Package org.forgerock.openam.secrets

Class SecretsProviderFacade

java.lang.Object

org.forgerock.secrets.SecretsProvider

org.forgerock.openam.secrets.SecretsProviderFacade

@EvolvingAll
public class SecretsProviderFacade
extends SecretsProvider

A facade around SecretsProvider instances from the realm and global levels that will delegate correctly to the global provider when a secret is not found in the realm, and knows how to resolve secrets for a DefaultingPurpose.

Since:

AM 6.5.0

Method Summary

Modifier and Type	Method	Description
<S extends Secret> Promise<S,NoSuchSecretException>	getActiveSecret(DefaultingPurpose<S> defaultingPurpose, String instanceId)	Get the active secret for a DefaultingPurpose.
<S extends Secret> Promise<S,NoSuchSecretException>	getActiveSecret(Purpose<S> purpose)	Gets the currently active secret for the given purpose.
X509ExtendedKeyManager	getKeyManager(Purpose<? extends CryptoKey> purpose)	Returns a KeyManager that can be used to initialize an SSLContext, allowing certificates and private keys to be retrieved from this secrets provider.
X509ExtendedKeyManager	getKeyManager(Purpose<? extends CryptoKey> purpose, Options options)	Returns a KeyManager that can be used to initialize an SSLContext, allowing certificates and private keys to be retrieved from this secrets provider.
<S extends Secret> Promise<S,NoSuchSecretException>	getNamedSecret(DefaultingPurpose<S> defaultingPurpose, String instanceId, String keyId)	Get the named secret for a DefaultingPurpose.
<S extends Secret> Promise<S,NoSuchSecretException>	getNamedSecret(Purpose<S> purpose, String id)	Gets the secret for the given purpose with the given stable secret id.
SecretsReferenceProvider	getSecretsReferenceProvider()	Get a SecretsReferenceProvider from this secrets provider.
SigningManager	getSigningManager()	Get a SigningManager from this secrets provider.
SecretsTrustManager	getTrustManager(Purpose<? extends CryptoKey> purpose, Options options)	Constructs an X509ExtendedTrustManager that will retrieve certificates from this secrets provider for the provided purpose.
<S extends Secret> Promise<Stream<S>,NeverThrowsException>	getValidSecrets(DefaultingPurpose<S> defaultingPurpose, String instanceId)	Get a stream of the valid secrets for a DefaultingPurpose.
<S extends Secret> Promise<Stream<S>,NeverThrowsException>	getValidSecrets(Purpose<S> purpose)	Returns all secrets for the given purpose which have not yet expired.

Methods inherited from class org.forgerock.secrets.SecretsProvider

asKeyStore, asKeyStore, createActiveReference, createNamedReference, createValidOrNamedReference, createValidReference, getNamedOrValidSecrets, getTrustManager, getTrustManager, setActiveStore, setActiveStore, setDefaultStores, useSpecificSecretForPurpose, useSpecificSecretsForPurpose

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

getActiveSecret

public <S extends Secret> Promise<S,NoSuchSecretException> getActiveSecret(DefaultingPurpose<S> defaultingPurpose,
                                                                                 String instanceId)

Get the active secret for a DefaultingPurpose. This method will first check for a secret using the custom purpose for the given instanceId, and if this is not found, will then check for a secret using the default purpose.

Type Parameters:

S - The type of the secret.

Parameters:

defaultingPurpose - The purpose.

instanceId - The instance ID of the item that may have a custom purpose configured. May be null.

Returns:

A promise of the active secret, or an exception if one could not be found.

getActiveSecret

public <S extends Secret> Promise<S,NoSuchSecretException> getActiveSecret(Purpose<S> purpose)

Description copied from class: SecretsProvider

Gets the currently active secret for the given purpose. If more than one secret exists for this purpose, then this method returns the secret that is currently active and should be used for new operations. The returned secret is guaranteed to be within the valid periods specified by its validFrom and expiry times. If no valid secret is configured for the purpose then a NoSuchSecretException is thrown instead.

The active secret is found by first consulting the currently active store for the purpose label. If no active stores exist for the purpose, all default stores are consulted, and the first matching secret is used.

Overrides:

getActiveSecret in class SecretsProvider

Type Parameters:

S - the type of secret to return.

Parameters:

purpose - the purpose for which the secret is intended to be used.

