MySQL Connector/J 9.2.0 · com.mysql.cj.sasl.ScramShaSaslClient

Modifier and Type	Class and Description
protected static enum	ScramShaSaslClient.ScramExchangeStage

Modifier and Type	Field and Description
protected String	authenticationId
protected String	authorizationId
protected static final byte[]	CLIENT_KEY
protected String	clientFirstMessageBare
protected String	cNonce
protected static final String	GS2_CBIND_FLAG
protected String	gs2Header
protected static final int	MINIMUM_ITERATIONS
protected String	password
protected ScramShaSaslClient.ScramExchangeStage	scramStage
protected static final byte[]	SERVER_KEY
protected byte[]	serverSignature

Access	Constructor and Description
public	ScramShaSaslClient(String authorizationId, String authenticationId, String password)

Method Summary

Modifier and Type	Method and Description
public void	dispose() Implements javax.security.sasl.SaslClient.dispose. Disposes of any system resources or security-sensitive information the SaslClient might be using.
public byte[]	evaluateChallenge(byte[] The non-null challenge sent from the server. The challenge array may have zero length. challenge) Implements javax.security.sasl.SaslClient.evaluateChallenge. Evaluates the challenge data and generates a response.
private String	Returns: a randomly generated string formed by printable ASCII characters except comma. generateRandomPrintableAsciiString(int the length of the nonce. length) Generates a RFC 5802 safe nonce: "a sequence of random printable ASCII characters excluding ','"
pack-priv abstract String	Returns: a non-null string representing the IANA-registered mechanism name. getIanaMechanismName() Returns the real IANA-registered mechanism name of this SASL client.
public Object	getNegotiatedProperty(String The non-null property name. propName) Implements javax.security.sasl.SaslClient.getNegotiatedProperty. Retrieves the negotiated property.
pack-priv abstract byte[]	Returns: the hash value of the given string. h(byte[] the string to hash. str) The "H(str)" cryptographic hash function as described in RFC 5802, Section 2.2.
public boolean	hasInitialResponse() Implements javax.security.sasl.SaslClient.hasInitialResponse. Determines whether this mechanism has an optional initial response.
pack-priv abstract byte[]	Returns: an hash value with an output length equal to the length of H(str). hi(String the string value to use as the internal HMAC key. str, byte[] the input string to hash in the initial iteration. salt, int the number of iterations to run the algorithm. iterations) The "Hi(str, salt, i)" PBKDF2 function as described in RFC 5802, Section 2.2.
pack-priv abstract byte[]	Returns: the hashed value of the given params. hmac(byte[] the hash key. key, byte[] the input string. str) The "HMAC(key, str)" HMAC keyed hash algorithm as described in RFC 5802, Section 2.2.
public boolean	isComplete() Implements javax.security.sasl.SaslClient.isComplete. Determines whether the authentication exchange has completed.
private Map<String, String>	Returns: a `Map` with the key/value pairs obtained from the server challenge. parseChallenge(String the server message (challenge) to parse. challenge) Parses a SASL challenge.
private String	prepUserName(String userName)
public byte[]	unwrap(byte[] A non-null byte array containing the encoded bytes from the server. incoming, int The starting position at `incoming` of the bytes to use. offset, int The number of bytes from `incoming` to use. len) Implements javax.security.sasl.SaslClient.unwrap. Unwraps a byte array received from the server.
public byte[]	wrap(byte[] A non-null byte array containing the bytes to encode. outgoing, int The starting position at `outgoing` of the bytes to use. offset, int The number of bytes from `outgoing` to use. len) Implements javax.security.sasl.SaslClient.wrap. Wraps a byte array to be sent to the server.
pack-priv byte[]	Returns: the same as the param `inOut`, after being updated. xorInPlace(byte[] the left operand of the XOR operation and the destination of the result. inOut, byte[] the right operand of the XOR operation. other) Combines the two byte arrays in a XOR operation, changing the contents of the first.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

