Class OcspRequesterService

java.lang.Object

zeroecho.pki.server.OcspRequesterService

public final class OcspRequesterService
extends Object

Transport-neutral signed-OCSP requester authentication and scoped query authorization. Certificate trust proves eligibility only; an enabled persisted principal and an explicit Permission.Action.OCSP_STATUS_QUERY grant are independently required.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	OcspRequesterService.Authorized	Safe successful authentication result.
static final record	OcspRequesterService.SignedRequest	Exact bounded cryptographic fields retained from one canonical request.
static final class	OcspRequesterService.UnauthorizedException	Safe authentication or authorization rejection.
static final class	OcspRequesterService.UnavailableException	Dependency corruption or recovery-required authorization authority.

Constructor Summary

Constructors

Constructor	Description
OcspRequesterService(ServerRealmContext realm, Clock clock)	Creates one realm-bound requester authentication service.

Method Summary

Modifier and Type	Method	Description
OcspRequesterService.Authorized	authenticate(OcspResponderService.Responder responder, OcspRequesterService.SignedRequest request, List<OcspResponseService.CertId> requests)	Authenticates and authorizes every CertID in one signed request.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

OcspRequesterService

public OcspRequesterService(ServerRealmContext realm,
 Clock clock)

Creates one realm-bound requester authentication service.

Parameters:

realm - owning realm context

clock - authoritative server clock

Method Details

authenticate

public OcspRequesterService.Authorized authenticate(OcspResponderService.Responder responder,
 OcspRequesterService.SignedRequest request,
 List<OcspResponseService.CertId> requests)

Authenticates and authorizes every CertID in one signed request. Any failure rejects the whole request without revealing the failed entry.

Parameters:

responder - exact responder configuration

request - canonical signed request fields

requests - certificate identifiers authorized as one unit

Returns:

authenticated enabled requester principal