org.apereo.cas.configuration.model.support.x509.X509Properties.getCrlFetcher() - Code Metrics - apereo/cas - Measure and Improve Code Quality continuously with Scrutinizer

getCrlFetcher() A
last analyzed 2017-11-22 16:02 UTC

↳ Parent: org.apereo.cas.configuration.model.support.x509.X509Properties

Complexity

Conditions

Size

Total Lines

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
dl	0
loc	2
c	0
b	0
f	0
cc	1
rs	10

package org.apereo.cas.configuration.model.support.x509;

import org.apereo.cas.configuration.model.core.authentication.PersonDirectoryPrincipalResolverProperties;
import org.apereo.cas.configuration.model.support.ldap.AbstractLdapProperties;
import org.apereo.cas.configuration.support.RequiresModule;
import org.springframework.boot.context.properties.NestedConfigurationProperty;

import java.io.Serializable;
import java.util.ArrayList;
import java.util.List;
import java.util.concurrent.TimeUnit;

/**
 * This is {@link X509Properties}.
 *
 * @author Misagh Moayyed
 * @since 5.0.0
 */
@RequiresModule(name = "cas-server-support-x509-webflow")
public class X509Properties implements Serializable {
    
    private static final long serialVersionUID = -9032744084671270366L;

    /**
     * The  Principal types.
     */
    public enum PrincipalTypes {
        /**
         * Create principal by subject.
         */
        SUBJECT,
        /**
         * Create principal by subject DN.
         */
        SUBJECT_DN,
        /**
         * Create principal by serial no.
         */
        SERIAL_NO,
        /**
         * Create principal by serial no and DN.
         */
        SERIAL_NO_DN,
        /**
         * Create principal by subject alternative name.
         */
        SUBJECT_ALT_NAME,
        /**
         * Create principal by common name and EDIPI.
         */
        CN_EDIPI,
    }

    /**
     * Default setting to limit the number of intermediate certificates.
     */
    private static final int DEFAULT_MAXPATHLENGTH = 1;

    /**
     * Default setting whether to allow unspecified number of intermediate certificates.
     */
    private static final boolean DEFAULT_MAXPATHLENGTH_ALLOW_UNSPECIFIED = false;

    /**
     * Default setting to check keyUsage extension.
     */
    private static final boolean DEFAULT_CHECK_KEYUSAGE = false;

    /**
     * Default setting to force require "KeyUsage" extension.
     */
    private static final boolean DEFAULT_REQUIRE_KEYUSAGE = false;

