org.forgerock.openig.secrets

Class SecretsServiceProvider

java.lang.Object

org.forgerock.secrets.SecretsProvider

org.forgerock.openig.secrets.SecretsServiceProvider

public class SecretsServiceProvider
extends SecretsProvider

Adapter class to present an instance of SecretsService as a SecretsProvider.

Constructor Summary

Constructors

Constructor and Description
SecretsServiceProvider(SecretsService secretsService) Constructs an adapter around SecretsService so we can use it as a SecretProvider.

Method Summary

Modifier and Type	Method and Description
<S extends Secret> Promise<S,NoSuchSecretException>	getActiveSecret(Purpose<S> purpose) Gets the currently active secret for the given purpose.
<S extends Secret> Promise<Stream<S>,NeverThrowsException>	getNamedOrValidSecrets(Purpose<S> purpose, String id) If the given id is not null, then this returns the single named secret that corresponds to that stable id (or a stream of valid secrets for the given purpose if no such secret exists), otherwise it returns all valid secrets for the given purpose.
<S extends Secret> Promise<S,NoSuchSecretException>	getNamedSecret(Purpose<S> purpose, String id) Gets the secret for the given purpose with the given stable secret id.
<S extends Secret> Promise<Stream<S>,NeverThrowsException>	getValidSecrets(Purpose<S> purpose) Returns all secrets for the given purpose which have not yet expired.

Methods inherited from class org.forgerock.secrets.SecretsProvider

setActiveStore, setActiveStore, setDefaultStores

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SecretsServiceProvider

public SecretsServiceProvider(SecretsService secretsService)

Constructs an adapter around SecretsService so we can use it as a SecretProvider.

Parameters:

secretsService - The SecretsService instance to wrap.

Method Detail

getActiveSecret

public <S extends Secret> Promise<S,NoSuchSecretException> getActiveSecret(Purpose<S> purpose)

Description copied from class: SecretsProvider

Gets the currently active secret for the given purpose. If more than one secret exists for this purpose, then this method returns the secret that is currently active and should be used for new operations. The returned secret is guaranteed to be within the valid periods specified by its validFrom and expiry times. If no valid secret is configured for the purpose then a NoSuchSecretException is thrown instead.

The active secret is found by first consulting the currently active store for the purpose label. If no active stores exist for the purpose, all default stores are consulted, and the first matching secret is used.

Overrides:

getActiveSecret in class SecretsProvider

Type Parameters:

S - the type of secret to return.

Parameters:

purpose - the purpose for which the secret is intended to be used.

Returns:

A promise containing either the active secret for this purpose, or a NoSuchSecretException if one cannot be found.

getNamedSecret

public <S extends Secret> Promise<S,NoSuchSecretException> getNamedSecret(Purpose<S> purpose,
                                                                          String id)

Description copied from class: SecretsProvider

Gets the secret for the given purpose with the given stable secret id.

Overrides:

getNamedSecret in class SecretsProvider

Type Parameters:

S - the type of secret to return

Parameters:

purpose - the purpose for which the secret is intended to be used.

id - the stable id of the particular secret to get.

Returns:

the secret with that id, or an empty result if no such secret exists.

See Also:

Secret.getStableId()

getValidSecrets

public <S extends Secret> Promise<Stream<S>,NeverThrowsException> getValidSecrets(Purpose<S> purpose)

Description copied from class: SecretsProvider

Returns all secrets for the given purpose which have not yet expired. This can be used, for instance, to get a list of all signature validation keys that are still trusted. The secrets will be returned in the order of preference of the store they are from: secrets from the active store will be first, then the most recent previous active store, and so on.

Overrides:

getValidSecrets in class SecretsProvider

Type Parameters:

S - the type of secret to return.

Parameters:

purpose - the purpose for which the secrets are intended for.

Returns:

a stream of all valid secrets for the given purpose, or an empty stream if not configured.

getNamedOrValidSecrets

public <S extends Secret> Promise<Stream<S>,NeverThrowsException> getNamedOrValidSecrets(Purpose<S> purpose,
                                                                                         String id)

Description copied from class: SecretsProvider

If the given id is not null, then this returns the single named secret that corresponds to that stable id (or a stream of valid secrets for the given purpose if no such secret exists), otherwise it returns all valid secrets for the given purpose. This is a convenience method for a frequent case where you want to process an incoming message (e.g., to decrypt or verify it) and the message may or may not have a secret/key identifier.

For example, to verify a JSON Web Token that might have a "kid" claim, we can do:

  SignedJwt jwt = ...;
  secrets.getNamedOrValidSecrets(Purpose.VERIFY, jwt.getHeader().getKeyId())
      .map(rethrowFunction(key -> signingManager.newVerificationHandler(key)))
      .anyMatch(jwt::verify);

 

Overrides:

getNamedOrValidSecrets in class SecretsProvider

Type Parameters:

S - the type of secrets to return.

Parameters:

purpose - the purpose for which the secrets are intended.

id - the optional stable id of the secret, or null if not known.

Returns:

a stream of all secrets to try, or an empty stream if none are applicable.