authenticationId	back to summary
protected String authenticationId

authorizationId	back to summary
protected String authorizationId

CLIENT_KEY	back to summary
protected static final byte[] CLIENT_KEY

clientFirstMessageBare	back to summary
protected String clientFirstMessageBare

cNonce	back to summary
protected String cNonce

GS2_CBIND_FLAG	back to summary
protected static final String GS2_CBIND_FLAG

gs2Header	back to summary
protected String gs2Header

MINIMUM_ITERATIONS	back to summary
protected static final int MINIMUM_ITERATIONS

password	back to summary
protected String password

scramStage	back to summary
protected ScramShaSaslClient.ScramExchangeStage scramStage

SERVER_KEY	back to summary
protected static final byte[] SERVER_KEY

serverSignature	back to summary
protected byte[] serverSignature

ScramShaSaslClient	back to summary
public ScramShaSaslClient(String authorizationId, String authenticationId, String password) throws SaslException

Method Detail

dispose	back to summary
public void dispose() throws SaslException Implements javax.security.sasl.SaslClient.dispose. Doc from javax.security.sasl.SaslClient.dispose. Disposes of any system resources or security-sensitive information the SaslClient might be using. Invoking this method invalidates the SaslClient instance. This method is idempotent. Annotations @Override Exceptions SaslException: If a problem was encountered while disposing the resources.

dispose

back to summary

public void dispose() throws SaslException

Implements javax.security.sasl.SaslClient.dispose.

Doc from javax.security.sasl.SaslClient.dispose.

Disposes of any system resources or security-sensitive information the SaslClient might be using. Invoking this method invalidates the SaslClient instance. This method is idempotent.

Annotations

@Override

Exceptions

SaslException:: If a problem was encountered while disposing the resources.

evaluateChallenge	back to summary
public byte[] evaluateChallenge(byte[] challenge) throws SaslException Implements javax.security.sasl.SaslClient.evaluateChallenge. Doc from javax.security.sasl.SaslClient.evaluateChallenge. Evaluates the challenge data and generates a response. If a challenge is received from the server during the authentication process, this method is called to prepare an appropriate next response to submit to the server. Parameters challenge:byte[] The non-null challenge sent from the server. The challenge array may have zero length. Returns:byte[] The possibly null response to send to the server. It is null if the challenge accompanied a "SUCCESS" status and the challenge only contains data for the client to update its state and no response needs to be sent to the server. The response is a zero-length byte array if the client is to send a response with no data. Annotations @Override Exceptions SaslException: If an error occurred while processing the challenge or generating a response.

evaluateChallenge

back to summary

public byte[] evaluateChallenge(byte[] challenge) throws SaslException

Implements javax.security.sasl.SaslClient.evaluateChallenge.

Doc from javax.security.sasl.SaslClient.evaluateChallenge.

Evaluates the challenge data and generates a response. If a challenge is received from the server during the authentication process, this method is called to prepare an appropriate next response to submit to the server.

Parameters

challenge:byte[]: The non-null challenge sent from the server. The challenge array may have zero length.

Returns:byte[]

The possibly null response to send to the server. It is null if the challenge accompanied a "SUCCESS" status and the challenge only contains data for the client to update its state and no response needs to be sent to the server. The response is a zero-length byte array if the client is to send a response with no data.

Annotations

@Override

Exceptions

SaslException:: If an error occurred while processing the challenge or generating a response.

generateRandomPrintableAsciiString	back to summary
private String generateRandomPrintableAsciiString(int length) Generates a RFC 5802 safe nonce: "a sequence of random printable ASCII characters excluding ','" Parameters length:int the length of the nonce. Returns:String a randomly generated string formed by printable ASCII characters except comma.

generateRandomPrintableAsciiString

back to summary

private String generateRandomPrintableAsciiString(int length)

Generates a RFC 5802 safe nonce: "a sequence of random printable ASCII characters excluding ','"

Parameters

length:int: the length of the nonce.

