Step that generates a 'Remember-Me' token and adds it to the response as cookie.
In most use cases this step must be activated by the end-user and configured accordingly. If the step does not have to be activated, valid Remember-Me cookies are issued automatically. Depending on their usage, this may impose a security risk.
", decompiled/com/airlock/iam/authentication/application/configuration/rememberme/RememberMeUserIdentifyingStepConfig.java:33: description = "If configured, Remember-Me cookies which originated from the JSP-Loginapp will be automatically migrated to the the new flow-based Remember-Me tokens. Be aware that invalid Remember-Me cookies will be forcibly removed from the client.", decompiled/com/airlock/iam/authentication/application/configuration/rememberme/RememberMeUserIdentifyingStepConfig.java:34: displayName = "Migrate JSP Remember-Me Cookies", decompiled/com/airlock/iam/authentication/application/configuration/rememberme/RememberMeUserIdentifyingStepConfig.java:37: private JspRememberMeConfig migrateJspRememberMeCookies; decompiled/com/airlock/iam/authentication/application/configuration/rememberme/RememberMeUserIdentifyingStepConfig.java:48: public OptionalNote: If an authentication flow starts with a user identifying step without verification of an authentication factor (e.g. password, remember-me cookie, SSO ticket, ...) this may lead to unwanted information leakage.
", decompiled/com/airlock/iam/authentication/application/configuration/processor/DefaultAuthenticationProcessorsConfig.java:61: RenewSessionIdProcessorConfig.RENEW_SESSION_ID_PROCESSOR, decompiled/com/airlock/iam/authentication/application/configuration/processor/DefaultOneShotAuthenticationProcessorsConfig.java:8:import com.airlock.iam.flow.shared.application.configuration.processor.RenewSessionIdProcessorConfig; decompiled/com/airlock/iam/authentication/application/configuration/processor/DefaultOneShotAuthenticationProcessorsConfig.java:48: RenewSessionIdProcessorConfig.RENEW_SESSION_ID_PROCESSOR, decompiled/com/airlock/iam/authentication/application/configuration/newdevice/LoginFromNewDeviceStepConfig.java:11:import com.airlock.iam.flow.shared.application.configuration.newdevice.NewDeviceCookieConfig; decompiled/com/airlock/iam/authentication/application/configuration/newdevice/LoginFromNewDeviceStepConfig.java:23: description = "Step which publishes an event if the user logged in from a new device:\nUser identifying flow step with integrated FIDO authentication.
\nThis step identifies users only by their username, thus it should only be integrated into flows where\neither a trusted, authenticated entity acts on behalf of the user, or further authentication steps\nverify the user's identity.
\nAdditionally, this step directly integrates FIDO passwordless authentication by supporting Webauthn\nconditional UI. When accessing the page, the user is automatically presented with FIDO credential selection\ndialog if it is supported by the browser, and allows the user to authenticate directly.
\nCaution: This step allows user enumeration attacks. Such attacks cannot be prevented,\neven if \"Prevent User-Enumeration\" is enabled on the \"Authentication Flow\".
", decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/OnBehalfLoginIdentityPropagationConfig.java:3:import com.airlock.iam.core.misc.impl.sso.onbehalflogin.CookieMapping; decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/OnBehalfLoginIdentityPropagationConfig.java:23: description = "This identity propagator performs a login 'on behalf' of the user at a backend web application.\nIt performs the necessary login steps to obtain an authenticated session from login into the backend application.\nThen it attaches the session cookie to the user's authenticated session, thus enabling access to the backend application.
\nThe login process is configured as a sequence of on behalf login steps. Each on behalf login step performs a\nHTTP operation and can store newly gathered information in an information storage for the next step.
\nFor example: A first on behalf login step executes a HTTP GET request on the web application's login page and extracts\nthe CSRF protection token. A next on behalf login step submits the login form with username, password and the extracted CSRF token.
\nOn behalf logins are not robust against changes of the web application. Therefore, this identity propagation\nmechanism is only recommended for legacy application that do not accept another way of identity propagation.
" decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/OnBehalfLoginIdentityPropagationConfig.java:31: description = "A list of cookies that are expected from the backend application and that are kept for\nsubsequent access to this backend. Usually the only cookie to configure is the session cookie.", decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/OnBehalfLoginIdentityPropagationConfig.java:35: private ListThe name of the cookie used to transport the ticket.
Only one cookie per cookie path and name can exist, therefore the name of this cookie must be distinct from all other cookie names used by this applications (such as \"JSESSIONID\").
", decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:16: private String cookieName; decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:18: description = "The path for which the cookie is set. This determines with which future requests the cookie will be sent to the server.
To add the cookie to all requests to a given domain, the value \"/\" can be used. If the cookie should be limited to a certain backend, the corresponding context path should be used.
Only one cookie per cookie path and name can exist, therefore the name of this cookie must be distinct from all other cookie for the same path (such as \"JSESSIONID\").
When using an Airlock Gateway (WAF), the Gateway configuration flag Interpret Cookie Domains must be set. Otherwise the cookie path is ignored and cookies in the cookie store are sent with back-end HTTP requests of the same session.
", decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:23: private String cookiePath; decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:25: description = "The domain for which the cookie is set. This determines with which future requests the cookie will be sent to the server.Because of security restrictions in browsers (same origin policy) it is usually not possible to set a cookie for a different domain (except subdomains).
Airlock Gateway (WAF) handle cookies differently and allow setting cookies for other domains within the protected infrastructure while not exposing them to the internet. The Gateway configuration flag Interpret Cookie Domains needs to be enabled for this feature. If this flag is enabled, also the following special domain names are supported:
.* results in cookies being sent to all back-end servers.If the cookie is marked as secure, the browser (and any HTTP proxy behaving like a browser) should send the cookie only over secure connections. Airlock Gateway can indicate (using an environment cookie) that roles have been dropped. Dropped roles can be mapped to tags in Airlock IAM that should be dropped as a consequence. The name of the control cookie used to communicate with the Airlock Gateway (WAF) backend control API.\nThis must be the same as configured in Airlock. A control cookie is set after successful authentication with the roles granted to the user as\ncredentials/roles. Additionally, a new session ID is generated (to prevent session fixation attacks) and the\nglobal session ID is set as audit token. This property also enables so-called \"session tickets\". After successful authentication the user's name\nand the granted roles are stored in the current session plus a session ticket cookie including this\ninformation is stored in the Airlock Gateway cookie store. The session ticket is needed to re-authenticate\nany new session later. \nRegister a new device token by providing a JSON Web Key (JWK) public key and optionally a label and/or a serial ID of the device.\nThe device token is only persisted if a subsequent \"Apply Changes Step\"\nwith an \"Apply Device Token Registration\" handler is configured.\n \nThe public key is represented as specified in JWK (RFC7517). Currently elliptic curve signatures (keys of type \"EC\") are supported.
",
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:37: public String getCookieName() {
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:38: return this.cookieName;
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:41: public String getCookiePath() {
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:42: return this.cookiePath;
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:45: public String getCookieDomain() {
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:46: return this.cookieDomain;
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:54: public static CookieTicketAdderConfig.CookieTicketAdderConfigBuilder builder() {
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:55: return new CookieTicketAdderConfig.CookieTicketAdderConfigBuilder();
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:59: public CookieTicketAdderConfig(String cookieName, String cookiePath, String cookieDomain, boolean secureFlag) {
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:60: this.cookieName = cookieName;
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:61: this.cookiePath = cookiePath;
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:62: this.cookieDomain = cookieDomain;
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:67: public CookieTicketAdderConfig() {
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:71: public static class CookieTicketAdderConfigBuilder {
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:73: private String cookieName;
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:75: private String cookiePath;
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:77: private String cookieDomain;
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:82: CookieTicketAdderConfigBuilder() {
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:86: public CookieTicketAdderConfig.CookieTicketAdderConfigBuilder cookieName(String cookieName) {
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:87: this.cookieName = cookieName;
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:92: public CookieTicketAdderConfig.CookieTicketAdderConfigBuilder cookiePath(String cookiePath) {
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:93: this.cookiePath = cookiePath;
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:98: public CookieTicketAdderConfig.CookieTicketAdderConfigBuilder cookieDomain(String cookieDomain) {
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:99: this.cookieDomain = cookieDomain;
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:104: public CookieTicketAdderConfig.CookieTicketAdderConfigBuilder secureFlag(boolean secureFlag) {
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:110: public CookieTicketAdderConfig build() {
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:111: return new CookieTicketAdderConfig(this.cookieName, this.cookiePath, this.cookieDomain, this.secureFlag);
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:117: return "CookieTicketAdderConfig.CookieTicketAdderConfigBuilder(cookieName="
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:118: + this.cookieName
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:119: + ", cookiePath="
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:120: + this.cookiePath
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:121: + ", cookieDomain="
decompiled/com/airlock/iam/authentication/application/configuration/idpropagation/CookieTicketAdderConfig.java:122: + this.cookieDomain
decompiled/com/airlock/iam/authentication/application/configuration/risk/extractor/clientfingerprinting/ClientFingerprintingScoreRiskExtractorConfig.java:16: description = "Risk Extractor that extracts the Airlock Gateway (WAF) client fingerprinting (CFP) score and compares it to the\nconfigured threshold. No tags are granted, if the request does not contain a CFP score environment cookie."
