORE.jks").getFile)
+  System.setProperty("netty.ssl.keyStoreType","JKS")
+  System.setProperty("netty.ssl.keyStorePassword","secret")
+
   def setup: (Https => Https)
   lazy val server = setup( KeyAuth_Https(port) )
 
+
+}
+
+object AcceptAllTrustManager extends X509TrustManager {
+      def checkClientTrusted(chain: Array[X509Certificate], authType: String) {}
+      def checkServerTrusted(chain: Array[X509Certificate], authType: String) {}
+      def getAcceptedIssuers = Array[X509Certificate]()
 }
 
 /**
@@ -55,7 +70,40 @@
 
   def resourceManager: ResourceManager
 
+  /**
+   * Inject flexible behavior into the client ssl so that it does not
+   * break on every localhost problem. It returns a key manager which can be used
+   * to allow the client to take on various guises
+   */
+  def flexi(client: HttpClient, km: KeyManager): SSLContext = {
+
+    val  sslContext = javax.net.ssl.SSLContext.getInstance("TLS");
+  
+    sslContext.init(Array(km.asInstanceOf[KeyManager]), Array(AcceptAllTrustManager),null); // we are not trying to test our trust of localhost server
+
+    import org.apache.http.conn.ssl._
+    val sf = new SSLSocketFactory(sslContext, SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER)
+    val scheme = new Scheme("https", 443, sf);
+    client.getConnectionManager.getSchemeRegistry.register(scheme)
+
+    sslContext
+  }
+
+
+
   val webCache = new WebCache()
+  val serverSslContext = javax.net.ssl.SSLContext.getInstance("TLS");
+
+
+
+  flexi(webCache.http.client, new FlexiKeyManager)
+
+
+  val testKeyManager = new FlexiKeyManager();
+  val sslContext = flexi(Http.client,testKeyManager)
+  
+
+
 
   val rww = new cycle.Plan  with cycle.ThreadPool with ServerErrorResponse with ReadWriteWeb[ReceivedMessage,HttpResponse] {
     val rm = resourceManager

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/test_www/.meta.n3	Sun Oct 30 20:42:26 2011 +0100
@@ -0,0 +1,14 @@
+@prefix acl: <http://www.w3.org/ns/auth/acl#> .
+@prefix foaf: <http://xmlns.com/foaf/0.1/> .
+@prefix : <#> .
+
+:a1 a acl:Authorization;
+   acl:accessTo <foaf.n3>;
+   acl:mode acl:Write;
+   acl:agent <http://bblfish.net/people/henry/card#me> .
+
+    
+:readAll a acl:Authorization;
+   acl:accessTo <foaf.n3>;
+   acl:mode acl:Read;
+   acl:agentClass foaf:Agent .

--- a/test_www/foaf.n3.protect.n3	Fri Oct 28 00:35:16 2011 +0200
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,8 +0,0 @@
-@prefix acl: <http://www.w3.org/ns/auth/acl#> .
-@prefix : <#> .
-
-:a1 a acl:Authorization;
-   acl:accessTo <foaf.n3>;
-   acl:mode acl:Read;
-   acl:agent <http://bblfish.net/people/henry/card#me> .
-