Class MutualTlsAuthenticator

java.lang.Object

zeroecho.pki.server.http.MutualTlsAuthenticator

All Implemented Interfaces:

AutoCloseable, PkiServerAuthenticator

public final class MutualTlsAuthenticator
extends Object
implements PkiServerAuthenticator

Production mutual-TLS authenticator using immutable cryptographic certificate commitments rather than mutable subject or SAN strings.

The HTTPS handshake has already validated the chain through the configured JSSE trust manager. This authenticator additionally validates validity time, canonical single-certificate encoding, mapping uniqueness, and the enabled state of the persisted principal.

Constructor Summary

Constructors

Constructor	Description
MutualTlsAuthenticator(List<PkiServerConfiguration.ClientCertificateMapping> mappings, Function<String, SecurityPrincipal> principalResolver, Clock clock)	Creates one immutable principal mapper.

Method Summary

Modifier and Type	Method	Description
PkiServerAuthenticationResult	authenticate(PkiServerAuthenticationContext context)	Authenticates one already TLS-validated peer without inspecting operation arguments.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface PkiServerAuthenticator

close

Constructor Details

MutualTlsAuthenticator

public MutualTlsAuthenticator(List<PkiServerConfiguration.ClientCertificateMapping> mappings,
 Function<String, SecurityPrincipal> principalResolver,
 Clock clock)

Creates one immutable principal mapper.

Parameters:

mappings - exact cryptographic mappings

principalResolver - persisted principal resolver

clock - injected validity clock

Method Details

authenticate

public PkiServerAuthenticationResult authenticate(PkiServerAuthenticationContext context)

Description copied from interface: PkiServerAuthenticator

Authenticates one already TLS-validated peer without inspecting operation arguments.

Specified by:

authenticate in interface PkiServerAuthenticator

Parameters:

context - bounded trusted TLS context; never null

Returns:

safe authentication result; never null