decompiled/com/airlock/iam/authentication/application/configuration/risk/extractor/clientfingerprinting/SessionHijackingNotificationRiskExtractorConfig.java:14: description = "Risk Extractor that extracts the notification flag of the Airlock Gateway (WAF) client fingerprinting (CFP)\nrequest. The notification flag indicates whether client fingerprinting has detected a potential session hijacking.\nNo tags are granted, if the request does not contain a CFP notification environment cookie."
decompiled/com/airlock/iam/authentication/application/configuration/risk/extractor/anomaly/AnomalyShieldStateRiskExtractorConfig.java:16: description = "Risk Extractor that extracts the state of the Gateway Anomaly Shield and compares it to the configured anomaly\nstates. No tags are granted, if the request does not contain an anomaly shield environment cookie."
decompiled/com/airlock/iam/authentication/application/service/session/ApplicationAccessCompletedServiceImpl.java:9:import com.airlock.iam.common.application.service.session.AirlockControlCookieService;
decompiled/com/airlock/iam/authentication/application/service/session/ApplicationAccessCompletedServiceImpl.java:32: private final ProviderADD_CREDENTIALS. If every identity propagation shall\nreplace all previously set roles, disable this property, which results in the Airlock Control Cookie\ncommand SET_CREDENTIALS.",
decompiled/com/airlock/iam/login/application/configuration/gateway/LoginappGatewayConfig.java:50: description = "
\nThe following attributes are expected in the public key attribute (according to the JWK specification):\n\n
\n\n
\nPlease note: During registration all four values are always allowed, but for the other use cases of device tokens (e.g. authentication)\nit is possible to restrict (in the IAM configuration) which curves are allowed.
For example, the API request for reCAPTCHA is 'https://google.com/recaptcha/api/siteverify' as POST method with the 'secret' and the user 'response' token as POST parameters.
", decompiled/com/airlock/iam/login/application/service/session/AuditTokenFactoryImpl.java:4:import com.airlock.iam.common.domain.model.session.SessionId; decompiled/com/airlock/iam/login/application/service/session/AuditTokenFactoryImpl.java:14: private final ProviderThe ticket encoder plugin used to encode the ticket to a string.
Attention: Do not use the \"Plain Ticket Encoder\" when storing this value in a cookie, as it might contain illegal values for cookies.
Some ticket encoders do not support ticket expiry, i.e. they do not encode the ticket validity into the ticket.
", decompiled/com/airlock/iam/flow/shared/application/configuration/processor/RenewSessionIdProcessorConfig.java:12:public class RenewSessionIdProcessorConfig implements FlowProcessorConfig { decompiled/com/airlock/iam/flow/shared/application/configuration/processor/RenewSessionIdProcessorConfig.java:14: public static final RenewSessionIdProcessorConfig RENEW_SESSION_ID_PROCESSOR = ((RenewSessionIdProcessorConfig.RenewSessionIdProcessorConfigBuilder)PluginPropertyBuilderInitializer.pluginBuilder( decompiled/com/airlock/iam/flow/shared/application/configuration/processor/RenewSessionIdProcessorConfig.java:15: RenewSessionIdProcessorConfig.RenewSessionIdProcessorConfigBuilder.class decompiled/com/airlock/iam/flow/shared/application/configuration/processor/RenewSessionIdProcessorConfig.java:20: public static RenewSessionIdProcessorConfig.RenewSessionIdProcessorConfigBuilder builder() { decompiled/com/airlock/iam/flow/shared/application/configuration/processor/RenewSessionIdProcessorConfig.java:21: return new RenewSessionIdProcessorConfig.RenewSessionIdProcessorConfigBuilder(); decompiled/com/airlock/iam/flow/shared/application/configuration/processor/RenewSessionIdProcessorConfig.java:25: public static class RenewSessionIdProcessorConfigBuilder { decompiled/com/airlock/iam/flow/shared/application/configuration/processor/RenewSessionIdProcessorConfig.java:27: RenewSessionIdProcessorConfigBuilder() { decompiled/com/airlock/iam/flow/shared/application/configuration/processor/RenewSessionIdProcessorConfig.java:31: public RenewSessionIdProcessorConfig build() { decompiled/com/airlock/iam/flow/shared/application/configuration/processor/RenewSessionIdProcessorConfig.java:32: return new RenewSessionIdProcessorConfig(); decompiled/com/airlock/iam/flow/shared/application/configuration/processor/RenewSessionIdProcessorConfig.java:38: return "RenewSessionIdProcessorConfig.RenewSessionIdProcessorConfigBuilder()"; decompiled/com/airlock/iam/flow/shared/application/configuration/processor/FailedFactorAttemptsProcessorConfig.java:10: description = "Processor for counting failed factor usages. Failed step results from authentication method verifying steps cause the failed attempts counter for the corresponding