Class SecomIdentityHints

Namespace

EncDotNet.S100.Collections.Secom

Assembly

EncDotNet.S100.Collections.dll

Judges which identities a SECOM service may accept, for the picker's hints (#883).

public static class SecomIdentityHints

Inheritance

object

SecomIdentityHints

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

A service that asks for a client certificate during the TLS handshake usually names the CAs it accepts. An identity whose chain (found through the trust anchors) holds one of them is IssuerAccepted; any other is IssuerNotAccepted.

SECOM 2.0 signed-request services (KHRA, KRISO), and some TLS servers, name no CAs. Then the fallback is the MCP instance: an identity issued under the same trust anchor as the server's own certificate (the same MCP instance, e.g. "MCP MCC") is accepted, one under another anchor is not, and when the server's certificate chains to no anchor (a public CA) nothing is suggested. When the service's MRN is known, the MRNs' instance parts (urn:mrn:mcp:<type>:<instance>:…) are compared too.

A refusal remembered for the source wins over both: it's RefusedHere. Nothing is ever chosen from a hint: the user picks.

Methods

Instance(string?)

The MCP instance part of an MRN (urn:mrn:mcp:vessel:mcc:… → mcc), or null.

public static string? Instance(string? mrn)

Parameters

mrn string

Returns

string

Judge(string, SecomClientIdentity, SecomTrustAnchors, IReadOnlyList<string>, string?, IEnumerable<string>, string?)

The hint for one identity.

public static SecomIdentityHint Judge(string id, SecomClientIdentity identity, SecomTrustAnchors anchors, IReadOnlyList<string> acceptableIssuers, string? serverAnchor, IEnumerable<string> refusedIds, string? serviceMrn = null)

Parameters

id string

The identity's reference id.

identity SecomClientIdentity

The identity.

anchors SecomTrustAnchors

The trust anchors its chain is found through.

acceptableIssuers IReadOnlyList<string>

The CAs the server named, by distinguished name.

serverAnchor string

The anchor the server's own certificate chains to, if any.

refusedIds IEnumerable<string>

The identities the source already presented and saw refused.

serviceMrn string

The service's MRN, when known (from the service registry).

Returns

SecomIdentityHint