Package com.ocient.jdbc

Enum Class XGConnection.HandshakeType

java.lang.Object

java.lang.Enum<XGConnection.HandshakeType>

com.ocient.jdbc.XGConnection.HandshakeType

All Implemented Interfaces:

Serializable, Comparable<XGConnection.HandshakeType>, Constable

Enclosing class:

XGConnection

public static enum XGConnection.HandshakeType
extends Enum<XGConnection.HandshakeType>

Nested Class Summary

Nested classes/interfaces inherited from class java.lang.Enum

Enum.EnumDesc<E extends Enum<E>>

Enum Constant Summary

Enum Constants

Enum Constant	Description
CBC
GCM
OKTA_NATIVE_SSO	The Native SSO Token is stored on the local filesystem.
OKTA_SESSION_TOKEN	This handshake was reluctantly added to provide a scriptable solution for testing Okta SSO.
SSO	See OpenIDAuthenticators.OAuthFlow for sequence diagrams for each flow in this handshake.

Method Summary

Modifier and Type	Method	Description
boolean	hasSharedSecurityToken()
boolean	sso()
static XGConnection.HandshakeType	valueOf(String name)	Returns the enum constant of this class with the specified name.
static XGConnection.HandshakeType[]	values()	Returns an array containing the constants of this enum class, in the order they are declared.

Methods inherited from class java.lang.Enum

clone, compareTo, describeConstable, equals, finalize, getDeclaringClass, hashCode, name, ordinal, toString, valueOf

Methods inherited from class java.lang.Object

getClass, notify, notifyAll, wait, wait, wait

Enum Constant Details

CBC

public static final XGConnection.HandshakeType CBC

GCM

public static final XGConnection.HandshakeType GCM

SSO

public static final XGConnection.HandshakeType SSO

See OpenIDAuthenticators.OAuthFlow for sequence diagrams for each flow in this handshake.

Note: The tokens are sent to the server using a GCM-encrypted cipher. Seems redundant considering TLS is REQUIRED for SSO. I *think* this was done to facilitate code reuse but can be cleaned up in Connectors V2.

Note: the handshake requires a sharedSecurityToken because the OAuth tokens generated for the initial request are used to spawn parallel connections. Without session multiplexing, care must be taken to ensure refresh tokens are spent exactly once when refresh token rotation is enabled.

OKTA_NATIVE_SSO

public static final XGConnection.HandshakeType OKTA_NATIVE_SSO

The Native SSO Token is stored on the local filesystem. The path MUST be in the user's home directory. If no token exists at the token file path, we generate one, then encrypt and persist it, allowing the token to be loaded into memory across restarts The Native SSO Token is used to generate id, access and refresh OAuth 2.0 tokens the Ocient database is configured to accept a authorization tokens.

Note: the handshake does not require a sharedSecurityToken because the native token is used to generate NEW OAuth 2.0 tokens for any parallel connections spawned by the JDBC client.

See https://developer.okta.com/docs/guides/configure-native-sso/main/

 .
                                              +---------+                         +---------+                      +-----------------------+
                                              | Client  |                         | Server  |                      | Authorization_Server  |
                                              +---------+                         +---------+                      +-----------------------+
 ------------------------------------------------\ |                                   |                                       |
 | Read Okta configuration from local filesystem |‑|                                   |                                       |
 |-----------------------------------------------| |                                   |                                       |
             ------------------------------------\ |                                   |                                       |
             | Opens web browser on host machine |‑|                                   |                                       |
             |-----------------------------------| |                                   |                                       |
                                                   |                                   |                                       |
                                                   | Direct User to Authorization Server login                                 |
                                                   |-------------------------------------------------------------------------->|
                                                   |                                   |                                       | ---------------------------------------------------\
                                                   |                                   |                                       |‑| User logs in and completes authorization request |
                                                   |                                   |                                       | |--------------------------------------------------|
                                                   |                                   |                                       |
                                                   |                                   |                       (device_secret) |
                                                   |<--------------------------------------------------------------------------|
        -----------------------------------------\ |                                   |                                       |
        | Persist device_secret using JWE format |‑|                                   |                                       |
        |----------------------------------------| |                                   |                                       |
                                                   |                                   |                                       |
                                                   | Exchange device_secret for tokens (repeatable)                            |
                                                   |-------------------------------------------------------------------------->|
                                                   |                                   |                                       |
                                                   |                                   |          (id, access, refresh tokens) |
                                                   |<--------------------------------------------------------------------------|
                                                   |                                   |                                       |
                                                   | GCM (id, access, refresh tokens)  |                                       |
                                                   |---------------------------------->|                                       |
                                                   |                                   | --------------------------\           |
                                                   |                                   |‑| Server validates tokens |           |
                                                   |                                   | |-------------------------|           |
                                                   |                                   |                                       |