authentication method to be increased (unless explicitly overridden in the step result). After successful completion of a flow all counters of authentication methods used during the flow are reset. If strict counting is enabled, all exceptions are also counted as failed attempts.", decompiled/com/airlock/iam/flow/shared/application/configuration/processor/FailedFactorAttemptsProcessorConfig.java:26: description = "If strict counting is enabled, exceptions and failures to connect to external systems are also counted\nas failed attempts. This is recommended for security-critical flows such as authentication. If the current\nstep does not specify an authentication method, the failed attempt is counted for the last authentication\nmethod used in this flow, or a generic UNSPECIFIED if there was no previous authentication method verifying step.", decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:19:@Plugin(description = "Configures the cookie used for detecting a login from a new device.") decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:20:public final class NewDeviceCookieConfig { decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:22: description = "The name of the cookie that is used to detect whether a login from a new device happened.If this name is changed, the IAM Loginapp mapping on Airlock Gateway has to be reconfigured to pass-through this cookie.
", decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:29: private String cookieName; decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:31: description = "The key used to encrypt the cookie. Must be 32 Bytes encoded as Base64 String.
One can, for example, generate a random base64 string with 256 bits (32 bytes) using OpenSSL as follows: openssl rand -base64 32
If this value is changed, all previously used devices are forgotten.
", decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:48: public String getCookieName() { decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:49: return this.cookieName; decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:73: public static NewDeviceCookieConfig.NewDeviceCookieConfigBuilder builder() { decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:74: return new NewDeviceCookieConfig.NewDeviceCookieConfigBuilder(); decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:78: public NewDeviceCookieConfig(String cookieName, String key, String validity) { decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:79: this.cookieName = cookieName; decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:85: public NewDeviceCookieConfig() { decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:89: public static class NewDeviceCookieConfigBuilder { decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:91: private String cookieName; decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:98: NewDeviceCookieConfigBuilder() { decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:102: public NewDeviceCookieConfig.NewDeviceCookieConfigBuilder cookieName(String cookieName) { decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:103: this.cookieName = cookieName; decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:108: public NewDeviceCookieConfig.NewDeviceCookieConfigBuilder key(String key) { decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:114: public NewDeviceCookieConfig.NewDeviceCookieConfigBuilder validity(String validity) { decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:120: public NewDeviceCookieConfig build() { decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:121: return new NewDeviceCookieConfig(this.cookieName, this.key, this.validity); decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceCookieConfig.java:127: return "NewDeviceCookieConfig.NewDeviceCookieConfigBuilder(cookieName=" + this.cookieName + ", key=" + this.key + ", validity=" + this.validity + ")"; decompiled/com/airlock/iam/flow/shared/application/configuration/newdevice/NewDeviceConditionConfig.java:9: description = "This condition is met if the user never logged in on the current device.
Device recognition is based on a cookie configured in the 'Cookie Settings'. A device is considered new for a user if the cookie is either missing or does not contain information about a prior login for that specific user.
To use this condition effectively:
Configuration for a user identifying flow step.
\nThis step identifies users only by their username, thus it should only be integrated into flows where\neither a trusted, authenticated entity acts on behalf of the user, or further authentication steps\nverify the user's identity.
\nCaution: This step allows user enumeration attacks. Such attacks cannot be prevented,\neven if \"Prevent User-Enumeration\" is enabled on the \"Authentication Flow\".
