Package org.forgerock.openig.secrets

Class DefaultSecretsService

    • Method Detail

      • getActiveSecret

        public <S extends Secret> Promise<S,​NoSuchSecretException> getActiveSecret​(Purpose<S> purpose)
        Deprecated.
        Description copied from interface: SecretsService
        Gets the currently active secret for the given purpose. If more than one secret exists for this purpose, then this method returns the secret that is currently active and should be used for new operations. The returned secret is guaranteed to be within the valid periods specified by its validFrom and expiry times. If no valid secret is configured for the purpose then a NoSuchSecretException is thrown instead.

        The active secret is found by first consulting the currently active store for the purpose label. If no active stores exist for the purpose, all default stores are consulted, and the first matching secret is used.

        This method is usually used for encryption and signature operations, where you need to use the active (not rotated) crypto material.

        Specified by:
        getActiveSecret in interface SecretsService
        Type Parameters:
        S - the type of secret to return.
        Parameters:
        purpose - the purpose for which the secret is intended to be used.
        Returns:
        A promise containing either the active secret for this purpose, or a NoSuchSecretException if one cannot be found.

      • getNamedSecret

        public <S extends Secret> Promise<S,​NoSuchSecretException> getNamedSecret​(Purpose<S> purpose,
                                                                                String id)
        Deprecated.
        Description copied from interface: SecretsService
        Gets the secret for the given purpose with the given stable secret id.

        This method is usually used for decryption and signature verification operations, where you may have a hint for selecting the crypto material to use for the operation. Because the verified signature may have been generated with a rotated secret (at time of verification), #getActiveSecret cannot be used.

        Specified by:
        getNamedSecret in interface SecretsService
        Type Parameters:
        S - the type of secret to return
        Parameters:
        purpose - the purpose for which the secret is intended to be used.
        id - the stable id of the particular secret to get.
        Returns:
        the secret with that id, or an empty result if no such secret exists.
        See Also:
        Secret.getStableId()

      • getValidSecrets

        public <S extends Secret> Promise<Stream<S>,​NeverThrowsException> getValidSecrets​(Purpose<S> purpose)
        Deprecated.
        Description copied from interface: SecretsService
        Returns all secrets for the given purpose which have not yet expired. This can be used, for instance, to get a list of all signature validation keys that are still trusted. The secrets will be returned in the order of preference of the store they are from: secrets from the active store will be first, then the most recent previously active store, and so on.
        Specified by:
        getValidSecrets in interface SecretsService
        Type Parameters:
        S - the type of secret to return.
        Parameters:
        purpose - the purpose for which the secrets are intended for.
        Returns:
        a stream of all valid secrets for the given purpose, or an empty stream if not configured.

      • createNamedReference

        public <S extends Secret> SecretReference<S> createNamedReference​(Purpose<S> purpose,
                                                                  String name)
        Deprecated.
        Description copied from interface: SecretsService
        Creates a reference to a secret with the given name (stable id) for the given purpose.
        Specified by:
        createNamedReference in interface SecretsService
        Type Parameters:
        S - the type of secret.
        Parameters:
        purpose - the purpose.
        name - the name (stable id) of the secret.
        Returns:
        a reference to the named secret in this secrets provider.

      • useSpecificSecretForPurpose

        public <S extends Secret> SecretsProvider useSpecificSecretForPurpose​(Purpose<S> purpose,
                                                                      S secret)
        Deprecated.
        Description copied from interface: SecretsService
        Configures this SecretsProvider to always return the specific given secret for the given purpose. This removes any other secret stores configured for this purpose and configures the provider to only ever return this specific secret as the active and only valid secret for this purpose, until the secret expires or is manually reconfigured.
        Specified by:
        useSpecificSecretForPurpose in interface SecretsService
        Type Parameters:
        S - the type of secret.
        Parameters:
        purpose - the purpose to configure the secret for.
        secret - the specific secret to use for this purpose.
        Returns:
        this provider after updating the configuration.

      • setDefaultStores

        public SecretsProvider setDefaultStores​(SecretStore<?> activeStore,
                                        SecretStore<?>... defaultStores)
        Deprecated.
        Description copied from interface: SecretsService
        Sets the default store(s) to use if there is no specific store configured for a particular purpose.
        Specified by:
        setDefaultStores in interface SecretsService
        Parameters:
        activeStore - the store to use for all requests for active secrets.
        defaultStores - remaining valid stores to consult for existing named/valid secrets.
        Returns:
        the updated secrets provider object.

      • asKeyStore

        public <T extends CryptoKey> KeyStore asKeyStore​(Purpose<T> purpose)
        Deprecated.
        Description copied from interface: SecretsService
        Returns a view of this secrets provider as a keystore for the given purpose.
        Specified by:
        asKeyStore in interface SecretsService
        Type Parameters:
        T - the type of keys.
        Parameters:
        purpose - the purpose that the keystore will be used for.
        Returns:
        the keystore view of this secrets provider.

      • getNamedOrValidSecrets

        public <S extends Secret> Promise<Stream<S>,​NeverThrowsException> getNamedOrValidSecrets​(Purpose<S> purpose,
                                                                                               String id)
        Deprecated.
        Description copied from interface: SecretsService
        If the given id is not null, then this returns the single named secret that corresponds to that stable id (or a stream of valid secrets for the given purpose if no such secret exists), otherwise it returns all valid secrets for the given purpose. This is a convenience method for a frequent case where you want to process an incoming message (e.g., to decrypt or verify it) and the message may or may not have a secret/key identifier.
        Specified by:
        getNamedOrValidSecrets in interface SecretsService
        Type Parameters:
        S - the type of secrets to return.
        Parameters:
        purpose - the purpose for which the secrets are intended.
        id - the optional stable id of the secret, or null if not known.
        Returns:
        a stream of all secrets to try, or an empty stream if none are applicable.