Management API Reference for kerberos-security-factory

A security factory for obtaining a GSSCredential for use during authentication.

Provided Capabilities (1)

Name	Dynamic	Other provider points
org.wildfly.security.security-factory.credential	true	/subsystem=elytron/custom-credential-security-factory=*

Attributes (14)

debug - Should the JAAS step of obtaining the credential have debug logging enabled.

Type	BOOLEAN
Default Value	false
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "Should the JAAS step of obtaining the credential have debug logging enabled.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

fail-cache - Amount of seconds before new try to obtain server credential should be done if it has failed last time.

Type	INT
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "INT" }, "description" : "Amount of seconds before new try to obtain server credential should be done if it has failed last time.", "expressions-allowed" : true, "required" : false, "nillable" : true, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

mechanism-names - The mechanism names the credential should be usable with. Names will be converted to OIDs and used together with OIDs from mechanism-oids attribute.

Type	LIST
Default Value	["KRB5","SPNEGO"]
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Allowed Values	SPNEGO GENERIC KRB5LEGACY KRB5 KRB5V2
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "LIST" }, "description" : "The mechanism names the credential should be usable with. Names will be converted to OIDs and used together with OIDs from mechanism-oids attribute.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : [ "KRB5", "SPNEGO" ], "min-length" : 1, "max-length" : 5, "allowed" : [ "KRB5LEGACY", "GENERIC", "KRB5", "KRB5V2", "SPNEGO" ], "stability" : "default", "value-type" : { "TYPE_MODEL_VALUE" : "STRING" }, "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }

mechanism-oids - The mechanism OIDs the credential should be usable with. Will be used together with OIDs derived from names from mechanism-names attribute.

Type	LIST
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "LIST" }, "description" : "The mechanism OIDs the credential should be usable with. Will be used together with OIDs derived from names from mechanism-names attribute.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 0, "max-length" : 2147483647, "stability" : "default", "value-type" : { "TYPE_MODEL_VALUE" : "STRING" }, "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }

minimum-remaining-lifetime - How much lifetime (in seconds) should a cached credential have remaining before it is recreated.

Type	INT
Default Value	0
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "INT" }, "description" : "How much lifetime (in seconds) should a cached credential have remaining before it is recreated.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : 0, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

obtain-kerberos-ticket - Should the KerberosTicket also be obtained and associated with the credential. This is required to be true where credentials are delegated to the server.

Type	BOOLEAN
Default Value	false
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "Should the KerberosTicket also be obtained and associated with the credential. This is required to be true where credentials are delegated to the server.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

options - The Krb5LoginModule additional options.

Type	OBJECT
Is the attribute nillable?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "OBJECT" }, "description" : "The Krb5LoginModule additional options.", "expressions-allowed" : false, "required" : false, "nillable" : true, "stability" : "default", "value-type" : { "TYPE_MODEL_VALUE" : "STRING" }, "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

path - The path of the KeyTab to load to obtain the credential.

Type	STRING
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The path of the KeyTab to load to obtain the credential.", "attribute-group" : "file", "expressions-allowed" : true, "required" : true, "nillable" : false, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

principal - The principal represented by the KeyTab

Type	STRING
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The principal represented by the KeyTab", "expressions-allowed" : true, "required" : true, "nillable" : false, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

relative-to - The name of another previously named path, or of one of the standard paths provided by the system. If 'relative-to' is provided, the value of the 'path' attribute is treated as relative to the path specified by this attribute.

Type	STRING
Is the attribute nillable?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The name of another previously named path, or of one of the standard paths provided by the system. If 'relative-to' is provided, the value of the 'path' attribute is treated as relative to the path specified by this attribute.", "attribute-group" : "file", "expressions-allowed" : false, "required" : false, "nillable" : true, "requires" : ["path"], "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }

request-lifetime - How much lifetime (in seconds) should be requested for newly created credentials.

Type	INT
Default Value	2147483647
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "INT" }, "description" : "How much lifetime (in seconds) should be requested for newly created credentials.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

required - Is the keytab file with adequate principal required to exist at the time the service starts?

Type	BOOLEAN
Default Value	false
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "Is the keytab file with adequate principal required to exist at the time the service starts?", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

server - If this for use server side or client side?

Type	BOOLEAN
Default Value	true
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "If this for use server side or client side?", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : true, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

wrap-gss-credential - Should generated GSS credentials be wrapped to prevent improper disposal or not?

Type	BOOLEAN
Default Value	false
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	all-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "Should generated GSS credentials be wrapped to prevent improper disposal or not?", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "all-services", "capability-reference" : null }`

Operations (2)

