|
|||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Object
org.identityconnectors.common.security.GuardedByteArray
public final class GuardedByteArray
Secure byte array implementation that solves the problems associated with keeping confidential data as byte[]
. That is, anything represented as a byte[]
is kept in memory in clear text and stays in memory at least until it is garbage collected.
The GuardedByteArray class alleviates this problem by storing the bytes in memory in an encrypted form. The encryption key will be a randomly-generated key.
In their serialized form, GuardedByteArrays will be encrypted using a known default key. This is to provide a minimum level of protection regardless of the transport. For communications with the Remote Connector Framework it is recommended that deployments enable SSL for true encryption.
Applications may also wish to persist GuardedByteArrays. In the case of Identity Manager, it should convert GuardedByteArrays to EncryptedData so that they can be stored and managed using the Manage Encryption features of Identity Manager. Other applications may wish to serialize APIConfiguration as a whole. These applications are responsible for encrypting the APIConfiguration blob for an additional layer of security (beyond the basic default key encryption provided by GuardedByteArray).
Nested Class Summary | |
---|---|
static interface |
GuardedByteArray.Accessor Callback interface for those times that it is necessary to access the clear text of the guarded bytes. |
Constructor Summary | |
---|---|
GuardedByteArray() Creates an empty secure byte array. |
|
GuardedByteArray(byte[] clearBytes) Initializes the GuardedByteArray from the given clear text bytes. |
Method Summary | |
---|---|
void |
access(GuardedByteArray.Accessor accessor) Provides access to the clear-text value of the byte array in a controlled fashion. |
void |
appendByte(byte b) Appends a single clear-text byte to the secure byte array. |
GuardedByteArray |
copy() Create a copy of the byte array. |
void |
dispose() Clears the in-memory representation of the byte array. |
boolean |
equals(java.lang.Object o) |
int |
hashCode() |
boolean |
isReadOnly() Returns true iff this byte array has been marked read-only |
void |
makeReadOnly() Mark this byte array as read-only. |
boolean |
verifyBase64SHA1Hash(java.lang.String hash) Verifies that this base-64 encoded SHA1 hash of this byte array matches the given value. |
Methods inherited from class java.lang.Object |
---|
clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait |
Constructor Detail |
---|
public GuardedByteArray()
public GuardedByteArray(byte[] clearBytes)
clearBytes
- The clear-text bytesMethod Detail |
---|
public void access(GuardedByteArray.Accessor accessor)
NOTE: Callers are encouraged to use verifyBase64SHA1Hash(String)
where possible if the intended use is merely to verify the contents of the byte array match an expected hash value.
accessor
- Accessor callback.java.lang.IllegalStateException
- If the byte array has been disposedpublic void appendByte(byte b)
b
- The byte to append.java.lang.IllegalStateException
- If the byte array is read-onlyjava.lang.IllegalStateException
- If the byte array has been disposedpublic void dispose()
public boolean isReadOnly()
java.lang.IllegalStateException
- If the byte array has been disposedpublic void makeReadOnly()
java.lang.IllegalStateException
- If the byte array has been disposedpublic GuardedByteArray copy()
java.lang.IllegalStateException
- If the byte array has been disposedpublic boolean verifyBase64SHA1Hash(java.lang.String hash)
hash
- The hash to verify against.java.lang.IllegalStateException
- If the byte array has been disposedpublic boolean equals(java.lang.Object o)
equals
in class java.lang.Object
public int hashCode()
hashCode
in class java.lang.Object
|
|||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |