001/*
002 * The contents of this file are subject to the terms of the Common Development and
003 * Distribution License (the License). You may not use this file except in compliance with the
004 * License.
005 *
006 * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
007 * specific language governing permission and limitations under the License.
008 *
009 * When distributing Covered Software, include this CDDL Header Notice in each file and include
010 * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
011 * Header, with the fields enclosed by brackets [] replaced by your own identifying
012 * information: "Portions Copyright [year] [name of copyright owner]".
013 *
014 * Copyright 2008 Sun Microsystems, Inc.
015 */
016package org.opends.server.admin.std.client;
017
018
019
020import java.net.InetAddress;
021import java.util.Collection;
022import java.util.SortedSet;
023import org.forgerock.opendj.ldap.DN;
024import org.forgerock.opendj.ldap.schema.AttributeType;
025import org.opends.server.admin.ManagedObjectDefinition;
026import org.opends.server.admin.PropertyException;
027import org.opends.server.admin.std.meta.LDAPPassThroughAuthenticationPolicyCfgDefn.MappingPolicy;
028import org.opends.server.admin.std.server.LDAPPassThroughAuthenticationPolicyCfg;
029
030
031
032/**
033 * A client-side interface for reading and modifying LDAP Pass Through
034 * Authentication Policy settings.
035 * <p>
036 * An authentication policy for users whose credentials are managed by
037 * a remote LDAP directory service.
038 */
039public interface LDAPPassThroughAuthenticationPolicyCfgClient extends AuthenticationPolicyCfgClient {
040
041  /**
042   * Get the configuration definition associated with this LDAP Pass Through Authentication Policy.
043   *
044   * @return Returns the configuration definition associated with this LDAP Pass Through Authentication Policy.
045   */
046  ManagedObjectDefinition<? extends LDAPPassThroughAuthenticationPolicyCfgClient, ? extends LDAPPassThroughAuthenticationPolicyCfg> definition();
047
048
049
050  /**
051   * Gets the "cached-password-storage-scheme" property.
052   * <p>
053   * Specifies the name of a password storage scheme which should be
054   * used for encoding cached passwords.
055   * <p>
056   * Changing the password storage scheme will cause all existing
057   * cached passwords to be discarded.
058   *
059   * @return Returns the value of the "cached-password-storage-scheme" property.
060   */
061  String getCachedPasswordStorageScheme();
062
063
064
065  /**
066   * Sets the "cached-password-storage-scheme" property.
067   * <p>
068   * Specifies the name of a password storage scheme which should be
069   * used for encoding cached passwords.
070   * <p>
071   * Changing the password storage scheme will cause all existing
072   * cached passwords to be discarded.
073   *
074   * @param value The value of the "cached-password-storage-scheme" property.
075   * @throws PropertyException
076   *           If the new value is invalid.
077   */
078  void setCachedPasswordStorageScheme(String value) throws PropertyException;
079
080
081
082  /**
083   * Gets the "cached-password-ttl" property.
084   * <p>
085   * Specifies the maximum length of time that a locally cached
086   * password may be used for authentication before it is refreshed
087   * from the remote LDAP service.
088   * <p>
089   * This property represents a cache timeout. Increasing the timeout
090   * period decreases the frequency that bind operations are delegated
091   * to the remote LDAP service, but increases the risk of users
092   * authenticating using stale passwords. Note that authentication
093   * attempts which fail because the provided password does not match
094   * the locally cached password will always be retried against the
095   * remote LDAP service.
096   *
097   * @return Returns the value of the "cached-password-ttl" property.
098   */
099  long getCachedPasswordTTL();
100
101
102
103  /**
104   * Sets the "cached-password-ttl" property.
105   * <p>
106   * Specifies the maximum length of time that a locally cached
107   * password may be used for authentication before it is refreshed
108   * from the remote LDAP service.
109   * <p>
110   * This property represents a cache timeout. Increasing the timeout
111   * period decreases the frequency that bind operations are delegated
112   * to the remote LDAP service, but increases the risk of users
113   * authenticating using stale passwords. Note that authentication
114   * attempts which fail because the provided password does not match
115   * the locally cached password will always be retried against the
116   * remote LDAP service.
117   *
118   * @param value The value of the "cached-password-ttl" property.
119   * @throws PropertyException
120   *           If the new value is invalid.
121   */
122  void setCachedPasswordTTL(Long value) throws PropertyException;
123
124
125
126  /**
127   * Gets the "connection-timeout" property.
128   * <p>
129   * Specifies the timeout used when connecting to remote LDAP
130   * directory servers, performing SSL negotiation, and for individual
131   * search and bind requests.
132   * <p>
133   * If the timeout expires then the current operation will be aborted
134   * and retried against another LDAP server if one is available.
135   *
136   * @return Returns the value of the "connection-timeout" property.
137   */
138  long getConnectionTimeout();
139
140
141
142  /**
143   * Sets the "connection-timeout" property.
144   * <p>
145   * Specifies the timeout used when connecting to remote LDAP
146   * directory servers, performing SSL negotiation, and for individual
147   * search and bind requests.
148   * <p>
149   * If the timeout expires then the current operation will be aborted
150   * and retried against another LDAP server if one is available.
151   *
152   * @param value The value of the "connection-timeout" property.
153   * @throws PropertyException
154   *           If the new value is invalid.
155   */
156  void setConnectionTimeout(Long value) throws PropertyException;
157
158
159
160  /**
161   * Gets the "java-class" property.
162   * <p>
163   * Specifies the fully-qualified name of the Java class which
164   * provides the LDAP Pass Through Authentication Policy
165   * implementation.
166   *
167   * @return Returns the value of the "java-class" property.
168   */
169  String getJavaClass();
170
171
172
173  /**
174   * Sets the "java-class" property.
175   * <p>
176   * Specifies the fully-qualified name of the Java class which
177   * provides the LDAP Pass Through Authentication Policy
178   * implementation.
179   *
180   * @param value The value of the "java-class" property.
181   * @throws PropertyException
182   *           If the new value is invalid.
183   */
184  void setJavaClass(String value) throws PropertyException;
185
186
187
188  /**
189   * Gets the "mapped-attribute" property.
190   * <p>
191   * Specifies one or more attributes in the user's entry whose
192   * value(s) will determine the bind DN used when authenticating to
193   * the remote LDAP directory service. This property is mandatory when
194   * using the "mapped-bind" or "mapped-search" mapping policies.
195   * <p>
196   * At least one value must be provided. All values must refer to the
197   * name or OID of an attribute type defined in the directory server
198   * schema. At least one of the named attributes must exist in a
199   * user's local entry in order for authentication to proceed. When
200   * multiple attributes or values are found in the user's entry then
201   * the behavior is determined by the mapping policy.
202   *
203   * @return Returns the values of the "mapped-attribute" property.
204   */
205  SortedSet<AttributeType> getMappedAttribute();
206
207
208
209  /**
210   * Sets the "mapped-attribute" property.
211   * <p>
212   * Specifies one or more attributes in the user's entry whose
213   * value(s) will determine the bind DN used when authenticating to
214   * the remote LDAP directory service. This property is mandatory when
215   * using the "mapped-bind" or "mapped-search" mapping policies.
216   * <p>
217   * At least one value must be provided. All values must refer to the
218   * name or OID of an attribute type defined in the directory server
219   * schema. At least one of the named attributes must exist in a
220   * user's local entry in order for authentication to proceed. When
221   * multiple attributes or values are found in the user's entry then
222   * the behavior is determined by the mapping policy.
223   *
224   * @param values The values of the "mapped-attribute" property.
225   * @throws PropertyException
226   *           If one or more of the new values are invalid.
227   */
228  void setMappedAttribute(Collection<AttributeType> values) throws PropertyException;
229
230
231
232  /**
233   * Gets the "mapped-search-base-dn" property.
234   * <p>
235   * Specifies the set of base DNs below which to search for users in
236   * the remote LDAP directory service. This property is mandatory when
237   * using the "mapped-search" mapping policy.
