Package org.jivesoftware.openfire.net

Class SaslStreamFeatures

java.lang.Object

org.jivesoftware.openfire.net.SaslStreamFeatures

public class SaslStreamFeatures
extends Object

Renders the SASL-related stream features that a session is offered, and records what was rendered. Advertisement and recording are deliberately performed together. The SCRAM implementations use the mechanism names that a peer was shown to detect channel-binding downgrades, and both the mechanism names and the XEP-0440 channel-binding types to compute the XEP-0474 downgrade-protection hash. A peer computes its own hash from what it actually received, so a recorded set that differs from the rendered one fails authentication for every user, with nothing to indicate why. What may be offered to a session at all is decided by SaslMechanismEligibility; this class turns that decision into XML.

Method Summary

Modifier and Type	Method	Description
static void	appendSASLFeatures(LocalSession session, List<org.dom4j.Element> features)	Adds the SASL-related stream features for the given session, and records what was advertised.
static List<org.dom4j.Element>	asSASLMechanisms(LocalSession session, Set<String> advertisableMechanismNames, Set<String> advertisableChannelBindingTypes)	Returns a list of XML elements representing the SASL mechanism features that are applicable to the given session.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

appendSASLFeatures

public static void appendSASLFeatures(@Nonnull
 LocalSession session,
 @Nonnull
 List<org.dom4j.Element> features)

Adds the SASL-related stream features for the given session, and records what was advertised. This method is the single place where the SASL mechanisms and the XEP-0440 channel-binding types that a session is offered are determined. Both are recorded on the session as they are rendered, because SASL mechanism implementations need to know exactly what the peer was shown: the SCRAM implementations use the mechanism names to detect channel-binding downgrades, and use both sets to compute the XEP-0474 downgrade protection hash. A hash taken over anything other than what the peer actually received will not match the one the peer computes, and authentication will fail for every user.

Parameters:

session - the session for which to advertise SASL features (cannot be null).

features - the collection of stream features to add to (cannot be null).

asSASLMechanisms

public static List<org.dom4j.Element> asSASLMechanisms(@Nonnull
 LocalSession session,
 @Nonnull
 Set<String> advertisableMechanismNames,
 @Nonnull
 Set<String> advertisableChannelBindingTypes)

Returns a list of XML elements representing the SASL mechanism features that are applicable to the given session. The returned elements are suitable for inclusion in the stream features element sent to the peer. Both SASL (RFC 6120) and SASL2 (XEP-0388) feature elements may be included, depending on configuration. An empty list is returned if the session is already authenticated or if the session type is not recognized.

Parameters:

session - the local session for which to determine applicable SASL mechanism feature elements (cannot be null)

advertisableMechanismNames - The set of SASL mechanism names that are to be advertised.

advertisableChannelBindingTypes - The set of channel binding types that are to be advertised.

Returns:

a list of XML elements representing SASL mechanism features; never null, possibly empty