", decompiled/com/airlock/iam/flow/shared/application/configuration/step/MtanVerificationStepConfig.java:33: description = "Flow step to verify the registration of an mTAN number of a previous user data edit step to be used as an authentication method. It sends an OTP to the number to be verified and optionally also verifies an IAK that was sent by letter. This step is typically followed by an \"Apply Changes Step\" with an \"Apply mTAN Registration Change\" handler, unless the number is already pre-registered and persisting is not needed. ", decompiled/com/airlock/iam/flow/shared/application/configuration/step/email/EmailChangeVerificationStepConfig.java:47: description = "Email address provider for the email address to verify. The \"Changed Email Address Provider\" can be used to provide the changed email address, if this step follows after a User Data Edit Step with an \"Email Item Definition\".", decompiled/com/airlock/iam/flow/shared/application/service/recovery/UserSessionRecoveryConfig.java:8: public static final String TICKET_KEY_USER_SESSION_ID = "sessionId"; decompiled/com/airlock/iam/flow/shared/application/service/recovery/SessionAttributeReaderFactory.java:101: return Optional.of(clazz.getMethod("deserializeSessionAttribute", Map.class)); decompiled/com/airlock/iam/flow/shared/application/service/MtanVerification.java:20: public FlowResult verifyOtp(UnverifiedOtp otp) { decompiled/com/airlock/iam/flow/shared/application/service/MtanVerification.java:21: return this.executeStepMethod(step -> step.verifyOtp(otp)); decompiled/com/airlock/iam/flow/shared/application/service/MtanVerification.java:24: public FlowResult verifyIak(Iak iak) { decompiled/com/airlock/iam/flow/shared/application/service/MtanVerification.java:25: return this.executeStepMethod(step -> step.verifyIak(iak)); decompiled/com/airlock/iam/flow/shared/application/service/RoleRemovalServiceImpl.java:5:import com.airlock.iam.common.domain.service.request.AirlockEnvCookiesInformationService; decompiled/com/airlock/iam/flow/shared/application/service/RoleRemovalServiceImpl.java:24: private final ProviderIf a 'Base URI' is configured, links are rewritten according to the configured value. Otherwise, links are rewritten according to the external view provided by the WAF (if configured an a WAF environment cookie is present).
", decompiled/com/airlock/iam/login/rest/application/configuration/LoginappRestConfig.java:88: description = "Allows to change the base URI for all links in REST responses.This property is useful in test environments where you want links contained in REST responses to be relative to the configured base URI. Note that configuring this property will take precedence over link rewriting based on the WAF environment cookie.
In order to produce correct links, the property must be configured up to and including the /rest subpath. IAM will automatically append public to the configured value for calls to the public API and protected for calls to the protected API of the Loginapp (or oauth2 for OAuth 2.0/OpenId Connect endpoints).
Example:
http://myhost:8090/test/rest/<loginapp-uri>/rest/public/users/register will contain a link to http://myhost:8090/test/rest/protected/my/selfCompletes adding a new Cronto Device.
\nAdds a new Cronto device by verifying the OTP the user has extracted from the cryptogram he has received\nfrom the prior POST to cronto/devices/activation/start.
\nInitiates a phone number change for an mTAN token.
\nIf the server responds with 200 OK, an OTP is sent to the user's existing number.\nThe OTP together with the context that is returned within the response must be\nsent when calling '/verify-number-change' in order for the change to become effective.
\n\nRegister a new device token by providing a JSON Web Key (JWK) public key and optionally a label and/or a serial ID of the device.\n
\n\nThe public key is represented as specified in JWK (RFC7517). Currently elliptic curve signatures (keys of type \"EC\") are supported.
\nThe following attributes are expected in the public key attribute (according to the JWK specification):\n
Proof Key for Code Exchange by OAuth 2.0 Public Clients (RFC 7636)
It is strongly recommended to use PKCE in setups involving native mobile apps (see the RFC 8252).
PKCE is always performed if the client starts it; however this property defines the minimum challenge hash method necessary and therefore allows to enforce the usage of PKCE.
If PKCE is required, \"plain\" should only be used if a legacy client doesn't support S256.
The value configured here applies to all clients, however, it's possible to override it in the configuration of each static client.
Background on PKCE:
OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the Authorization Code interception attack. PKCE helps to mitigate this risk through the use of Proof Key for Code Exchange.
This extension utilizes a dynamically created cryptographic random key called \"code verifier\". A unique code verifier is created for every authentication request, and its transformed value, called \"code challenge\", is sent to the authorization server to obtain the Authorization Code. The Authorization Code obtained is later sent to the token endpoint with the \"code verifier\", which allows the server to verify the possession of the \"code verifier\" before issuing an Access Token.
