co.cask.cdap.security.auth

Interface KeyManager

All Superinterfaces:

com.google.common.util.concurrent.Service

All Known Implementing Classes:

AbstractKeyManager, DistributedKeyManager, FileBasedKeyManager, InMemoryKeyManager, MapBackedKeyManager

public interface KeyManager
extends com.google.common.util.concurrent.Service

Maintains secret keys used to sign and validate authentication tokens.

Nested Class Summary

Nested Classes

Modifier and Type	Interface and Description
static class	KeyManager.DigestId Represents the combination of a digest computed on a message using a secret key, and the ID of the secret key used to compute the digest.

Nested classes/interfaces inherited from interface com.google.common.util.concurrent.Service

com.google.common.util.concurrent.Service.Listener, com.google.common.util.concurrent.Service.State

Method Summary

Methods

Modifier and Type	Method and Description
KeyManager.DigestId	generateMAC(byte[] message) Computes a digest for the given input message, using the current secret key.
<T> void	validateMAC(Codec<T> codec, Signed<T> signedMessage) Recomputes the digest for the given message and verifies that it matches the provided value.

Methods inherited from interface com.google.common.util.concurrent.Service

addListener, isRunning, start, startAndWait, state, stop, stopAndWait

Method Detail

generateMAC

KeyManager.DigestId generateMAC(byte[] message)
                                throws InvalidKeyException

Computes a digest for the given input message, using the current secret key.

Parameters:

message - The data over which we should generate a digest.

Returns:

The computed digest and the ID of the secret key used in generation.

Throws:

InvalidKeyException - If the internal Mac implementation does not accept the given key.

validateMAC

<T> void validateMAC(Codec<T> codec,
                   Signed<T> signedMessage)
                 throws InvalidDigestException,
                        InvalidKeyException

Recomputes the digest for the given message and verifies that it matches the provided value.

Parameters:

codec - The serialization utility to use in serializing the message when recomputing the digest

signedMessage - The message and digest to validate.

Throws:

InvalidDigestException

InvalidKeyException