    /**
     * The serial number prefix used for principal resolution
     * when type is set to {@link PrincipalTypes#SERIAL_NO_DN}.
     */
    private String serialNumberPrefix = "SERIALNUMBER=";
    /**
     * Value delimiter used for principal resolution
     * when type is set to {@link PrincipalTypes#SERIAL_NO_DN}.
     */
    private String valueDelimiter = ", ";
    /**
     * Threshold value if expired CRL revocation policy is to be handled via threshold.
     */
    private int revocationPolicyThreshold = 172_800;
    /**
     * Whether revocation checking should check all resources, or stop at first one.
     */
    private boolean checkAll;
    /**
     * The refresh interval of the internal scheduler in cases where CRL revocation checking
     * is done via resources.
     */
    private int refreshIntervalSeconds = 3_600;
    /**
     * The principal descriptor used for principal resolution
     * when type is set to {@link PrincipalTypes#SUBJECT}.
     */
    private String principalDescriptor;
    /**
     * When CRL revocation checking is done via distribution points,
     * decide if fetch failures should throw errors.
     */
    private boolean throwOnFetchFailure;
    /**
     * Indicates the type of principal resolution for X509.
     * <ul>
     * <li>{@code SERIAL_NO}: Resolve the principal by the serial number with a configurable radix,
     * ranging from 2 to 36. If radix is 16, then the serial number could be filled with leading zeros to even the number of digits.</li>
     * <li>{@code SERIAL_NO_DN}: Resolve the principal by serial number and issuer dn.</li>
     * <li>{@code SUBJECT}: Resolve the principal by extracting one or more attribute values from the
     * certificate subject DN and combining them with intervening delimiters.</li>
     * <li>{@code SUBJECT_ALT_NAME}: Resolve the principal by the subject alternative name extension.</li>
     * <li>{@code SUBJECT_DN}: The default type; Resolve the principal by the certificate’s subject dn.</li>
     * </ul>
     */
    private PrincipalTypes principalType;
    /**
     * Revocation certificate checking can be carried out in one of the following ways:
     * <ul>
     * <li>{@code NONE}: No revocation is performed.</li>
     * <li>{@code CRL}: The CRL URI(s) mentioned in the certificate cRLDistributionPoints extension field.
     * Caches are available to prevent excessive IO against CRL endpoints; CRL data is fetched if does not exist in the cache or if it is expired.</li>
     * <li>{@code RESOURCE}: A CRL hosted at a fixed location. The CRL is fetched at periodic intervals and cached.</li>
     * </ul>
     */
    private String revocationChecker = "NONE";
    /**
     * To fetch CRLs, the following options are available:
     * <ul>
     * <li>{@code RESOURCE}: By default, all revocation checks use fixed resources to fetch the CRL resource from the specified location.</li>
     * <li>{@code LDAP}: A CRL resource may be fetched from a pre-configured attribute, in the event that the CRL resource location is an LDAP URI.</li>
     * </ul>
     */
    private String crlFetcher = "RESOURCE";
    /**
     * List of CRL resources to use for fetching.
     */
    private List<String> crlResources = new ArrayList<>();
    /**
     * When CRLs are cached, indicate maximum number of elements kept in memory.
     */
    private int cacheMaxElementsInMemory = 1_000;
    /**
     * When CRLs are cached, indicate whether cache should overflow to disk.
     */
    private boolean cacheDiskOverflow;
    /**
     * When CRLs are cached, indicate if cache items should be eternal.
     */
    private boolean cacheEternal;
    /**
     * When CRLs are cached, indicate the time-to-live of cache items.
     */
    private long cacheTimeToLiveSeconds = TimeUnit.HOURS.toSeconds(4);
    /**
     * When CRLs are cached, indicate the idle timeout of cache items.
     */
    private long cacheTimeToIdleSeconds = TimeUnit.MINUTES.toSeconds(30);
    /**
     * If the CRL resource is unavailable, activate the this policy.
     * Activated if {@link #revocationChecker} is {@code RESOURCE}.
     * Accepted values are:
     * <ul>
     * <li>{@code ALLOW}: Allow authentication to proceed.</li>
     * <li>{@code DENY}: Deny authentication and block.</li>
     * <li>{@code THRESHOLD}: Applicable to CRL expiration, throttle the request whereby expired
     * data is permitted up to a threshold period of time but not afterward.</li>
     * </ul>
     */
    private String crlResourceUnavailablePolicy = "DENY";
    /**
     * If the CRL resource has expired, activate the this policy.
     * Activated if {@link #revocationChecker} is {@code RESOURCE}.
     * Accepted values are:
     * <ul>
     * <li>{@code ALLOW}: Allow authentication to proceed.</li>
     * <li>{@code DENY}: Deny authentication and block.</li>
     * <li>{@code THRESHOLD}: Applicable to CRL expiration, throttle the request whereby expired
     * data is permitted up to a threshold period of time but not afterward.</li>
     * </ul>
     */
    private String crlResourceExpiredPolicy = "DENY";
    /**
     * If the CRL is unavailable, activate the this policy.
     * Activated if {@link #revocationChecker} is {@code CRL}.
     * Accepted values are:
     * <ul>
     * <li>{@code ALLOW}: Allow authentication to proceed.</li>
     * <li>{@code DENY}: Deny authentication and block.</li>
     * <li>{@code THRESHOLD}: Applicable to CRL expiration, throttle the request whereby expired
     * data is permitted up to a threshold period of time but not afterward.</li>
     * </ul>
     */
    private String crlUnavailablePolicy = "DENY";
    /**
     * If the CRL has expired, activate the this policy.
     * Activated if {@link #revocationChecker} is {@code CRL}.
     * Accepted values are:
     * <ul>
     * <li>{@code ALLOW}: Allow authentication to proceed.</li>
     * <li>{@code DENY}: Deny authentication and block.</li>
     * <li>{@code THRESHOLD}: Applicable to CRL expiration, throttle the request whereby expired
     * data is permitted up to a threshold period of time but not afterward.</li>
     * </ul>
     */
    private String crlExpiredPolicy = "DENY";

    /**
     * Radix used when {@link #principalType} is {@link PrincipalTypes#SERIAL_NO}.
     */
    private int principalSNRadix;
    /**
     * If radix hex padding should be used when {@link #principalType} is {@link PrincipalTypes#SERIAL_NO}.
     */
    private boolean principalHexSNZeroPadding;

    /**
     * Principal resolution properties.
     */
    @NestedConfigurationProperty
    private PersonDirectoryPrincipalResolverProperties principal = new PersonDirectoryPrincipalResolverProperties();

    /**
     * LDAP settings when fetching CRLs from LDAP.
     */
    private Ldap ldap = new Ldap();

    /**
     * The compiled pattern supplied by the deployer.
     */
    private String regExTrustedIssuerDnPattern;

    /**
     * Deployer supplied setting for maximum pathLength in a SUPPLIED
     * certificate.
     */
    private int maxPathLength = DEFAULT_MAXPATHLENGTH;

    /**
     * Deployer supplied setting to allow unlimited pathLength in a SUPPLIED
     * certificate.
     */
    private boolean maxPathLengthAllowUnspecified = DEFAULT_MAXPATHLENGTH_ALLOW_UNSPECIFIED;

    /**
     * Deployer supplied setting to check the KeyUsage extension.
     */
    private boolean checkKeyUsage = DEFAULT_CHECK_KEYUSAGE;

    /**
     * Deployer supplied setting to force require the correct KeyUsage
     * extension.
     */
    private boolean requireKeyUsage = DEFAULT_REQUIRE_KEYUSAGE;

    /**
     * The pattern that authorizes an acceptable certificate by its subject dn.
     */
    private String regExSubjectDnPattern = ".+";

    /**
     * The authentication handler name.
     */
    private String name;
    

    public String getName() {
        return name;
    }

    public void setName(final String name) {
        this.name = name;
    }

    public int getCacheMaxElementsInMemory() {
        return cacheMaxElementsInMemory;
    }

    public void setCacheMaxElementsInMemory(final int cacheMaxElementsInMemory) {
        this.cacheMaxElementsInMemory = cacheMaxElementsInMemory;
    }

    public Ldap getLdap() {
        return ldap;
    }

    public void setLdap(final Ldap ldap) {
        this.ldap = ldap;
    }

    public boolean isCacheDiskOverflow() {
        return cacheDiskOverflow;
    }

    public void setCacheDiskOverflow(final boolean cacheDiskOverflow) {
        this.cacheDiskOverflow = cacheDiskOverflow;
    }

    public boolean isCacheEternal() {
        return cacheEternal;
    }

    public void setCacheEternal(final boolean cacheEternal) {
        this.cacheEternal = cacheEternal;
    }

    public long getCacheTimeToLiveSeconds() {
        return cacheTimeToLiveSeconds;
    }

    public void setCacheTimeToLiveSeconds(final long cacheTimeToLiveSeconds) {
        this.cacheTimeToLiveSeconds = cacheTimeToLiveSeconds;
    }

    public long getCacheTimeToIdleSeconds() {
        return cacheTimeToIdleSeconds;
    }

    public void setCacheTimeToIdleSeconds(final long cacheTimeToIdleSeconds) {
        this.cacheTimeToIdleSeconds = cacheTimeToIdleSeconds;
    }

    public String getCrlFetcher() {
        return crlFetcher;
    }

    public void setCrlFetcher(final String crlFetcher) {
        this.crlFetcher = crlFetcher;
    }

    public PersonDirectoryPrincipalResolverProperties getPrincipal() {
        return principal;
    }

    public void setPrincipal(final PersonDirectoryPrincipalResolverProperties principal) {
        this.principal = principal;
    }

    public String getRegExTrustedIssuerDnPattern() {
        return regExTrustedIssuerDnPattern;
    }

    public void setRegExTrustedIssuerDnPattern(final String regExTrustedIssuerDnPattern) {
        this.regExTrustedIssuerDnPattern = regExTrustedIssuerDnPattern;
    }

    public List<String> getCrlResources() {
        return crlResources;
    }

    public void setCrlResources(final List<String> crlResources) {
        this.crlResources = crlResources;
    }

    public int getMaxPathLength() {
        return maxPathLength;
    }

    public void setMaxPathLength(final int maxPathLength) {
        this.maxPathLength = maxPathLength;
    }

    public boolean isMaxPathLengthAllowUnspecified() {
        return maxPathLengthAllowUnspecified;
    }

    public void setMaxPathLengthAllowUnspecified(final boolean maxPathLengthAllowUnspecified) {
        this.maxPathLengthAllowUnspecified = maxPathLengthAllowUnspecified;
    }

    public boolean isCheckKeyUsage() {
        return checkKeyUsage;
    }

    public void setCheckKeyUsage(final boolean checkKeyUsage) {
        this.checkKeyUsage = checkKeyUsage;
    }

    public boolean isRequireKeyUsage() {
        return requireKeyUsage;
    }

    public void setRequireKeyUsage(final boolean requireKeyUsage) {
        this.requireKeyUsage = requireKeyUsage;
    }

    public String getRegExSubjectDnPattern() {
        return regExSubjectDnPattern;
    }

    public void setRegExSubjectDnPattern(final String regExSubjectDnPattern) {
        this.regExSubjectDnPattern = regExSubjectDnPattern;
    }

    public boolean isThrowOnFetchFailure() {
        return throwOnFetchFailure;
    }

    public void setThrowOnFetchFailure(final boolean throwOnFetchFailure) {
        this.throwOnFetchFailure = throwOnFetchFailure;
    }

    public String getPrincipalDescriptor() {
        return principalDescriptor;
    }

    public void setPrincipalDescriptor(final String principalDescriptor) {
        this.principalDescriptor = principalDescriptor;
    }

    public int getRefreshIntervalSeconds() {
        return refreshIntervalSeconds;
    }

    public void setRefreshIntervalSeconds(final int refreshIntervalSeconds) {
        this.refreshIntervalSeconds = refreshIntervalSeconds;
    }

    public boolean isCheckAll() {
        return checkAll;
    }

    public void setCheckAll(final boolean checkAll) {
        this.checkAll = checkAll;
    }

    public String getValueDelimiter() {
        return valueDelimiter;
    }

    public void setValueDelimiter(final String valueDelimiter) {
        this.valueDelimiter = valueDelimiter;
    }

    public String getRevocationChecker() {
        return revocationChecker;
    }

    public void setRevocationChecker(final String revocationChecker) {
        this.revocationChecker = revocationChecker;
    }

    public String getSerialNumberPrefix() {
        return serialNumberPrefix;
    }

    public PrincipalTypes getPrincipalType() {
        return principalType;
    }

    public void setPrincipalType(final PrincipalTypes principalType) {
        this.principalType = principalType;
    }

    public void setSerialNumberPrefix(final String serialNumberPrefix) {
        this.serialNumberPrefix = serialNumberPrefix;
    }

    public int getRevocationPolicyThreshold() {
        return revocationPolicyThreshold;
    }

    public void setRevocationPolicyThreshold(final int revocationPolicyThreshold) {
        this.revocationPolicyThreshold = revocationPolicyThreshold;
    }

    public String getCrlResourceUnavailablePolicy() {
        return crlResourceUnavailablePolicy;
    }

    public void setCrlResourceUnavailablePolicy(final String crlResourceUnavailablePolicy) {
        this.crlResourceUnavailablePolicy = crlResourceUnavailablePolicy;
    }

    public String getCrlResourceExpiredPolicy() {
        return crlResourceExpiredPolicy;
    }

    public void setCrlResourceExpiredPolicy(final String crlResourceExpiredPolicy) {
        this.crlResourceExpiredPolicy = crlResourceExpiredPolicy;
    }

    public String getCrlUnavailablePolicy() {
        return crlUnavailablePolicy;
    }

    public void setCrlUnavailablePolicy(final String crlUnavailablePolicy) {
        this.crlUnavailablePolicy = crlUnavailablePolicy;
    }

    public String getCrlExpiredPolicy() {
        return crlExpiredPolicy;
    }

    public void setCrlExpiredPolicy(final String crlExpiredPolicy) {
        this.crlExpiredPolicy = crlExpiredPolicy;
    }

    public int getPrincipalSNRadix() {
        return principalSNRadix;
    }

    public void setPrincipalSNRadix(final int principalSNRadix) {
        this.principalSNRadix = principalSNRadix;
    }

    public boolean isPrincipalHexSNZeroPadding() {
        return principalHexSNZeroPadding;
    }

    public void setPrincipalHexSNZeroPadding(final boolean principalHexSNZeroPadding) {
        this.principalHexSNZeroPadding = principalHexSNZeroPadding;
    }

    public static class Ldap extends AbstractLdapProperties {
        private static final long serialVersionUID = -1655068554291000206L;
        /**
         * The LDAP base dn to start the search.
         */
        private String baseDn;
        /**
         * The search filter. Example: {@code cn={user}}.
         */
        private String searchFilter;

        /**
         * The LDAP attribute that holds the certificate revocation list.
         */
        private String certificateAttribute = "certificateRevocationList";

        public String getCertificateAttribute() {
            return certificateAttribute;
        }

        public void setCertificateAttribute(final String certificateAttribute) {
            this.certificateAttribute = certificateAttribute;
        }
        
        public String getBaseDn() {
            return baseDn;
        }

        public void setBaseDn(final String baseDn) {
            this.baseDn = baseDn;
        }

        public String getSearchFilter() {
            return searchFilter;
        }

        public void setSearchFilter(final String searchFilter) {
            this.searchFilter = searchFilter;
        }
    }
}


1			package org.apereo.cas.configuration.model.support.x509;
2
3			import org.apereo.cas.configuration.model.core.authentication.PersonDirectoryPrincipalResolverProperties;
4			import org.apereo.cas.configuration.model.support.ldap.AbstractLdapProperties;
5			import org.apereo.cas.configuration.support.RequiresModule;
6			import org.springframework.boot.context.properties.NestedConfigurationProperty;
7
8			import java.io.Serializable;
9			import java.util.ArrayList;
10			import java.util.List;
11			import java.util.concurrent.TimeUnit;
12
13			/**
14			* This is {@link X509Properties}.
15			*
16			* @author Misagh Moayyed
17			* @since 5.0.0
18			*/
19			@RequiresModule(name = "cas-server-support-x509-webflow")
20			public class X509Properties implements Serializable {
21
22			private static final long serialVersionUID = -9032744084671270366L;
23
24			/**
25			* The Principal types.
26			*/
27			public enum PrincipalTypes {
28			/**
29			* Create principal by subject.
30			*/
31			SUBJECT,
32			/**
33			* Create principal by subject DN.
34			*/
35			SUBJECT_DN,
36			/**
37			* Create principal by serial no.
38			*/
39			SERIAL_NO,
40			/**
41			* Create principal by serial no and DN.
42			*/
43			SERIAL_NO_DN,
44			/**
45			* Create principal by subject alternative name.
46			*/
47			SUBJECT_ALT_NAME,
48			/**
49			* Create principal by common name and EDIPI.
50			*/
51			CN_EDIPI,
52			}
53
54			/**
55			* Default setting to limit the number of intermediate certificates.
56			*/
57			private static final int DEFAULT_MAXPATHLENGTH = 1;
58
59			/**
60			* Default setting whether to allow unspecified number of intermediate certificates.
61			*/
62			private static final boolean DEFAULT_MAXPATHLENGTH_ALLOW_UNSPECIFIED = false;
63
64			/**
65			* Default setting to check keyUsage extension.
66			*/
67			private static final boolean DEFAULT_CHECK_KEYUSAGE = false;
68
69			/**
70			* Default setting to force require "KeyUsage" extension.
71			*/
72			private static final boolean DEFAULT_REQUIRE_KEYUSAGE = false;
73
74			/**
75			* The serial number prefix used for principal resolution
76			* when type is set to {@link PrincipalTypes#SERIAL_NO_DN}.
77			*/
78			private String serialNumberPrefix = "SERIALNUMBER=";
79			/**
80			* Value delimiter used for principal resolution
81			* when type is set to {@link PrincipalTypes#SERIAL_NO_DN}.
82			*/
83			private String valueDelimiter = ", ";
84			/**
85			* Threshold value if expired CRL revocation policy is to be handled via threshold.
86			*/
87			private int revocationPolicyThreshold = 172_800;
88			/**
89			* Whether revocation checking should check all resources, or stop at first one.
90			*/
91			private boolean checkAll;
92			/**
93			* The refresh interval of the internal scheduler in cases where CRL revocation checking
94			* is done via resources.
95			*/
96			private int refreshIntervalSeconds = 3_600;
97			/**
98			* The principal descriptor used for principal resolution
99			* when type is set to {@link PrincipalTypes#SUBJECT}.
100			*/
101			private String principalDescriptor;
102			/**
103			* When CRL revocation checking is done via distribution points,
104			* decide if fetch failures should throw errors.
105			*/
106			private boolean throwOnFetchFailure;
107			/**
108			* Indicates the type of principal resolution for X509.
109			* <ul>
110			* <li>{@code SERIAL_NO}: Resolve the principal by the serial number with a configurable radix,
111			* ranging from 2 to 36. If radix is 16, then the serial number could be filled with leading zeros to even the number of digits.</li>
112			* <li>{@code SERIAL_NO_DN}: Resolve the principal by serial number and issuer dn.</li>
113			* <li>{@code SUBJECT}: Resolve the principal by extracting one or more attribute values from the
114			* certificate subject DN and combining them with intervening delimiters.</li>
115			* <li>{@code SUBJECT_ALT_NAME}: Resolve the principal by the subject alternative name extension.</li>
116			* <li>{@code SUBJECT_DN}: The default type; Resolve the principal by the certificate’s subject dn.</li>
117			* </ul>
118			*/
119			private PrincipalTypes principalType;
120			/**
121			* Revocation certificate checking can be carried out in one of the following ways:
122			* <ul>
123			* <li>{@code NONE}: No revocation is performed.</li>
124			* <li>{@code CRL}: The CRL URI(s) mentioned in the certificate cRLDistributionPoints extension field.
125			* Caches are available to prevent excessive IO against CRL endpoints; CRL data is fetched if does not exist in the cache or if it is expired.</li>
126			* <li>{@code RESOURCE}: A CRL hosted at a fixed location. The CRL is fetched at periodic intervals and cached.</li>
127			* </ul>
128			*/
129			private String revocationChecker = "NONE";
130			/**
131			* To fetch CRLs, the following options are available:
132			* <ul>
133			* <li>{@code RESOURCE}: By default, all revocation checks use fixed resources to fetch the CRL resource from the specified location.</li>
134			* <li>{@code LDAP}: A CRL resource may be fetched from a pre-configured attribute, in the event that the CRL resource location is an LDAP URI.</li>
135			* </ul>
136			*/
137			private String crlFetcher = "RESOURCE";
138			/**
139			* List of CRL resources to use for fetching.
140			*/
141			private List<String> crlResources = new ArrayList<>();
142			/**
143			* When CRLs are cached, indicate maximum number of elements kept in memory.
144			*/
145			private int cacheMaxElementsInMemory = 1_000;
146			/**
147			* When CRLs are cached, indicate whether cache should overflow to disk.
148			*/
149			private boolean cacheDiskOverflow;
150			/**
151			* When CRLs are cached, indicate if cache items should be eternal.
152			*/
153			private boolean cacheEternal;
154			/**
155			* When CRLs are cached, indicate the time-to-live of cache items.
156			*/
157			private long cacheTimeToLiveSeconds = TimeUnit.HOURS.toSeconds(4);
158			/**
159			* When CRLs are cached, indicate the idle timeout of cache items.
160			*/
161			private long cacheTimeToIdleSeconds = TimeUnit.MINUTES.toSeconds(30);
162			/**
163			* If the CRL resource is unavailable, activate the this policy.
164			* Activated if {@link #revocationChecker} is {@code RESOURCE}.
165			* Accepted values are:
166			* <ul>
167			* <li>{@code ALLOW}: Allow authentication to proceed.</li>
168			* <li>{@code DENY}: Deny authentication and block.</li>
169			* <li>{@code THRESHOLD}: Applicable to CRL expiration, throttle the request whereby expired
170			* data is permitted up to a threshold period of time but not afterward.</li>
171			* </ul>
172			*/
173			private String crlResourceUnavailablePolicy = "DENY";
174			/**
175			* If the CRL resource has expired, activate the this policy.
176			* Activated if {@link #revocationChecker} is {@code RESOURCE}.
177			* Accepted values are:
178			* <ul>
179			* <li>{@code ALLOW}: Allow authentication to proceed.</li>
180			* <li>{@code DENY}: Deny authentication and block.</li>
181			* <li>{@code THRESHOLD}: Applicable to CRL expiration, throttle the request whereby expired
182			* data is permitted up to a threshold period of time but not afterward.</li>
183			* </ul>
184			*/
185			private String crlResourceExpiredPolicy = "DENY";
186			/**
187			* If the CRL is unavailable, activate the this policy.
188			* Activated if {@link #revocationChecker} is {@code CRL}.
189			* Accepted values are:
190			* <ul>
191			* <li>{@code ALLOW}: Allow authentication to proceed.</li>
192			* <li>{@code DENY}: Deny authentication and block.</li>
193			* <li>{@code THRESHOLD}: Applicable to CRL expiration, throttle the request whereby expired
194			* data is permitted up to a threshold period of time but not afterward.</li>
195			* </ul>
196			*/
197			private String crlUnavailablePolicy = "DENY";
198			/**
199			* If the CRL has expired, activate the this policy.
200			* Activated if {@link #revocationChecker} is {@code CRL}.
201			* Accepted values are:
202			* <ul>
203			* <li>{@code ALLOW}: Allow authentication to proceed.</li>
204			* <li>{@code DENY}: Deny authentication and block.</li>
205			* <li>{@code THRESHOLD}: Applicable to CRL expiration, throttle the request whereby expired
206			* data is permitted up to a threshold period of time but not afterward.</li>
207			* </ul>
208			*/
209			private String crlExpiredPolicy = "DENY";
210
211			/**
212			* Radix used when {@link #principalType} is {@link PrincipalTypes#SERIAL_NO}.
213			*/
214			private int principalSNRadix;
215			/**
216			* If radix hex padding should be used when {@link #principalType} is {@link PrincipalTypes#SERIAL_NO}.
217			*/
218			private boolean principalHexSNZeroPadding;
219
220			/**
221			* Principal resolution properties.
222			*/
223			@NestedConfigurationProperty
224			private PersonDirectoryPrincipalResolverProperties principal = new PersonDirectoryPrincipalResolverProperties();
225
226			/**
227			* LDAP settings when fetching CRLs from LDAP.
228			*/
229			private Ldap ldap = new Ldap();
230
231			/**
232			* The compiled pattern supplied by the deployer.
233			*/
234			private String regExTrustedIssuerDnPattern;
235
236			/**
237			* Deployer supplied setting for maximum pathLength in a SUPPLIED
238			* certificate.
239			*/
240			private int maxPathLength = DEFAULT_MAXPATHLENGTH;
241
242			/**
243			* Deployer supplied setting to allow unlimited pathLength in a SUPPLIED
244			* certificate.
245			*/
246			private boolean maxPathLengthAllowUnspecified = DEFAULT_MAXPATHLENGTH_ALLOW_UNSPECIFIED;
247
248			/**
249			* Deployer supplied setting to check the KeyUsage extension.
250			*/
251			private boolean checkKeyUsage = DEFAULT_CHECK_KEYUSAGE;
252
253			/**
254			* Deployer supplied setting to force require the correct KeyUsage
255			* extension.
256			*/
257			private boolean requireKeyUsage = DEFAULT_REQUIRE_KEYUSAGE;
258
259			/**
260			* The pattern that authorizes an acceptable certificate by its subject dn.
261			*/
262			private String regExSubjectDnPattern = ".+";
263
264			/**
265			* The authentication handler name.
266			*/
267			private String name;
268
269
270			public String getName() {
271			return name;
272			}
273
274			public void setName(final String name) {
275			this.name = name;
276			}
277
278			public int getCacheMaxElementsInMemory() {
279			return cacheMaxElementsInMemory;
280			}
281
282			public void setCacheMaxElementsInMemory(final int cacheMaxElementsInMemory) {
283			this.cacheMaxElementsInMemory = cacheMaxElementsInMemory;
284			}
285
286			public Ldap getLdap() {
287			return ldap;
288			}
289
290			public void setLdap(final Ldap ldap) {
291			this.ldap = ldap;
292			}
293
294			public boolean isCacheDiskOverflow() {
295			return cacheDiskOverflow;
296			}
297
298			public void setCacheDiskOverflow(final boolean cacheDiskOverflow) {
299			this.cacheDiskOverflow = cacheDiskOverflow;
300			}
301
302			public boolean isCacheEternal() {
303			return cacheEternal;
304			}
305
306			public void setCacheEternal(final boolean cacheEternal) {
307			this.cacheEternal = cacheEternal;
308			}
309
310			public long getCacheTimeToLiveSeconds() {
311			return cacheTimeToLiveSeconds;
312			}
313
314			public void setCacheTimeToLiveSeconds(final long cacheTimeToLiveSeconds) {
315			this.cacheTimeToLiveSeconds = cacheTimeToLiveSeconds;
316			}
317
318			public long getCacheTimeToIdleSeconds() {
319			return cacheTimeToIdleSeconds;
320			}
321
322			public void setCacheTimeToIdleSeconds(final long cacheTimeToIdleSeconds) {
323			this.cacheTimeToIdleSeconds = cacheTimeToIdleSeconds;
324			}
325
326			public String getCrlFetcher() {
327			return crlFetcher;
328			}
329
330			public void setCrlFetcher(final String crlFetcher) {
331			this.crlFetcher = crlFetcher;
332			}
333
334			public PersonDirectoryPrincipalResolverProperties getPrincipal() {
335			return principal;
336			}
337
338			public void setPrincipal(final PersonDirectoryPrincipalResolverProperties principal) {
339			this.principal = principal;
340			}
341
342			public String getRegExTrustedIssuerDnPattern() {
343			return regExTrustedIssuerDnPattern;
344			}
345
346			public void setRegExTrustedIssuerDnPattern(final String regExTrustedIssuerDnPattern) {
347			this.regExTrustedIssuerDnPattern = regExTrustedIssuerDnPattern;
348			}
349
350			public List<String> getCrlResources() {
351			return crlResources;
352			}
353
354			public void setCrlResources(final List<String> crlResources) {
355			this.crlResources = crlResources;
356			}
357
358			public int getMaxPathLength() {
359			return maxPathLength;
360			}
361
362			public void setMaxPathLength(final int maxPathLength) {
363			this.maxPathLength = maxPathLength;
364			}
365
366			public boolean isMaxPathLengthAllowUnspecified() {
367			return maxPathLengthAllowUnspecified;
368			}
369
370			public void setMaxPathLengthAllowUnspecified(final boolean maxPathLengthAllowUnspecified) {
371			this.maxPathLengthAllowUnspecified = maxPathLengthAllowUnspecified;
372			}
373
374			public boolean isCheckKeyUsage() {
375			return checkKeyUsage;
376			}
377
378			public void setCheckKeyUsage(final boolean checkKeyUsage) {
379			this.checkKeyUsage = checkKeyUsage;
380			}
381
382			public boolean isRequireKeyUsage() {
383			return requireKeyUsage;
384			}
385
386			public void setRequireKeyUsage(final boolean requireKeyUsage) {
387			this.requireKeyUsage = requireKeyUsage;
388			}
389
390			public String getRegExSubjectDnPattern() {
391			return regExSubjectDnPattern;
392			}
393
394			public void setRegExSubjectDnPattern(final String regExSubjectDnPattern) {
395			this.regExSubjectDnPattern = regExSubjectDnPattern;
396			}
397
398			public boolean isThrowOnFetchFailure() {
399			return throwOnFetchFailure;
400			}
401
402			public void setThrowOnFetchFailure(final boolean throwOnFetchFailure) {
403			this.throwOnFetchFailure = throwOnFetchFailure;
404			}
405
406			public String getPrincipalDescriptor() {
407			return principalDescriptor;
408			}
409
410			public void setPrincipalDescriptor(final String principalDescriptor) {
411			this.principalDescriptor = principalDescriptor;
412			}
413
414			public int getRefreshIntervalSeconds() {
415			return refreshIntervalSeconds;
416			}
417
418			public void setRefreshIntervalSeconds(final int refreshIntervalSeconds) {
419			this.refreshIntervalSeconds = refreshIntervalSeconds;
420			}
421
422			public boolean isCheckAll() {
423			return checkAll;
424			}
425
426			public void setCheckAll(final boolean checkAll) {
427			this.checkAll = checkAll;
428			}
429
430			public String getValueDelimiter() {
431			return valueDelimiter;
432			}
433
434			public void setValueDelimiter(final String valueDelimiter) {
435			this.valueDelimiter = valueDelimiter;
436			}
437
438			public String getRevocationChecker() {
439			return revocationChecker;
440			}
441
442			public void setRevocationChecker(final String revocationChecker) {
443			this.revocationChecker = revocationChecker;
444			}
445
446			public String getSerialNumberPrefix() {
447			return serialNumberPrefix;
448			}
449
450			public PrincipalTypes getPrincipalType() {
451			return principalType;
452			}
453
454			public void setPrincipalType(final PrincipalTypes principalType) {
455			this.principalType = principalType;
456			}
457
458			public void setSerialNumberPrefix(final String serialNumberPrefix) {
459			this.serialNumberPrefix = serialNumberPrefix;
460			}
461
462			public int getRevocationPolicyThreshold() {
463			return revocationPolicyThreshold;
464			}
465
466			public void setRevocationPolicyThreshold(final int revocationPolicyThreshold) {
467			this.revocationPolicyThreshold = revocationPolicyThreshold;
468			}
469
470			public String getCrlResourceUnavailablePolicy() {
471			return crlResourceUnavailablePolicy;
472			}
473
474			public void setCrlResourceUnavailablePolicy(final String crlResourceUnavailablePolicy) {
475			this.crlResourceUnavailablePolicy = crlResourceUnavailablePolicy;
476			}
477
478			public String getCrlResourceExpiredPolicy() {
479			return crlResourceExpiredPolicy;
480			}
481
482			public void setCrlResourceExpiredPolicy(final String crlResourceExpiredPolicy) {
483			this.crlResourceExpiredPolicy = crlResourceExpiredPolicy;
484			}
485
486			public String getCrlUnavailablePolicy() {
487			return crlUnavailablePolicy;
488			}
489
490			public void setCrlUnavailablePolicy(final String crlUnavailablePolicy) {
491			this.crlUnavailablePolicy = crlUnavailablePolicy;
492			}
493
494			public String getCrlExpiredPolicy() {
495			return crlExpiredPolicy;
496			}
497
498			public void setCrlExpiredPolicy(final String crlExpiredPolicy) {
499			this.crlExpiredPolicy = crlExpiredPolicy;
500			}
501
502			public int getPrincipalSNRadix() {
503			return principalSNRadix;
504			}
505
506			public void setPrincipalSNRadix(final int principalSNRadix) {
507			this.principalSNRadix = principalSNRadix;
508			}
509
510			public boolean isPrincipalHexSNZeroPadding() {
511			return principalHexSNZeroPadding;
512			}
513
514			public void setPrincipalHexSNZeroPadding(final boolean principalHexSNZeroPadding) {
515			this.principalHexSNZeroPadding = principalHexSNZeroPadding;
516			}
517
518			public static class Ldap extends AbstractLdapProperties {
519			private static final long serialVersionUID = -1655068554291000206L;
520			/**
521			* The LDAP base dn to start the search.
522			*/
523			private String baseDn;
524			/**
525			* The search filter. Example: {@code cn={user}}.
526			*/
527			private String searchFilter;
528
529			/**
530			* The LDAP attribute that holds the certificate revocation list.
531			*/
532			private String certificateAttribute = "certificateRevocationList";
533
534			public String getCertificateAttribute() {
535			return certificateAttribute;
536			}
537
538			public void setCertificateAttribute(final String certificateAttribute) {
539			this.certificateAttribute = certificateAttribute;
540			}
541
542			public String getBaseDn() {
543			return baseDn;
544			}
545
546			public void setBaseDn(final String baseDn) {
547			this.baseDn = baseDn;
548			}
549
550			public String getSearchFilter() {
551			return searchFilter;
552			}
553
554			public void setSearchFilter(final String searchFilter) {
555			this.searchFilter = searchFilter;
556			}
557			}
558			}
559

apereo / cas

getCrlFetcher() A last analyzed 2017-11-22 16:02 UTC

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like

getCrlFetcher() A
last analyzed 2017-11-22 16:02 UTC