238   * <p>
239   * If multiple values are given, searches are performed below all
240   * specified base DNs.
241   *
242   * @return Returns the values of the "mapped-search-base-dn" property.
243   */
244  SortedSet<DN> getMappedSearchBaseDN();
245
246
247
248  /**
249   * Sets the "mapped-search-base-dn" property.
250   * <p>
251   * Specifies the set of base DNs below which to search for users in
252   * the remote LDAP directory service. This property is mandatory when
253   * using the "mapped-search" mapping policy.
254   * <p>
255   * If multiple values are given, searches are performed below all
256   * specified base DNs.
257   *
258   * @param values The values of the "mapped-search-base-dn" property.
259   * @throws PropertyException
260   *           If one or more of the new values are invalid.
261   */
262  void setMappedSearchBaseDN(Collection<DN> values) throws PropertyException;
263
264
265
266  /**
267   * Gets the "mapped-search-bind-dn" property.
268   * <p>
269   * Specifies the bind DN which should be used to perform user
270   * searches in the remote LDAP directory service.
271   *
272   * @return Returns the value of the "mapped-search-bind-dn" property.
273   */
274  DN getMappedSearchBindDN();
275
276
277
278  /**
279   * Sets the "mapped-search-bind-dn" property.
280   * <p>
281   * Specifies the bind DN which should be used to perform user
282   * searches in the remote LDAP directory service.
283   *
284   * @param value The value of the "mapped-search-bind-dn" property.
285   * @throws PropertyException
286   *           If the new value is invalid.
287   */
288  void setMappedSearchBindDN(DN value) throws PropertyException;
289
290
291
292  /**
293   * Gets the "mapped-search-bind-password" property.
294   * <p>
295   * Specifies the bind password which should be used to perform user
296   * searches in the remote LDAP directory service.
297   *
298   * @return Returns the value of the "mapped-search-bind-password" property.
299   */
300  String getMappedSearchBindPassword();
301
302
303
304  /**
305   * Sets the "mapped-search-bind-password" property.
306   * <p>
307   * Specifies the bind password which should be used to perform user
308   * searches in the remote LDAP directory service.
309   *
310   * @param value The value of the "mapped-search-bind-password" property.
311   * @throws PropertyException
312   *           If the new value is invalid.
313   */
314  void setMappedSearchBindPassword(String value) throws PropertyException;
315
316
317
318  /**
319   * Gets the "mapped-search-bind-password-environment-variable" property.
320   * <p>
321   * Specifies the name of an environment variable containing the bind
322   * password which should be used to perform user searches in the
323   * remote LDAP directory service.
324   *
325   * @return Returns the value of the "mapped-search-bind-password-environment-variable" property.
326   */
327  String getMappedSearchBindPasswordEnvironmentVariable();
328
329
330
331  /**
332   * Sets the "mapped-search-bind-password-environment-variable" property.
333   * <p>
334   * Specifies the name of an environment variable containing the bind
335   * password which should be used to perform user searches in the
336   * remote LDAP directory service.
337   *
338   * @param value The value of the "mapped-search-bind-password-environment-variable" property.
339   * @throws PropertyException
340   *           If the new value is invalid.
341   */
342  void setMappedSearchBindPasswordEnvironmentVariable(String value) throws PropertyException;
343
344
345
346  /**
347   * Gets the "mapped-search-bind-password-file" property.
348   * <p>
349   * Specifies the name of a file containing the bind password which
350   * should be used to perform user searches in the remote LDAP
351   * directory service.
352   *
353   * @return Returns the value of the "mapped-search-bind-password-file" property.
354   */
355  String getMappedSearchBindPasswordFile();
356
357
358
359  /**
360   * Sets the "mapped-search-bind-password-file" property.
361   * <p>
362   * Specifies the name of a file containing the bind password which
363   * should be used to perform user searches in the remote LDAP
364   * directory service.
365   *
366   * @param value The value of the "mapped-search-bind-password-file" property.
367   * @throws PropertyException
368   *           If the new value is invalid.
369   */
370  void setMappedSearchBindPasswordFile(String value) throws PropertyException;
371
372
373
374  /**
375   * Gets the "mapped-search-bind-password-property" property.
376   * <p>
377   * Specifies the name of a Java property containing the bind
378   * password which should be used to perform user searches in the
379   * remote LDAP directory service.
380   *
381   * @return Returns the value of the "mapped-search-bind-password-property" property.
382   */
383  String getMappedSearchBindPasswordProperty();
384
385
386
387  /**
388   * Sets the "mapped-search-bind-password-property" property.
389   * <p>
390   * Specifies the name of a Java property containing the bind
391   * password which should be used to perform user searches in the
392   * remote LDAP directory service.
393   *
394   * @param value The value of the "mapped-search-bind-password-property" property.
395   * @throws PropertyException
396   *           If the new value is invalid.
397   */
398  void setMappedSearchBindPasswordProperty(String value) throws PropertyException;
399
400
401
402  /**
403   * Gets the "mapping-policy" property.
404   * <p>
405   * Specifies the mapping algorithm for obtaining the bind DN from
406   * the user's entry.
407   *
408   * @return Returns the value of the "mapping-policy" property.
409   */
410  MappingPolicy getMappingPolicy();
411
412
413
414  /**
415   * Sets the "mapping-policy" property.
416   * <p>
417   * Specifies the mapping algorithm for obtaining the bind DN from
418   * the user's entry.
419   *
420   * @param value The value of the "mapping-policy" property.
421   * @throws PropertyException
422   *           If the new value is invalid.
423   */
424  void setMappingPolicy(MappingPolicy value) throws PropertyException;
425
426
427
428  /**
429   * Gets the "primary-remote-ldap-server" property.
430   * <p>
431   * Specifies the primary list of remote LDAP servers which should be
432   * used for pass through authentication.
433   * <p>
434   * If more than one LDAP server is specified then operations may be
435   * distributed across them. If all of the primary LDAP servers are
436   * unavailable then operations will fail-over to the set of secondary
437   * LDAP servers, if defined.
438   *
439   * @return Returns the values of the "primary-remote-ldap-server" property.
440   */
441  SortedSet<String> getPrimaryRemoteLDAPServer();
442
443
444
445  /**
446   * Sets the "primary-remote-ldap-server" property.
447   * <p>
448   * Specifies the primary list of remote LDAP servers which should be
449   * used for pass through authentication.
450   * <p>
451   * If more than one LDAP server is specified then operations may be
452   * distributed across them. If all of the primary LDAP servers are
453   * unavailable then operations will fail-over to the set of secondary
454   * LDAP servers, if defined.
455   *
456   * @param values The values of the "primary-remote-ldap-server" property.
457   * @throws PropertyException
458   *           If one or more of the new values are invalid.
459   */
460  void setPrimaryRemoteLDAPServer(Collection<String> values) throws PropertyException;
461
462
463
464  /**
465   * Gets the "secondary-remote-ldap-server" property.
466   * <p>
467   * Specifies the secondary list of remote LDAP servers which should
468   * be used for pass through authentication in the event that the
469   * primary LDAP servers are unavailable.
470   * <p>
471   * If more than one LDAP server is specified then operations may be
472   * distributed across them. Operations will be rerouted to the
473   * primary LDAP servers as soon as they are determined to be
474   * available.
475   *
476   * @return Returns the values of the "secondary-remote-ldap-server" property.
477   */
478  SortedSet<String> getSecondaryRemoteLDAPServer();
479
480
481
482  /**
483   * Sets the "secondary-remote-ldap-server" property.
484   * <p>
485   * Specifies the secondary list of remote LDAP servers which should
486   * be used for pass through authentication in the event that the
487   * primary LDAP servers are unavailable.
488   * <p>
489   * If more than one LDAP server is specified then operations may be
490   * distributed across them. Operations will be rerouted to the
491   * primary LDAP servers as soon as they are determined to be
492   * available.
