Package org.wildfly.security.auth.realm

Class FileSystemSecurityRealm.Identity

java.lang.Object

org.wildfly.security.auth.realm.FileSystemSecurityRealm.Identity

All Implemented Interfaces:

ModifiableRealmIdentity, RealmIdentity

Enclosing class:

FileSystemSecurityRealm

static class FileSystemSecurityRealm.Identity
extends Object
implements ModifiableRealmIdentity

Field Summary

Fields

Modifier and Type	Field	Description
private static String	BASE64_FORMAT
private static String	ENCRYPTION_FORMAT
private Charset	hashCharset
private Encoding	hashEncoding
private static String	HEX
private boolean	integrityEnabled
private IdentitySharedExclusiveLock.IdentityLock	lock
private static String	MCF_FORMAT
private String	name
private Path	path
private PrivateKey	privateKey
private Supplier<Provider[]>	providers
private PublicKey	publicKey
private SecretKey	secretKey
private static String	X509_FORMAT

Fields inherited from interface org.wildfly.security.auth.server.ModifiableRealmIdentity

NON_EXISTENT

Fields inherited from interface org.wildfly.security.auth.server.RealmIdentity

ANONYMOUS

Constructor Summary

Constructors

Constructor	Description
Identity(String name, Path path, IdentitySharedExclusiveLock.IdentityLock lock, Charset hashCharset, Encoding hashEncoding, Supplier<Provider[]> providers, SecretKey secretKey, PrivateKey privateKey, PublicKey publicKey, boolean integrityEnabled)

Method Summary

Modifier and Type	Method	Description
private void	consumeContent(XMLStreamReader reader)
void	create()	Create this realm identity.
private Void	createPrivileged()
void	delete()	Delete this realm identity.
private Void	deletePrivileged()
void	dispose()	Dispose this realm identity after a completed authentication attempt.
boolean	exists()	Determine if the identity exists in lieu of verifying or acquiring a credential.
Attributes	getAttributes()	Get the attributes for the realm identity.
AuthorizationIdentity	getAuthorizationIdentity()	Get an authorization identity for this pre-authenticated identity.
<C extends Credential> C	getCredential(Class<C> credentialType)	Acquire a credential of the given type.
<C extends Credential> C	getCredential(Class<C> credentialType, String algorithmName)	Acquire a credential of the given type and algorithm name.
<C extends Credential> C	getCredential(Class<C> credentialType, String algorithmName, AlgorithmParameterSpec parameterSpec)	Acquire a credential of the given type and algorithm name.
SupportLevel	getCredentialAcquireSupport(Class<? extends Credential> credentialType, String algorithmName, AlgorithmParameterSpec parameterSpec)	Determine whether a given credential type is definitely obtainable, possibly obtainable, or definitely not obtainable for this identity.
SupportLevel	getEvidenceVerifySupport(Class<? extends Evidence> evidenceType, String algorithmName)	Determine whether a given type of evidence is definitely verifiable, possibly verifiable, or definitely not verifiable.
Principal	getRealmIdentityPrincipal()	Get the principal that canonically identifies the identity within the realm.
private FileSystemSecurityRealm.Version	identifyVersion(XMLStreamReader streamReader)
private boolean	isIntegrityValid()
(package private) List<Credential>	loadCredentials()
private FileSystemSecurityRealm.LoadedIdentity	loadIdentity(boolean skipCredentials, boolean skipAttributes)
protected FileSystemSecurityRealm.LoadedIdentity	loadIdentityPrivileged(boolean skipCredentials, boolean skipAttributes)
private void	parseAttribute(XMLStreamReader streamReader, Attributes attributes)
private Attributes	parseAttributes(XMLStreamReader streamReader, FileSystemSecurityRealm.Version version)
private void	parseCertificate(List<Credential> credentials, XMLStreamReader streamReader)
private void	parseCredential(XMLStreamReader streamReader, FileSystemSecurityRealm.CredentialParseFunction function)
private List<Credential>	parseCredentials(XMLStreamReader streamReader, FileSystemSecurityRealm.Version version)
private FileSystemSecurityRealm.LoadedIdentity	parseIdentity(XMLStreamReader streamReader, boolean skipCredentials, boolean skipAttributes)
private FileSystemSecurityRealm.LoadedIdentity	parseIdentityContents(XMLStreamReader streamReader, FileSystemSecurityRealm.Version version, boolean skipCredentials, boolean skipAttributes)
private void	parseOtp(List<Credential> credentials, XMLStreamReader streamReader)
private void	parsePassword(List<Credential> credentials, XMLStreamReader streamReader, FileSystemSecurityRealm.Version version)
private void	parsePublicKey(List<Credential> credentials, XMLStreamReader streamReader)
private void	replaceIdentity(FileSystemSecurityRealm.LoadedIdentity newIdentity)
private Void	replaceIdentityPrivileged(FileSystemSecurityRealm.LoadedIdentity newIdentity)
private FileSystemSecurityRealm.Version	requiredVersion(FileSystemSecurityRealm.LoadedIdentity identityToWrite)
void	setAttributes(Attributes attributes)	Modify the attributes collection of this identity.
void	setCredentials(Collection<? extends Credential> credentials)	Set the credentials of this identity.
private Path	tempPath()
private String	tempSuffix()
private boolean	validateDigitalSignature(Document doc)
private boolean	validatePrincipalName(Document doc)
boolean	verifyEvidence(Evidence evidence)	Verify the given evidence against a credential of this identity.
private void	writeDigitalSignature(Path path, String name)
private void	writeIdentity(XMLStreamWriter streamWriter, FileSystemSecurityRealm.LoadedIdentity newIdentity)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.wildfly.security.auth.server.ModifiableRealmIdentity

updateCredential

Methods inherited from interface org.wildfly.security.auth.server.RealmIdentity

applyToCredential, applyToCredential, applyToCredential, getCredentialAcquireSupport

Field Detail

ENCRYPTION_FORMAT

private static final String ENCRYPTION_FORMAT

See Also:

Constant Field Values

BASE64_FORMAT

private static final String BASE64_FORMAT

See Also:

Constant Field Values

MCF_FORMAT

private static final String MCF_FORMAT

See Also:

Constant Field Values

X509_FORMAT

private static final String X509_FORMAT

See Also:

Constant Field Values

HEX

private static final String HEX

See Also:

Constant Field Values

name

private final String name

path

private final Path path

providers

private final Supplier<Provider[]> providers

lock

private IdentitySharedExclusiveLock.IdentityLock lock

hashCharset

private final Charset hashCharset

hashEncoding

private final Encoding hashEncoding

secretKey

private final SecretKey secretKey

privateKey

private final PrivateKey privateKey

publicKey

private final PublicKey publicKey

integrityEnabled

private final boolean integrityEnabled

Constructor Detail

Identity

Identity(String name,
         Path path,
         IdentitySharedExclusiveLock.IdentityLock lock,
         Charset hashCharset,
         Encoding hashEncoding,
         Supplier<Provider[]> providers,
         SecretKey secretKey,
         PrivateKey privateKey,
         PublicKey publicKey,
         boolean integrityEnabled)

Method Detail

getRealmIdentityPrincipal

public Principal getRealmIdentityPrincipal()

Description copied from interface: RealmIdentity

Get the principal that canonically identifies the identity within the realm. This method may return the principal object which was passed in as a parameter to SecurityRealm.getRealmIdentity(Principal) (a.k.a. domain principal), but is not required to do so. Any existent realm identity (i.e. any identity which returns true on invocation of RealmIdentity.exists()) must return a non-null principal.

Specified by:

getRealmIdentityPrincipal in interface RealmIdentity

Returns:

the principal for this realm identity (may not be null)

getCredentialAcquireSupport

public SupportLevel getCredentialAcquireSupport(Class<? extends Credential> credentialType,
                                                String algorithmName,
                                                AlgorithmParameterSpec parameterSpec)
                                         throws RealmUnavailableException

Description copied from interface: RealmIdentity

Determine whether a given credential type is definitely obtainable, possibly obtainable, or definitely not obtainable for this identity.

