public interface Management
| Modifier and Type | Method and Description |
|---|---|
CwsResponse |
authenticated(Authentication request)
Simple check to see if a Member is authenticated to work with this
CWS instance.
|
FetchCircleResponse |
fetchCircles(FetchCircleRequest request)
This request will fetch a list of all Circles in the system.
|
FetchMemberResponse |
fetchMembers(FetchMemberRequest request)
Allows the retrieval of existing Member Accounts from the System, if
a specific Account is requested, then a list of Circles where the Account
is also a Trustee is returned.
|
FetchTrusteeResponse |
fetchTrustees(FetchTrusteeRequest request)
With this request, it is possible to retrieve a list of Trustees,
belonging to either a Member, or a Circle.
|
MasterKeyResponse |
masterKey(MasterKeyRequest request)
The Master Key is a special symmetric key, which is used to encrypt
and decrypt all Initial Vectors & Member Salt values.
|
ProcessCircleResponse |
processCircle(ProcessCircleRequest request)
With this request it is possible to process Circles.
|
ProcessMemberResponse |
processMember(ProcessMemberRequest request)
When a fresh installation is made, the Database contain one account,
which is the System Administrator (admin), this account does not contain
any pre-defined security settings, i.e.
|
ProcessTrusteeResponse |
processTrustee(ProcessTrusteeRequest request)
With this request it is possible to process Trustees.
|
SanityResponse |
sanitized(SanityRequest request)
Data stored encrypted is nothing but a long array of bytes.
|
SettingResponse |
settings(SettingRequest request)
This request allows the System Administrator to read and alter the
Settings of this CWS system.
|
VersionResponse |
version()
Returns the current Version of the running CWS instance.
|
VersionResponse version()
Returns the current Version of the running CWS instance. This method serves mainly as a simply way to check if the system is operational.
SettingResponse settings(SettingRequest request)
This request allows the System Administrator to read and alter the Settings of this CWS system. Please be aware, that some fields cannot be altered once the system is started, as it may have fatal consequences for running system.
The following is the standard settings, and the values which they will expect. If the value is invalid or cannot be transferred into something which the CWS can understand, then no entries is being updated and the request will respond with a warning
request - Request ObjectMasterKeyResponse masterKey(MasterKeyRequest request)
The Master Key is a special symmetric key, which is used to encrypt and decrypt all Initial Vectors & Member Salt values. The key is only kept in memory and is never persisted. Meaning, that it must be set when the CWS instance is started - otherwise, the entire system is rendered useless.
There is a default Master Key, which is based on known values in the system. So, even if this key is not set by an Administrator, it is still used throughout the system. However, as the default key is based on known values, it cannot be used to enhance security. To accomplish this, it must be set by the System Administrator.
Note, that it is very important that the MasterKey is set after the system Salt has been updated. As the system Salt is required by the Master Key, it and can only be updated by this request, it will make the system completely unusable.
request - Request ObjectSanityResponse sanitized(SanityRequest request)
Data stored encrypted is nothing but a long array of bytes. If, over time, an error occurs the da storage so a few bits have been flipped, then it is not possible to decrypt the data.
The stored data is having a checksum, which is written when the data is stored and checked when the data is read out. The checksum is made from the encrypted data.
The build-in sanity checks will run over all persisted data either at predefined intervals or during startup. If a record is no longer valid, i.e. the checksum becomes invalid, then the record is marked as failed, and thus unusable. It should be possible for administrators to recover these from backups, but it requires that it is known when the failure occurred - which this request can help with ascertaining.
The request can be invoked by the System Administrator, which can then return a complete list of all failures, or it can be invoked by a Circle Administrator, and result in a list of Objects failing for a given Circle or all Circles Administrated by the Circle Administrator. It is also possible to provide a timestamp, to only get failures reported since a certain time.
The response Object contain a Map of ObjectIds which has failed, with the value being the timestamp of the first check where it failed.
request - Request ObjectCwsResponse authenticated(Authentication request)
Simple check to see if a Member is authenticated to work with this
CWS instance. The Response will return ReturnCode.SUCCESS
if authentication information exists, otherwise an error is returned
together with a more detailed message.
request - Authentication Request ObjectFetchMemberResponse fetchMembers(FetchMemberRequest request)
Allows the retrieval of existing Member Accounts from the System, if a specific Account is requested, then a list of Circles where the Account is also a Trustee is returned.
request - Request ObjectProcessMemberResponse processMember(ProcessMemberRequest request)
When a fresh installation is made, the Database contain one account, which is the System Administrator (admin), this account does not contain any pre-defined security settings, i.e. no Asymmetric Key. Rather, the first invocation will set the Key on the account, based on the security credentials provided. This is done to avoid that the System Administrator account remain unchanged, i.e. that the default information is still present.
