AuthorizationType (Kerby-kerb core 1.0.1 API)

java.lang.Object
- java.lang.Enum<AuthorizationType>
- - org.apache.kerby.kerberos.kerb.type.ad.AuthorizationType

All Implemented Interfaces:

Serializable, Comparable<AuthorizationType>, org.apache.kerby.asn1.EnumType
```
public enum AuthorizationType
extends Enum<AuthorizationType>
implements org.apache.kerby.asn1.EnumType
```
The various AuthorizationType values, as defined in RFC 4120 and RFC 1510.

Author:

Apache Directory Project

Enum Constant Summary

Enum Constants
Enum Constant and Description
`AD_AND_OR` Constant for the "and/or" authorization type.
`AD_AUTHENTICAION_INDICATOR` Constant for the "Authentication-Indicator" authorization type.
`AD_CAMMAC` Constant for the "CAM-MAC" authorization type.
`AD_ETYPE_NEGOTIATION` Constant for the "EncType-Negotiation" authorization type.
`AD_IF_RELEVANT` Constant for the "if relevant" authorization type.
`AD_IN_TICKET_EXTENSIONS` Constant for the "in ticket extensions" authorization type.
`AD_INITIAL_VERIFIED_CAS` Constant for the "initial-verified-cas" authorization type.
`AD_INTENDED_FOR_APPLICATION_CLASS` Constant for the "intended for application class" authorization type.
`AD_INTENDED_FOR_SERVER` Constant for the "intended for server" authorization type.
`AD_KDC_ISSUED` Constant for the "kdc issued" authorization type.
`AD_MANDATORY_FOR_KDC` Constant for the "mandatory-for-kdc" authorization type.
`AD_MANDATORY_TICKET_EXTENSIONS` Constant for the "mandatory ticket extensions" authorization type.
`AD_OSF_DCE_PKI_CERTID` Constant for the "OSF-DCE pki certid" authorization type.
`AD_TOKEN` Constant for the Authorization Data Type.
`AD_WIN2K_PAC` Constant for the "Windows 2K Privilege Attribute Certificate (PAC)" authorization type.
`NONE` Constant for the "null" authorization type.
`OSF_DCE` Constant for the "OSF DCE" authorization type.
`SESAME` Constant for the "sesame" authorization type.

Method Summary

Methods
Modifier and Type	Method and Description
`static AuthorizationType`	`fromValue(Integer value)` Get the AuthorizationType associated with a value.
`String`	`getName()`
`int`	`getValue()`
`static AuthorizationType`	`valueOf(String name)` Returns the enum constant of this type with the specified name.
`static AuthorizationType[]`	`values()` Returns an array containing the constants of this enum type, in the order they are declared.

Methods inherited from class java.lang.Enum
clone, compareTo, equals, finalize, getDeclaringClass, hashCode, name, ordinal, toString, valueOf

Methods inherited from class java.lang.Object
getClass, notify, notifyAll, wait, wait, wait