Specified by:

getCredentialAcquireSupport in interface RealmIdentity

Parameters:

credentialType - the exact credential type (must not be null)

algorithmName - the algorithm name, or null if any algorithm is acceptable or the credential type does not support algorithm names

parameterSpec - the algorithm parameters to match, or null if any parameters are acceptable or the credential type does not support algorithm parameters

Returns:

the level of support for this credential type (may not be null)

Throws:

RealmUnavailableException - if the realm is not able to handle requests for any reason

getCredential

public <C extends Credential> C getCredential(Class<C> credentialType)
                                       throws RealmUnavailableException

Description copied from interface: RealmIdentity

Acquire a credential of the given type.

Specified by:

getCredential in interface RealmIdentity

Type Parameters:

C - the credential type

Parameters:

credentialType - the credential type class (must not be null)

Returns:

the credential, or null if no such credential exists

Throws:

RealmUnavailableException - if the realm is not able to handle requests for any reason

getCredential

public <C extends Credential> C getCredential(Class<C> credentialType,
                                              String algorithmName)
                                       throws RealmUnavailableException

Description copied from interface: RealmIdentity

Acquire a credential of the given type and algorithm name. Realms which support more than one credential of a given type must override this method.

Specified by:

getCredential in interface RealmIdentity

Type Parameters:

C - the credential type

Parameters:

credentialType - the credential type class (must not be null)

algorithmName - the algorithm name, or null if any algorithm is acceptable or the credential type does not support algorithm names

Returns:

the credential, or null if no such credential exists

Throws:

RealmUnavailableException - if the realm is not able to handle requests for any reason

getCredential

public <C extends Credential> C getCredential(Class<C> credentialType,
                                              String algorithmName,
                                              AlgorithmParameterSpec parameterSpec)
                                       throws RealmUnavailableException

Description copied from interface: RealmIdentity

Acquire a credential of the given type and algorithm name. Realms which support more than one credential of a given type and algorithm must override this method.

Specified by:

getCredential in interface RealmIdentity

Type Parameters:

C - the credential type

Parameters:

credentialType - the credential type class (must not be null)

algorithmName - the algorithm name, or null if any algorithm is acceptable or the credential type does not support algorithm names

parameterSpec - the algorithm parameters to match, or null if any parameters are acceptable or the credential type does not support algorithm parameters

Returns:

the credential, or null if no such credential exists

Throws:

RealmUnavailableException - if the realm is not able to handle requests for any reason

getEvidenceVerifySupport

public SupportLevel getEvidenceVerifySupport(Class<? extends Evidence> evidenceType,
                                             String algorithmName)
                                      throws RealmUnavailableException

Description copied from interface: RealmIdentity

Determine whether a given type of evidence is definitely verifiable, possibly verifiable, or definitely not verifiable.

Specified by:

getEvidenceVerifySupport in interface RealmIdentity

Parameters:

evidenceType - the type of evidence to be verified (must not be null)

algorithmName - the algorithm name, or null if any algorithm is acceptable or the evidence type does not support algorithm names

Returns:

the level of support for this evidence type

Throws:

RealmUnavailableException - if the realm is not able to handle requests for any reason

verifyEvidence

public boolean verifyEvidence(Evidence evidence)
                       throws RealmUnavailableException

Description copied from interface: RealmIdentity

Verify the given evidence against a credential of this identity. The credential to be used is selected based on the evidence type.

Specified by:

verifyEvidence in interface RealmIdentity

Parameters:

evidence - the evidence to verify

Returns:

true if verification was successful, false otherwise

Throws:

RealmUnavailableException - if the realm is not able to handle requests for any reason

loadCredentials

List<Credential> loadCredentials()
                          throws RealmUnavailableException

Throws:

RealmUnavailableException

exists

public boolean exists()
               throws RealmUnavailableException

Description copied from interface: RealmIdentity

Determine if the identity exists in lieu of verifying or acquiring a credential. This method is intended to be used to verify an identity for non-authentication purposes only. Implementations of this method should return false up until the point it is known that a call to RealmIdentity.getAuthorizationIdentity() can successfully return an identity. If a realm can load an identity independently of credential acquisition and evidence verification if not already loaded it should be loaded at the time of this call to return an accurate result.

