|
|||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Objectjavacardx.security.CredentialManager.SecurityRequirements
@SensitiveType(sensitivity=INTEGRITY) public static class CredentialManager.SecurityRequirements
Encapsulates the requirements for a secure connection or access. The requirements may be:
Similarly to credential managers, the security requirements to be used for a particular connection or access may depend on the mode of operation (WEB, GCF,...) and on the endpoint URI being used for the connection or access.
When invoked for a web application, the default implementation of the
isClientAuthRequired(String, byte)
,
isConfidentialityRequired(String, byte)
and
isIntegrityRequired(String, byte)
methods of the
SecurityRequirements
base class indicate the requirement
for client authentication and the overall requirements for content
integrity and confidentiality of the current application as declared in
the web application's runtime descriptor and deployment descriptor,
respectively. The overall requirements of a web application for content
integrity and confidentiality corresponds to the transport guarantee
requirements declared overall on its web resources, that is whether at
least one user data security constraint has a transport guarantee value
of INTEGRAL
and whether at least one other user data security constraint
has a transport guarantee value of CONFIDENTIAL
.
SecurityRequirements objects can be set and retrieved using the
CredentialManager.setSecurityRequirements(javacardx.security.CredentialManager.SecurityRequirements, byte)
method and the
CredentialManager.getSecurityRequirements(byte)
method, respectively.
The security requirements that must apply for a particular connection being established are looked up by the protocol handler independently of the credential manager.
See Runtime Environment Specification for the Java Card Platform, Connected Edition, chapters 3, 6 and 8 for details regarding credential management and related descriptor-based configuration.
CredentialManager
,
SecurityInfo
,
TLSSecurityInfo
Constructor Summary | |
---|---|
CredentialManager.SecurityRequirements()
Creates a SecurityRequirements object that encapsulates the requirements for client authentication and the overall requirements for content integrity and confidentiality of the current web application, as declared in the web application's runtime descriptor and deployment descriptor. |
Method Summary | |
---|---|
String[] |
chooseCipherSuites(String[] supportedCipherSuites,
String endpointURI,
byte mode)
Chooses the list of cipher suite names that can be used for connection/access to the specified endpoint URI in the specified mode. |
boolean |
isClientAuthRequired(String endpointURI,
byte mode)
Indicates if client authentication is required for connection/access to the specified endpoint URI. |
boolean |
isConfidentialityRequired(String endpointURI,
byte mode)
Indicates if confidentiality guarantee is required for connection/access to the specified endpoint URI. |
boolean |
isIntegrityRequired(String endpointURI,
byte mode)
Indicates if integrity guarantee is required for connection/access to the specified endpoint URI. |
Methods inherited from class java.lang.Object |
---|
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Constructor Detail |
---|
public CredentialManager.SecurityRequirements()
false
.
Method Detail |
---|
public boolean isClientAuthRequired(String endpointURI, byte mode)
This method is only called for server connections.
The default implementation of this method when invoked for the mode
of operation CredentialManager.MODE_WEB_SERVER
returns the client
authentication requirement declared in the Runtime Descriptor of the
current application, if it is a Web application. It returns false for
any other mode of operation or other type of application.
endpointURI
- the canonicalized endpoint URI.mode
- the mode of operation: CredentialManager.MODE_GCF_SERVER
or
CredentialManager.MODE_WEB_SERVER
.
public boolean isIntegrityRequired(String endpointURI, byte mode)
The default implementation of this method when invoked for the mode
of operation CredentialManager.MODE_WEB_SERVER
returns the overall integrity
requirement declared in the Web application Deployment Descriptor of
the current application, if it is a Web application. It returns false
for any other mode of operation or other type of application.
endpointURI
- the canonicalized endpoint URI.mode
- the mode of operation: CredentialManager.MODE_GCF_SERVER
,
CredentialManager.MODE_GCF_CLIENT
or CredentialManager.MODE_WEB_SERVER
.
public boolean isConfidentialityRequired(String endpointURI, byte mode)
The default implementation of this method when invoked for the mode
of operation CredentialManager.MODE_WEB_SERVER
returns the overall
confidentiality requirement declared in the Web application
Deployment Descriptor of the current application, if it is a Web
application. It returns false for any other mode of operation or
other type of application.
endpointURI
- the canonicalized endpoint URI.mode
- the mode of operation: CredentialManager.MODE_GCF_SERVER
,
CredentialManager.MODE_GCF_CLIENT
or CredentialManager.MODE_WEB_SERVER
.
public String[] chooseCipherSuites(String[] supportedCipherSuites, String endpointURI, byte mode)
The list of supported cipher suites passed through the
supportedCipherSuites
parameter corresponds to the
cipher suites supported on the platform (in mode of operation
CredentialManager.MODE_GCF_CLIENT
) or by the peer (in mode of operation
CredentialManager.MODE_GCF_SERVER
or CredentialManager.MODE_WEB_SERVER
) that match the
application's requirements for confidentiality, integrity and peer
authentication as expressed by the methods
isConfidentialityRequired(String, byte)
,
isIntegrityRequired(String, byte)
and
isClientAuthRequired(String, byte)
, respectively.
The returned list designates the cipher suites to be used in
decreasing preference order. If null
is returned, any
cipher suite from the list of supported cipher suites may be used
(without any preference). If an empty list is returned, then no
cipher suite has been chosen and the connection/access may fail. When
a GCF client or server secure connection is successfully established,
a call to SecurityInfo.getCipherSuite()
returns one of these chosen cipher suite names. When an HTTP request
received over a web server secure connection is serviced, the value
of the request attribute
javax.servlet.request.cipher_suite
is one of these
chosen cipher suite names.
The names passed in and returned are from the Cipher Suite column of the CipherSuite definitions table in Appendix C of RFC 5246.
supportedCipherSuites
- the list of cipher suite names supported on the platform
or by the peer.endpointURI
- the canonicalized endpoint URI.mode
- the mode of operation: CredentialManager.MODE_GCF_SERVER
,
CredentialManager.MODE_GCF_CLIENT
or CredentialManager.MODE_WEB_SERVER
.
SecurityInfo
,
HttpServletRequest
|
|||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |