001/*
002 * CDDL HEADER START
003 *
004 * The contents of this file are subject to the terms of the
005 * Common Development and Distribution License, Version 1.0 only
006 * (the "License").  You may not use this file except in compliance
007 * with the License.
008 *
009 * You can obtain a copy of the license at legal-notices/CDDLv1_0.txt
010 * or http://forgerock.org/license/CDDLv1.0.html.
011 * See the License for the specific language governing permissions
012 * and limitations under the License.
013 *
014 * When distributing Covered Code, include this CDDL HEADER in each
015 * file and include the License file at legal-notices/CDDLv1_0.txt.
016 * If applicable, add the following below this CDDL HEADER, with the
017 * fields enclosed by brackets "[]" replaced with your own identifying
018 * information:
019 *      Portions Copyright [yyyy] [name of copyright owner]
020 *
021 * CDDL HEADER END
022 *
023 *
024 *      Copyright 2008 Sun Microsystems, Inc.
025 */
026package org.opends.server.admin.std.client;
027
028
029
030import java.net.InetAddress;
031import java.util.Collection;
032import java.util.SortedSet;
033import org.opends.server.admin.ManagedObjectDefinition;
034import org.opends.server.admin.PropertyException;
035import org.opends.server.admin.std.meta.LDAPPassThroughAuthenticationPolicyCfgDefn.MappingPolicy;
036import org.opends.server.admin.std.server.LDAPPassThroughAuthenticationPolicyCfg;
037import org.opends.server.types.AttributeType;
038import org.opends.server.types.DN;
039
040
041
042/**
043 * A client-side interface for reading and modifying LDAP Pass Through
044 * Authentication Policy settings.
045 * <p>
046 * An authentication policy for users whose credentials are managed by
047 * a remote LDAP directory service.
048 */
049public interface LDAPPassThroughAuthenticationPolicyCfgClient extends AuthenticationPolicyCfgClient {
050
051  /**
052   * Get the configuration definition associated with this LDAP Pass Through Authentication Policy.
053   *
054   * @return Returns the configuration definition associated with this LDAP Pass Through Authentication Policy.
055   */
056  ManagedObjectDefinition<? extends LDAPPassThroughAuthenticationPolicyCfgClient, ? extends LDAPPassThroughAuthenticationPolicyCfg> definition();
057
058
059
060  /**
061   * Gets the "cached-password-storage-scheme" property.
062   * <p>
063   * Specifies the name of a password storage scheme which should be
064   * used for encoding cached passwords.
065   * <p>
066   * Changing the password storage scheme will cause all existing
067   * cached passwords to be discarded.
068   *
069   * @return Returns the value of the "cached-password-storage-scheme" property.
070   */
071  String getCachedPasswordStorageScheme();
072
073
074
075  /**
076   * Sets the "cached-password-storage-scheme" property.
077   * <p>
078   * Specifies the name of a password storage scheme which should be
079   * used for encoding cached passwords.
080   * <p>
081   * Changing the password storage scheme will cause all existing
082   * cached passwords to be discarded.
083   *
084   * @param value The value of the "cached-password-storage-scheme" property.
085   * @throws PropertyException
086   *           If the new value is invalid.
087   */
088  void setCachedPasswordStorageScheme(String value) throws PropertyException;
089
090
091
092  /**
093   * Gets the "cached-password-ttl" property.
094   * <p>
095   * Specifies the maximum length of time that a locally cached
096   * password may be used for authentication before it is refreshed
097   * from the remote LDAP service.
098   * <p>
099   * This property represents a cache timeout. Increasing the timeout
100   * period decreases the frequency that bind operations are delegated
101   * to the remote LDAP service, but increases the risk of users
102   * authenticating using stale passwords. Note that authentication
103   * attempts which fail because the provided password does not match
104   * the locally cached password will always be retried against the
105   * remote LDAP service.
106   *
107   * @return Returns the value of the "cached-password-ttl" property.
108   */
109  long getCachedPasswordTTL();
110
111
112
113  /**
114   * Sets the "cached-password-ttl" property.
