Package co.ankatech.ankasecure.sdk.auth

Class AdmittedIssuer

java.lang.Object
co.ankatech.ankasecure.sdk.auth.AdmittedIssuer
public final class AdmittedIssuer extends Object
An external issuer that passed admission, together with the addresses it resolved to at that moment.

It exists so that the decision and the thing dialled cannot come apart. A check that resolves a name and then hands the caller back only a verdict forces a SECOND lookup to obtain something dialable, and the second lookup is the one an attacker controls - that gap is what DNS rebinding is. Handing back the addresses that passed removes the second lookup from the caller's vocabulary: there is nothing left to re-resolve.

Instances are produced only by ExternalIssuerAdmission. There is no public constructor, so an admitted issuer cannot be fabricated by a caller that skipped the rules.

No userinfo can survive here. Admission refuses a URL carrying a username or a password before this type is constructed, so describe() - which flows into exception messages and into diagnostic context maps - cannot render a credential.

  • Method Summary

    Modifier and Type
    Method
    Description
    String
    describe()
    An operator-facing description of the issuer, safe to log and to put in a diagnostic context map: the origin and the path, and nothing else.
    String
    host()
    The host the pinned addresses belong to, as a resolver key: an IPv6 literal appears here WITHOUT its brackets, because that is the form a Dns implementation is asked for.
    String
    origin()
    The origin the issuer client is pinned to.
    List<InetAddress>
    pinnedAddresses()
    The addresses admission resolved and screened.
    String
    toString()
     
    okhttp3.HttpUrl
    url()
    The admitted issuer URL.

    Methods inherited from class java.lang.Object

    equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

  • Method Details

    • url

      public okhttp3.HttpUrl url()
      The admitted issuer URL.
      Returns:
      the URL; never null

    • host

      public String host()
      The host the pinned addresses belong to, as a resolver key: an IPv6 literal appears here WITHOUT its brackets, because that is the form a Dns implementation is asked for. The bracketed form belongs in a URL and is what origin() renders.
      Returns:
      the host; never null

    • origin

      public String origin()
      The origin the issuer client is pinned to.
      Returns:
      scheme://host:port; never null

    • describe

      public String describe()
      An operator-facing description of the issuer, safe to log and to put in a diagnostic context map: the origin and the path, and nothing else.

      The scheme's default port is omitted, which origin() deliberately does not do. The two render for different readers and the difference is not cosmetic: origin() is compared, so it states the port the transport actually pins; this one is READ, by a person who wrote https://issuer.example.com/realms/anka in a properties file and has to recognise their own value in a message about it. Showing them a :443 they never typed makes a refusal look like it is about a URL they did not configure.

      Returns:
      the description; never null, never containing credentials

    • pinnedAddresses

      public List<InetAddress> pinnedAddresses()
      The addresses admission resolved and screened. A caller connects to these and never resolves the host again.
      Returns:
      an immutable, non-empty list in resolution order

    • toString

      public String toString()
      Overrides:
      toString in class Object