Package com.ongres.scram.client

Class ClientFinalProcessor

java.lang.Object
com.ongres.scram.client.ClientFinalProcessor
final class ClientFinalProcessor extends Object
Processor that allows to generate the client-final-message, as well as process the server-final-message and verify server's signature. Generate the processor by calling either ServerFirstProcessor#clientFinalProcessor(char[]) or ServerFirstProcessor#clientFinalProcessor(byte[], byte[]).

  • Field Details

    • clientKey

      private final byte[] clientKey

    • storedKey

      private final byte[] storedKey

    • serverKey

      private final byte[] serverKey

    • scramMechanism

      private final ScramMechanism scramMechanism

    • clientFirstMessage

      private final ClientFirstMessage clientFirstMessage

    • serverFirstMessage

      private final ServerFirstMessage serverFirstMessage

    • authMessage

      private String authMessage

  • Constructor Details

    • ClientFinalProcessor

      private ClientFinalProcessor(ScramMechanism scramMechanism, byte[] clientKey, byte[] storedKey, byte[] serverKey, ClientFirstMessage clientFirstMessage, ServerFirstMessage serverFirstMessage)
      Primary constructor utilizing pre-computed cryptographic keys.

    • ClientFinalProcessor

      ClientFinalProcessor(ScramMechanism scramMechanism, byte[] clientKey, byte[] serverKey, ClientFirstMessage clientFirstMessage, ServerFirstMessage serverFirstMessage)
      Constructs a processor using pre-computed Client and Server keys. The Stored Key is automatically derived.
      Parameters:
      scramMechanism - The SCRAM mechanism.
      clientKey - The pre-computed client key material.
      serverKey - The pre-computed server key material.
      clientFirstMessage - The client-first-message contextual state.
      serverFirstMessage - The server-first-message contextual state.

    • ClientFinalProcessor

      ClientFinalProcessor(ScramMechanism scramMechanism, byte[] saltedPassword, ClientFirstMessage clientFirstMessage, ServerFirstMessage serverFirstMessage)
      Constructs a processor using a pre-computed salted password. Client, Server, and Stored keys are derived directly from the salted password.
      Parameters:
      scramMechanism - The SCRAM mechanism.
      saltedPassword - The pre-computed salted password material.
      clientFirstMessage - The client-first-message contextual state.
      serverFirstMessage - The server-first-message contextual state.

    • ClientFinalProcessor

      ClientFinalProcessor(ScramMechanism scramMechanism, StringPreparation stringPreparation, char[] password, byte[] salt, ClientFirstMessage clientFirstMessage, ServerFirstMessage serverFirstMessage)
      Constructs a processor from raw credentials, performing PBKDF2 salt derivation.
      Parameters:
      scramMechanism - The SCRAM mechanism.
      stringPreparation - The SASLprep normalization configuration rules.
      password - The cleartext password array.
      salt - The salt bytes received from the server.
      clientFirstMessage - The client-first-message contextual state.
      serverFirstMessage - The server-first-message contextual state.

  • Method Details

    • generateAndCacheAuthMessage

      private void generateAndCacheAuthMessage(byte[] cbindData)
      Generates and caches the authMessage metadata string required for signing logic if not already present.
      Parameters:
      cbindData - The channel binding payload data bytes.

    • clientFinalMessage

      ClientFinalMessage clientFinalMessage(byte[] cbindData)
      Generates the SCRAM representation of the client-final-message, including the given channel-binding data.
      Parameters:
      cbindData - The bytes of the channel-binding data, or null if no channel binding is utilized.
      Returns:
      The constructed ClientFinalMessage object.

    • receiveServerFinalMessage

      ServerFinalMessage receiveServerFinalMessage(String serverFinalMessage) throws ScramParseException, ScramServerErrorException, ScramInvalidServerSignatureException
      Receive and process the server-final-message. The server's signature is explicitly verified.
      Parameters:
      serverFinalMessage - The received raw server-final-message text line string.
      Returns:
      The parsed and validated ServerFinalMessage instance representation.
      Throws:
      ScramParseException - If the string composition fails structure parsing rules.
      ScramServerErrorException - If the server-final-message contains an error attribute message.
      ScramInvalidServerSignatureException - If the verified computed signature fails validation matches.
      IllegalArgumentException - If the input parameter message value evaluates null or empty.