Package com.nimbusds.openid.connect.sdk.id

Class PairwiseSubjectCodec

  • Direct Known Subclasses:
    HashBasedPairwiseSubjectCodec, SIVAESBasedPairwiseSubjectCodec
    @ThreadSafe
public abstract class PairwiseSubjectCodec
extends Object
    Encoder and decoder of pairwise subject identifiers. The encoder algorithms must be deterministic, to ensure a given set of inputs always produces an identical pairwise subject identifier.

    Decoding pairwise subject identifiers is optional, and is implemented by algorithms that supported reversal (typically with encryption-based codecs). Hash-based codecs don't support reversal.

    Codec implementations thread-safe.

    Related specifications:

    • OpenID Connect Core 1.0, section 8.1.

    • Field Detail

      • CHARSET

        public static final Charset CHARSET
        The charset (UTF-8) for string to byte conversions.

    • Constructor Detail

      • PairwiseSubjectCodec

        public PairwiseSubjectCodec​(byte[] salt)
        Creates a new codec for pairwise subject identifiers.
        Parameters:
        salt - The salt, null if not required.

    • Method Detail

      • getSalt

        public byte[] getSalt()
        Returns the salt.
        Returns:
        The salt, null if not required.

      • getProvider

        public Provider getProvider()
        Gets the security provider for cryptographic operations.
        Returns:
        The security provider, null if not specified (implies the default one).

      • setProvider

        public void setProvider​(Provider provider)
        Sets the security provider for cryptographic operations.
        Parameters:
        provider - The security provider, null if not specified (implies the default one).

      • encode

        public Subject encode​(URI sectorURI,
                      Subject localSub)
        Encodes a new pairwise subject identifier from the specified sector identifier URI and local subject.
        Parameters:
        sectorURI - The sector identifier URI. Its scheme should be "https", must include a host portion and must not be null.
        localSub - The local subject identifier. Must not be null.
        Returns:
        The pairwise subject identifier.

      • encode

        public abstract Subject encode​(SectorID sectorID,
                               Subject localSub)
        Encodes a new pairwise subject identifier from the specified sector identifier and local subject.
        Parameters:
        sectorID - The sector identifier. Must not be null.
        localSub - The local subject identifier. Must not be null.
        Returns:
        The pairwise subject identifier.