public class SharedSecret extends DirBasedAuthentication implements ISharedToken
Modifier and Type | Field and Description |
---|---|
static java.lang.String |
CRED_ShrTok |
static java.lang.String |
DEF_SharedToken_ATTR |
protected byte[] |
iv |
protected static java.lang.String[] |
mConfigParams |
protected static java.lang.String[] |
mRequiredCreds |
protected java.lang.String |
mShrTokAttr |
protected static java.lang.String |
PROP_DNPATTERN |
protected static java.lang.String |
PROP_LDAP_BOUND_CONN |
protected static java.lang.String |
PROP_LDAP_BOUND_TAG |
protected static java.lang.String |
PROP_LDAPBYTEATTRS |
protected static java.lang.String |
PROP_LDAPSTRINGATTRS |
static java.lang.String |
PROP_SharedToken_ATTR |
protected org.mozilla.jss.crypto.CryptoToken |
token |
org.mozilla.jss.crypto.KeyWrapAlgorithm |
wrapAlgorithm |
DEFAULT_DNPATTERN, mBaseDN, mBoundConnEnable, mConfig, mConnFactory, mExtendedPluginInfo, mGroupObjectClass, mGroups, mGroupsBaseDN, mGroupsEnable, mGroupUserIDName, mImplName, mLdapAttrs, mLdapByteAttrs, mLdapConfig, mLdapStringAttrs, mLogger, mName, mPattern, mSearchGroupUserByUserdn, mTag, mUserIDName, PROP_BASEDN, PROP_GROUP_OBJECT_CLASS, PROP_GROUP_USERID_NAME, PROP_GROUPS, PROP_GROUPS_BASEDN, PROP_GROUPS_ENABLE, PROP_LDAP, PROP_SEARCH_GROUP_USER_BY_USERDN, PROP_USERID_NAME, USER_DN
CRED_CERT_SERIAL_TO_REVOKE, CRED_CMC_SELF_SIGNED, CRED_CMC_SIGNING_CERT, CRED_HOST_NAME, CRED_SESSION_ID, CRED_SSL_CLIENT_CERT
HELP_TEXT, HELP_TOKEN
Constructor and Description |
---|
SharedSecret() |
Modifier and Type | Method and Description |
---|---|
protected java.lang.String |
authenticate(netscape.ldap.LDAPConnection conn,
IAuthCredentials authCreds,
AuthToken token)
unsupported
This is an unconventional authentication plugin implementation that
does not support authenticate()
|
java.lang.String[] |
getConfigParams()
Returns a list of configuration parameter names.
|
java.lang.String[] |
getRequiredCreds()
Returns array of required credentials for this authentication manager.
|
char[] |
getSharedToken(java.math.BigInteger serial)
getSharedToken(BigInteger serial) retrieves the shared secret data
from CA's internal certificate db based on serial number to revoke shared
secret based revocation
Note that unlike the shared token attribute for enrollment, the metaInfo
attribute for shared token in revocatoiin is not configurable.
|
char[] |
getSharedToken(org.mozilla.jss.pkix.cmc.PKIData cmcdata)
unsupported
|
char[] |
getSharedToken(java.lang.String identification)
getSharedToken(String identification) provides
support for id_cmc_identification shared secret based enrollment
Note: caller should clear the memory for the returned token
after each use
|
void |
init(java.lang.String name,
java.lang.String implName,
IConfigStore config)
Initializes the UidPwdDirBasedAuthentication auth manager.
|
void |
initLdapConn(IConfigStore config)
initLadapConn initializes ldap connection for shared token based
CMC enrollment.
|
authenticate, formCertInfo, formSubjectName, getConfigStore, getExtendedPluginInfo, getImplName, getLdapAttrs, getLdapByteAttrs, getName, init, log, setAuthTokenByteValue, setAuthTokenStringValue, setAuthTokenValues, shutdown
public static final java.lang.String CRED_ShrTok
protected static java.lang.String[] mRequiredCreds
protected static final java.lang.String PROP_DNPATTERN
protected static final java.lang.String PROP_LDAPSTRINGATTRS
protected static final java.lang.String PROP_LDAPBYTEATTRS
protected static final java.lang.String PROP_LDAP_BOUND_CONN
protected static final java.lang.String PROP_LDAP_BOUND_TAG
public static final java.lang.String PROP_SharedToken_ATTR
public static final java.lang.String DEF_SharedToken_ATTR
public org.mozilla.jss.crypto.KeyWrapAlgorithm wrapAlgorithm
protected static java.lang.String[] mConfigParams
protected java.lang.String mShrTokAttr
protected org.mozilla.jss.crypto.CryptoToken token
protected byte[] iv
public void init(java.lang.String name, java.lang.String implName, IConfigStore config) throws EBaseException
DirBasedAuthentication
ldap.basedn - the ldap base dn. ldap.ldapconn.host - the ldap host. ldap.ldapconn.port - the ldap port ldap.ldapconn.secureConn - whether port should be secure ldap.minConns - minimum connections ldap.maxConns - max connections dnpattern - dn pattern.
dnpattern is a string representing a subject name pattern to formulate from the directory attributes and entry dn. If empty or not set, the ldap entry DN will be used as the certificate subject name.
The syntax is
dnpattern = SubjectNameComp *[ "," SubjectNameComp ] SubjectNameComponent = DnComp | EntryComp | ConstantComp DnComp = CertAttr "=" "$dn" "." DnAttr "." Num EntryComp = CertAttr "=" "$attr" "." EntryAttr "." Num ConstantComp = CertAttr "=" Constant DnAttr = an attribute in the Ldap entry dn EntryAttr = an attribute in the Ldap entry CertAttr = a Component in the Certificate Subject Name (multiple AVA in one RDN not supported) Num = the nth value of tha attribute in the dn or entry. Constant = Constant String, with any accepted ldap string value.
Example:
dnpattern: E=$attr.mail.1, CN=$attr.cn, OU=$attr.ou.2, O=$dn.o, C=US
Ldap entry dn: UID=joesmith, OU=people, O=Acme.com
Ldap attributes: cn: Joe Smith sn: Smith mail: joesmith@acme.com mail: joesmith@redhat.com ou: people ou: IS etc.
The subject name formulated in the cert will be :
E=joesmith@acme.com, CN=Joe Smith, OU=Human Resources, O=Acme.com, C=US E = the first 'mail' ldap attribute value in user's entry - joesmithe@acme.com CN = the (first) 'cn' ldap attribute value in the user's entry - Joe Smith OU = the second 'ou' value in the ldap entry - IS O = the (first) 'o' value in the user's entry DN - "Acme.com" C = the constant string "US"
init
in interface IAuthManager
init
in class DirBasedAuthentication
name
- The name for this authentication manager instance.implName
- The name of the authentication manager plugin.config
- - The configuration store for this instance.EBaseException
- If an error occurs during initialization.public void initLdapConn(IConfigStore config) throws EBaseException
EBaseException
public char[] getSharedToken(java.lang.String identification) throws EBaseException
getSharedToken
in interface ISharedToken
EBaseException
public char[] getSharedToken(org.mozilla.jss.pkix.cmc.PKIData cmcdata) throws EBaseException
getSharedToken
in interface ISharedToken
EBaseException
public char[] getSharedToken(java.math.BigInteger serial) throws EBaseException
getSharedToken
in interface ISharedToken
EBaseException
protected java.lang.String authenticate(netscape.ldap.LDAPConnection conn, IAuthCredentials authCreds, AuthToken token) throws EBaseException
authenticate
in class DirBasedAuthentication
authCreds
- The authentication credentials.EInvalidCredentials
- If the uid and password are not validEBaseException
- If an internal error occurs.public java.lang.String[] getConfigParams()
getConfigParams
in interface IAuthManager
getConfigParams
in class DirBasedAuthentication
public java.lang.String[] getRequiredCreds()
getRequiredCreds
in interface IAuthManager
getRequiredCreds
in class DirBasedAuthentication