115   * <p>
116   * Specifies the maximum length of time that a locally cached
117   * password may be used for authentication before it is refreshed
118   * from the remote LDAP service.
119   * <p>
120   * This property represents a cache timeout. Increasing the timeout
121   * period decreases the frequency that bind operations are delegated
122   * to the remote LDAP service, but increases the risk of users
123   * authenticating using stale passwords. Note that authentication
124   * attempts which fail because the provided password does not match
125   * the locally cached password will always be retried against the
126   * remote LDAP service.
127   *
128   * @param value The value of the "cached-password-ttl" property.
129   * @throws PropertyException
130   *           If the new value is invalid.
131   */
132  void setCachedPasswordTTL(Long value) throws PropertyException;
133
134
135
136  /**
137   * Gets the "connection-timeout" property.
138   * <p>
139   * Specifies the timeout used when connecting to remote LDAP
140   * directory servers, performing SSL negotiation, and for individual
141   * search and bind requests.
142   * <p>
143   * If the timeout expires then the current operation will be aborted
144   * and retried against another LDAP server if one is available.
145   *
146   * @return Returns the value of the "connection-timeout" property.
147   */
148  long getConnectionTimeout();
149
150
151
152  /**
153   * Sets the "connection-timeout" property.
154   * <p>
155   * Specifies the timeout used when connecting to remote LDAP
156   * directory servers, performing SSL negotiation, and for individual
157   * search and bind requests.
158   * <p>
159   * If the timeout expires then the current operation will be aborted
160   * and retried against another LDAP server if one is available.
161   *
162   * @param value The value of the "connection-timeout" property.
163   * @throws PropertyException
164   *           If the new value is invalid.
165   */
166  void setConnectionTimeout(Long value) throws PropertyException;
167
168
169
170  /**
171   * Gets the "java-class" property.
172   * <p>
173   * Specifies the fully-qualified name of the Java class which
174   * provides the LDAP Pass Through Authentication Policy
175   * implementation.
176   *
177   * @return Returns the value of the "java-class" property.
178   */
179  String getJavaClass();
180
181
182
183  /**
184   * Sets the "java-class" property.
185   * <p>
186   * Specifies the fully-qualified name of the Java class which
187   * provides the LDAP Pass Through Authentication Policy
188   * implementation.
189   *
190   * @param value The value of the "java-class" property.
191   * @throws PropertyException
192   *           If the new value is invalid.
193   */
194  void setJavaClass(String value) throws PropertyException;
195
196
197
198  /**
199   * Gets the "mapped-attribute" property.
200   * <p>
201   * Specifies one or more attributes in the user's entry whose
202   * value(s) will determine the bind DN used when authenticating to
203   * the remote LDAP directory service. This property is mandatory when
204   * using the "mapped-bind" or "mapped-search" mapping policies.
205   * <p>
206   * At least one value must be provided. All values must refer to the
207   * name or OID of an attribute type defined in the directory server
208   * schema. At least one of the named attributes must exist in a
209   * user's local entry in order for authentication to proceed. When
210   * multiple attributes or values are found in the user's entry then
211   * the behavior is determined by the mapping policy.
212   *
213   * @return Returns the values of the "mapped-attribute" property.
214   */
215  SortedSet<AttributeType> getMappedAttribute();
216
217
218
219  /**
220   * Sets the "mapped-attribute" property.
221   * <p>
222   * Specifies one or more attributes in the user's entry whose
223   * value(s) will determine the bind DN used when authenticating to
224   * the remote LDAP directory service. This property is mandatory when
225   * using the "mapped-bind" or "mapped-search" mapping policies.
226   * <p>
227   * At least one value must be provided. All values must refer to the
228   * name or OID of an attribute type defined in the directory server
229   * schema. At least one of the named attributes must exist in a
230   * user's local entry in order for authentication to proceed. When
231   * multiple attributes or values are found in the user's entry then
232   * the behavior is determined by the mapping policy.
233   *
234   * @param values The values of the "mapped-attribute" property.
235   * @throws PropertyException
236   *           If one or more of the new values are invalid.