Returns:String

a randomly generated string formed by printable ASCII characters except comma.

getIanaMechanismName back to summary

getIanaMechanismName	back to summary
pack-priv abstract String getIanaMechanismName() Returns the real IANA-registered mechanism name of this SASL client. This is the same as `SaslClient#getMechanismName()` except that subclasses may use custom mechanism names to avoid future name clashes. Returns:String a non-null string representing the IANA-registered mechanism name.

pack-priv abstract String getIanaMechanismName()

Returns the real IANA-registered mechanism name of this SASL client. This is the same as SaslClient#getMechanismName() except that subclasses may use custom mechanism names to avoid future name clashes.

Returns:String: a non-null string representing the IANA-registered mechanism name.

getNegotiatedProperty back to summary

getNegotiatedProperty	back to summary
public Object getNegotiatedProperty(String propName) Implements javax.security.sasl.SaslClient.getNegotiatedProperty. Doc from javax.security.sasl.SaslClient.getNegotiatedProperty. Retrieves the negotiated property. This method can be called only after the authentication exchange has completed (i.e., when `isComplete()` returns true); otherwise, an `IllegalStateException` is thrown. The `Sasl` class includes several well-known property names (For example, `Sasl#QOP`). A SASL provider can support other properties which are specific to the vendor and/or a mechanism. Parameters propName:String The non-null property name. Returns:Object The value of the negotiated property. If null, the property was not negotiated or is not applicable to this mechanism. Annotations @Override

public Object getNegotiatedProperty(String propName)

Implements javax.security.sasl.SaslClient.getNegotiatedProperty.

Doc from javax.security.sasl.SaslClient.getNegotiatedProperty.

Retrieves the negotiated property. This method can be called only after the authentication exchange has completed (i.e., when isComplete() returns true); otherwise, an IllegalStateException is thrown.

The Sasl class includes several well-known property names (For example, Sasl#QOP). A SASL provider can support other properties which are specific to the vendor and/or a mechanism.

Parameters

propName:String: The non-null property name.

Returns:Object

The value of the negotiated property. If null, the property was not negotiated or is not applicable to this mechanism.

Annotations

@Override

h	back to summary
pack-priv abstract byte[] h(byte[] str) The "H(str)" cryptographic hash function as described in RFC 5802, Section 2.2. Parameters str:byte[] the string to hash. Returns:byte[] the hash value of the given string.

back to summary

pack-priv abstract byte[] h(byte[] str)

The "H(str)" cryptographic hash function as described in RFC 5802, Section 2.2.

Parameters

str:byte[]: the string to hash.

Returns:byte[]

the hash value of the given string.

hasInitialResponse back to summary

hasInitialResponse	back to summary
public boolean hasInitialResponse() Implements javax.security.sasl.SaslClient.hasInitialResponse. Doc from javax.security.sasl.SaslClient.hasInitialResponse. Determines whether this mechanism has an optional initial response. If true, caller should call `evaluateChallenge()` with an empty array to get the initial response. Returns:boolean true if this mechanism has an initial response. Annotations @Override

public boolean hasInitialResponse()

Implements javax.security.sasl.SaslClient.hasInitialResponse.

Doc from javax.security.sasl.SaslClient.hasInitialResponse.

Determines whether this mechanism has an optional initial response. If true, caller should call evaluateChallenge() with an empty array to get the initial response.

Returns:boolean

true if this mechanism has an initial response.

Annotations

@Override

hi	back to summary
pack-priv abstract byte[] hi(String str, byte[] salt, int iterations) The "Hi(str, salt, i)" PBKDF2 function as described in RFC 5802, Section 2.2. Parameters str:String the string value to use as the internal HMAC key. salt:byte[] the input string to hash in the initial iteration. iterations:int the number of iterations to run the algorithm. Returns:byte[] an hash value with an output length equal to the length of H(str).

back to summary

pack-priv abstract byte[] hi(String str, byte[] salt, int iterations)

The "Hi(str, salt, i)" PBKDF2 function as described in RFC 5802, Section 2.2.