", decompiled/com/airlock/iam/login/app/misc/configuration/oauth/as/oauth2/OpenIdConnectAuthorizationCodeGrantConfig.java:393: PluginConfiguration accessTokenSigner = PluginPropertyValueReader.effectivePluginPropertyValue(hybridFlowAccessTokenConfig, "signature", env, context); decompiled/com/airlock/iam/login/app/misc/configuration/oauth/as/oauth2/OpenIdConnectAuthorizationCodeGrantConfig.java:396: "signature", hybridFlowAccessTokenConfig, env, context, "OpenID Connect Hybrid Flow Access Tokens must be signed." decompiled/com/airlock/iam/login/app/misc/configuration/oauth/as/oauth2/OAuth2AuthorizationCodeGrantConfig.java:64: description = "Proof Key for Code Exchange by OAuth 2.0 Public Clients\n(RFC 7636)
\nIt is strongly recommended to use PKCE in setups involving native mobile apps\n(see the RFC 8252).
\nPKCE is always performed if the client starts it; however this property defines the minimum challenge\nhash method necessary and therefore allows to enforce the usage of PKCE.
\nIf PKCE is required, \"plain\" should only be used if a legacy client doesn't support S256.
\nThe value configured here applies to all clients, however, it's possible to override it in the\nconfiguration of each static client.
\nBackground on PKCE:
\nOAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the Authorization Code\ninterception attack. PKCE helps to mitigate this risk through the use of Proof Key for Code Exchange\n(pronounced \"pixy\").
This extension utilizes a dynamically created cryptographic random key called \"code verifier\". A unique\ncode verifier is created for every authorization request, and its transformed value, called \"code challenge\",\nis sent to the authorization server to obtain the Authorization Code. The Authorization Code obtained is later\nsent to the token endpoint with the \"code verifier\", which allows the server to verify the possession of the\n\"code verifier\" before issuing an Access Token.
", decompiled/com/airlock/iam/login/app/misc/configuration/oauth/as/OAuth2ASConfigClientSecretLengthValidator.java:3:import com.airlock.iam.oauth2.application.configuration.openid.signature.OpenIDConnectIDTokenMACSignatureSigner; decompiled/com/airlock/iam/login/app/misc/configuration/oauth/as/client/OAuth2StaticClientConfig.java:5:import com.airlock.iam.common.application.configuration.jwt.signature.JwksSignatureVerifierSettings; decompiled/com/airlock/iam/login/app/misc/configuration/oauth/as/client/OAuth2StaticClientConfig.java:130: description = "The client secret, used for authentication.openssl rand -base64 32.\nIf using an HMAC signature for ID tokens, the client secret length must suffice for the signature algorithm (e.g., 32 bytes for HS256).\n",
decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/impl/IdPropagationPreparation.java:27: addIfValueNotEmpty(list, "GSID", context.getSessionId().id());
decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/impl/TargetApplicationBasedAirlockMetaInformation.java:5:import com.airlock.iam.core.misc.util.airlock.AirlockControlCookie;
decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/impl/TargetApplicationBasedAirlockMetaInformation.java:10:import jakarta.servlet.http.Cookie;
decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/impl/TargetApplicationBasedAirlockMetaInformation.java:26: AirlockControlCookie airlockCookie = this.createAirlockCookie(authentee, context);
decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/impl/TargetApplicationBasedAirlockMetaInformation.java:27: Cookie cookie = airlockCookie.getControlCookie(this.alConfig.getControlCookieName());
decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/impl/TargetApplicationBasedAirlockMetaInformation.java:28: response.addCookie(cookie);
decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/impl/TargetApplicationBasedAirlockMetaInformation.java:31: private AirlockControlCookie createAirlockCookie(Authentee authentee, OneShotContext context) {
decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/impl/TargetApplicationBasedAirlockMetaInformation.java:32: AirlockControlCookie cookie = new AirlockControlCookie();
decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/impl/TargetApplicationBasedAirlockMetaInformation.java:34: cookie.setAddCredentials(this.getRolesToPropagate(authentee));
decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/impl/TargetApplicationBasedAirlockMetaInformation.java:36: cookie.replaceCredentials(this.getRolesToPropagate(authentee));
decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/impl/TargetApplicationBasedAirlockMetaInformation.java:39: cookie.setAuditToken(this.alConfig.getAuditToken().getAuditTokenValue(context.getSessionId().id(), authentee.getName()));
decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/impl/TargetApplicationBasedAirlockMetaInformation.java:40: return cookie;
decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/OneShotTargetApplicationConfig.java:29: description = "Defines how to authenticate HTTP requests based on the original HTTP request sent by the client (provided to IAM in various Airlock Gateway environment cookies).
The following actions are applied for each request:
Validates the credential from the credential extractor in order to authenticate the HTTP request.
