Class GenerateTOTPSharedSecretExtendedRequest

  • All Implemented Interfaces:
    ProtocolOp, ReadOnlyLDAPRequest, java.io.Serializable

    @NotMutable
    @ThreadSafety(level=COMPLETELY_THREADSAFE)
    public final class GenerateTOTPSharedSecretExtendedRequest
    extends ExtendedRequest
    This class provides an implementation of an extended request that may be used to generate a shared secret for use in generating TOTP authentication codes (as per RFC 6238, for example, using the mechanism provided in the OneTimePassword class), which can be used to authenticate to the server via the UnboundIDTOTPBindRequest.
    NOTE: This class, and other classes within the com.unboundid.ldap.sdk.unboundidds package structure, are only supported for use against Ping Identity, UnboundID, and Nokia/Alcatel-Lucent 8661 server products. These classes provide support for proprietary functionality or for external specifications that are not considered stable or mature enough to be guaranteed to work in an interoperable way with other types of LDAP servers.

    This request may be invoked in one of following ways:

    • With a null authentication identity and a non-null static password. In this case, the authorization identity for the operation (typically the user as whom the underlying connection is authenticated, but possibly a different user if the request also includes a control like the proxied authorization or intermediate client request control that specifies and alternate authorization identity, or if the client authenticated with a SASL mechanism that included an alternate authorization identity) will be used as the authentication identity for this request, and the static password must be valid for that user. This will be treated as a user requesting a TOTP shared secret for their own account.
    • With a non-null authentication identity (which may or may not match the authorization identity for the operation) and a non-null static password that is valid for the provided authentication identity. This will also be treated as a user requesting a TOTP shared secret for their own account.
    • With a non-null authentication identity and a null static password. In this case, the authentication identity must not match the authorization identity for the operation, and the authorization identity must have the password-reset privilege. This will be treated as an administrator requesting a TOTP shared secret on behalf of a user and is recommended only for the case in which the identity of the user has been verified through some means other than a static password.


    If the request is processed successfully, the server will generate a TOTP shared secret for the user, will store it in the user's entry, and will return that secret back to the client via the GenerateTOTPSharedSecretExtendedResult.

    Note that this operation will not interfere with any other TOTP shared secrets that may already exist in the user's entry; the new shared secret will be merged with any existing shared secret values for the user. If a TOTP shared secret is no longer needed, the RevokeTOTPSharedSecretExtendedRequest may be used to remove it from the user's account.

    This extended request has an OID of 1.3.6.1.4.1.30221.2.6.56, and it must include a request value with the following encoding:

       GenerateTOTPSharedSecretRequest ::= SEQUENCE {
            authenticationID     [0] OCTET STRING OPTIONAL,
            staticPassword       [1] OCTET STRING OPTIONAL,
            ... }
     
    See Also:
    Serialized Form
    • Constructor Detail

      • GenerateTOTPSharedSecretExtendedRequest

        public GenerateTOTPSharedSecretExtendedRequest​(@Nullable
                                                       java.lang.String authenticationID,
                                                       @Nullable
                                                       java.lang.String staticPassword,
                                                       @Nullable
                                                       Control... controls)
        Creates a new generate TOTP shared secret extended request with the provided information.
        Parameters:
        authenticationID - The authentication ID to use to identify the user for whom to generate the TOTP shared secret. It should be a string in the form "dn:" followed by the DN of the target user, or "u:" followed by the username. It may be null if the TOTP shared secret is to be generated for the authorization identity for the operation, and only if the staticPassword is non-null).
        staticPassword - The static password of the user for whom to generate the TOTP shared secret. It may be null only if the authenticationID is non-null, is different from the operation's authorization identity, and the operation's authorization identity has the password-reset privilege.
        controls - The set of controls to include in the request. It may be null or empty if there should not be any request controls.
      • GenerateTOTPSharedSecretExtendedRequest