Any subsequent ProcessMember request made, must be one of the following:
Add new Member: Adding a new Member can be done by either the System Administrator or a Circle Administrator, in preparation to adding the Member to one or more Circles being administrated by the Circle Administrator.
Alter Member: It is possible for a System Administrator to alter Accounts, and change the Role - which may allow someone else to become System Administrator, or simply revoke the role.
A special variant for creating new Accounts is via Invitations, where the System Administrator can issue a signed invitation to a potential Member. If this is made, then the armoredKey, will contain a Signature, rather than a Private Key in the Response.
Login / Logout Linking and unlinking a Session with an Account. This is to help websites to use CWS without needing to store the Account credentials in an unsafe way.
Update existing Member This action will only affect a member's own Account. Whereby it is allowed to change the Account Name, provided the name has not been taken. It is also possible to update the credentials (PassPhrase), and to change the Public Key belonging to an account and which others may see.
Update Credential It is possible for an active member to update the credentials used for authentication, but it is not possible to update the credentials for anyone else, not even an administrator can update the credentials for anyone else. The reason for this, is that the credentials is used to unlock the internal keys and this cannot be done by anyone else than the current owner of an account.
Remove Member Removing a Member from the system, can be done either by the Member (to remove themselves) or by the System Administrator. A Circle Administrator cannot remove a Member from the system. Removal of a Member will automatically remove all Data belonging to the Member, i.e. the Circle relations and the Member details.
It is also possible, via this request, to invalidate the account, meaning that the account will appear correct, but it is not possible to either read or write data in any Circles. The Account can be later corrected, by replacing all existing Trustee records.
request - Request Object with details for the ProcessingFetchCircleResponse fetchCircles(FetchCircleRequest request)
This request will fetch a list of all Circles in the system.
request - Fetch Circle Request ObjectProcessCircleResponse processCircle(ProcessCircleRequest request)
With this request it is possible to process Circles. The request may be invoked by all members, allowing members to create the different types of connections needed to sharing of data.
If a request to create a new Circle is made by a member, then the initial Circle Administrator will automatically be set to the Member. If the request is made by the System administrator, then a Member Id is required, as it is not allowed for the System Administrator to be part of any Circles.
The Request supports the following Actions:
Action.CREATE a new
Circle. This can only be performed by the System Administrator. It
allows the creation of a new Circle with a default new Circle
Administrator, which cannot be the System Administrator.Action.UPDATE an existing
Circle, i.e. rename it.Action.DELETE an existing
Circle from the System. This action cannot be reverted - once Deleted,
the Keys and Data will also be deleted.request - Request ObjectFetchTrusteeResponse fetchTrustees(FetchTrusteeRequest request)
With this request, it is possible to retrieve a list of Trustees, belonging to either a Member, or a Circle. A Trustee, is a member who has been granted access to a Circle either as Circle Administrator, Write access or Read access only.
If no MemberId or CircleId is provided, a listing of the requesting Member's Trustee information is being returned. If both MemberId and CircleId is set, then a list with either one or zero records is being returned.
It should be noted, that the request is limited in what it returns, so unless the requesting user is System Administrator, only Trustee information from Circles of Trust, of which the user belongs too, is returned. If no information can be found, an error is returned.
request - Fetch Circle Request ObjectProcessTrusteeResponse processTrustee(ProcessTrusteeRequest request)
With this request it is possible to process Trustees. A Trustee, is a Member which has been granted access to a Circle, and thereby is able to access the Circle Key to both encrypt and decrypt Circle Data.
The Request supports the following Actions:
Action.ADD a new Trustee
to the Circle, i.e. an Account other than the System Administrator with
a specific Trust level.Action.ALTER the level of
trust for a given Trustee towards the Circle.Action.REMOVE a Trustee
from the Circle, meaning that the Account will no longer be able to
access any data belonging to the Circle.The System Administrator is not allowed to be a Trustee of a Circle, as this may pose as a conflict of interest or potentially as a Security issue.
request - Request ObjectCopyright © 2019 JavaDog.io. All rights reserved.