Note:
A common use-case is to verify JWT tokens issued by an upfront authentication process (as \"Authorization Bearer\" header):
Configures the end-point used to authenticated HTTP requests with the Airlock Gateway (WAF)'s one-shot flow. It can be used, for example, to authenticate stateless REST calls.
The HTTP header of non-authenticated request are sent to this IAM end-point by the Airlock Gateway.
Make sure to use \".../login-oneshot/\" as denied access URL on the corresponding gateway mappings.
This end-point may roughly do the following with the requests:
All settings are configured in the list of target applications/services (see properties).
The target application/service is selected by the original request by the HTTP client (provided to IAM in various environment cookies).
In case no target application/service matches, the default target application/service is used.
List of target applications/services:
One of the target applications/services is selected by matching the \"URL Pattern\" against URL of the original HTTP request sent by the client (provided to IAM by several environment cookies).
They are matched in the order they are declared and the first matching is used. In case no one matches, the default target application/service is used.
", decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/OneShotAuthenticationConfig.java:51: LOG.info(LogTypes.AIRLOCK_ONESHOT, "Cannot determine One-Shot target application, because ENV-cookie values cannot be interpreted. Using default."); decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/OneShotAuthenticationConfig.java:60: return envValues.getUrlFromAirlockEnvironmentCookie(); decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/OneShotAuthenticationConfig.java:62: LOG.warn(LogTypes.AIRLOCK_ONESHOT, "Exception while extracting accessed URL from ENV cookies ", e); decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/FailureHttpResponseConfig.java:38: new AirlockAuthWorkflowErrorBehavior(this.workflow, wafConfig.getControlCookieName()) decompiled/com/airlock/iam/login/app/application/configuration/oauth/OAuth2AccessTokenOneShotAuthenticator.java:87: .filter(token -> token.getTokenBinding().map(binding -> this.verifyBoundToken(credential, binding)).orElse(true)); decompiled/com/airlock/iam/login/app/application/configuration/oauth/OAuth2AccessTokenOneShotAuthenticator.java:93: private boolean verifyBoundToken(TokenCredential credential, OAuth2TokenBinding binding) { decompiled/com/airlock/iam/login/app/application/configuration/oauth/OAuth2AccessTokenOneShotAuthenticator.java:102: return this.bindingVerifier.verify(binding, Optional.of(new OAuth2TokenBindingClientCertificateCredential(certificate))); decompiled/com/airlock/iam/login/app/misc/configuration/oneshot/HttpHeaderTokenExtractorConfig.java:27: description = "Extracts a token from an HTTP header, decodes it using the specified ticket decoder (e.g. JWT) and provides a \"Single-Sign-On-Credential\" to the authenticator.
This extractor can be used to verify JWTs in \"Authorization\" headers (to remove the \"Bearer \"-Prefix from the header value use \"Header Value Conversion Pattern\" and \"Header Value Conversion Replacement\").
This extractor can only be used with authenticators that are able to process Single-Sign-On-Credentials (e.g. the \"SSO Credential Authenticator\").
", decompiled/com/airlock/iam/login/app/misc/configuration/targetapps/GenericTargetApplicationBase.java:78: description = "The type of password encryption used to decrypt this password.This allows to enforce certain data to be included/excluded in the signature.
", decompiled/com/airlock/iam/login/app/misc/oneshot/impl/HttpSignatureVerificationCredentialExtractorConfig.java:64: private List\tDepending on the keystore type, leaving this property empty (or undefined) has a different effect:\t
Security warning: The revocation status is only checked for the leaf certificate. Issuer certificates are not checked for revocation. If revocation checks for issuer certificates are required, these must be performed by the administrative process that manages the IAM truststore, see property 'Trust Store Path'.
", decompiled/com/airlock/iam/login/app/misc/oneshot/impl/HttpSignatureVerificationCredentialExtractorConfig.java:110: description = "Verifies the signature algorithms being used. If not configured, all algorithms are allowed and therefore all supported algorithms that can be used with the certificate's key material will pass the signature verification.", decompiled/com/airlock/iam/login/app/misc/oneshot/impl/HttpSignatureVerificationCredentialExtractorConfig.java:116: description = "Client credential verification against the used HTTP signature signing certificate. If not configured, no verification of the credential will be performed.", decompiled/com/airlock/iam/login/app/misc/oneshot/impl/HttpSignatureVerificationCredentialExtractorConfig.java:122: description = "Enables logging of signature verification information. Certificate, algorithm, signing string and the signature will be logged in case the verification was successful. This allows to verify signatures at a later point in time.Security Warning: Signing strings contain request headers which often contain sensitive information and should therefore not be logged. If this feature is enabled, it is highly recommended that these logs are redirected to a special destination using the Logger Name.
