Class AdministrativeAuthenticator

java.lang.Object

zeroecho.pki.server.http.AdministrativeAuthenticator

All Implemented Interfaces:

AutoCloseable, PkiServerAuthenticator

public final class AdministrativeAuthenticator
extends Object
implements PkiServerAuthenticator

Composes direct mutual-TLS authentication or separately authenticated proxy transport with independently validated forwarded end-client identity.

Direct proof of possession comes from the ZeroEcho TLS handshake. In proxy mode proof of possession for the forwarded key is attested by the mutually authenticated, explicitly authorized proxy; parsing a certificate does not by itself prove possession.

Method Summary

Modifier and Type	Method	Description
PkiServerAuthenticationResult	authenticate(PkiServerAuthenticationContext context)	Authenticates one already TLS-validated peer without inspecting operation arguments.
Optional<String>	authenticatePublicProxyTransport(PkiServerAuthenticationContext context)	Authenticates only the backend transport for an anonymous public request.
static AdministrativeAuthenticator	create(PkiServerConfiguration.Authentication configuration, Function<String, SecurityPrincipal> principalResolver, BiFunction<String, String, AuthorizationEngine.Decision> forwardingAuthorization, Clock clock, ClassLoader loader)	Creates the configured authentication composition before listener startup.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface PkiServerAuthenticator

close

Method Details

create

public static AdministrativeAuthenticator create(PkiServerConfiguration.Authentication configuration,
 Function<String, SecurityPrincipal> principalResolver,
 BiFunction<String, String, AuthorizationEngine.Decision> forwardingAuthorization,
 Clock clock,
 ClassLoader loader)

Creates the configured authentication composition before listener startup.

Parameters:

configuration - strict mode-specific configuration

principalResolver - durable enabled-state resolver

forwardingAuthorization - default-deny proxy forwarding authorization

clock - certificate validity clock

loader - explicitly scoped provider loader

Returns:

immutable request authenticator

authenticate

public PkiServerAuthenticationResult authenticate(PkiServerAuthenticationContext context)

Description copied from interface: PkiServerAuthenticator

Authenticates one already TLS-validated peer without inspecting operation arguments.

Specified by:

authenticate in interface PkiServerAuthenticator

Parameters:

context - bounded trusted TLS context; never null

Returns:

safe authentication result; never null

authenticatePublicProxyTransport

public Optional<String> authenticatePublicProxyTransport(PkiServerAuthenticationContext context)

Authenticates only the backend transport for an anonymous public request. This method is valid solely in trusted-proxy mode and never manufactures an end-client principal.

Parameters:

context - backend TLS peer context without operation data

Returns:

authorized trusted-proxy principal, or empty on any safe failure