add - The add operation for the Kerberos SecurityFactory

Request Parameter	Type	Required	Expressions Allowed	Default value	Description
debug	BOOLEAN	false	true	false	Should the JAAS step of obtaining the credential have debug logging enabled.
fail-cache	INT	false	true		Amount of seconds before new try to obtain server credential should be done if it has failed last time.
mechanism-names	LIST	false	true	["KRB5","SPNEGO"]	The mechanism names the credential should be usable with. Names will be converted to OIDs and used together with OIDs from mechanism-oids attribute.
mechanism-oids	LIST	false	true		The mechanism OIDs the credential should be usable with. Will be used together with OIDs derived from names from mechanism-names attribute.
minimum-remaining-lifetime	INT	false	true	0	How much lifetime (in seconds) should a cached credential have remaining before it is recreated.
obtain-kerberos-ticket	BOOLEAN	false	true	false	Should the KerberosTicket also be obtained and associated with the credential. This is required to be true where credentials are delegated to the server.
options	OBJECT	false	false		The Krb5LoginModule additional options.
principal	STRING	true	true		The principal represented by the KeyTab
request-lifetime	INT	false	true	2147483647	How much lifetime (in seconds) should be requested for newly created credentials.
required	BOOLEAN	false	true	false	Is the keytab file with adequate principal required to exist at the time the service starts?
server	BOOLEAN	false	true	true	If this for use server side or client side?
wrap-gss-credential	BOOLEAN	false	true	false	Should generated GSS credentials be wrapped to prevent improper disposal or not?
path	STRING	true	true		The path of the KeyTab to load to obtain the credential.
relative-to	STRING	false	false		The name of another previously named path, or of one of the standard paths provided by the system. If 'relative-to' is provided, the value of the 'path' attribute is treated as relative to the path specified by this attribute.

Raw DMR model


{
    "operation-name" : "add",
    "description" : "The add operation for the Kerberos SecurityFactory",
    "request-properties" : {
        "debug" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "Should the JAAS step of obtaining the credential have debug logging enabled.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : false,
            "stability" : "default"
        },
        "fail-cache" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "INT"
            },
            "description" : "Amount of seconds before new try to obtain server credential should be done if it has failed last time.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "stability" : "default"
        },
        "mechanism-names" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "LIST"
            },
            "description" : "The mechanism names the credential should be usable with. Names will be converted to OIDs and used together with OIDs from mechanism-oids attribute.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : [
                "KRB5",
                "SPNEGO"
            ],
            "min-length" : 1,
            "max-length" : 5,
            "allowed" : [
                "KRB5LEGACY",
                "GENERIC",
                "KRB5",
                "KRB5V2",
                "SPNEGO"
            ],
            "stability" : "default",
            "value-type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            }
        },
        "mechanism-oids" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "LIST"
            },
            "description" : "The mechanism OIDs the credential should be usable with. Will be used together with OIDs derived from names from mechanism-names attribute.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 0,
            "max-length" : 2147483647,
            "stability" : "default",
            "value-type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            }
        },
        "minimum-remaining-lifetime" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "INT"
            },
            "description" : "How much lifetime (in seconds) should a cached credential have remaining before it is recreated.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : 0,
            "stability" : "default"
        },
        "obtain-kerberos-ticket" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "Should the KerberosTicket also be obtained and associated with the credential. This is required to be true where credentials are delegated to the server.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : false,
            "stability" : "default"
        },
        "options" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "OBJECT"
            },
            "description" : "The Krb5LoginModule additional options.",
            "expressions-allowed" : false,
            "required" : false,
            "nillable" : true,
            "stability" : "default",
            "value-type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            }
        },
        "principal" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The principal represented by the KeyTab",
            "expressions-allowed" : true,
            "required" : true,
            "nillable" : false,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "request-lifetime" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "INT"
            },
            "description" : "How much lifetime (in seconds) should be requested for newly created credentials.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : 2147483647,
            "stability" : "default"
        },
        "required" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "Is the keytab file with adequate principal required to exist at the time the service starts?",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : false,
            "stability" : "default"
        },
        "server" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "If this for use server side or client side?",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : true,
            "stability" : "default"
        },
        "wrap-gss-credential" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "Should generated GSS credentials be wrapped to prevent improper disposal or not?",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : false,
            "stability" : "default"
        },
        "path" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The path of the KeyTab to load to obtain the credential.",
            "expressions-allowed" : true,
            "required" : true,
            "nillable" : false,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "relative-to" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The name of another previously named path, or of one of the standard paths provided by the system. If 'relative-to' is provided, the value of the 'path' attribute is treated as relative to the path specified by this attribute.",
            "expressions-allowed" : false,
            "required" : false,
            "nillable" : true,
            "requires" : ["path"],
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        }
    },
    "reply-properties" : {},
    "stability" : "default",
    "read-only" : false,
    "restart-required" : "resource-services",
    "runtime-only" : false
}

remove - The remove operation for the Kerberos SecurityFactory

Raw DMR model


{
    "operation-name" : "remove",
    "description" : "The remove operation for the Kerberos SecurityFactory",
    "request-properties" : {},
    "reply-properties" : {},
    "stability" : "default",
    "read-only" : false,
    "restart-required" : "resource-services",
    "runtime-only" : false
}

Galleon Features

Galleon features are to be used when creating Galleon feature-packs.

subsystem.elytron.kerberos-security-factory

        
<feature spec="subsystem.elytron.kerberos-security-factory">
  <param name="kerberos-security-factory" value="{resource name}"/>
  <param name="debug" value="{value}"/>
  <param name="fail-cache" value="{value}"/>
  <param name="mechanism-names" value="{value}"/>
  <param name="mechanism-oids" value="{value}"/>
  <param name="minimum-remaining-lifetime" value="{value}"/>
  <param name="obtain-kerberos-ticket" value="{value}"/>
  <param name="options" value="{value}"/>
  <param name="path" value="{value}"/>
  <param name="principal" value="{value}"/>
  <param name="relative-to" value="{value}"/>
  <param name="request-lifetime" value="{value}"/>
  <param name="required" value="{value}"/>
  <param name="server" value="{value}"/>
  <param name="wrap-gss-credential" value="{value}"/>
<feature/>