com.digitalasset.canton.synchronizer.sequencing.authentication
MemberAuthenticationService
Companion object MemberAuthenticationService
class MemberAuthenticationService extends NamedLogging with FlagCloseable
The authentication service issues tokens to members after they have successfully completed the following challenge response protocol and after they have accepted the service agreement of the synchronizer. The tokens are required for connecting to the sequencer.
In order for a member to subscribe to the sequencer, it must follow a few steps for it to authenticate. Assuming the synchronizer already has knowledge of the member's public keys, the following steps are to be taken:
- member sends request to the synchronizer for authenticating
- synchronizer returns a nonce (a challenge random number)
- member takes the nonce, concatenates it with the identity of the synchronizer, signs it and sends it back
- synchronizer checks the signature against the key of the member. if it matches, create a token and return it
- member will use the token when subscribing to the sequencer
- Alphabetic
- By Inheritance
- MemberAuthenticationService
- FlagCloseable
- PerformUnlessClosing
- HasSynchronizeWithReaders
- HasSynchronizeWithClosing
- OnShutdownRunner
- HasRunOnClosing
- HasUnlessClosing
- AutoCloseable
- NamedLogging
- AnyRef
- Any
- Hide All
- Show All
- Public
- Protected
Instance Constructors
- new MemberAuthenticationService(synchronizerId: PhysicalSynchronizerId, cryptoApi: SynchronizerCryptoClient, store: MemberAuthenticationStore, clock: Clock, nonceExpirationInterval: Duration, maxTokenExpirationInterval: Duration, useExponentialRandomTokenExpiration: Boolean, invalidateMemberCallback: (Traced[Member]) => Unit, isTopologyInitialized: FutureUnlessShutdown[Unit], timeouts: ProcessingTimeout, loggerFactory: NamedLoggerFactory)(implicit ec: ExecutionContext)
- invalidateMemberCallback
Called when a member is explicitly deactivated on the synchronizer so all active subscriptions for this member should be terminated.
Value Members
- final def !=(arg0: Any): Boolean
- Definition Classes
- AnyRef → Any
- final def ##: Int
- Definition Classes
- AnyRef → Any
- final def ==(arg0: Any): Boolean
- Definition Classes
- AnyRef → Any
- def addReader(reader: String)(implicit traceContext: TraceContext): UnlessShutdown[ReaderHandle]
TODO(#16601) Make this method private once PerformUnlessClosing doesn't need it any more
TODO(#16601) Make this method private once PerformUnlessClosing doesn't need it any more
- Attributes
- protected[this]
- Definition Classes
- HasSynchronizeWithReaders
- final def asInstanceOf[T0]: T0
- Definition Classes
- Any
- def clone(): AnyRef
- Attributes
- protected[lang]
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.CloneNotSupportedException]) @IntrinsicCandidate() @native()
- final def close(): Unit
Blocks until all earlier tasks have completed and then prevents further tasks from being run.
Blocks until all earlier tasks have completed and then prevents further tasks from being run.
- Definition Classes
- FlagCloseable → OnShutdownRunner → AutoCloseable
- def closingTimeout: FiniteDuration
- Attributes
- protected
- Definition Classes
- FlagCloseable → PerformUnlessClosing
- final def eq(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef
- def equals(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef → Any
- implicit def errorLoggingContext(implicit traceContext: TraceContext): ErrorLoggingContext
- Attributes
- protected
- Definition Classes
- NamedLogging
- def generateNonce(member: Member)(implicit traceContext: TraceContext): EitherT[FutureUnlessShutdown, AuthenticationError, (Nonce, NonEmpty[Seq[Fingerprint]])]
synchronizer generates nonce that he expects the participant to use to concatenate with the synchronizer's id and sign to proceed with the authentication (step 2).
synchronizer generates nonce that he expects the participant to use to concatenate with the synchronizer's id and sign to proceed with the authentication (step 2). We expect to find a key with usage 'SequencerAuthentication' to sign these messages.
- final def getClass(): Class[_ <: AnyRef]
- Definition Classes
- AnyRef → Any
- Annotations
- @IntrinsicCandidate() @native()
- def hashCode(): Int
- Definition Classes
- AnyRef → Any
- Annotations
- @IntrinsicCandidate() @native()
- def invalidateAndExpire[T <: Member](isActiveCheck: (T) => FutureUnlessShutdown[Boolean])(memberId: T)(implicit traceContext: TraceContext): FutureUnlessShutdown[Unit]
- Attributes
- protected
- def invalidateMemberWithToken(token: AuthenticationToken)(implicit traceContext: TraceContext): FutureUnlessShutdown[Either[LogoutTokenDoesNotExist.type, Unit]]
- def isClosing: Boolean
Check whether we're closing.
