Package org.gcube.resourcemanagement.model.reference.properties

Interface SecurityScheme

All Superinterfaces:
org.gcube.informationsystem.base.reference.Element, GCubeProperty, org.gcube.informationsystem.model.reference.ModelElement, org.gcube.informationsystem.model.reference.properties.Property, org.gcube.informationsystem.base.reference.properties.PropertyElement, org.gcube.informationsystem.base.reference.SchemaMixedElement, Serializable
All Known Subinterfaces:
HTTPSecurityScheme
All Known Implementing Classes:
HTTPSecuritySchemeImpl, SecuritySchemeImpl
@TypeMetadata(name="SecurityScheme", description="SecurityScheme describes how a client authenticates to an access point: the authentication mechanism, where the credentials are obtained or verified, and a human-readable description. The name of a mechanism is meaningful only within the framework it belongs to (\'Bearer\' is an HTTP authentication scheme, \'SCRAM-SHA-256\' a SASL mechanism), so this type is abstract: each extension defines the framework the credentials belong to, and so the registry the scheme is taken from. HTTPSecurityScheme covers credentials sent in an HTTP header (RFC 9110, section 11: https://www.rfc-editor.org/rfc/rfc9110#section-11). As an illustration only, not modelled: a SASL-based extension (databases, message brokers, LDAP, SMTP) would take the scheme from the IANA SASL Mechanisms registry (https://www.iana.org/assignments/sasl-mechanisms), e.g. \'SCRAM-SHA-256\' (RFC 7677), or \'OAUTHBEARER\' (RFC 7628) with the url pointing to the token issuer, e.g. {\"scheme\": \"OAUTHBEARER\", \"url\": \"https://accounts.d4science.org/auth/realms/d4science/.well-known/openid-configuration\"}; an SSH extension would take it from the IANA SSH Authentication Method Names (https://www.iana.org/assignments/ssh-parameters), e.g. \'publickey\' (RFC 4252).", version="1.0.0") @Change(version="1.0.0", description="First Version") public interface SecurityScheme extends GCubeProperty
SecurityScheme describes how a client authenticates to an access point: the authentication mechanism, where the credentials are obtained or verified, and a human-readable description.

The name of a mechanism is meaningful only within the framework it belongs to (Bearer is an HTTP authentication scheme, SCRAM-SHA-256 a SASL mechanism). This type is therefore abstract: each extension defines the framework the credentials belong to, and so the registry the scheme is taken from.

As an illustration only, not modelled: a SASL-based extension (databases, message brokers, LDAP, SMTP) would take scheme from the IANA SASL Mechanisms registry, e.g. SCRAM-SHA-256 (RFC 7677), or OAUTHBEARER (RFC 7628) with url pointing to the token issuer: 

 { "scheme": "OAUTHBEARER",
   "url": "https://accounts.d4science.org/auth/realms/d4science/.well-known/openid-configuration" }

an SSH extension would take it from the IANA SSH Authentication Method Names, e.g. publickey (RFC 4252).

Author:
Luca Frosini (ISTI - CNR)

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    DESCRIPTION_PROPERTY
    The name of the property holding the human-readable description
    static final String
    NAME
    The name associated with this property
    static final String
    REFERENCE_PROPERTY
    The name of the property holding the specification defining the scheme
    static final String
    SCHEME_PROPERTY
    The name of the property holding the authentication mechanism
    static final String
    URL_PROPERTY
    The name of the property holding where the credentials are obtained or verified

    Fields inherited from interface org.gcube.informationsystem.base.reference.Element

    DATETIME_PATTERN, REDACTED, TYPE_PROPERTY, UNKNOWN_USER

    Fields inherited from interface org.gcube.informationsystem.model.reference.ModelElement

    EXPECTED_TYPE_PROPERTY, SUPERTYPES_PROPERTY

  • Method Summary

    Modifier and Type
    Method
    Description
    String
    getDescription()
    A human-readable description of the security scheme, e.g.
    String
    getReference()
    The specification defining the scheme, as cited by the registry of the extension, written as a Markdown link, e.g.
    String
    getScheme()
    The name of the authentication mechanism, taken from the registry of the framework the extension defines, e.g.
    URI
    getURL()
    Where the credentials are obtained or verified, e.g. the discovery document of the OpenID Connect provider issuing the tokens (OpenID Connect Discovery 1.0), such as https://accounts.d4science.org/auth/realms/d4science/.well-known/openid-configuration for the D4Science IAM, or the portal issuing API keys.
    void
    setDescription(String description)
    Sets the human-readable description of the security scheme
    void
    setReference(String reference)
    Sets the specification defining the scheme
    void
    setScheme(String scheme)
    Sets the name of the authentication mechanism
    void
    setURL(URI url)
    Sets where the credentials are obtained or verified

