Package co.ankatech.ankasecure.sdk.auth

Enum Class ExternalTokenSourceKind

java.lang.Object
java.lang.Enum<ExternalTokenSourceKind>
co.ankatech.ankasecure.sdk.auth.ExternalTokenSourceKind
All Implemented Interfaces:
Serializable, Comparable<ExternalTokenSourceKind>, Constable
public enum ExternalTokenSourceKind extends Enum<ExternalTokenSourceKind>
Where an externally minted token comes from.

Three of the four kinds READ a token the environment already produced - a value, a file, a command - and mirror the shape Google's Workload Identity Federation settled on for exactly this problem: a local configuration naming the source, with application code identical across all of them. The fourth OBTAINS one, by holding the workload's own credential at the workload's own authorization server and performing the client-credentials grant against it. Google's fourth kind - the URL-sourced credential - is still deliberately NOT reproduced; see TokenSourceChain for the reason that survives.

These are alternatives, not a fallback ladder. Configuring two at once is refused rather than resolved: they are all ways of naming ONE token, and silently preferring one would mean an operator who added a command discovers months later that a stale file was answering all along.

  • Enum Constant Details

    • EXPLICIT_VALUE

      public static final ExternalTokenSourceKind EXPLICIT_VALUE
      The token itself, supplied directly by the consumer or by configuration.

    • FILE

      public static final ExternalTokenSourceKind FILE
      A file an external agent writes and refreshes; the SDK reads it on every mint.

    • COMMAND

      public static final ExternalTokenSourceKind COMMAND
      A command the operator configured, executed to produce a token on stdout.

      This is code execution and is gated behind an explicit environment opt-in that no configuration file can set. See CommandExternalTokenProvider.

    • CLIENT_CREDENTIALS

      public static final ExternalTokenSourceKind CLIENT_CREDENTIALS
      The workload's own client-credentials grant against its own authorization server.

      The only kind that HOLDS a credential - the workload's external client secret - and the only one that opens a connection to a host the ANKASecure configuration does not name. That host is screened before anything dials it and the client is pinned to it; see ExternalIssuerAdmission and ClientCredentialsExternalTokenProvider.

  • Method Details

    • values

      public static ExternalTokenSourceKind[] values()
      Returns an array containing the constants of this enum class, in the order they are declared.
      Returns:
      an array containing the constants of this enum class, in the order they are declared

    • valueOf

      public static ExternalTokenSourceKind valueOf(String name)
      Returns the enum constant of this class with the specified name. The string must match exactly an identifier used to declare an enum constant in this class. (Extraneous whitespace characters are not permitted.)
      Parameters:
      name - the name of the enum constant to be returned.
      Returns:
      the enum constant with the specified name
      Throws:
      IllegalArgumentException - if this enum class has no constant with the specified name
      NullPointerException - if the argument is null