237   */
238  void setMappedAttribute(Collection<AttributeType> values) throws PropertyException;
239
240
241
242  /**
243   * Gets the "mapped-search-base-dn" property.
244   * <p>
245   * Specifies the set of base DNs below which to search for users in
246   * the remote LDAP directory service. This property is mandatory when
247   * using the "mapped-search" mapping policy.
248   * <p>
249   * If multiple values are given, searches are performed below all
250   * specified base DNs.
251   *
252   * @return Returns the values of the "mapped-search-base-dn" property.
253   */
254  SortedSet<DN> getMappedSearchBaseDN();
255
256
257
258  /**
259   * Sets the "mapped-search-base-dn" property.
260   * <p>
261   * Specifies the set of base DNs below which to search for users in
262   * the remote LDAP directory service. This property is mandatory when
263   * using the "mapped-search" mapping policy.
264   * <p>
265   * If multiple values are given, searches are performed below all
266   * specified base DNs.
267   *
268   * @param values The values of the "mapped-search-base-dn" property.
269   * @throws PropertyException
270   *           If one or more of the new values are invalid.
271   */
272  void setMappedSearchBaseDN(Collection<DN> values) throws PropertyException;
273
274
275
276  /**
277   * Gets the "mapped-search-bind-dn" property.
278   * <p>
279   * Specifies the bind DN which should be used to perform user
280   * searches in the remote LDAP directory service.
281   *
282   * @return Returns the value of the "mapped-search-bind-dn" property.
283   */
284  DN getMappedSearchBindDN();
285
286
287
288  /**
289   * Sets the "mapped-search-bind-dn" property.
290   * <p>
291   * Specifies the bind DN which should be used to perform user
292   * searches in the remote LDAP directory service.
293   *
294   * @param value The value of the "mapped-search-bind-dn" property.
295   * @throws PropertyException
296   *           If the new value is invalid.
297   */
298  void setMappedSearchBindDN(DN value) throws PropertyException;
299
300
301
302  /**
303   * Gets the "mapped-search-bind-password" property.
304   * <p>
305   * Specifies the bind password which should be used to perform user
306   * searches in the remote LDAP directory service.
307   *
308   * @return Returns the value of the "mapped-search-bind-password" property.
309   */
310  String getMappedSearchBindPassword();
311
312
313
314  /**
315   * Sets the "mapped-search-bind-password" property.
316   * <p>
317   * Specifies the bind password which should be used to perform user
318   * searches in the remote LDAP directory service.
319   *
320   * @param value The value of the "mapped-search-bind-password" property.
321   * @throws PropertyException
322   *           If the new value is invalid.
323   */
324  void setMappedSearchBindPassword(String value) throws PropertyException;
325
326
327
328  /**
329   * Gets the "mapped-search-bind-password-environment-variable" property.
330   * <p>
331   * Specifies the name of an environment variable containing the bind
332   * password which should be used to perform user searches in the
333   * remote LDAP directory service.
334   *
335   * @return Returns the value of the "mapped-search-bind-password-environment-variable" property.
336   */
337  String getMappedSearchBindPasswordEnvironmentVariable();
338
339
340
341  /**
342   * Sets the "mapped-search-bind-password-environment-variable" property.
343   * <p>
344   * Specifies the name of an environment variable containing the bind
345   * password which should be used to perform user searches in the
346   * remote LDAP directory service.
347   *
348   * @param value The value of the "mapped-search-bind-password-environment-variable" property.
349   * @throws PropertyException
350   *           If the new value is invalid.
351   */
352  void setMappedSearchBindPasswordEnvironmentVariable(String value) throws PropertyException;
353
354
355
356  /**
357   * Gets the "mapped-search-bind-password-file" property.
358   * <p>
359   * Specifies the name of a file containing the bind password which
360   * should be used to perform user searches in the remote LDAP
361   * directory service.
362   *
363   * @return Returns the value of the "mapped-search-bind-password-file" property.
364   */
365  String getMappedSearchBindPasswordFile();
366
367
368
369  /**
370   * Sets the "mapped-search-bind-password-file" property.
