Package org.jivesoftware.openfire.sasl

Class SaslMechanismEligibility

java.lang.Object
org.jivesoftware.openfire.sasl.SaslMechanismEligibility
public class SaslMechanismEligibility extends Object
Narrows the SASL mechanisms that this server supports down to those that a particular session may use. SaslMechanismCatalog answers what this deployment can do at all. This class answers what one peer, on one connection, in its current state, may be offered: whether it presented a usable certificate, whether the user it claims to be holds SCRAM credentials, and whether its connection can supply the channel-binding data that a mechanism needs. Offering a mechanism that a session cannot complete is not merely untidy. A peer that selects it has to fall back, and for the SCRAM family the set that was offered is itself covered by the XEP-0474 downgrade-protection hash, so offering the wrong set breaks authentication outright.

  • Method Details

    • getAdvertisableSASLMechanisms

      public static Set<String> getAdvertisableSASLMechanisms(@Nonnull LocalSession session)
      Returns a Set of SASL mechanism names are applicable to advertise to the given session. When the session is already authenticated, SASL mechanisms are no longer to be advertised. An empty collection is returned for these sessions.
      Parameters:
      session - the local session for which to determine applicable SASL mechanisms (cannot be null)
      Returns:
      a set of SASL mechanism names; never null, possibly empty

    • getAvailableMechanismsForSession

      public static Set<String> getAvailableMechanismsForSession(LocalSession session)
      Returns the set of SASL mechanisms available for the given session.
      Parameters:
      session - the session (cannot be null).
      Returns:
      a set of available mechanism names for the session (never null, possibly empty).

    • getScramMechanismsForSession

      @Nonnull public static Set<String> getScramMechanismsForSession(@Nonnull LocalClientSession session)
      Returns the SCRAM mechanism names that are usable for the user that is expected to authenticate on the provided session, including the channel binding variant of each. The result is cached on the session, keyed by the expected username. When that username changes (as it does when a peer restates, omits or changes its claimed identity on a new stream, or once it has authenticated), the cached value is not used and the mechanisms are determined again. Note that a credential that is added or removed while a session is negotiating is not reflected until the next time the expected username changes. That window is brief, and the alternative is to repeat the lookup on data that an unauthenticated peer controls.
      Parameters:
      session - the session for which to determine usable SCRAM mechanisms (cannot be null).
      Returns:
      SCRAM mechanism names (never null, possibly empty).

    • getAdvertisableChannelBindingTypes

      @Nonnull public static Set<String> getAdvertisableChannelBindingTypes(@Nonnull LocalSession session, @Nonnull Set<String> advertisableSASLMechanisms)
      Returns the channel-binding types to advertise to the given session. Channel-binding types are announced only when at least one channel-binding-capable mechanism is being offered. The types themselves are those the session's connection can supply in its current state, which is not necessarily every type for which a provider is registered: a connection that is not encrypted, or whose transport cannot supply channel-binding data, supports none.
      Parameters:
      session - the session the types would be advertised to (cannot be null).
      advertisableSASLMechanisms - the SASL mechanism names being offered (cannot be null).
      Returns:
      the channel-binding type names to advertise; never null, possibly empty.
      See Also: