Package co.ankatech.ankasecure.sdk.auth

Enum Class AuthSetting

java.lang.Object
java.lang.Enum<AuthSetting>
co.ankatech.ankasecure.sdk.auth.AuthSetting
All Implemented Interfaces:
Serializable, Comparable<AuthSetting>, Constable
public enum AuthSetting extends Enum<AuthSetting>
Every configuration value the resolution chain reads, and the two names each one answers to.

The list is deliberately short and deliberately closed. It is the entire surface by which a deployment tells the SDK how this workload proves itself - and because it is an enum, "what can be configured" is a question with an exhaustive answer rather than one that has to be discovered by reading resolution code.

Two names, one meaning

Each setting has a properties key and an environment variable. Properties win, because a value written into a file was written on purpose; the environment is the fallback, which is what makes a container, a systemd unit or a Kubernetes pod spec able to decide the mechanism without the consumer's code changing at all. That is the whole point of the design: the environment decides, the code does not.

What is deliberately NOT here

CommandExternalTokenProvider.ALLOW_ENV_VARIABLE - the opt-in that permits executing a command - is absent by design and must stay absent. Listing it here would make it settable from a properties file, and a properties file must never be able to make this process spawn another one. It is read from the process environment directly, at the point of use.

  • Enum Constant Details

    • CLIENT_ID

      public static final AuthSetting CLIENT_ID
      The ANKASecure actor UUID. Required by every mechanism.

    • CLIENT_SECRET

      public static final AuthSetting CLIENT_SECRET
      The ANKASecure-issued client secret. The last link of the chain.

    • EXTERNAL_TOKEN

      public static final AuthSetting EXTERNAL_TOKEN
      An externally minted token supplied verbatim.

    • EXTERNAL_TOKEN_FILE

      public static final AuthSetting EXTERNAL_TOKEN_FILE
      A file an external agent writes the current token into.

    • EXTERNAL_TOKEN_COMMAND

      public static final AuthSetting EXTERNAL_TOKEN_COMMAND
      A command that prints the current token to standard output. Gated; see the class javadoc.

    • EXTERNAL_TOKEN_COMMAND_TIMEOUT_MILLIS

      public static final AuthSetting EXTERNAL_TOKEN_COMMAND_TIMEOUT_MILLIS
      How long that command may take, in milliseconds. Clamped to a bounded range.

    • EXTERNAL_ISSUER

      public static final AuthSetting EXTERNAL_ISSUER
      The workload's OWN authorization server, as an https origin and path.

      Its presence is what constitutes the client-credentials credential, and it is the only one of the five the chain reads to decide that: deciding WHICH credential a deployment uses must not require producing the secret.

      It is also the one setting in this enum that names a host this SDK will contact, so it is screened before anything dials it - see ExternalIssuerAdmission.

    • EXTERNAL_CLIENT_ID

      public static final AuthSetting EXTERNAL_CLIENT_ID
      The client id registered at that external authorization server.

      A different value on a different hop from CLIENT_ID, which stays the ANKASecure actor UUID. The two are never conflated and never substitute for one another.

    • EXTERNAL_CLIENT_SECRET

      public static final AuthSetting EXTERNAL_CLIENT_SECRET
      The client secret for that registration - the workload's own credential at its own issuer, never anything of ANKASecure's.

      Read through AuthSettings.secret(AuthSetting) as SecretChars and never through AuthSettings.value(AuthSetting): the value path materialises a String, and a String cannot be zeroized.

    • EXTERNAL_AUDIENCE

      public static final AuthSetting EXTERNAL_AUDIENCE
      The audience the external authorization server must mint the token for.

      Deliberately NOT EXPECTED_AUDIENCE. That one is the audience the deployment returned when a key pair was registered, derived for the deployment; this one is the value the external server needs in order to issue a token ANKASecure will accept. On a tenant-scoped issuer the two are measurably different values, so one key holding both would be right for one link and wrong for the other.

      Optional, and it is the pair with EXTERNAL_SCOPE that is required: the two are the two spellings of one question, and which one an authorization server understands is that server's design. audience is a vendor extension rather than an RFC 6749 §4.4 parameter, and a server that derives the audience from scope has no audience parameter to receive it - so demanding this key would make such a deployment invent a value that is then POSTed to an endpoint which discards it. A configuration carrying NEITHER is refused locally, naming both keys.

    • EXTERNAL_SCOPE

      public static final AuthSetting EXTERNAL_SCOPE
      The scope to request from the external authorization server, when it needs one.

      Optional, and optional is the whole point: audience is an Auth0 extension rather than an RFC 6749 §4.4 parameter, and Entra derives the audience from scope=<resource>/.default instead. Demanding both would refuse the Auth0 shape; offering neither would work against Auth0 alone.

      Requesting a scope in order to obtain the right audience derives no authorization from one: what the external server RETURNS still grants nothing here, because ANKASecure authorizes from the bound actor's own scopes and grants.

    • ACTOR_KEY_FILE

      public static final AuthSetting ACTOR_KEY_FILE
      A private JWK file for the registered key pair.

    • EXPECTED_AUDIENCE

      public static final AuthSetting EXPECTED_AUDIENCE
      The audience the deployment returned when that key pair was registered.

    • TENANT

      public static final AuthSetting TENANT
      The tenant this session belongs to.

      Carried for the grants whose wire contract accepts it and for diagnostics. It is NOT sent on a machine credential: on that path the platform derives the tenant from the actor itself, so a client supplying one would be asserting a value it does not own.

  • Method Details

    • values

      public static AuthSetting[] values()
      Returns an array containing the constants of this enum class, in the order they are declared.
      Returns:
      an array containing the constants of this enum class, in the order they are declared

    • valueOf

      public static AuthSetting valueOf(String name)
      Returns the enum constant of this class with the specified name. The string must match exactly an identifier used to declare an enum constant in this class. (Extraneous whitespace characters are not permitted.)
      Parameters:
      name - the name of the enum constant to be returned.
      Returns:
      the enum constant with the specified name
      Throws:
      IllegalArgumentException - if this enum class has no constant with the specified name
      NullPointerException - if the argument is null

    • propertyKey

      public String propertyKey()
      The key this setting answers to in a properties file.
      Returns:
      the key; never null

    • environmentVariable

      public String environmentVariable()
      The environment variable this setting answers to.
      Returns:
      the variable name; never null