371   * <p>
372   * Specifies the name of a file containing the bind password which
373   * should be used to perform user searches in the remote LDAP
374   * directory service.
375   *
376   * @param value The value of the "mapped-search-bind-password-file" property.
377   * @throws PropertyException
378   *           If the new value is invalid.
379   */
380  void setMappedSearchBindPasswordFile(String value) throws PropertyException;
381
382
383
384  /**
385   * Gets the "mapped-search-bind-password-property" property.
386   * <p>
387   * Specifies the name of a Java property containing the bind
388   * password which should be used to perform user searches in the
389   * remote LDAP directory service.
390   *
391   * @return Returns the value of the "mapped-search-bind-password-property" property.
392   */
393  String getMappedSearchBindPasswordProperty();
394
395
396
397  /**
398   * Sets the "mapped-search-bind-password-property" property.
399   * <p>
400   * Specifies the name of a Java property containing the bind
401   * password which should be used to perform user searches in the
402   * remote LDAP directory service.
403   *
404   * @param value The value of the "mapped-search-bind-password-property" property.
405   * @throws PropertyException
406   *           If the new value is invalid.
407   */
408  void setMappedSearchBindPasswordProperty(String value) throws PropertyException;
409
410
411
412  /**
413   * Gets the "mapping-policy" property.
414   * <p>
415   * Specifies the mapping algorithm for obtaining the bind DN from
416   * the user's entry.
417   *
418   * @return Returns the value of the "mapping-policy" property.
419   */
420  MappingPolicy getMappingPolicy();
421
422
423
424  /**
425   * Sets the "mapping-policy" property.
426   * <p>
427   * Specifies the mapping algorithm for obtaining the bind DN from
428   * the user's entry.
429   *
430   * @param value The value of the "mapping-policy" property.
431   * @throws PropertyException
432   *           If the new value is invalid.
433   */
434  void setMappingPolicy(MappingPolicy value) throws PropertyException;
435
436
437
438  /**
439   * Gets the "primary-remote-ldap-server" property.
440   * <p>
441   * Specifies the primary list of remote LDAP servers which should be
442   * used for pass through authentication.
443   * <p>
444   * If more than one LDAP server is specified then operations may be
445   * distributed across them. If all of the primary LDAP servers are
446   * unavailable then operations will fail-over to the set of secondary
447   * LDAP servers, if defined.
448   *
449   * @return Returns the values of the "primary-remote-ldap-server" property.
450   */
451  SortedSet<String> getPrimaryRemoteLDAPServer();
452
453
454
455  /**
456   * Sets the "primary-remote-ldap-server" property.
457   * <p>
458   * Specifies the primary list of remote LDAP servers which should be
459   * used for pass through authentication.
460   * <p>
461   * If more than one LDAP server is specified then operations may be
462   * distributed across them. If all of the primary LDAP servers are
463   * unavailable then operations will fail-over to the set of secondary
464   * LDAP servers, if defined.
465   *
466   * @param values The values of the "primary-remote-ldap-server" property.
467   * @throws PropertyException
468   *           If one or more of the new values are invalid.
469   */
470  void setPrimaryRemoteLDAPServer(Collection<String> values) throws PropertyException;
471
472
473
474  /**
475   * Gets the "secondary-remote-ldap-server" property.
476   * <p>
477   * Specifies the secondary list of remote LDAP servers which should
478   * be used for pass through authentication in the event that the
479   * primary LDAP servers are unavailable.
480   * <p>
481   * If more than one LDAP server is specified then operations may be
482   * distributed across them. Operations will be rerouted to the
483   * primary LDAP servers as soon as they are determined to be
484   * available.
485   *
486   * @return Returns the values of the "secondary-remote-ldap-server" property.
487   */
488  SortedSet<String> getSecondaryRemoteLDAPServer();
489
490
491
492  /**
493   * Sets the "secondary-remote-ldap-server" property.
494   * <p>
495   * Specifies the secondary list of remote LDAP servers which should
496   * be used for pass through authentication in the event that the
497   * primary LDAP servers are unavailable.
498   * <p>
499   * If more than one LDAP server is specified then operations may be
500   * distributed across them. Operations will be rerouted to the
501   * primary LDAP servers as soon as they are determined to be
502   * available.
503   *
504   * @param values The values of the "secondary-remote-ldap-server" property.
505   * @throws PropertyException
506   *           If one or more of the new values are invalid.
507   */
508  void setSecondaryRemoteLDAPServer(Collection<String> values) throws PropertyException;
509
510
511
512  /**
513   * Gets the "source-address" property.
514   * <p>
515   * If specified, the server will bind to the address before
516   * connecting to the remote server.
517   * <p>
518   * The address must be one assigned to an existing network
519   * interface.
520   *
521   * @return Returns the value of the "source-address" property.
522   */
523  InetAddress getSourceAddress();
524
525
526
527  /**
528   * Sets the "source-address" property.
529   * <p>
530   * If specified, the server will bind to the address before
531   * connecting to the remote server.
532   * <p>
533   * The address must be one assigned to an existing network
534   * interface.
535   *
536   * @param value The value of the "source-address" property.
537   * @throws PropertyException
538   *           If the new value is invalid.
539   */
540  void setSourceAddress(InetAddress value) throws PropertyException;
541
542
543
544  /**
545   * Gets the "ssl-cipher-suite" property.
546   * <p>
547   * Specifies the names of the SSL cipher suites that are allowed for
548   * use in SSL based LDAP connections.
549   *
550   * @return Returns the values of the "ssl-cipher-suite" property.
551   */
552  SortedSet<String> getSSLCipherSuite();
553
554
555
556  /**
557   * Sets the "ssl-cipher-suite" property.
558   * <p>
559   * Specifies the names of the SSL cipher suites that are allowed for
560   * use in SSL based LDAP connections.
561   *
562   * @param values The values of the "ssl-cipher-suite" property.
563   * @throws PropertyException
564   *           If one or more of the new values are invalid.
565   */
566  void setSSLCipherSuite(Collection<String> values) throws PropertyException;
567
568
569
570  /**
571   * Gets the "ssl-protocol" property.
572   * <p>
573   * Specifies the names of the SSL protocols which are allowed for
574   * use in SSL based LDAP connections.
575   *
576   * @return Returns the values of the "ssl-protocol" property.
577   */
578  SortedSet<String> getSSLProtocol();
579
580
581
582  /**
583   * Sets the "ssl-protocol" property.
584   * <p>
585   * Specifies the names of the SSL protocols which are allowed for
586   * use in SSL based LDAP connections.
587   *
588   * @param values The values of the "ssl-protocol" property.
589   * @throws PropertyException
590   *           If one or more of the new values are invalid.
591   */
592  void setSSLProtocol(Collection<String> values) throws PropertyException;
593
594
595
596  /**
597   * Gets the "trust-manager-provider" property.
598   * <p>
599   * Specifies the name of the trust manager that should be used when
600   * negotiating SSL connections with remote LDAP directory servers.
601   *
602   * @return Returns the value of the "trust-manager-provider" property.
603   */
604  String getTrustManagerProvider();
605
606
607
608  /**
609   * Sets the "trust-manager-provider" property.
610   * <p>
611   * Specifies the name of the trust manager that should be used when
612   * negotiating SSL connections with remote LDAP directory servers.
613   *
614   * @param value The value of the "trust-manager-provider" property.
615   * @throws PropertyException
616   *           If the new value is invalid.
617   */
618  void setTrustManagerProvider(String value) throws PropertyException;
619
620
621
622  /**
623   * Gets the "use-password-caching" property.
624   * <p>
625   * Indicates whether passwords should be cached locally within the
626   * user's entry.
627   *
628   * @return Returns the value of the "use-password-caching" property.
629   */
630  boolean isUsePasswordCaching();
631
632
633
634  /**
635   * Sets the "use-password-caching" property.
636   * <p>
637   * Indicates whether passwords should be cached locally within the
638   * user's entry.
639   *
640   * @param value The value of the "use-password-caching" property.
641   * @throws PropertyException
642   *           If the new value is invalid.