Specified by:

exists in interface RealmIdentity

Returns:

true if the identity exists in this realm, false otherwise

Throws:

RealmUnavailableException - if the realm is not able to handle requests for any reason

delete

public void delete()
            throws RealmUnavailableException

Description copied from interface: ModifiableRealmIdentity

Delete this realm identity. After this call, RealmIdentity.exists() will return false. If the identity does not exist, an exception is thrown.

Specified by:

delete in interface ModifiableRealmIdentity

Throws:

RealmUnavailableException - if deletion fails for some reason

deletePrivileged

private Void deletePrivileged()
                       throws RealmUnavailableException

Throws:

RealmUnavailableException

tempSuffix

private String tempSuffix()

tempPath

private Path tempPath()

create

public void create()
            throws RealmUnavailableException

Description copied from interface: ModifiableRealmIdentity

Create this realm identity. After this call, RealmIdentity.exists() will return true and the credentials and role sets will be empty. If the identity already exists, an exception is thrown.

Specified by:

create in interface ModifiableRealmIdentity

Throws:

RealmUnavailableException - if creation fails for some reason

createPrivileged

private Void createPrivileged()
                       throws RealmUnavailableException

Throws:

RealmUnavailableException

setCredentials

public void setCredentials(Collection<? extends Credential> credentials)
                    throws RealmUnavailableException

Description copied from interface: ModifiableRealmIdentity

Set the credentials of this identity. If the identity does not exist, an exception is thrown. Any existing credential(s) are replaced/updated with the new value (in a possibly realm-specific manner).

Specified by:

setCredentials in interface ModifiableRealmIdentity

Parameters:

credentials - the new credentials to set

Throws:

RealmUnavailableException - if updating the credentials fails for some reason

setAttributes

public void setAttributes(Attributes attributes)
                   throws RealmUnavailableException

Description copied from interface: ModifiableRealmIdentity

Modify the attributes collection of this identity. If the identity does not exist, an exception is thrown.

Specified by:

setAttributes in interface ModifiableRealmIdentity

Parameters:

attributes - the new attributes collection

Throws:

RealmUnavailableException - if updating the attributes collection fails for some reason

getAttributes

public Attributes getAttributes()
                         throws RealmUnavailableException

Description copied from interface: RealmIdentity

Get the attributes for the realm identity.

Specified by:

getAttributes in interface RealmIdentity

Returns:

the attributes, or null if the implementing class does not support getting attributes

Throws:

RealmUnavailableException - if accessing the attributes fails for some reason

replaceIdentity

private void replaceIdentity(FileSystemSecurityRealm.LoadedIdentity newIdentity)
                      throws RealmUnavailableException

Throws:

RealmUnavailableException

replaceIdentityPrivileged

private Void replaceIdentityPrivileged(FileSystemSecurityRealm.LoadedIdentity newIdentity)
                                throws RealmUnavailableException

Throws:

RealmUnavailableException

requiredVersion

private FileSystemSecurityRealm.Version requiredVersion(FileSystemSecurityRealm.LoadedIdentity identityToWrite)

writeIdentity

private void writeIdentity(XMLStreamWriter streamWriter,
                           FileSystemSecurityRealm.LoadedIdentity newIdentity)
                    throws XMLStreamException,
                           InvalidKeySpecException,
                           NoSuchAlgorithmException,
                           GeneralSecurityException

Throws:

XMLStreamException

InvalidKeySpecException

NoSuchAlgorithmException

GeneralSecurityException

dispose

public void dispose()

Description copied from interface: RealmIdentity

Dispose this realm identity after a completed authentication attempt.

Specified by:

dispose in interface RealmIdentity

getAuthorizationIdentity

public AuthorizationIdentity getAuthorizationIdentity()
                                               throws RealmUnavailableException

Description copied from interface: RealmIdentity

Get an authorization identity for this pre-authenticated identity.

