Class EnrollmentIdentityAliases

java.lang.Object

zeroecho.pki.server.enrollment.EnrollmentIdentityAliases

public final class EnrollmentIdentityAliases
extends Object

Conservative, exclusion-only aliases derived from configured end-client credential commitments. A matching certificate, supported equivalent SPKI or issuer/serial coordinate excludes its principal even when other mapping coordinates differ or that principal is disabled. Authentication continues to require every configured coordinate and its existing uniqueness rules.

Hash-only certificate mappings cannot reveal that an unseen different certificate contains the same key. This helper makes no such inference. Canonical requester/decider key comparisons remain a separate necessary check. Instances contain one immutable realm configuration and are thread-safe.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	EnrollmentIdentityAliases.Snapshot	Immutable sorted aliases bound to one realm; at most 20,000 entries permits union of one frozen and one current configuration snapshot.

Constructor Summary

Constructors

Constructor	Description
EnrollmentIdentityAliases(RealmId realmId, PkiServerConfiguration.Authentication authentication)	Selects only end-client mappings for the configured administrative topology.

Method Summary

Modifier and Type	Method	Description
EnrollmentIdentityAliases.Snapshot	knownAliases(CertificateIdentityEvidence evidence)	Collects every known alias without principal-state or authorization lookups.
EnrollmentIdentityAliases.Snapshot	knownKeyAliases(PublicKeyIdentity identity)	Finds exclusion-only aliases for an authenticated account key that has no client certificate.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

EnrollmentIdentityAliases

public EnrollmentIdentityAliases(RealmId realmId,
 PkiServerConfiguration.Authentication authentication)

Selects only end-client mappings for the configured administrative topology. Proxy transport mappings can never contribute end-client aliases.

Parameters:

realmId - exact realm

authentication - immutable authentication configuration

Method Details

knownAliases

public EnrollmentIdentityAliases.Snapshot knownAliases(CertificateIdentityEvidence evidence)

Collects every known alias without principal-state or authorization lookups. Time is O(M log A), retained memory O(A), for at most 10,000 configured mappings M and distinct aliases A. No identity relationship grants access.

Parameters:

evidence - verified requester evidence for this realm

Returns:

immutable realm-bound exclusion snapshot, including disabled aliases

Throws:

IllegalArgumentException - if the evidence belongs to another realm

knownKeyAliases

public EnrollmentIdentityAliases.Snapshot knownKeyAliases(PublicKeyIdentity identity)

Finds exclusion-only aliases for an authenticated account key that has no client certificate. Only the finite validated equivalent SPKI hashes are compared; certificate-only mappings cannot reveal this relationship.

Parameters:

identity - independently validated mathematical account key

Returns:

every configured key alias in this realm, including disabled aliases