    Methods inherited from interface org.gcube.informationsystem.base.reference.Element

    getTypeName

    Methods inherited from interface org.gcube.informationsystem.model.reference.ModelElement

    getExpectedType, getSupertypes

    Methods inherited from interface org.gcube.informationsystem.model.reference.properties.Property

    getAdditionalProperties, getAdditionalProperty, setAdditionalProperties, setAdditionalProperty

  • Field Details

    • NAME

      static final String NAME
      The name associated with this property
      See Also:

    • SCHEME_PROPERTY

      static final String SCHEME_PROPERTY
      The name of the property holding the authentication mechanism
      See Also:

    • URL_PROPERTY

      static final String URL_PROPERTY
      The name of the property holding where the credentials are obtained or verified
      See Also:

    • REFERENCE_PROPERTY

      static final String REFERENCE_PROPERTY
      The name of the property holding the specification defining the scheme
      See Also:

    • DESCRIPTION_PROPERTY

      static final String DESCRIPTION_PROPERTY
      The name of the property holding the human-readable description
      See Also:

  • Method Details

    • getScheme

      @ISProperty(name="scheme", description="The name of the authentication mechanism, taken from the registry of the framework the extension defines, e.g. \'Bearer\' for an HTTPSecurityScheme (IANA HTTP Authentication Scheme Registry: https://www.iana.org/assignments/http-authschemes).") String getScheme()
      The name of the authentication mechanism, taken from the registry of the framework the extension defines, e.g. Bearer for an HTTPSecurityScheme (IANA HTTP Authentication Scheme Registry).
      Returns:
      the name of the authentication mechanism

    • setScheme

      void setScheme(String scheme)
      Sets the name of the authentication mechanism
      Parameters:
      scheme - the name of the authentication mechanism, e.g. Bearer

    • getReference

      @ISProperty(name="reference", description="The specification defining the scheme, as cited by the registry of the extension, written as a Markdown link, e.g. \'[RFC 6750](https://www.rfc-editor.org/rfc/rfc6750)\' or \'[RFC 9449, Section 7.1](https://www.rfc-editor.org/rfc/rfc9449#section-7.1)\'; plain text when there is no link.") String getReference()
      The specification defining the scheme, as cited by the registry of the extension, written as a Markdown link, e.g. [RFC 6750](https://www.rfc-editor.org/rfc/rfc6750) or [RFC 9449, Section 7.1](https://www.rfc-editor.org/rfc/rfc9449#section-7.1); plain text when there is no link.
      Returns:
      the specification defining the scheme

    • setReference

      void setReference(String reference)
      Sets the specification defining the scheme
      Parameters:
      reference - the specification defining the scheme, as a Markdown link

    • getURL

      @ISProperty(name="url", description="Where the credentials are obtained or verified, e.g. the discovery document of the OpenID Connect provider issuing the tokens (OpenID Connect Discovery 1.0: https://openid.net/specs/openid-connect-discovery-1_0.html), such as \'https://accounts.d4science.org/auth/realms/d4science/.well-known/openid-configuration\' for the D4Science IAM, or the portal issuing API keys.") URI getURL()
      Where the credentials are obtained or verified, e.g. the discovery document of the OpenID Connect provider issuing the tokens (OpenID Connect Discovery 1.0), such as https://accounts.d4science.org/auth/realms/d4science/.well-known/openid-configuration for the D4Science IAM, or the portal issuing API keys.
      Returns:
      where the credentials are obtained or verified

    • setURL

      void setURL(URI url)
      Sets where the credentials are obtained or verified
      Parameters:
      url - where the credentials are obtained or verified, e.g. the OpenID Connect discovery document of the issuer

    • getDescription

      @ISProperty(name="description", description="A human-readable description of the security scheme, e.g. \'Tokens issued by the D4Science IAM for the Context of the call\'.") String getDescription()
      A human-readable description of the security scheme, e.g. Tokens issued by the D4Science IAM for the Context of the call.
      Returns:
      the description

    • setDescription

      void setDescription(String description)
      Sets the human-readable description of the security scheme
      Parameters:
      description - the description