Parameters

str:String: the string value to use as the internal HMAC key.
salt:byte[]: the input string to hash in the initial iteration.
iterations:int: the number of iterations to run the algorithm.

Returns:byte[]

an hash value with an output length equal to the length of H(str).

hmac	back to summary
pack-priv abstract byte[] hmac(byte[] key, byte[] str) The "HMAC(key, str)" HMAC keyed hash algorithm as described in RFC 5802, Section 2.2. Parameters key:byte[] the hash key. str:byte[] the input string. Returns:byte[] the hashed value of the given params.

hmac

back to summary

pack-priv abstract byte[] hmac(byte[] key, byte[] str)

The "HMAC(key, str)" HMAC keyed hash algorithm as described in RFC 5802, Section 2.2.

Parameters

key:byte[]: the hash key.
str:byte[]: the input string.

Returns:byte[]

the hashed value of the given params.

isComplete	back to summary
public boolean isComplete() Implements javax.security.sasl.SaslClient.isComplete. Doc from javax.security.sasl.SaslClient.isComplete. Determines whether the authentication exchange has completed. This method may be called at any time, but typically, it will not be called until the caller has received indication from the server (in a protocol-specific manner) that the exchange has completed. Returns:boolean true if the authentication exchange has completed; false otherwise. Annotations @Override

isComplete

back to summary

public boolean isComplete()

Implements javax.security.sasl.SaslClient.isComplete.

Doc from javax.security.sasl.SaslClient.isComplete.

Determines whether the authentication exchange has completed. This method may be called at any time, but typically, it will not be called until the caller has received indication from the server (in a protocol-specific manner) that the exchange has completed.

Returns:boolean

true if the authentication exchange has completed; false otherwise.

Annotations

@Override

parseChallenge back to summary

parseChallenge	back to summary
private Map<String, String> parseChallenge(String challenge) Parses a SASL challenge. Parameters challenge:String the server message (challenge) to parse. Returns:Map<String, String> a `Map` with the key/value pairs obtained from the server challenge.

private Map<String, String> parseChallenge(String challenge)

Parses a SASL challenge.

Parameters

challenge:String: the server message (challenge) to parse.

Returns:Map<String, String>

a Map with the key/value pairs obtained from the server challenge.

prepUserName	back to summary
private String prepUserName(String userName)

unwrap back to summary

unwrap	back to summary
public byte[] unwrap(byte[] incoming, int offset, int len) throws SaslException Implements javax.security.sasl.SaslClient.unwrap. Doc from javax.security.sasl.SaslClient.unwrap. Unwraps a byte array received from the server. This method can be called only after the authentication exchange has completed (i.e., when `isComplete()` returns true) and only if the authentication exchange has negotiated integrity and/or privacy as the quality of protection; otherwise, an `IllegalStateException` is thrown. `incoming` is the contents of the SASL buffer as defined in RFC 2222 without the leading four octet field that represents the length. `offset` and `len` specify the portion of `incoming` to use. Parameters incoming:byte[] A non-null byte array containing the encoded bytes from the server. offset:int The starting position at `incoming` of the bytes to use. len:int The number of bytes from `incoming` to use. Returns:byte[] A non-null byte array containing the decoded bytes. Annotations @Override Exceptions SaslException: if `incoming` cannot be successfully unwrapped.

public byte[] unwrap(byte[] incoming, int offset, int len) throws SaslException

Implements javax.security.sasl.SaslClient.unwrap.

Doc from javax.security.sasl.SaslClient.unwrap.

Unwraps a byte array received from the server. This method can be called only after the authentication exchange has completed (i.e., when isComplete() returns true) and only if the authentication exchange has negotiated integrity and/or privacy as the quality of protection; otherwise, an IllegalStateException is thrown.

incoming is the contents of the SASL buffer as defined in RFC 2222 without the leading four octet field that represents the length. offset and len specify the portion of incoming to use.