Specified by:

getAuthorizationIdentity in interface RealmIdentity

Returns:

the authorization identity (may not be null)

Throws:

RealmUnavailableException - if the realm is not able to handle requests for any reason

loadIdentity

private FileSystemSecurityRealm.LoadedIdentity loadIdentity(boolean skipCredentials,
                                                            boolean skipAttributes)
                                                     throws RealmUnavailableException

Throws:

RealmUnavailableException

loadIdentityPrivileged

protected FileSystemSecurityRealm.LoadedIdentity loadIdentityPrivileged(boolean skipCredentials,
                                                                        boolean skipAttributes)
                                                                 throws RealmUnavailableException

Throws:

RealmUnavailableException

parseIdentity

private FileSystemSecurityRealm.LoadedIdentity parseIdentity(XMLStreamReader streamReader,
                                                             boolean skipCredentials,
                                                             boolean skipAttributes)
                                                      throws RealmUnavailableException,
                                                             XMLStreamException

Throws:

RealmUnavailableException

XMLStreamException

identifyVersion

private FileSystemSecurityRealm.Version identifyVersion(XMLStreamReader streamReader)

parseIdentityContents

private FileSystemSecurityRealm.LoadedIdentity parseIdentityContents(XMLStreamReader streamReader,
                                                                     FileSystemSecurityRealm.Version version,
                                                                     boolean skipCredentials,
                                                                     boolean skipAttributes)
                                                              throws RealmUnavailableException,
                                                                     XMLStreamException

Throws:

RealmUnavailableException

XMLStreamException

parseCredentials

private List<Credential> parseCredentials(XMLStreamReader streamReader,
                                          FileSystemSecurityRealm.Version version)
                                   throws RealmUnavailableException,
                                          XMLStreamException

Throws:

RealmUnavailableException

XMLStreamException

parseCredential

private void parseCredential(XMLStreamReader streamReader,
                             FileSystemSecurityRealm.CredentialParseFunction function)
                      throws RealmUnavailableException,
                             XMLStreamException

Throws:

RealmUnavailableException

XMLStreamException

parseCertificate

private void parseCertificate(List<Credential> credentials,
                              XMLStreamReader streamReader)
                       throws RealmUnavailableException,
                              XMLStreamException

Throws:

RealmUnavailableException

XMLStreamException

parsePublicKey

private void parsePublicKey(List<Credential> credentials,
                            XMLStreamReader streamReader)
                     throws RealmUnavailableException,
                            XMLStreamException

Throws:

RealmUnavailableException

XMLStreamException

parsePassword

private void parsePassword(List<Credential> credentials,
                           XMLStreamReader streamReader,
                           FileSystemSecurityRealm.Version version)
                    throws XMLStreamException,
                           RealmUnavailableException

Throws:

XMLStreamException

RealmUnavailableException

parseOtp

private void parseOtp(List<Credential> credentials,
                      XMLStreamReader streamReader)
               throws XMLStreamException,
                      RealmUnavailableException

Throws:

XMLStreamException

RealmUnavailableException

parseAttributes

private Attributes parseAttributes(XMLStreamReader streamReader,
                                   FileSystemSecurityRealm.Version version)
                            throws RealmUnavailableException,
                                   XMLStreamException

Throws:

RealmUnavailableException

XMLStreamException

parseAttribute

private void parseAttribute(XMLStreamReader streamReader,
                            Attributes attributes)
                     throws XMLStreamException,
                            RealmUnavailableException

Throws:

XMLStreamException

RealmUnavailableException

consumeContent

private void consumeContent(XMLStreamReader reader)
                     throws XMLStreamException

Throws:

XMLStreamException

isIntegrityValid

private boolean isIntegrityValid()

validateDigitalSignature

private boolean validateDigitalSignature(Document doc)

validatePrincipalName

private boolean validatePrincipalName(Document doc)

writeDigitalSignature

private void writeDigitalSignature(Path path,
                                   String name)
                            throws RealmUnavailableException

Throws:

RealmUnavailableException