Legrand / Raritan Xerus™ JSON-RPC API for Remote Access Devices like KX4-101, KX3G2

Loading...
Searching...
No Matches
ClientCertAuthManager.idl
1/* SPDX-License-Identifier: BSD-3-Clause */
2/*
3 * Copyright 2024 Raritan Inc. All rights reserved.
4 */
5
6/** httpd client cert authentication settings **/
7module auth {
8 /** configuration interface **/
9 interface ClientCertAuthManager {
10
11 constant int ERR_MISSING_CERT = 1;
12 constant int ERR_TOO_MANY_CERTS = 2;
13 constant int ERR_INVALID_PARAMS = 3;
14
15 enumeration AuthMapType {
16 CN, ///< Common name
17 OTHER, ///< Other name (from subject alt name)
18 DNSNAME, ///< DNS name (from subject alt name)
19 EMAIL, ///< E-mail (from subject alt name)
20 URI, ///< URI (from subject alt name)
21 UID, ///< UID
22 LEGACYEMAIL ///< E-mail
23 };
24
25 enumeration OcspScope {
26 LEAF,
27 FULL
28 };
29
30 structure OcspSettings {
31 boolean enabled;
32 string defaultUri;
33 boolean forceDefaultUri;
34 OcspScope scope;
35 boolean nonce;
36 boolean allowUnknown;
37 boolean verifyResponder;
38 };
39
40 /** Information about a single CA certificate */
41 structure CACertInfo {
42 string subject; ///< Certificate subject
43 string issuer; ///< Certificate issuer
44 string invalidBefore; ///< Begin of validity period
45 string invalidAfter; ///< End of validity period
46 string serialNumber; ///< Serial number
47 };
48
49 structure ClientCertAuthSettings {
50 boolean enabled; ///< Whether client certificate authentication is enabled
51 boolean forced; ///< Enforce usage of client certificates for all authenticated HTTPS requests
52 AuthMapType authMap; ///< Which certificate field to use as login user name
53 boolean ekuRequired; ///< Whether client Extended Key Usage is required
54 OcspSettings ocsp; ///< OCSP settings
55 vector<string> caCertChains; ///< CA certificate chains
56 };
57
58 /**
59 * Get client certificate authentication settings
60 *
61 * @param caCertInfos Output value: CA certificate chain information (one entry for each caCertChains entry)
62 *
63 * @return Client certificate authentication settings
64 */
65 ClientCertAuthSettings getClientCertAuthSettings(out vector<CACertInfo> caCertInfos);
66
67 /**
68 * Set client certificate authentication settings
69 *
70 * @param settings New settings
71 *
72 * @return 0 on success
73 * @return 1 if no CA certificate was given
74 * @return 2 if too many CA certificates were given
75 * @return 3 if any other parameter was invalid
76 */
77 int setClientCertAuthSettings(in ClientCertAuthSettings settings);
78 };
79}
auth::ClientCertAuthManager
configuration interface
Definition ClientCertAuthManager.idl:9
auth::ClientCertAuthManager::getClientCertAuthSettings
ClientCertAuthSettings getClientCertAuthSettings(out vector< CACertInfo > caCertInfos)
Get client certificate authentication settings.
auth::ClientCertAuthManager::AuthMapType
AuthMapType
Definition ClientCertAuthManager.idl:15
auth::ClientCertAuthManager::OTHER
@ OTHER
Other name (from subject alt name)
Definition ClientCertAuthManager.idl:17
auth::ClientCertAuthManager::LEGACYEMAIL
@ LEGACYEMAIL
E-mail.
Definition ClientCertAuthManager.idl:22
auth::ClientCertAuthManager::DNSNAME
@ DNSNAME
DNS name (from subject alt name)
Definition ClientCertAuthManager.idl:18
auth::ClientCertAuthManager::EMAIL
@ EMAIL
E-mail (from subject alt name)
Definition ClientCertAuthManager.idl:19
auth::ClientCertAuthManager::URI
@ URI
URI (from subject alt name)
Definition ClientCertAuthManager.idl:20
auth::ClientCertAuthManager::UID
@ UID
UID.
Definition ClientCertAuthManager.idl:21
auth::ClientCertAuthManager::CN
@ CN
Common name.
Definition ClientCertAuthManager.idl:16
auth::ClientCertAuthManager::setClientCertAuthSettings
int setClientCertAuthSettings(in ClientCertAuthSettings settings)
Set client certificate authentication settings.
auth
Local and Remote Authentication Management.
Definition AuthManager.idl:7
auth::ClientCertAuthManager::CACertInfo
Information about a single CA certificate.
Definition ClientCertAuthManager.idl:41
auth::ClientCertAuthManager::CACertInfo::serialNumber
string serialNumber
Serial number.
Definition ClientCertAuthManager.idl:46
auth::ClientCertAuthManager::CACertInfo::issuer
string issuer
Certificate issuer.
Definition ClientCertAuthManager.idl:43
auth::ClientCertAuthManager::CACertInfo::subject
string subject
Certificate subject.
Definition ClientCertAuthManager.idl:42
auth::ClientCertAuthManager::CACertInfo::invalidAfter
string invalidAfter
End of validity period.
Definition ClientCertAuthManager.idl:45
auth::ClientCertAuthManager::CACertInfo::invalidBefore
string invalidBefore
Begin of validity period.
Definition ClientCertAuthManager.idl:44
auth::ClientCertAuthManager::ClientCertAuthSettings
Definition ClientCertAuthManager.idl:49
auth::ClientCertAuthManager::ClientCertAuthSettings::forced
boolean forced
Enforce usage of client certificates for all authenticated HTTPS requests.
Definition ClientCertAuthManager.idl:51
auth::ClientCertAuthManager::ClientCertAuthSettings::ocsp
OcspSettings ocsp
OCSP settings.
Definition ClientCertAuthManager.idl:54
auth::ClientCertAuthManager::ClientCertAuthSettings::caCertChains
vector< string > caCertChains
CA certificate chains.
Definition ClientCertAuthManager.idl:55
auth::ClientCertAuthManager::ClientCertAuthSettings::enabled
boolean enabled
Whether client certificate authentication is enabled.
Definition ClientCertAuthManager.idl:50
auth::ClientCertAuthManager::ClientCertAuthSettings::ekuRequired
boolean ekuRequired
Whether client Extended Key Usage is required.
Definition ClientCertAuthManager.idl:53
auth::ClientCertAuthManager::ClientCertAuthSettings::authMap
AuthMapType authMap
Which certificate field to use as login user name.
Definition ClientCertAuthManager.idl:52
auth::ClientCertAuthManager::OcspSettings
Definition ClientCertAuthManager.idl:30