co.cask.cdap.security.auth

Class AccessToken

java.lang.Object

co.cask.cdap.security.auth.AccessToken

All Implemented Interfaces:

Signed<AccessTokenIdentifier>

public class AccessToken
extends Object
implements Signed<AccessTokenIdentifier>

Represents a verified identity used for client authentication. The token consists of two parts:

• the token identity - represented by the AccessTokenIdentifier, this contains the authenticated username, group memberships, and valid token lifetime,
• the token digest - a signature computed on the token identity components plus a server-side secret key, this ensures that the token is authentic (was issued by a trusted server) and has not been modified.

An access token is issued following successful authentication of a client by an external mechanism (such as LDAP, Kerberos, etc). The token is then provided by the client on subsequent requests to CDAP. In order to validate the token, CDAP components recompute the digest for the token identifier, based on their own knowledge of the secret key. If the recomputed digest matches that provided by the client, we know that, barring compromise of the secret keys or exposure of the token itself, the token was issued by CDAP for this client.

Constructor Summary

Constructors

Constructor and Description
AccessToken(AccessTokenIdentifier identifier, int keyId, byte[] digest)

Method Summary

Methods

Modifier and Type	Method and Description
boolean	equals(Object object)
byte[]	getDigestBytes() Returns the digest generated against the message.
AccessTokenIdentifier	getIdentifier() Returns the identity portion of the token (username, group memberships, etc).
int	getKeyId() Returns the identifier for the secret key used to sign this token.
AccessTokenIdentifier	getMessage() Returns the message object which was signed.
int	hashCode()
String	toString()

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Constructor Detail

AccessToken

public AccessToken(AccessTokenIdentifier identifier,
           int keyId,
           byte[] digest)

Method Detail

getKeyId

public int getKeyId()

Returns the identifier for the secret key used to sign this token.

Specified by:

getKeyId in interface Signed<AccessTokenIdentifier>

getIdentifier

public AccessTokenIdentifier getIdentifier()

Returns the identity portion of the token (username, group memberships, etc).

getMessage

public AccessTokenIdentifier getMessage()

Description copied from interface: Signed

Returns the message object which was signed.

Specified by:

getMessage in interface Signed<AccessTokenIdentifier>

getDigestBytes

public byte[] getDigestBytes()

Description copied from interface: Signed

Returns the digest generated against the message.

Specified by:

getDigestBytes in interface Signed<AccessTokenIdentifier>

equals

public boolean equals(Object object)

Overrides:

equals in class Object

hashCode

public int hashCode()

Overrides:

hashCode in class Object

toString

public String toString()

Overrides:

toString in class Object