- Enum Constant Detail
  - NONE
```
public static final AuthorizationType NONE
```
    Constant for the "null" authorization type.
  - AD_IF_RELEVANT
```
public static final AuthorizationType AD_IF_RELEVANT
```
    Constant for the "if relevant" authorization type. RFC 4120 AD elements encapsulated within the if-relevant element are intended for interpretation only by application servers that understand the particular ad-type of the embedded element. Application servers that do not understand the type of an element embedded within the if-relevant element may ignore the uninterpretable element. This element promotes interoperability across implementations which may have local extensions for authorization.
  - AD_INTENDED_FOR_SERVER
```
public static final AuthorizationType AD_INTENDED_FOR_SERVER
```
    Constant for the "intended for server" authorization type. RFC 4120 AD-INTENDED-FOR-SERVER SEQUENCE { intended-server[0] SEQUENCE OF PrincipalName elements[1] AuthorizationData } AD elements encapsulated within the intended-for-server element may be ignored if the application server is not in the list of principal names of intended servers. Further, a KDC issuing a ticket for an application server can remove this element if the application server is not in the list of intended servers. Application servers should check for their principal name in the intended-server field of this element. If their principal name is not found, this element should be ignored. If found, then the encapsulated elements should be evaluated in the same manner as if they were present in the top level authorization data field. Applications and application servers that do not implement this element should reject tickets that contain authorization data elements of this type.
  - AD_INTENDED_FOR_APPLICATION_CLASS
```
public static final AuthorizationType AD_INTENDED_FOR_APPLICATION_CLASS
```
    Constant for the "intended for application class" authorization type. RFC 4120 AD-INTENDED-FOR-APPLICATION-CLASS SEQUENCE { intended-application-class[0] SEQUENCE OF GeneralString elements[1] AuthorizationData } AD elements encapsulated within the intended-for-application-class element may be ignored if the application server is not in one of the named classes of application servers. Examples of application server classes include "FILESYSTEM", and other kinds of servers. This element and the elements it encapsulates may be safely ignored by applications, application servers, and KDCs that do not implement this element.
  - AD_KDC_ISSUED
```
public static final AuthorizationType AD_KDC_ISSUED
```
    Constant for the "kdc issued" authorization type. RFC 4120 AD-KDCIssued SEQUENCE { ad-checksum[0] Checksum, i-realm[1] Realm OPTIONAL, i-sname[2] PrincipalName OPTIONAL, elements[3] AuthorizationData. } ad-checksum A checksum over the elements field using a cryptographic checksum method that is identical to the checksum used to protect the ticket itself (i.e. using the same hash function and the same encryption algorithm used to encrypt the ticket) and using a key derived from the same key used to protect the ticket. i-realm, i-sname The name of the issuing principal if different from the KDC itself. This field would be used when the KDC can verify the authenticity of elements signed by the issuing principal and it allows this KDC to notify the application server of the validity of those elements. elements A sequence of authorization data elements issued by the KDC. The KDC-issued ad-data field is intended to provide a means for Kerberos principal credentials to embed within themselves privilege attributes and other mechanisms for positive authorization, amplifying the privileges of the principal beyond what can be done using a credentials without such an a-data element. This can not be provided without this element because the definition of the authorization-data field allows elements to be added at will by the bearer of a TGT at the time that they request service tickets and elements may also be added to a delegated ticket by inclusion in the authenticator.
  - AD_AND_OR
```
public static final AuthorizationType AD_AND_OR
```
    Constant for the "and/or" authorization type. RFC 4120 When restrictive AD elements encapsulated within the and-or element are encountered, only the number specified in condition-count of the encapsulated conditions must be met in order to satisfy this element. This element may be used to implement an "or" operation by setting the condition-count field to 1, and it may specify an "and" operation by setting the condition count to the number of embedded elements. Application servers that do not implement this element must reject tickets that contain authorization data elements of this type.
  - AD_MANDATORY_TICKET_EXTENSIONS
```
public static final AuthorizationType AD_MANDATORY_TICKET_EXTENSIONS
```
    Constant for the "mandatory ticket extensions" authorization type. RFC 4120 AD-Mandatory-Ticket-Extensions Checksum An authorization data element of type mandatory-ticket-extensions specifies a collision-proof checksum using the same hash algorithm used to protect the integrity of the ticket itself. This checksum will be calculated over the entire extensions field. If there are more than one extension, all will be covered by the checksum. This restriction indicates that the ticket should not be accepted if the checksum does not match that calculated over the ticket extensions. Application servers that do not implement this element must reject tickets that contain authorization data elements of this type.
  - AD_IN_TICKET_EXTENSIONS
```
public static final AuthorizationType AD_IN_TICKET_EXTENSIONS
```
    Constant for the "in ticket extensions" authorization type. RFC 4120 AD-IN-Ticket-Extensions Checksum An authorization data element of type in-ticket-extensions specifies a collision-proof checksum using the same hash algorithm used to protect the integrity of the ticket itself. This checksum is calculated over a separate external AuthorizationData field carried in the ticket extensions. Application servers that do not implement this element must reject tickets that contain authorization data elements of this type. Application servers that do implement this element will search the ticket extensions for authorization data fields, calculate the specified checksum over each authorization data field and look for one matching the checksum in this in-ticket-extensions element. If not found, then the ticket must be rejected. If found, the corresponding authorization data elements will be interpreted in the same manner as if they were contained in the top level authorization data field.
