SelfValidatingAuthenticationToken
- public abstract class SelfValidatingAuthenticationToken extends Principal implements AuthenticationToken
These AuthenticationTokens are characterized by the following properties:
date: The creation time.
timeout: How long this token is valid after creation.
checksum: The checksum is calculated from all relevant parts of the authentication token (including the salt, timeout, permissions, roles, and date) and most importantly, the pepper which serves as a randomized password of the server. The salt makes it hard to guess the pepper by creating a rainbow table with plausible values for the other properties.
salt: Salt for the password checksum, may be used by inheriting classes.
pepper: A static property, generated when class is loaded and used until the server reboots. It servers as randomized password of the server. “In cryptography, a pepper is a secret added to an input such as a password prior to being hashed with a cryptographic hash function.” (from: Pepper (cryptography), https://en.wikipedia.org/w/index.php?title=Pepper_(cryptography)&oldid=960047694 (last visited July 7, 2020)) In our case, the pepper is added to the token before hashing, but not exposed to the public, while the salt is. That also means that the resulting hash cannot be generated by any client nor be validated by any client, and that all tokens of this kind invalidate when the server reboots.
Fields
PEPPER
checksum
date
- protected final long date
permissions
roles
salt
timeout
- protected final long timeout
Constructors
SelfValidatingAuthenticationToken
SelfValidatingAuthenticationToken
Methods
calcChecksum
calcChecksum
- public abstract String calcChecksum(String pepper)
Implementation specific version of a peppered checksum.
For secure operation, implementing classes must make sure that the pepper is actually used in calculating the checksum and that the checksum can not be used to infer information about the pepper. This can be achieved for example by using the
calcChecksum(finalObject...fields)method.
calcChecksum
defaultIfNull
- protected static <T> T defaultIfNull(T val, T def)
getCredentials
getExpires
- public long getExpires()
getFreshSalt
getPermissions
- public Collection<String> getPermissions()
getPrincipal
- public SelfValidatingAuthenticationToken getPrincipal()
No “other” identity, so this returns itself.
getRoles
- public Collection<String> getRoles()
getTimeout
- public long getTimeout()
isExpired
- public boolean isExpired()
isHashValid
- public boolean isHashValid()
Test if the hash stored in checksum is equal to the one calculated using the secret pepper.
isValid
- public boolean isValid()
parse
- public static SelfValidatingAuthenticationToken parse(String token)
Parse a JSON string and return the generated token. Depending on the first element of the JSON, this is either (if it is “O”) a OneTimeAuthenticationToken or (if it is “S”) a SessionToken.
- Throws:
AuthenticationToken– if the string could not be parsed into a token.