Returns:

A promise containing either the active secret for this purpose, or a NoSuchSecretException if one cannot be found.

getNamedSecret

public <S extends Secret> Promise<S,NoSuchSecretException> getNamedSecret(DefaultingPurpose<S> defaultingPurpose,
                                                                                String instanceId,
                                                                                String keyId)

Get the named secret for a DefaultingPurpose. This method will first check for a secret using the custom purpose for the given instanceId, and if this is not found, will then check for a secret using the default purpose.

Type Parameters:

S - The type of the secret.

Parameters:

defaultingPurpose - The purpose.

instanceId - The instance ID of the item that may have a custom purpose configured. May be null.

keyId - The secret's stable ID.

Returns:

A promise of the named secret, or an exception if one could not be found.

getNamedSecret

public <S extends Secret> Promise<S,NoSuchSecretException> getNamedSecret(Purpose<S> purpose,
                                                                                String id)

Description copied from class: SecretsProvider

Gets the secret for the given purpose with the given stable secret id.

Overrides:

getNamedSecret in class SecretsProvider

Type Parameters:

S - the type of secret to return

Parameters:

purpose - the purpose for which the secret is intended to be used.

id - the stable id of the particular secret to get.

Returns:

the secret with that id, or an empty result if no such secret exists.

See Also:

Secret.getStableId()

getValidSecrets

public <S extends Secret> Promise<Stream<S>,NeverThrowsException> getValidSecrets(DefaultingPurpose<S> defaultingPurpose,
                                                                                        String instanceId)

Get a stream of the valid secrets for a DefaultingPurpose. This method will first check for secrets using the custom purpose for the given instanceId, and if this is not found, will then check for secrets using the default purpose.

Type Parameters:

S - The type of the secret.

Parameters:

defaultingPurpose - The purpose.

instanceId - The instance ID of the item that may have a custom purpose configured. May be null.

Returns:

A promise of a stream of secrets.

getValidSecrets

public <S extends Secret> Promise<Stream<S>,NeverThrowsException> getValidSecrets(Purpose<S> purpose)

Description copied from class: SecretsProvider

Returns all secrets for the given purpose which have not yet expired. This can be used, for instance, to get a list of all signature validation keys that are still trusted. The secrets will be returned in the order of preference of the store they are from: secrets from the active store will be first, then the most recent previous active store, and so on.

Overrides:

getValidSecrets in class SecretsProvider

Type Parameters:

S - the type of secret to return.

Parameters:

purpose - the purpose for which the secrets are intended for.

Returns:

a stream of all valid secrets for the given purpose, or an empty stream if not configured.

getSecretsReferenceProvider

public SecretsReferenceProvider getSecretsReferenceProvider()

Get a SecretsReferenceProvider from this secrets provider.

Returns:

The SecretsReferenceProvider for this SecretsProvider.

getSigningManager

public SigningManager getSigningManager()

Get a SigningManager from this secrets provider.

Returns:

The SigningManager for thisSecretsProvider.

getTrustManager

public SecretsTrustManager getTrustManager(Purpose<? extends CryptoKey> purpose,
                                           Options options)

Description copied from class: SecretsProvider

Constructs an X509ExtendedTrustManager that will retrieve certificates from this secrets provider for the provided purpose. This can be used to configured SSL connections via SSLContext.init(KeyManager[], TrustManager[], SecureRandom).

Overrides:

getTrustManager in class SecretsProvider

Parameters:

purpose - the purpose to use to lookup trusted certificates.

options - the trust manager options - see SecretsTrustManager for details.

Returns:

the trust manager to use

getKeyManager

public X509ExtendedKeyManager getKeyManager(Purpose<? extends CryptoKey> purpose)

Description copied from class: SecretsProvider

Returns a KeyManager that can be used to initialize an SSLContext, allowing certificates and private keys to be retrieved from this secrets provider.

Overrides:

getKeyManager in class SecretsProvider

Parameters:

purpose - the purpose to use for retrieving TLS certificates and keys.

Returns:

a KeyManager that obtains keys and certificates from this secrets provider.

getKeyManager

public X509ExtendedKeyManager getKeyManager(Purpose<? extends CryptoKey> purpose,
                                            Options options)

Description copied from class: SecretsProvider

Returns a KeyManager that can be used to initialize an SSLContext, allowing certificates and private keys to be retrieved from this secrets provider.

Overrides:

getKeyManager in class SecretsProvider

Parameters:

purpose - the purpose to use for retrieving TLS certificates and keys.

options - the options to configure the key manager. See SecretsKeyManager.KEY_MANAGER_ALGORITHM.

Returns:

a KeyManager that obtains keys and certificates from this secrets provider.