Top Description Inners Fields Constructors Methods
com.oracle.bmc.auth.internal

public Class X509FederationClient

extends Object
implements FederationClient, ProvidesConfigurableRefresh
Class Inheritance
All Implemented Interfaces
com.oracle.bmc.auth.ProvidesConfigurableRefresh, com.oracle.bmc.auth.internal.FederationClient
Imports
com.fasterxml.jackson.annotation.JsonInclude, .JsonProperty, com.oracle.bmc.auth.ProvidesConfigurableRefresh, .SessionKeySupplier, .X509CertificateSupplier, com.oracle.bmc.circuitbreaker.CircuitBreakerConfiguration, .OciCircuitBreaker, com.oracle.bmc.http.ClientConfigurator, .Priorities, com.oracle.bmc.http.client.HttpClient, .HttpProvider, .Method, .StandardClientProperties, com.oracle.bmc.http.internal.AuthnClientFilter, .CircuitBreakerHelper, .ClientCall, .ClientIdFilter, .LogHeadersFilter, com.oracle.bmc.http.signing.SigningStrategy, com.oracle.bmc.http.signing.internal.KeySupplier, .RequestSignerImpl, com.oracle.bmc.model.BmcException, com.oracle.bmc.requests.BmcRequest, com.oracle.bmc.responses.BmcResponse, com.oracle.bmc.retrier.DefaultRetryCondition, .RetryConfiguration, com.oracle.bmc.util.VisibleForTesting, com.oracle.bmc.util.internal.Validate, com.oracle.bmc.waiter.ExponentialBackoffDelayStrategyWithJitter, .MaxAttemptsTerminationStrategy, org.slf4j.Logger, jakarta.annotation.Nonnull, javax.security.auth.RefreshFailedException, .Refreshable, java.net.URI, java.security.KeyPair, .PrivateKey, java.security.cert.CertificateException, .X509Certificate, java.security.interfaces.RSAPrivateKey, .RSAPublicKey, java.time.Duration, java.util.Collections, .HashSet, .List, .Map, .Optional, .Set, java.util.function.Supplier

This class gets a security token from the auth service by signing the request with a PKI issued leaf certificate, passing along a temporary public key that is bounded to the the security token, and the leaf certificate.

Nested and Inner Type Summary

Modifier and TypeClass and Description
private static class
pack-priv static class
public static class
public static class

Field Summary

Modifier and TypeField and Description
private final List<ClientConfigurator>
private final OciCircuitBreaker
private final ClientConfigurator
private static final String
private static final String
private final HttpClient
private final Set<X509CertificateSupplier>
private final X509CertificateSupplier
private static final Logger
private final String
private static final RetryConfiguration
private volatile SecurityTokenAdapter
private final SessionKeySupplier
private String

Constructor Summary

AccessConstructor and Description
public
X509FederationClient(String federationEndpoint, String tenancyId, X509CertificateSupplier leafCertificateSupplier, SessionKeySupplier sessionKeySupplier, Set<X509CertificateSupplier> intermediateCertificateSuppliers, ClientConfigurator clientConfigurator, List<ClientConfigurator> additionalClientConfigurators, CircuitBreakerConfiguration circuitBreakerConfig)

Same as X509FederationClient(String, String, X509CertificateSupplier, SessionKeySupplier, Set, ClientConfigurator, List, String) but with 'purpose' set to DEFAULT_PURPOSE.

public
X509FederationClient(String
the auth service endpoint.
federationEndpoint
,
String
the tenancy id, to construct the key id
tenancyId
,
X509CertificateSupplier
the leaf certificate, used to identify the caller
leafCertificateSupplier
,
SessionKeySupplier
the temporary public key, whose corresponding private key will be used to sign actual API calls
sessionKeySupplier
,
Set<X509CertificateSupplier>
intermediate certificates, if there are any (else null)
intermediateCertificateSuppliers
,
ClientConfigurator
client configurator used to configure the federation rest client, if any (else null)
clientConfigurator
,
List<ClientConfigurator>
Additional client configurators to be run after the primary configurator.
additionalClientConfigurators
,
CircuitBreakerConfiguration circuitBreakerConfig, String
The purpose that will be configured for each request.
purpose
)

The constructor.