Check whether we're closing. Susceptible to race conditions; unless you're using this as a flag to the retry lib or you really know what you're doing, prefer
performUnlessClosingand friends.- Definition Classes
- OnShutdownRunner → HasUnlessClosing
- final def isInstanceOf[T0]: Boolean
- Definition Classes
- Any
- def isMediatorActive(mediator: MediatorId)(implicit traceContext: TraceContext): FutureUnlessShutdown[Boolean]
- Attributes
- protected
- def isMemberActive(check: (TopologySnapshot) => FutureUnlessShutdown[Boolean])(implicit traceContext: TraceContext): FutureUnlessShutdown[Boolean]
- Attributes
- protected
- def isParticipantActive(participant: ParticipantId)(implicit traceContext: TraceContext): FutureUnlessShutdown[Boolean]
- Attributes
- protected
- def isSequencerActive(sequencer: SequencerId)(implicit traceContext: TraceContext): FutureUnlessShutdown[Boolean]
- Attributes
- protected
- def keepTrackOfReaderCallStack: Boolean
Set this to true to get detailed information about all futures that did not complete during shutdown.
Set this to true to get detailed information about all futures that did not complete during shutdown.
- Attributes
- protected[this]
- Definition Classes
- PerformUnlessClosing → HasSynchronizeWithReaders
- def logger: TracedLogger
- Attributes
- protected
- Definition Classes
- NamedLogging
- val loggerFactory: NamedLoggerFactory
- Definition Classes
- MemberAuthenticationService → NamedLogging
- def nameInternal: String
- Attributes
- protected[this]
- Definition Classes
- PerformUnlessClosing → HasSynchronizeWithReaders
- implicit def namedLoggingContext(implicit traceContext: TraceContext): NamedLoggingContext
- Attributes
- protected
- Definition Classes
- NamedLogging
- final def ne(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef
- def noTracingLogger: Logger
- Attributes
- protected
- Definition Classes
- NamedLogging
- final def notify(): Unit
- Definition Classes
- AnyRef
- Annotations
- @IntrinsicCandidate() @native()
- final def notifyAll(): Unit
- Definition Classes
- AnyRef
- Annotations
- @IntrinsicCandidate() @native()
- def onCloseFailure(e: Throwable): Unit
- Attributes
- protected
- Definition Classes
- PerformUnlessClosing
- def onClosed(): Unit
- Attributes
- protected
- Definition Classes
- PerformUnlessClosing
- final def onFirstClose(): Unit
Blocks until all earlier tasks have completed and then prevents further tasks from being run.
Blocks until all earlier tasks have completed and then prevents further tasks from being run.
- Definition Classes
- PerformUnlessClosing → OnShutdownRunner
- def remainingReaders(): Seq[String]
- Attributes
- protected[this]
- Definition Classes
- HasSynchronizeWithReaders
- def removeReader(handle: ReaderHandle): Unit
TODO(#16601) Make this method private once PerformUnlessClosing doesn't need it any more
TODO(#16601) Make this method private once PerformUnlessClosing doesn't need it any more
- Attributes
- protected[this]
- Definition Classes
- HasSynchronizeWithReaders
- def runOnClose(task: RunOnClosing): UnlessShutdown[LifeCycleRegistrationHandle]
Schedules the given task to be run upon closing.
Schedules the given task to be run upon closing.
- returns
An com.digitalasset.canton.lifecycle.UnlessShutdown.Outcome indicates that the task will have been run when the
LifeCycleManager'scloseAsyncmethod completes or whenAutoCloseable'sclosemethod returns, unless the returnedLifeCycleRegistrationHandlewas used to cancel the task or the task has been done beforehand. com.digitalasset.canton.lifecycle.UnlessShutdown.AbortedDueToShutdown if the task is not run due to closing. This always happens if isClosing returns true.
- Definition Classes
- OnShutdownRunner → HasRunOnClosing
- def runOnOrAfterClose(task: RunOnClosing)(implicit traceContext: TraceContext): LifeCycleRegistrationHandle
Register a task to run when closing is initiated, or run it immediately if closing is already ongoing.
Register a task to run when closing is initiated, or run it immediately if closing is already ongoing. Unlike runOnClose, this method does not guarantee that this task will have run by the time the
LifeCycleManager'scloseAsyncmethod completes orAutoCloseable'sclosereturns. This is because the task is run immediately if the component has already been closed.- Definition Classes
- HasRunOnClosing
- final def runOnOrAfterClose_(task: RunOnClosing)(implicit traceContext: TraceContext): Unit
Variant of runOnOrAfterClose that does not return a com.digitalasset.canton.lifecycle.LifeCycleRegistrationHandle.
Variant of runOnOrAfterClose that does not return a com.digitalasset.canton.lifecycle.LifeCycleRegistrationHandle.
- Definition Classes
- HasRunOnClosing
- def runTaskUnlessDone(task: RunOnClosing)(implicit traceContext: TraceContext): Unit
- Attributes
- protected[this]
- Definition Classes
- OnShutdownRunner → HasRunOnClosing
- def synchronizeWithClosing[F[_], A](name: String)(f: => F[A])(implicit traceContext: TraceContext, F: Thereafter[F], A: CanAbortDueToShutdown[F]): F[A]
Runs the computation
fonly if the component is not yet closing.Runs the computation
fonly if the component is not yet closing. If so, the component will delay releasing its resources untilfhas completed (as defined by the com.digitalasset.canton.util.Thereafter instance) or thesynchronizeWithClosingPatiencehas elapsed.DO NOT CALL
this.closeas part off, because it will result in a deadlock. DO NOT PUT retries, especially indefinite ones, insidef.- returns
The computation completes with com.digitalasset.canton.lifecycle.UnlessShutdown.AbortedDueToShutdown if
fhas not run. Otherwise it is the result of runningf.
- Definition Classes
- HasSynchronizeWithClosing
- See also
HasRunOnClosing.isClosing
- def synchronizeWithClosingF[A](name: String)(f: => Future[A])(implicit ec: ExecutionContext, traceContext: TraceContext): FutureUnlessShutdown[A]
Convenience method for synchronizing on
Futures instead ofFutureUnlessShutdowns.Convenience method for synchronizing on
Futures instead ofFutureUnlessShutdowns. Equivalent tosynchronizeWithClosing(name)(FutureUnlessShutdown.outcomeF(f))
- Definition Classes
- PerformUnlessClosing
- def synchronizeWithClosingPatience: FiniteDuration
- Attributes
- protected[this]
- Definition Classes
- PerformUnlessClosing → HasSynchronizeWithReaders
- def synchronizeWithClosingSync[A](name: String)(f: => A)(implicit traceContext: TraceContext): UnlessShutdown[A]
Runs the computation
fonly if the component is not yet closing.Runs the computation
fonly if the component is not yet closing. If so, the component will delay releasing its resources untilfhas finished or thesynchronizeWithClosingPatiencehas elapsed.DO NOT CALL
this.closeas part off, because it will result in a deadlock. DO NOT PUT retries, especially indefinite ones, insidef.- returns
com.digitalasset.canton.lifecycle.UnlessShutdown.AbortedDueToShutdown if
fhas not run.
- Definition Classes
- HasSynchronizeWithClosing
- Annotations
- @SuppressWarnings()
- See also
HasRunOnClosing.isClosing
- def synchronizeWithClosingUS[F[_], A](name: String)(f: => F[A])(implicit traceContext: TraceContext, F: Thereafter[F]): UnlessShutdown[F[A]]
Runs the computation
fonly if the component is not yet closing.Runs the computation
fonly if the component is not yet closing. If so, the component will delay releasing its resources untilfhas completed (as defined by the com.digitalasset.canton.util.Thereafter instance) or thesynchronizeWithClosingPatiencehas elapsed.DO NOT CALL
this.closeas part off, because it will result in a deadlock. DO NOT PUT retries, especially indefinite ones, insidef.- returns
com.digitalasset.canton.lifecycle.UnlessShutdown.AbortedDueToShutdown if
fhas not run. Otherwise the result of runningf.
- Definition Classes
- PerformUnlessClosing → HasSynchronizeWithClosing
- See also
HasRunOnClosing.isClosing
- def synchronizeWithReaders()(implicit traceContext: TraceContext): Boolean
- Attributes
- protected[this]
- Definition Classes
- HasSynchronizeWithReaders
- final def synchronized[T0](arg0: => T0): T0
- Definition Classes
- AnyRef
- val timeouts: ProcessingTimeout
- Definition Classes
- MemberAuthenticationService → FlagCloseable
- def toString(): String
- Definition Classes
- AnyRef → Any
- final def unlessClosing[F[_], A](fa: => F[A])(implicit F: CanAbortDueToShutdown[F]): F[A]
Runs the computation
faunless isClosing returns true.Runs the computation
faunless isClosing returns true.This method does not delay the closing while
fais running, unlike the methods inHasSynchronizeWithClosing. Accordingly, this method is useful for intermittent checks whether the result of the computation is still relevant.- returns
The result of
faor com.digitalasset.canton.lifecycle.UnlessShutdown.AbortedDueToShutdown if isClosing is true
- Definition Classes
- HasUnlessClosing
- Annotations
- @inline()
- def validateSignature(member: Member, signature: Signature, providedNonce: Nonce)(implicit traceContext: TraceContext): EitherT[FutureUnlessShutdown, AuthenticationError, AuthenticationTokenWithExpiry]
synchronizer checks that the signature given by the member matches and returns a token if it does (step 4)
- def validateToken(intendedSynchronizerId: PhysicalSynchronizerId, member: Member, token: AuthenticationToken): Either[AuthenticationError, StoredAuthenticationToken]
synchronizer checks if the token given by the participant is the one previously assigned to it for authentication.
synchronizer checks if the token given by the participant is the one previously assigned to it for authentication. The participant also provides the synchronizer id for which they think they are connecting to. If this id does not match this synchronizer's id, it means the participant was previously connected to a different synchronizer on the same address and now should be informed that this address now hosts a different synchronizer.
- final def wait(arg0: Long, arg1: Int): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException])
- final def wait(arg0: Long): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException])
- final def wait(): Unit
- Definition Classes
- AnyRef
- Annotations
- @throws(classOf[java.lang.InterruptedException])
- def withReader[F[_], A](name: String)(f: => F[A])(implicit traceContext: TraceContext, F: Thereafter[F]): UnlessShutdown[F[A]]
- Attributes
- protected[this]
- Definition Classes
- HasSynchronizeWithReaders