493   *
494   * @param values The values of the "secondary-remote-ldap-server" property.
495   * @throws PropertyException
496   *           If one or more of the new values are invalid.
497   */
498  void setSecondaryRemoteLDAPServer(Collection<String> values) throws PropertyException;
499
500
501
502  /**
503   * Gets the "source-address" property.
504   * <p>
505   * If specified, the server will bind to the address before
506   * connecting to the remote server.
507   * <p>
508   * The address must be one assigned to an existing network
509   * interface.
510   *
511   * @return Returns the value of the "source-address" property.
512   */
513  InetAddress getSourceAddress();
514
515
516
517  /**
518   * Sets the "source-address" property.
519   * <p>
520   * If specified, the server will bind to the address before
521   * connecting to the remote server.
522   * <p>
523   * The address must be one assigned to an existing network
524   * interface.
525   *
526   * @param value The value of the "source-address" property.
527   * @throws PropertyException
528   *           If the new value is invalid.
529   */
530  void setSourceAddress(InetAddress value) throws PropertyException;
531
532
533
534  /**
535   * Gets the "ssl-cipher-suite" property.
536   * <p>
537   * Specifies the names of the SSL cipher suites that are allowed for
538   * use in SSL based LDAP connections.
539   *
540   * @return Returns the values of the "ssl-cipher-suite" property.
541   */
542  SortedSet<String> getSSLCipherSuite();
543
544
545
546  /**
547   * Sets the "ssl-cipher-suite" property.
548   * <p>
549   * Specifies the names of the SSL cipher suites that are allowed for
550   * use in SSL based LDAP connections.
551   *
552   * @param values The values of the "ssl-cipher-suite" property.
553   * @throws PropertyException
554   *           If one or more of the new values are invalid.
555   */
556  void setSSLCipherSuite(Collection<String> values) throws PropertyException;
557
558
559
560  /**
561   * Gets the "ssl-protocol" property.
562   * <p>
563   * Specifies the names of the SSL protocols which are allowed for
564   * use in SSL based LDAP connections.
565   *
566   * @return Returns the values of the "ssl-protocol" property.
567   */
568  SortedSet<String> getSSLProtocol();
569
570
571
572  /**
573   * Sets the "ssl-protocol" property.
574   * <p>
575   * Specifies the names of the SSL protocols which are allowed for
576   * use in SSL based LDAP connections.
577   *
578   * @param values The values of the "ssl-protocol" property.
579   * @throws PropertyException
580   *           If one or more of the new values are invalid.
581   */
582  void setSSLProtocol(Collection<String> values) throws PropertyException;
583
584
585
586  /**
587   * Gets the "trust-manager-provider" property.
588   * <p>
589   * Specifies the name of the trust manager that should be used when
590   * negotiating SSL connections with remote LDAP directory servers.
591   *
592   * @return Returns the value of the "trust-manager-provider" property.
593   */
594  String getTrustManagerProvider();
595
596
597
598  /**
599   * Sets the "trust-manager-provider" property.
600   * <p>
601   * Specifies the name of the trust manager that should be used when
602   * negotiating SSL connections with remote LDAP directory servers.
603   *
604   * @param value The value of the "trust-manager-provider" property.
605   * @throws PropertyException
606   *           If the new value is invalid.
607   */
608  void setTrustManagerProvider(String value) throws PropertyException;
609
610
611
612  /**
613   * Gets the "use-password-caching" property.
614   * <p>
615   * Indicates whether passwords should be cached locally within the
616   * user's entry.
617   *
618   * @return Returns the value of the "use-password-caching" property.
619   */
620  boolean isUsePasswordCaching();
621
622
623
624  /**
625   * Sets the "use-password-caching" property.
626   * <p>
627   * Indicates whether passwords should be cached locally within the
628   * user's entry.
629   *
630   * @param value The value of the "use-password-caching" property.
631   * @throws PropertyException
632   *           If the new value is invalid.
633   */
634  void setUsePasswordCaching(boolean value) throws PropertyException;
635
636
637
638  /**
639   * Gets the "use-ssl" property.