Method Summary

Modifier and TypeMethod and Description
public X509CertificateSupplier
public String

Returns:

the security token
getSecurityToken
()

Implements com.oracle.bmc.auth.internal.FederationClient.getSecurityToken.

Gets a security token.

private SecurityTokenAdapter

Returns:

the security token, which is basically a JWT token string
getSecurityTokenFromServer
()

Gets a security token from the federation server

public String

Returns:

the value of the claim
getStringClaim
(String
the name of the claim
key
)

Implements com.oracle.bmc.auth.internal.FederationClient.getStringClaim.

Return a claim embedded in the security token

public String
private static String
keyIdForX509Request(String tenancyId, X509Certificate certificate)

pack-priv X509FederationClient.FederationResponseWrapper
public String
refreshAndGetSecurityToken()

Implements com.oracle.bmc.auth.internal.FederationClient.refreshAndGetSecurityToken.

Gets a security token from the federation endpoint.

public String
refreshAndGetSecurityTokenIfExpiringWithin(Duration
the duration to check
time
)

Implements com.oracle.bmc.auth.ProvidesConfigurableRefresh.refreshAndGetSecurityTokenIfExpiringWithin.

Gets a security token from the federation endpoint if the security token expires within the provided duration.

public String
refreshAndGetSecurityTokenIfExpiringWithin(Duration
the duration to check
time
,
boolean
boolean value to enable/disable refresh of keys
refreshKeys
)

Implements com.oracle.bmc.auth.ProvidesConfigurableRefresh.refreshAndGetSecurityTokenIfExpiringWithin.

Gets a security token from the federation endpoint if the security token expires within the provided duration and allows to enable/disable refresh of keys.

private String
refreshAndGetSecurityTokenInner(final boolean doFinalTokenValidityCheck, Optional<Duration> time, boolean refreshKeys)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

additionalClientConfiguratorsback to summary
private final List<ClientConfigurator> additionalClientConfigurators
circuitBreakerback to summary
private final OciCircuitBreaker circuitBreaker
clientConfiguratorback to summary
private final ClientConfigurator clientConfigurator
DEFAULT_FINGERPRINTback to summary
private static final String DEFAULT_FINGERPRINT
DEFAULT_PURPOSEback to summary
private static final String DEFAULT_PURPOSE
httpClientback to summary
private final HttpClient httpClient
intermediateCertificateSuppliersback to summary
private final Set<X509CertificateSupplier> intermediateCertificateSuppliers
leafCertificateSupplierback to summary
private final X509CertificateSupplier leafCertificateSupplier
LOGback to summary
private static final Logger LOG
purposeback to summary
private final String purpose
RETRY_CONFIGURATIONback to summary
private static final RetryConfiguration RETRY_CONFIGURATION
securityTokenAdapterback to summary
private volatile SecurityTokenAdapter securityTokenAdapter
sessionKeySupplierback to summary
private final SessionKeySupplier sessionKeySupplier
tenancyIdback to summary
private String tenancyId

Constructor Detail

X509FederationClientback to summary
public X509FederationClient(String federationEndpoint, String tenancyId, X509CertificateSupplier leafCertificateSupplier, SessionKeySupplier sessionKeySupplier, Set<X509CertificateSupplier> intermediateCertificateSuppliers, ClientConfigurator clientConfigurator, List<ClientConfigurator> additionalClientConfigurators, CircuitBreakerConfiguration circuitBreakerConfig)

Same as X509FederationClient(String, String, X509CertificateSupplier, SessionKeySupplier, Set, ClientConfigurator, List, String) but with 'purpose' set to DEFAULT_PURPOSE.

X509FederationClientback to summary
public X509FederationClient(String federationEndpoint, String tenancyId, X509CertificateSupplier leafCertificateSupplier, SessionKeySupplier sessionKeySupplier, Set<X509CertificateSupplier> intermediateCertificateSuppliers, ClientConfigurator clientConfigurator, List<ClientConfigurator> additionalClientConfigurators, CircuitBreakerConfiguration circuitBreakerConfig, String purpose)

The constructor.