  - AD_MANDATORY_FOR_KDC
```
public static final AuthorizationType AD_MANDATORY_FOR_KDC
```
    Constant for the "mandatory-for-kdc" authorization type. RFC 4120 AD-MANDATORY-FOR-KDC ::= AuthorizationData AD elements encapsulated within the mandatory-for-kdc element are to be interpreted by the KDC. KDCs that do not understand the type of an element embedded within the mandatory-for-kdc element MUST reject the request.
  - AD_INITIAL_VERIFIED_CAS
```
public static final AuthorizationType AD_INITIAL_VERIFIED_CAS
```
    Constant for the "initial-verified-cas" authorization type. RFC 4556 AD-INITIAL-VERIFIED-CAS ::= SEQUENCE OF ExternalPrincipalIdentifier -- Identifies the certification path with which -- the client certificate was validated. -- Each ExternalPrincipalIdentifier identifies a CA -- or a CA certificate (thereby its public key). The AD-INITIAL-VERIFIED-CAS structure identifies the certification path with which the client certificate was validated. Each ExternalPrincipalIdentifier (as defined in Section 3.2.1) in the AD- INITIAL-VERIFIED-CAS structure identifies a CA or a CA certificate (thereby its public key). Note that the syntax for the AD-INITIAL-VERIFIED-CAS authorization data does permit empty SEQUENCEs to be encoded. Such empty sequences may only be used if the KDC itself vouches for the user's certificate. The AS wraps any AD-INITIAL-VERIFIED-CAS data in AD-IF-RELEVANT containers if the list of CAs satisfies the AS' realm's local policy (this corresponds to the TRANSITED-POLICY-CHECKED ticket flag [RFC4120]). Furthermore, any TGS MUST copy such authorization data from tickets used within a PA-TGS-REQ of the TGS-REQ into the resulting ticket. If the list of CAs satisfies the local KDC's realm's policy, the TGS MAY wrap the data into the AD-IF-RELEVANT container; otherwise, it MAY unwrap the authorization data out of the AD-IF-RELEVANT container. Application servers that understand this authorization data type SHOULD apply local policy to determine whether a given ticket bearing such a type *not* contained within an AD-IF-RELEVANT container is acceptable. (This corresponds to the AP server's checking the transited field when the TRANSITED-POLICY-CHECKED flag has not been set [RFC4120].) If such a data type is contained within an AD-IF- RELEVANT container, AP servers MAY apply local policy to determine whether the authorization data is acceptable. ExternalPrincipalIdentifier ::= SEQUENCE { subjectName [0] IMPLICIT OCTET STRING OPTIONAL, -- Contains a PKIX type Name encoded according to -- [RFC3280]. -- Identifies the certificate subject by the -- distinguished subject name. -- REQUIRED when there is a distinguished subject -- name present in the certificate. issuerAndSerialNumber [1] IMPLICIT OCTET STRING OPTIONAL, -- Contains a CMS type IssuerAndSerialNumber encoded -- according to [RFC3852]. -- Identifies a certificate of the subject. -- REQUIRED for TD-INVALID-CERTIFICATES and -- TD-TRUSTED-CERTIFIERS. subjectKeyIdentifier [2] IMPLICIT OCTET STRING OPTIONAL, -- Identifies the subject's public key by a key -- identifier. When an X.509 certificate is -- referenced, this key identifier matches the X.509 -- subjectKeyIdentifier extension value. When other -- certificate formats are referenced, the documents -- that specify the certificate format and their use -- with the CMS must include details on matching the -- key identifier to the appropriate certificate -- field. -- RECOMMENDED for TD-TRUSTED-CERTIFIERS. ... }
  - OSF_DCE
```
public static final AuthorizationType OSF_DCE
```
    Constant for the "OSF DCE" authorization type. RFC 1510
  - SESAME
```
public static final AuthorizationType SESAME
```
    Constant for the "sesame" authorization type. RFC 4120
  - AD_OSF_DCE_PKI_CERTID
```
public static final AuthorizationType AD_OSF_DCE_PKI_CERTID
```
    Constant for the "OSF-DCE pki certid" authorization type. RFC 4120
  - AD_CAMMAC
```
public static final AuthorizationType AD_CAMMAC
```
    Constant for the "CAM-MAC" authorization type. RFC 7751 for details.
  - AD_WIN2K_PAC
```
public static final AuthorizationType AD_WIN2K_PAC
```
    Constant for the "Windows 2K Privilege Attribute Certificate (PAC)" authorization type. RFC 4120 See: Microsoft standard documents MS-PAC and MS-KILE.
  - AD_ETYPE_NEGOTIATION
```
public static final AuthorizationType AD_ETYPE_NEGOTIATION
```
    Constant for the "EncType-Negotiation" authorization type. RFC 4537 for details.
  - AD_TOKEN
```
public static final AuthorizationType AD_TOKEN
```
    Constant for the Authorization Data Type. Note that this is not a standard Type as of yet. See the draft spec "Token Pre-Authentication for Kerberos".
  - AD_AUTHENTICAION_INDICATOR
```
public static final AuthorizationType AD_AUTHENTICAION_INDICATOR
```
    Constant for the "Authentication-Indicator" authorization type. RFC 6711 An IANA Registry for Level of Assurance (LoA) Profiles provides the syntax and semantics of LoA profiles. See: Internet draft "draft-jain-kitten-krb-auth-indicator-01"
- Method Detail
  - values
```
public static AuthorizationType[] values()
```
    Returns an array containing the constants of this enum type, in the order they are declared. This method may be used to iterate over the constants as follows:
```
for (AuthorizationType c : AuthorizationType.values())
    System.out.println(c);
```
    Returns:
    an array containing the constants of this enum type, in the order they are declared
  - valueOf
```
public static AuthorizationType valueOf(String name)
```
    Returns the enum constant of this type with the specified name. The string must match exactly an identifier used to declare an enum constant in this type. (Extraneous whitespace characters are not permitted.)
    