 
 

OKTA_SESSION_TOKEN

public static final XGConnection.HandshakeType OKTA_SESSION_TOKEN

This handshake was reluctantly added to provide a scriptable solution for testing Okta SSO. Session Tokens are one-time-use tokens issued by Okta's Authentication API that can be exchanged for OAuth 2.0 tokens using the Authorization Code Flow. Importantly, the Session Token is a bearer token.

Every authentication transaction starts with primary authentication which validates a user's primary password credential. Password Policy, MFA Policy, and Sign-On Policy are evaluated during primary authentication to determine if the user's password is expired, a Factor should be enrolled, or additional verification is required. The transaction state of the response depends on the user's status, group memberships and assigned policies.

See https://developer.okta.com/docs/reference/api/authn/#primary-authentication See https://developer.okta.com/docs/reference/api/oidc/#authorize

 .

                                      +---------+                         +---------+                       +-----------------------+
                                      | Client  |                         | Server  |                       | Authorization_Server  |
                                      +---------+                         +---------+                       +-----------------------+
                                           |                                   |                                        |
                                           | Fetch Authenticators for db       |                                        |
                                           |---------------------------------->|                                        |
                                           |                                   |                                        |
                                           |                  (Authenticators) |                                        |
                                           |<----------------------------------|                                        |
 ----------------------------------------\ |                                   |                                        |
 | Ask User for Okta Username & Password |‑|                                   |                                        |
 |---------------------------------------| |                                   |                                        |
                                           |                                   |                                        |
                                           | Request sessionToken using Okta's /v1/authn endpoint                       |
                                           |--------------------------------------------------------------------------->|
                                           |                                   |                                        |
                                           |                                   |                         (sessionToken) |
                                           |<---------------------------------------------------------------------------|
                                           |                                   |                                        |
                                           | Initiate Authorization Code w/ PKCE flow(include sessionToken)             |
                                           |--------------------------------------------------------------------------->|
                                           |                                   |                                        | ---------------------------------------------------\
                                           |                                   |                                        |‑| sessionToken is exchanged for authorization_code |
                                           |                                   |                                        | |--------------------------------------------------|
                                           |                                   |                                        |
                                           |                                   |                   (authorization_code) |
                                           |<---------------------------------------------------------------------------|
                                           |                                   |                                        |
                                           | Exchange authorization_code for tokens                                     |
                                           |--------------------------------------------------------------------------->|
                                           |                                   |                                        |
                                           |                                   |           (id, access, refresh tokens) |
                                           |<---------------------------------------------------------------------------|
                                           |                                   |                                        |
                                           | (id, access, refresh tokens)      |                                        |
                                           |---------------------------------->|                                        |
                                           |                                   | --------------------------\            |
                                           |                                   |‑| Server validates tokens |            |
                                           |                                   | |-------------------------|            |
                                           |                                   |                                        |
 
 

Method Details

values

public static XGConnection.HandshakeType[] values()

Returns an array containing the constants of this enum class, in the order they are declared.

Returns:

an array containing the constants of this enum class, in the order they are declared

valueOf

public static XGConnection.HandshakeType valueOf(String name)

Returns the enum constant of this class with the specified name. The string must match exactly an identifier used to declare an enum constant in this class. (Extraneous whitespace characters are not permitted.)

Parameters:

name - the name of the enum constant to be returned.

Returns:

the enum constant with the specified name

Throws:

IllegalArgumentException - if this enum class has no constant with the specified name

NullPointerException - if the argument is null

sso

public boolean sso()

hasSharedSecurityToken

public boolean hasSharedSecurityToken()