Parameters
federationEndpoint:String

the auth service endpoint.

tenancyId:String

the tenancy id, to construct the key id

leafCertificateSupplier:X509CertificateSupplier

the leaf certificate, used to identify the caller

sessionKeySupplier:SessionKeySupplier

the temporary public key, whose corresponding private key will be used to sign actual API calls

intermediateCertificateSuppliers:Set<X509CertificateSupplier>

intermediate certificates, if there are any (else null)

clientConfigurator:ClientConfigurator

client configurator used to configure the federation rest client, if any (else null)

additionalClientConfigurators:List<ClientConfigurator>

Additional client configurators to be run after the primary configurator.

purpose:String

The purpose that will be configured for each request.

Method Detail

getLeafCertificateSupplierback to summary
public X509CertificateSupplier getLeafCertificateSupplier()
getSecurityTokenback to summary
public String getSecurityToken()

Implements com.oracle.bmc.auth.internal.FederationClient.getSecurityToken.

Gets a security token. If there is already a valid token cached, it will be returned. Else this will make a call to the auth service to get a new token, using the provided suppliers.

This method is thread-safe.

Returns:String

the security token

Annotations
@Override
Exceptions
BmcException:
If there is any issue with getting a token from the auth server
IllegalArgumentException:
if there is a problem with the key/certificate suppliers
getSecurityTokenFromServerback to summary
private SecurityTokenAdapter getSecurityTokenFromServer()

Gets a security token from the federation server

Returns:SecurityTokenAdapter

the security token, which is basically a JWT token string

getStringClaimback to summary
public String getStringClaim(String key)

Implements com.oracle.bmc.auth.internal.FederationClient.getStringClaim.

Return a claim embedded in the security token

Parameters
key:String

the name of the claim

Returns:String

the value of the claim

Annotations
@Override
getTenancyIdback to summary
public String getTenancyId()
keyIdForX509Requestback to summary
private static String keyIdForX509Request(String tenancyId, X509Certificate certificate)
makeCallback to summary
pack-priv X509FederationClient.FederationResponseWrapper makeCall(X509FederationClient.X509FederationRequest federationRequest)
Annotations
@VisibleForTesting
refreshAndGetSecurityTokenback to summary
public String refreshAndGetSecurityToken()

Implements com.oracle.bmc.auth.internal.FederationClient.refreshAndGetSecurityToken.

Doc from com.oracle.bmc.auth.internal.FederationClient.refreshAndGetSecurityToken.

Gets a security token from the federation endpoint. This will always retreive a new token from the federation endpoint and does not use a cached token.

Returns:String

A security token that can be used to authenticate requests.

Annotations
@Override
refreshAndGetSecurityTokenIfExpiringWithinback to summary
public String refreshAndGetSecurityTokenIfExpiringWithin(Duration time)

Implements com.oracle.bmc.auth.ProvidesConfigurableRefresh.refreshAndGetSecurityTokenIfExpiringWithin.

Doc from com.oracle.bmc.auth.ProvidesConfigurableRefresh.refreshAndGetSecurityTokenIfExpiringWithin.

Gets a security token from the federation endpoint if the security token expires within the provided duration. This will always retrieve a new token from the federation endpoint and does not use a cached token.

Parameters
time:Duration

the duration to check

Returns:String

A security token that can be used to authenticate requests.

Annotations
@Override
refreshAndGetSecurityTokenIfExpiringWithinback to summary
public String refreshAndGetSecurityTokenIfExpiringWithin(Duration time, boolean refreshKeys)

Implements com.oracle.bmc.auth.ProvidesConfigurableRefresh.refreshAndGetSecurityTokenIfExpiringWithin.

Doc from com.oracle.bmc.auth.ProvidesConfigurableRefresh.refreshAndGetSecurityTokenIfExpiringWithin.

Gets a security token from the federation endpoint if the security token expires within the provided duration and allows to enable/disable refresh of keys. This will always retrieve a new token from the federation endpoint and does not use a cached token.