643   */
644  void setUsePasswordCaching(boolean value) throws PropertyException;
645
646
647
648  /**
649   * Gets the "use-ssl" property.
650   * <p>
651   * Indicates whether the LDAP Pass Through Authentication Policy
652   * should use SSL.
653   * <p>
654   * If enabled, the LDAP Pass Through Authentication Policy will use
655   * SSL to encrypt communication with the clients.
656   *
657   * @return Returns the value of the "use-ssl" property.
658   */
659  boolean isUseSSL();
660
661
662
663  /**
664   * Sets the "use-ssl" property.
665   * <p>
666   * Indicates whether the LDAP Pass Through Authentication Policy
667   * should use SSL.
668   * <p>
669   * If enabled, the LDAP Pass Through Authentication Policy will use
670   * SSL to encrypt communication with the clients.
671   *
672   * @param value The value of the "use-ssl" property.
673   * @throws PropertyException
674   *           If the new value is invalid.
675   */
676  void setUseSSL(Boolean value) throws PropertyException;
677
678
679
680  /**
681   * Gets the "use-tcp-keep-alive" property.
682   * <p>
683   * Indicates whether LDAP connections should use TCP keep-alive.
684   * <p>
685   * If enabled, the SO_KEEPALIVE socket option is used to indicate
686   * that TCP keepalive messages should periodically be sent to the
687   * client to verify that the associated connection is still valid.
688   * This may also help prevent cases in which intermediate network
689   * hardware could silently drop an otherwise idle client connection,
690   * provided that the keepalive interval configured in the underlying
691   * operating system is smaller than the timeout enforced by the
692   * network hardware.
693   *
694   * @return Returns the value of the "use-tcp-keep-alive" property.
695   */
696  boolean isUseTCPKeepAlive();
697
698
699
700  /**
701   * Sets the "use-tcp-keep-alive" property.
702   * <p>
703   * Indicates whether LDAP connections should use TCP keep-alive.
704   * <p>
705   * If enabled, the SO_KEEPALIVE socket option is used to indicate
706   * that TCP keepalive messages should periodically be sent to the
707   * client to verify that the associated connection is still valid.
708   * This may also help prevent cases in which intermediate network
709   * hardware could silently drop an otherwise idle client connection,
710   * provided that the keepalive interval configured in the underlying
711   * operating system is smaller than the timeout enforced by the
712   * network hardware.
713   *
714   * @param value The value of the "use-tcp-keep-alive" property.
715   * @throws PropertyException
716   *           If the new value is invalid.
717   */
718  void setUseTCPKeepAlive(Boolean value) throws PropertyException;
719
720
721
722  /**
723   * Gets the "use-tcp-no-delay" property.
724   * <p>
725   * Indicates whether LDAP connections should use TCP no-delay.
726   * <p>
727   * If enabled, the TCP_NODELAY socket option is used to ensure that
728   * response messages to the client are sent immediately rather than
729   * potentially waiting to determine whether additional response
730   * messages can be sent in the same packet. In most cases, using the
731   * TCP_NODELAY socket option provides better performance and lower
732   * response times, but disabling it may help for some cases in which
733   * the server sends a large number of entries to a client in response
734   * to a search request.
735   *
736   * @return Returns the value of the "use-tcp-no-delay" property.
737   */
738  boolean isUseTCPNoDelay();
739
740
741
742  /**
743   * Sets the "use-tcp-no-delay" property.
744   * <p>
745   * Indicates whether LDAP connections should use TCP no-delay.
746   * <p>
747   * If enabled, the TCP_NODELAY socket option is used to ensure that
748   * response messages to the client are sent immediately rather than
749   * potentially waiting to determine whether additional response
750   * messages can be sent in the same packet. In most cases, using the
751   * TCP_NODELAY socket option provides better performance and lower
752   * response times, but disabling it may help for some cases in which
753   * the server sends a large number of entries to a client in response
754   * to a search request.
755   *
756   * @param value The value of the "use-tcp-no-delay" property.
757   * @throws PropertyException
758   *           If the new value is invalid.
759   */
760  void setUseTCPNoDelay(Boolean value) throws PropertyException;
761
762}