", decompiled/com/airlock/iam/login/app/misc/oneshot/impl/HttpSignatureVerificationCredentialExtractorConfig.java:131: ListSecurity Warning: Request bodies often contain sensitive information and should therefore not be logged. If this feature is enabled, it is highly recommended that these logs are redirected to a special destination using the Logger Name.
", decompiled/com/airlock/iam/login/app/misc/oneshot/impl/KerberosSpnegoErrorMapper.java:4:import com.airlock.iam.core.misc.util.airlock.AirlockControlCookie; decompiled/com/airlock/iam/login/app/misc/oneshot/impl/KerberosSpnegoErrorMapper.java:12: private final String alCookieName; decompiled/com/airlock/iam/login/app/misc/oneshot/impl/KerberosSpnegoErrorMapper.java:14: public KerberosSpnegoErrorMapper(LegacyKerberosService kerberosService, String alCookieName) { decompiled/com/airlock/iam/login/app/misc/oneshot/impl/KerberosSpnegoErrorMapper.java:16: this.alCookieName = (String)Preconditions.checkNotNull(alCookieName); decompiled/com/airlock/iam/login/app/misc/oneshot/impl/KerberosSpnegoErrorMapper.java:35: AirlockControlCookie cookie = new AirlockControlCookie(); decompiled/com/airlock/iam/login/app/misc/oneshot/impl/KerberosSpnegoErrorMapper.java:36: cookie.authFlowFinalResponse(); decompiled/com/airlock/iam/login/app/misc/oneshot/impl/KerberosSpnegoErrorMapper.java:37: response.addCookie(cookie.getControlCookie(this.alCookieName)); decompiled/com/airlock/iam/login/app/misc/oneshot/impl/HttpSignatureAlgorithmWhitelistConfig.java:3:import com.airlock.iam.core.domain.model.http.signature.verifier.HttpSignatureAlgorithmVerifier; decompiled/com/airlock/iam/login/app/misc/oneshot/impl/HttpSignatureAlgorithmWhitelistConfig.java:4:import com.airlock.iam.core.domain.model.http.signature.verifier.HttpSignatureAlgorithmWhitelistVerifier; decompiled/com/airlock/iam/login/app/misc/oneshot/impl/HttpSignatureAlgorithmWhitelistConfig.java:5:import com.airlock.iam.core.domain.model.http.signature.verifier.SignatureAlgorithmIdentifier; decompiled/com/airlock/iam/login/app/misc/oneshot/impl/HttpSignatureAlgorithmWhitelistConfig.java:14: description = "The allowed signature algorithms. The value can be provided in any letter case. The format specified by Java is <digest>with<encryption>and<mgf>, where the mgf is optional.", decompiled/com/airlock/iam/login/app/misc/oneshot/impl/HttpSignatureAlgorithmWhitelistConfig.java:34: SignatureAlgorithmIdentifier.signatureAlgorithmIdentifiers(this.allowedSignatureAlgorithms) decompiled/com/airlock/iam/login/app/application/configuration/psd2/NextGenPsd2CertificateAuthenticator.java:158: this.verifyIntegrity(subjectX500Principal, clientsWithSameSubject); decompiled/com/airlock/iam/login/app/application/configuration/psd2/NextGenPsd2CertificateAuthenticator.java:162: private void verifyIntegrity(X500Principal subjectX500Principal, CollectionThe encryption key (encoded in base64) is required to encrypt sensitive data in cookies or in REST responses.
The openssl tool can be used to generate a random base64 string with 256 bits (32 bytes): openssl rand -base64 32
The HMAC Key (encoded in base64) is required to sign sensitive data stored in cookies or REST responses.
The openssl tool can be used to generate a random base64 string with 512 bits (64 bytes): openssl rand -base64 64
Security Recommendation: Use an HMAC key length of 512 bit or greater for optimal security with the used HS512 algorithm.
", decompiled/com/airlock/iam/login/app/application/configuration/SecurityConfig.java:80: displayName = "Session Cookie SameSite Policy", decompiled/com/airlock/iam/login/app/application/configuration/SecurityConfig.java:81: description = "Specifies the 'SameSite' cookie attribute of the IAM session cookie 'iam-session-id'. The 'Secure' attribute is automatically set based on whether the request was performed using http or https (see exception for 'None' below).