com.eruces.teagent.DelegatedAuthenticationContext
The DelegatedAuthenticationContext class is the authentication context for a DELEGATED session (the Key Service's DelegatedAuthentication module, ks AM04): the client authenticates as the DELEGATOR – the certificate this connection presents during the TLS handshake – and names ONE target principal to become.
The delegator, not the target, is what is authenticated. The Key Service requires that the TLS layer has already validated a client certificate and loaded that certificate's principal for the connection, and that THAT principal carries the DELEGATION flag; otherwise the exchange fails with the Key Service's own Impersonation is not allowed for principal. So the certificate is the credential, exactly as it is for SSLMAuthenticationContext, and this context carries it the same way (a PKCS#12 stream, or a KeyStore + password + alias); the connection type that presents it is TEAgentSSLMConnection. The two selectors below only name whom to become. ADR-0029 is the binding record; ADR-0127 records this client.
The selector set is CLOSED, at the API. There are exactly two targets a delegated session can name, and each is a named method: setX509Target(byte[]) (a certificate principal, by its DER; wire selector "X509") and setXAuthTarget(String) (an Externally Authenticated principal, by its id; wire selector "XAUTH"). There is no method taking a selector string, so a caller cannot express a third target type: the KRB5 selector TE81-338 removed is not reintroducible from here, and there is deliberately NO SRP/password selector – delegation bypasses authentication, so a native password identity can never be a delegation target (TE81-137, TE81-173, ADR-0029). That exclusion is enforced by the shape of this class, not merely documented.
One selector only. A second selector call – either method after either method – is REFUSED with a TEAgentException (DELEGATION_TARGET_SET) and the first choice stands. ADR-0029 measured the TypeScript agent's selectors replacing each other silently; that shape is made impossible here rather than documented.
Since: 8.1
© Pi Soft, 2018-2026 · Tricryption Engine 8.1
Inheritance
Public Member Functions
| Member | Description |
|---|---|
DelegatedAuthenticationContext() | The DelegatedAuthenticationContext constructor is the default class constructor. |
void setSecret(Object objSec) | The setSecret method sets secret authentication information. |
void setSecret(InputStream pfx, String passwd) | The setSecret method sets the DELEGATOR's credential from a PKCS#12 stream: the certificate the connection will present and its private key. |
void setSecret(KeyStore ks, String password, String alias) | The setSecret method sets the DELEGATOR's credential from a loaded KeyStore. |
void setX509Target(byte[] certificateDer) | The setX509Target method names a CERTIFICATE principal as the target of the delegated session, by its DER-encoded certificate. |
void setX509Target(X509Certificate certificate) | The setX509Target method names a CERTIFICATE principal as the target of the delegated session. |
void setXAuthTarget(String principalId) | The setXAuthTarget method names an EXTERNALLY AUTHENTICATED principal (an XAuthPrincipalInfo) as the target of the delegated session, by its id. |
void setXAuthTarget(XAuthPrincipalInfo target) | The setXAuthTarget method names an EXTERNALLY AUTHENTICATED principal as the target of the delegated session: the XAuthPrincipalInfo the Key Service holds (created or read through com.eruces.teadmin.Administration) is the login target. |
DelegationTarget getTargetType() | The getTargetType method returns which selector was called on this context, or NONE. |
byte[] getTarget() | The getTarget method returns a copy of the selected target's value: the DER certificate (X509) or the id's UTF-8 bytes (XAUTH); null when no selector was called. |
Static Public Member Functions
| Member | Description |
|---|---|
DelegatedAuthenticationContext getInstance() | The getInstance method is a factory method that gets an instance of the DelegatedAuthenticationContext class. |
Member Function Documentation
DelegatedAuthenticationContext()
The DelegatedAuthenticationContext constructor is the default class constructor.
void setSecret(Object objSec)
The setSecret method sets secret authentication information.
Parameters
| Parameter | Description |
|---|---|
objSec | Ignored: the delegator's credential is set by the two-argument and three-argument forms below. |
Remark: Specified by the setSecret method in the AuthenticationContext class.
void setSecret(InputStream pfx, String passwd)
The setSecret method sets the DELEGATOR's credential from a PKCS#12 stream: the certificate the connection will present and its private key.
The first key entry's alias is used.
Parameters
| Parameter | Description |
|---|---|
pfx | A stream over the delegator's PKCS#12 file. |
passwd | The PKCS#12 password. |
Exceptions
| Exception | Description |
|---|---|
TEAgentException | if the stream is not a PKCS#12 holding a key entry (IMPORT_PKCS12_FAILED). |
void setSecret(KeyStore ks, String password, String alias)
The setSecret method sets the DELEGATOR's credential from a loaded KeyStore.
Parameters
| Parameter | Description |
|---|---|
ks | A KeyStore holding the delegator's certificate and private key. |
password | The key entry's password. |
alias | The key entry's alias. |
void setX509Target(byte[] certificateDer)
The setX509Target method names a CERTIFICATE principal as the target of the delegated session, by its DER-encoded certificate.
Wire selector "X509".
Parameters
| Parameter | Description |
|---|---|
certificateDer | The target's certificate, DER-encoded (what the Key Service's TransportPrincipalInfo reads). |
Exceptions
| Exception | Description |
|---|---|
TEAgentException | DELEGATION_TARGET_SET if a target was already selected on this context (the first choice stands); INVALID_PARAMETER on a null or empty certificate. |
void setX509Target(X509Certificate certificate)
The setX509Target method names a CERTIFICATE principal as the target of the delegated session.
Wire selector "X509".
Parameters
| Parameter | Description |
|---|---|
certificate | The target's certificate; its DER encoding goes on the wire. |
Exceptions
| Exception | Description |
|---|---|
TEAgentException | DELEGATION_TARGET_SET if a target was already selected on this context; CERT_INVALID_ERROR if the certificate cannot be encoded. |
void setXAuthTarget(String principalId)
The setXAuthTarget method names an EXTERNALLY AUTHENTICATED principal (an XAuthPrincipalInfo) as the target of the delegated session, by its id.
Wire selector "XAUTH".
Parameters
| Parameter | Description |
|---|---|
principalId | The XAuth principal's id (XAuthPrincipalInfo.getUid()). |
Exceptions
| Exception | Description |
|---|---|
TEAgentException | DELEGATION_TARGET_SET if a target was already selected on this context (the first choice stands); INVALID_PARAMETER on a null or empty id. |
void setXAuthTarget(XAuthPrincipalInfo target)
The setXAuthTarget method names an EXTERNALLY AUTHENTICATED principal as the target of the delegated session: the XAuthPrincipalInfo the Key Service holds (created or read through com.eruces.teadmin.Administration) is the login target.
Wire selector "XAUTH".
Parameters
| Parameter | Description |
|---|---|
target | The XAuth principal; its id (getUid) is what the Key Service resolves. |
Exceptions
| Exception | Description |
|---|---|
TEAgentException | DELEGATION_TARGET_SET if a target was already selected on this context; INVALID_PARAMETER if the principal carries no id. |
DelegationTarget getTargetType()
The getTargetType method returns which selector was called on this context, or NONE.
Returns: The selected DelegationTarget.
byte[] getTarget()
The getTarget method returns a copy of the selected target's value: the DER certificate (X509) or the id's UTF-8 bytes (XAUTH); null when no selector was called.
Returns: A copy of the target value, or null.
DelegatedAuthenticationContext getInstance()
The getInstance method is a factory method that gets an instance of the DelegatedAuthenticationContext class.
Returns: Returns a DelegatedAuthenticationContext object with no delegator and no target.