Parameters
time:Duration

the duration to check

refreshKeys:boolean

boolean value to enable/disable refresh of keys

Returns:String

A security token that can be used to authenticate requests.

Annotations
@Override
refreshAndGetSecurityTokenInnerback to summary
private String refreshAndGetSecurityTokenInner(final boolean doFinalTokenValidityCheck, Optional<Duration> time, boolean refreshKeys)
com.oracle.bmc.auth.internal back to summary

private Class X509FederationClient.FederationRequestWrapper

extends BmcRequest<X509FederationClient.X509FederationRequest>
Class Inheritance

Field Summary

Modifier and TypeField and Description
private final X509FederationClient.X509FederationRequest

Constructor Summary

AccessConstructor and Description
pack-priv

Method Summary

Modifier and TypeMethod and Description
public X509FederationClient.X509FederationRequest
getBody$()

Overrides com.oracle.bmc.requests.BmcRequest.getBody$.

Alternative accessor for the body parameter, if this request supports a body.

Inherited from com.oracle.bmc.requests.BmcRequest:
equalsgetInvocationCallbackgetRetryConfigurationhashCodesetInvocationCallbacksetRetryConfigurationsupportsExpect100Continue

Field Detail

requestback to summary
private final X509FederationClient.X509FederationRequest request

Constructor Detail

FederationRequestWrapperback to summary
pack-priv FederationRequestWrapper(X509FederationClient.X509FederationRequest request)

Method Detail

getBody$back to summary
public X509FederationClient.X509FederationRequest getBody$()

Overrides com.oracle.bmc.requests.BmcRequest.getBody$.

Doc from com.oracle.bmc.requests.BmcRequest.getBody$.

Alternative accessor for the body parameter, if this request supports a body.

If this request does not support a body, an IllegalStateException is thrown.

Returns:X509FederationClient.X509FederationRequest

body parameter

Annotations
@Override
com.oracle.bmc.auth.internal back to summary

pack-priv Class X509FederationClient.FederationResponseWrapper

extends BmcResponse
Class Inheritance

Nested and Inner Type Summary

Modifier and TypeClass and Description
pack-priv static class

Field Summary

Modifier and TypeField and Description
pack-priv final X509FederationClient.SecurityToken

Constructor Summary

AccessConstructor and Description
pack-priv

Method Summary

Inherited from com.oracle.bmc.responses.BmcResponse:
canEqualequalsget__httpStatusCode__getHeadershashCode

Field Detail

tokenback to summary
pack-priv final X509FederationClient.SecurityToken token

Constructor Detail

FederationResponseWrapperback to summary
pack-priv FederationResponseWrapper(int status, X509FederationClient.SecurityToken token)
com.oracle.bmc.auth.internal back to summary

pack-priv Class X509FederationClient.FederationResponseWrapper.Builder

extends Object
implements BmcResponse.Builder<X509FederationClient.FederationResponseWrapper>
Class Inheritance
  • java.lang.Object
  • com.oracle.bmc.auth.internal.X509FederationClient.FederationResponseWrapper.Builder
All Implemented Interfaces
com.oracle.bmc.responses.BmcResponse.Builder

Field Summary

Modifier and TypeField and Description
private Map<String, List<String>>
private int
pack-priv X509FederationClient.SecurityToken

Constructor Summary

AccessConstructor and Description
pack-priv
private

Field Detail

headersback to summary
private Map<String, List<String>> headers
statusback to summary
private int status
tokenback to summary
pack-priv X509FederationClient.SecurityToken token

Constructor Detail

Builderback to summary
pack-priv Builder()
Builderback to summary
private Builder(X509FederationClient.FederationResponseWrapper b)
com.oracle.bmc.auth.internal back to summary

public Class X509FederationClient.SecurityToken

extends Object
Class Inheritance
  • java.lang.Object
  • com.oracle.bmc.auth.internal.X509FederationClient.SecurityToken

Field Summary

Modifier and TypeField and Description
private String

Constructor Summary

AccessConstructor and Description
public

Method Summary

Modifier and TypeMethod and Description
public String
Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

tokenback to summary
private String token

Constructor Detail

SecurityTokenback to summary
public SecurityToken(String token)

Method Detail

getTokenback to summary
public String getToken()
com.oracle.bmc.auth.internal back to summary

public Class X509FederationClient.X509FederationRequest

extends Object
Class Inheritance
  • java.lang.Object
  • com.oracle.bmc.auth.internal.X509FederationClient.X509FederationRequest
Annotations
@JsonInclude:NON_NULL

Class is immutable. @Immutable

Field Summary

Modifier and TypeField and Description
private final String
private final String
private final Set<String>
private final String
private final String

Constructor Summary

AccessConstructor and Description
public
X509FederationRequest(String publicKey, String certificate, Set<String> intermediateCertificates, String purpose, String fingerprintAlgorithm)

Method Summary

Modifier and TypeMethod and Description
protected boolean
canEqual(final Object other)

public boolean
equals(final Object
the reference object with which to compare.
o
)

Overrides java.lang.Object.equals.

Indicates whether some other object is "equal to" this one.

public String
public String
public Set<String>
public String
public String
public int
hashCode()

Overrides java.lang.Object.hashCode.

Returns a hash code value for this object.

Inherited from java.lang.Object:
clonefinalizegetClassnotifynotifyAlltoStringwaitwaitwait

Field Detail

certificateback to summary
private final String certificate
fingerprintAlgorithmback to summary
private final String fingerprintAlgorithm
intermediateCertificatesback to summary
private final Set<String> intermediateCertificates
publicKeyback to summary
private final String publicKey
purposeback to summary
private final String purpose

Constructor Detail

X509FederationRequestback to summary
public X509FederationRequest(String publicKey, String certificate, Set<String> intermediateCertificates, String purpose, String fingerprintAlgorithm)

Method Detail

canEqualback to summary
protected boolean canEqual(final Object other)
equalsback to summary
public boolean equals(final Object o)

Overrides java.lang.Object.equals.

Doc from java.lang.Object.equals.

Indicates whether some other object is "equal to" this one.

The equals method implements an equivalence relation on non-null object references:

  • It is reflexive: for any non-null reference value x, x.equals(x) should return true.
  • It is symmetric: for any non-null reference values x and y, x.equals(y) should return true if and only if y.equals(x) returns true.
  • It is transitive: for any non-null reference values x, y, and z, if x.equals(y) returns true and y.equals(z) returns true, then x.equals(z) should return true.
  • It is consistent: for any non-null reference values x and y, multiple invocations of x.equals(y) consistently return true or consistently return false, provided no information used in equals comparisons on the objects is modified.
  • For any non-null reference value x, x.equals(null) should return false.

An equivalence relation partitions the elements it operates on into equivalence classes; all the members of an equivalence class are equal to each other. Members of an equivalence class are substitutable for each other, at least for some purposes.

Parameters
o:Object

the reference object with which to compare.

Returns:boolean

true if this object is the same as the obj argument; false otherwise.

getCertificateback to summary
public String getCertificate()
getFingerprintAlgorithmback to summary
public String getFingerprintAlgorithm()
getIntermediateCertificatesback to summary
public Set<String> getIntermediateCertificates()
getPublicKeyback to summary
public String getPublicKey()
getPurposeback to summary
public String getPurpose()
hashCodeback to summary
public int hashCode()

Overrides java.lang.Object.hashCode.

Doc from java.lang.Object.hashCode.

Returns a hash code value for this object. This method is supported for the benefit of hash tables such as those provided by java.util.HashMap.

The general contract of hashCode is:

  • Whenever it is invoked on the same object more than once during an execution of a Java application, the hashCode method must consistently return the same integer, provided no information used in equals comparisons on the object is modified. This integer need not remain consistent from one execution of an application to another execution of the same application.
  • If two objects are equal according to the equals method, then calling the hashCode method on each of the two objects must produce the same integer result.
  • It is not required that if two objects are unequal according to the equals method, then calling the hashCode method on each of the two objects must produce distinct integer results. However, the programmer should be aware that producing distinct integer results for unequal objects may improve the performance of hash tables.
Returns:int

a hash code value for this object