640   * <p>
641   * Indicates whether the LDAP Pass Through Authentication Policy
642   * should use SSL.
643   * <p>
644   * If enabled, the LDAP Pass Through Authentication Policy will use
645   * SSL to encrypt communication with the clients.
646   *
647   * @return Returns the value of the "use-ssl" property.
648   */
649  boolean isUseSSL();
650
651
652
653  /**
654   * Sets the "use-ssl" property.
655   * <p>
656   * Indicates whether the LDAP Pass Through Authentication Policy
657   * should use SSL.
658   * <p>
659   * If enabled, the LDAP Pass Through Authentication Policy will use
660   * SSL to encrypt communication with the clients.
661   *
662   * @param value The value of the "use-ssl" property.
663   * @throws PropertyException
664   *           If the new value is invalid.
665   */
666  void setUseSSL(Boolean value) throws PropertyException;
667
668
669
670  /**
671   * Gets the "use-tcp-keep-alive" property.
672   * <p>
673   * Indicates whether LDAP connections should use TCP keep-alive.
674   * <p>
675   * If enabled, the SO_KEEPALIVE socket option is used to indicate
676   * that TCP keepalive messages should periodically be sent to the
677   * client to verify that the associated connection is still valid.
678   * This may also help prevent cases in which intermediate network
679   * hardware could silently drop an otherwise idle client connection,
680   * provided that the keepalive interval configured in the underlying
681   * operating system is smaller than the timeout enforced by the
682   * network hardware.
683   *
684   * @return Returns the value of the "use-tcp-keep-alive" property.
685   */
686  boolean isUseTCPKeepAlive();
687
688
689
690  /**
691   * Sets the "use-tcp-keep-alive" property.
692   * <p>
693   * Indicates whether LDAP connections should use TCP keep-alive.
694   * <p>
695   * If enabled, the SO_KEEPALIVE socket option is used to indicate
696   * that TCP keepalive messages should periodically be sent to the
697   * client to verify that the associated connection is still valid.
698   * This may also help prevent cases in which intermediate network
699   * hardware could silently drop an otherwise idle client connection,
700   * provided that the keepalive interval configured in the underlying
701   * operating system is smaller than the timeout enforced by the
702   * network hardware.
703   *
704   * @param value The value of the "use-tcp-keep-alive" property.
705   * @throws PropertyException
706   *           If the new value is invalid.
707   */
708  void setUseTCPKeepAlive(Boolean value) throws PropertyException;
709
710
711
712  /**
713   * Gets the "use-tcp-no-delay" property.
714   * <p>
715   * Indicates whether LDAP connections should use TCP no-delay.
716   * <p>
717   * If enabled, the TCP_NODELAY socket option is used to ensure that
718   * response messages to the client are sent immediately rather than
719   * potentially waiting to determine whether additional response
720   * messages can be sent in the same packet. In most cases, using the
721   * TCP_NODELAY socket option provides better performance and lower
722   * response times, but disabling it may help for some cases in which
723   * the server sends a large number of entries to a client in response
724   * to a search request.
725   *
726   * @return Returns the value of the "use-tcp-no-delay" property.
727   */
728  boolean isUseTCPNoDelay();
729
730
731
732  /**
733   * Sets the "use-tcp-no-delay" property.
734   * <p>
735   * Indicates whether LDAP connections should use TCP no-delay.
736   * <p>
737   * If enabled, the TCP_NODELAY socket option is used to ensure that
738   * response messages to the client are sent immediately rather than
739   * potentially waiting to determine whether additional response
740   * messages can be sent in the same packet. In most cases, using the
741   * TCP_NODELAY socket option provides better performance and lower
742   * response times, but disabling it may help for some cases in which
743   * the server sends a large number of entries to a client in response
744   * to a search request.
745   *
746   * @param value The value of the "use-tcp-no-delay" property.
747   * @throws PropertyException
748   *           If the new value is invalid.
749   */
750  void setUseTCPNoDelay(Boolean value) throws PropertyException;
751
752}