Type Members

1.  sealed trait AccessLevel extends Product with Serializable with UniformCantonConfigValidation
2.  abstract class AsyncForwardingListener[ReqT] extends Listener[ReqT]

   This listener buffers all messages until setNextListener is called, at which point all buffered messages are sent to the given listener.

   This listener buffers all messages until setNextListener is called, at which point all buffered messages are sent to the given listener. From then on, all future messages are sent directly to the given listener.

   The target listener is usually created through Contexts.interceptCall or ServerCallHandler.startCall.

   Annotations

   @SuppressWarnings()

3.  class AuthInterceptor extends ServerInterceptor with NamedLogging

   This interceptor uses the given AuthService to get ClaimSet.Claims for the current request, and then stores them in the current io.grpc.Context.

4.  trait AuthService extends AnyRef

   An interface for authorizing the ledger API access to a participant.

   An interface for authorizing the ledger API access to a participant.

   The AuthService is responsible for converting request metadata (such as the HTTP headers) into a ClaimSet. These claims are then used by the ledger API server to check whether the request is authorized.

   • The authorization information MUST be specified in the Authorization header.
   • The value of the Authorization header MUST start with Bearer (notice the trailing space of the prefix).
   • An AuthService implementation MAY use other headers when converting metadata to claims.

   For example, a participant could:

   • Ask all ledger API users to attach an Authorization header with a JWT token as the header value.
   • Implement decodeMetadata() such that it reads the JWT token from the corresponding HTTP header, validates the token, and converts the token payload to ClaimSet.
5.  class AuthServiceJWT extends AuthServiceJWTBase
6.  abstract class AuthServiceJWTBase extends AuthService with NamedLogging

   An AuthService that reads a JWT token from a Authorization: Bearer HTTP header.

   An AuthService that reads a JWT token from a Authorization: Bearer HTTP header. The token is expected to use the format as defined in com.daml.jwt.AuthServiceJWTPayload:

7.  class AuthServicePrivilegedJWT extends AuthServiceJWTBase
8.  sealed abstract class AuthorizationError extends AnyRef
9.  final case class AuthorizedUser(userId: String, allowedServices: Seq[String]) extends UniformCantonConfigValidation with Product with Serializable
10.  final class Authorizer extends NamedLogging with TelemetryTracing

    A simple helper that allows services to use authorization claims that have been stored by AuthInterceptor.

11.  final case class CantonAdminToken(secret: String) extends Product with Serializable
12.  class CantonAdminTokenAuthService extends AuthService

    AuthService interceptor used for internal canton services

    AuthService interceptor used for internal canton services

    Internal Canton services such as the PingService or the DarService require access to the Ledger-Api server. However, if the Ledger-Api server is configured with JWT, they will fail. But we can't expect that Canton obtains an oauth token from a third party service during startup.

    Therefore, we create on each startup a master token which is only ever shared internally.

13.  sealed abstract class Claim extends AnyRef

    A claim is a single statement about what an authenticated user can do with the ledger API.

    A claim is a single statement about what an authenticated user can do with the ledger API.

    Note: this ADT is expected to evolve in the future by adding new cases for more fine grained claims. The existing cases should be treated as immutable in order to guarantee backwards compatibility for AuthService implementations.

14.  final case class ClaimActAsParty(name: Party) extends Claim with Product with Serializable

    Authorized to act as the given party, including:

    Authorized to act as the given party, including:

    • Reading all data for the given party
    • Creating contracts on behalf of the given party
    • Exercising choices on behalf of the given party
15.  final case class ClaimReadAsParty(name: Party) extends Claim with Product with Serializable

    Authorized to read all data for the given party.

    Authorized to read all data for the given party.

    Does NOT authorize to issue commands.

16.  sealed trait ClaimSet extends AnyRef
17.  final case class NoOpOngoingAuthorizationFactory() extends OngoingAuthorizationFactory with Product with Serializable
18.  trait OngoingAuthorizationFactory extends AnyRef
19.  sealed trait RequiredClaim[Req] extends Product with Serializable
20.  trait StatelessAuthorizer extends AnyRef
21.  class UserConfigAuthService extends AuthServiceJWTBase