        public GenerateTOTPSharedSecretExtendedRequest​(@Nullable
                                                       java.lang.String authenticationID,
                                                       @Nullable
                                                       byte[] staticPassword,
                                                       @Nullable
                                                       Control... controls)
        Creates a new generate TOTP shared secret extended request with the provided information.
        Parameters:
        authenticationID - The authentication ID to use to identify the user for whom to generate the TOTP shared secret. It should be a string in the form "dn:" followed by the DN of the target user, or "u:" followed by the username. It may be null if the TOTP shared secret is to be generated for the authorization identity for the operation, and only if the staticPassword is non-null).
        staticPassword - The static password of the user for whom to generate the TOTP shared secret. It may be null only if the authenticationID is non-null, is different from the operation's authorization identity, and the operation's authorization identity has the password-reset privilege.
        controls - The set of controls to include in the request. It may be null or empty if there should not be any request controls.
      • GenerateTOTPSharedSecretExtendedRequest

        public GenerateTOTPSharedSecretExtendedRequest​(@Nullable
                                                       java.lang.String authenticationID,
                                                       @Nullable
                                                       ASN1OctetString staticPassword,
                                                       @Nullable
                                                       Control... controls)
        Creates a new generate TOTP shared secret extended request with the provided information.
        Parameters:
        authenticationID - The authentication ID to use to identify the user for whom to generate the TOTP shared secret. It should be a string in the form "dn:" followed by the DN of the target user, or "u:" followed by the username. It may be null if the TOTP shared secret is to be generated for the authorization identity for the operation, and only if the staticPassword is non-null).
        staticPassword - The static password of the user for whom to generate the TOTP shared secret. It may be null only if the authenticationID is non-null, is different from the operation's authorization identity, and the operation's authorization identity has the password-reset privilege.
        controls - The set of controls to include in the request. It may be null or empty if there should not be any request controls.
      • GenerateTOTPSharedSecretExtendedRequest

        public GenerateTOTPSharedSecretExtendedRequest​(@NotNull
                                                       ExtendedRequest request)
                                                throws LDAPException
        Creates a new generate TOTP shared secret extended request that is decoded from the provided generic extended request.
        Parameters:
        request - The generic extended request to decode as a generate TOTP shared secret request.
        Throws:
        LDAPException - If a problem is encountered while attempting to decode the provided request.
    • Method Detail

      • getAuthenticationID

        @Nullable
        public java.lang.String getAuthenticationID()
        Retrieves the authentication ID that identifies the user for whom to generate the TOTP shared secret, if provided.
        Returns:
        The authentication ID that identifies the target user, or null if the shared secret is to be generated for the authorization identity associated with the extended request.
      • getStaticPasswordString

        @Nullable
        public java.lang.String getStaticPasswordString()
        Retrieves the string representation of the static password for the target user, if provided.
        Returns:
        The string representation of the static password for the target user, or null if no static password was provided.
      • getStaticPasswordBytes

        @Nullable
        public byte[] getStaticPasswordBytes()
        Retrieves the bytes that comprise the static password for the target user, if provided.
        Returns:
        The bytes that comprise the static password for the target user, or null if no static password was provided.
      • process

        @NotNull
        protected GenerateTOTPSharedSecretExtendedResult process​(@NotNull
                                                                 LDAPConnection connection,
                                                                 int depth)
                                                          throws LDAPException
        Sends this extended request to the directory server over the provided connection and returns the associated response.
        Overrides:
        process in class ExtendedRequest
        Parameters:
        connection - The connection to use to communicate with the directory server.
        depth - The current referral depth for this request. It should always be one for the initial request, and should only be incremented when following referrals.
        Returns:
        An LDAP result object that provides information about the result of the extended operation processing.
        Throws:
        LDAPException - If a problem occurs while sending the request or reading the response.
      • duplicate

        @NotNull
        public GenerateTOTPSharedSecretExtendedRequest duplicate​(@Nullable
                                                                 Control[] controls)
        Creates a new instance of this LDAP request that may be modified without impacting this request. The provided controls will be used for the new request instead of duplicating the controls from this request.. Subclasses should override this method to return a duplicate of the appropriate type.
        Specified by:
        duplicate in interface ReadOnlyLDAPRequest
        Overrides:
        duplicate in class ExtendedRequest
        Parameters:
        controls - The set of controls to include in the duplicate request.
        Returns:
        A new instance of this LDAP request that may be modified without impacting this request.
      • getExtendedRequestName

        @NotNull
        public java.lang.String getExtendedRequestName()
        Retrieves the user-friendly name for the extended request, if available. If no user-friendly name has been defined, then the OID will be returned.
        Overrides:
        getExtendedRequestName in class ExtendedRequest
        Returns:
        The user-friendly name for this extended request, or the OID if no user-friendly name is available.