Parameters

incoming:byte[]: A non-null byte array containing the encoded bytes from the server.
offset:int: The starting position at incoming of the bytes to use.
len:int: The number of bytes from incoming to use.

Returns:byte[]

A non-null byte array containing the decoded bytes.

Annotations

@Override

Exceptions

SaslException:: if incoming cannot be successfully unwrapped.

wrap back to summary

wrap	back to summary
public byte[] wrap(byte[] outgoing, int offset, int len) throws SaslException Implements javax.security.sasl.SaslClient.wrap. Doc from javax.security.sasl.SaslClient.wrap. Wraps a byte array to be sent to the server. This method can be called only after the authentication exchange has completed (i.e., when `isComplete()` returns true) and only if the authentication exchange has negotiated integrity and/or privacy as the quality of protection; otherwise, an `IllegalStateException` is thrown. The result of this method will make up the contents of the SASL buffer as defined in RFC 2222 without the leading four octet field that represents the length. `offset` and `len` specify the portion of `outgoing` to use. Parameters outgoing:byte[] A non-null byte array containing the bytes to encode. offset:int The starting position at `outgoing` of the bytes to use. len:int The number of bytes from `outgoing` to use. Returns:byte[] A non-null byte array containing the encoded bytes. Annotations @Override Exceptions SaslException: if `outgoing` cannot be successfully wrapped.

public byte[] wrap(byte[] outgoing, int offset, int len) throws SaslException

Implements javax.security.sasl.SaslClient.wrap.

Doc from javax.security.sasl.SaslClient.wrap.

Wraps a byte array to be sent to the server. This method can be called only after the authentication exchange has completed (i.e., when isComplete() returns true) and only if the authentication exchange has negotiated integrity and/or privacy as the quality of protection; otherwise, an IllegalStateException is thrown.

The result of this method will make up the contents of the SASL buffer as defined in RFC 2222 without the leading four octet field that represents the length. offset and len specify the portion of outgoing to use.

Parameters

outgoing:byte[]: A non-null byte array containing the bytes to encode.
offset:int: The starting position at outgoing of the bytes to use.
len:int: The number of bytes from outgoing to use.

Returns:byte[]

A non-null byte array containing the encoded bytes.

Annotations

@Override

Exceptions

SaslException:: if outgoing cannot be successfully wrapped.

xorInPlace back to summary

xorInPlace	back to summary
pack-priv byte[] xorInPlace(byte[] inOut, byte[] other) Combines the two byte arrays in a XOR operation, changing the contents of the first. Parameters inOut:byte[] the left operand of the XOR operation and the destination of the result. other:byte[] the right operand of the XOR operation. Returns:byte[] the same as the param `inOut`, after being updated.

pack-priv byte[] xorInPlace(byte[] inOut, byte[] other)

Combines the two byte arrays in a XOR operation, changing the contents of the first.

Parameters

inOut:byte[]: the left operand of the XOR operation and the destination of the result.
other:byte[]: the right operand of the XOR operation.

Returns:byte[]

the same as the param inOut, after being updated.

Modifier and Type	Field and Description
public static final ScramShaSaslClient.ScramExchangeStage	CLIENT_FIRST
private ScramShaSaslClient.ScramExchangeStage	next
public static final ScramShaSaslClient.ScramExchangeStage	SERVER_FINAL
public static final ScramShaSaslClient.ScramExchangeStage	SERVER_FIRST_CLIENT_FINAL
public static final ScramShaSaslClient.ScramExchangeStage	TERMINATED

Modifier and Type	Method and Description
public ScramShaSaslClient.ScramExchangeStage	getNext()
public static ScramShaSaslClient.ScramExchangeStage	valueOf(String name)
public static ScramShaSaslClient.ScramExchangeStage[]	values()

public abstract Class ScramShaSaslClient

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

protected final Enum ScramShaSaslClient.ScramExchangeStage

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail