public interface PasswordAgent
The PasswordAgent
provides access to the internal mechanisms of FirstSpirit which allow to encrypt and
decrypt password strings.
Although the FirstSpirit internal mechanisms are used, the encryption is not compatible to the password property
encryption used by the FirstSpirit server.
There are three possible ways to provide an encryption key. If more than one key is available, the key with the highest priority is used. The ordering from lowest to highest priority is as follows:
fs-server.conf
fs-server.conf
Password string encryption is always available, even when it is not activated for internal password property
handling of the FirstSpirit server.
Reminder: If keys are removed or unavailable, all passwords encrypted with such a key are
not decryptable.
A password namespace string is part of the encryption process. This namespace can be a constant, for instance a class or module name or a random token. The namespace used for decrypting a password must be the same used for encrypting the password or decryption will not be successful. It is the responsibility of the API user to provide a namespace. Using a constant namespace is a viable option and not a security drawback.
Modifier and Type | Field and Description |
---|---|
static SpecialistType<PasswordAgent> |
TYPE
The agent's technical type to be used to request the agent from a
SpecialistsBroker . |
Modifier and Type | Method and Description |
---|---|
String |
decryptPassword(String namespace,
String password)
Decrypts a password.
|
String |
encryptPassword(String namespace,
String password)
Encrypts a password.
|
boolean |
isEncryptedPassword(String password)
Indicates if the given string is an encrypted password.
|
boolean |
isHigherPriorityKeyAvailableForPassword(String password)
Tests whether the encrypted password has been encrypted with a low priority key while a higher priority key is
available on the FirstSpirit server in the meantime.
|
boolean |
isPasswordEncryptionEnabled()
Indicates if the password encryption is enabled for the FirstSpirit server.
|
static final SpecialistType<PasswordAgent> TYPE
SpecialistsBroker
.boolean isPasswordEncryptionEnabled()
false
), it is possible to use the encryptPassword(String, String)
and
decryptPassword(String, String)
methods.password.encryption.active
setting in the fs-server.conf
file.true
if the password encryption is enabled for the FirstSpirit server, false
otherwise.boolean isEncryptedPassword(@Nullable String password)
null
, in this case false
is returned. If the password string is
identified as an encrypted password, it can be decrypted by calling the decryptPassword(String, String)
method.password
- The encrypted password or null
.true
if the password string was identified as an encrypted password, false
otherwise.boolean isHigherPriorityKeyAvailableForPassword(@NotNull String password)
true
if a higher priority key is available
and re-encrypting the encrypted password by calling the encryptPassword(String, String)
method as well
as updating the stored password string should be performed.password
- The encrypted password, must not be null
.true
if the encrypted password should be re-encrypted and updated because a higher priority
key is available, false
otherwise.NullPointerException
- If the password is null
.IllegalArgumentException
- If the password is not an encrypted password.@NotNull String encryptPassword(@NotNull String namespace, @NotNull String password)
namespace
- Choosable password namespace. The namespace is part of the encryption process, only
passwords with the same namespace are compatible and decryptable. Must not be null
.password
- The clear text password, must not be null
.NullPointerException
- If one of the parameters is null
.@NotNull String decryptPassword(@NotNull String namespace, @NotNull String password)
namespace
- Choosable password namespace string. The namespace is part of the encryption process, only
passwords with the same namespace are compatible and decryptable. Must not be null
.password
- The encrypted password, must not be null
.SecurityException
- If the encryption key is not (longer) available, the encrypted password was
tampered with or the namespace is wrong.NullPointerException
- If one of the parameters is null
.IllegalArgumentException
- If the password is not an encrypted password.Copyright © 2021 e-Spirit AG. All Rights Reserved. Build 5.2.210210