ClientCertAuthManager.idl

/* SPDX-License-Identifier: BSD-3-Clause */
/*
 * Copyright 2024 Raritan Inc. All rights reserved.
 */
 
/** httpd client cert authentication settings **/
module auth {
    /** configuration interface **/
    interface ClientCertAuthManager {
 
        constant int ERR_MISSING_CERT   = 1;
        constant int ERR_TOO_MANY_CERTS = 2;
        constant int ERR_INVALID_PARAMS = 3;
 
        enumeration AuthMapType {
            CN,             ///< Common name
            OTHER,          ///< Other name (from subject alt name)
            DNSNAME,        ///< DNS name (from subject alt name)
            EMAIL,          ///< E-mail (from subject alt name)
            URI,            ///< URI (from subject alt name)
            UID,            ///< UID
            LEGACYEMAIL     ///< E-mail
        };
 
        enumeration OcspScope {
            LEAF,
            FULL
        };
 
        structure OcspSettings {
            boolean enabled;
            string defaultUri;
            boolean forceDefaultUri;
            OcspScope scope;
            boolean nonce;
            boolean allowUnknown;
            boolean verifyResponder;
        };
 
        /** Information about a single CA certificate */
        structure CACertInfo {
            string subject;         ///< Certificate subject
            string issuer;          ///< Certificate issuer
            string invalidBefore;   ///< Begin of validity period
            string invalidAfter;    ///< End of validity period
            string serialNumber;    ///< Serial number
        };
 
        structure ClientCertAuthSettings {
            boolean enabled;                ///< Whether client certificate authentication is enabled
            boolean forced;                 ///< Enforce usage of client certificates for all authenticated HTTPS requests
            AuthMapType authMap;            ///< Which certificate field to use as login user name
            boolean ekuRequired;            ///< Whether client Extended Key Usage is required
            OcspSettings ocsp;              ///< OCSP settings
            vector<string> caCertChains;    ///< CA certificate chains
        };
 
        /**
         * Get client certificate authentication settings
         *
         * @param caCertInfos Output value: CA certificate chain information (one entry for each caCertChains entry)
         *
         * @return Client certificate authentication settings
         */
        ClientCertAuthSettings getClientCertAuthSettings(out vector<CACertInfo> caCertInfos);
 
        /**
         * Set client certificate authentication settings
         *
         * @param settings New settings
         *
         * @return 0 on success
         * @return 1 if no CA certificate was given
         * @return 2 if too many CA certificates were given
         * @return 3 if any other parameter was invalid
         */
        int setClientCertAuthSettings(in ClientCertAuthSettings settings);
    };
}