    Parameters:
    name - the name of the enum constant to be returned.
    
    Returns:
    the enum constant with the specified name
    
    Throws:
    
    IllegalArgumentException - if this enum type has no constant with the specified name
    
    NullPointerException - if the argument is null
  - getValue
```
public int getValue()
```
    Specified by:
    
    getValue in interface org.apache.kerby.asn1.EnumType
  - getName
```
public String getName()
```
    Specified by:
    
    getName in interface org.apache.kerby.asn1.EnumType
  - fromValue
```
public static AuthorizationType fromValue(Integer value)
```
    Get the AuthorizationType associated with a value.
    
    Parameters:
    value - The integer value of the AuthorizationType we are looking for
    
    Returns:
    The associated AuthorizationType, or NULL if not found or if value is null

Enum AuthorizationType

Enum Constant Summary

Method Summary

Methods inherited from class java.lang.Enum

Methods inherited from class java.lang.Object

Enum Constant Detail

NONE

AD_IF_RELEVANT

AD_INTENDED_FOR_SERVER

AD_INTENDED_FOR_APPLICATION_CLASS

AD_KDC_ISSUED

AD_AND_OR

AD_MANDATORY_TICKET_EXTENSIONS

AD_IN_TICKET_EXTENSIONS

AD_MANDATORY_FOR_KDC

AD_INITIAL_VERIFIED_CAS

OSF_DCE

SESAME

AD_OSF_DCE_PKI_CERTID

AD_CAMMAC

AD_WIN2K_PAC

AD_ETYPE_NEGOTIATION

AD_TOKEN

AD_AUTHENTICAION_INDICATOR

Method Detail

values

valueOf

getValue

getName

fromValue