Package com.unboundid.ldap.sdk.unboundidds.extensions

Class RevokeTOTPSharedSecretExtendedRequest

java.lang.Object
com.unboundid.ldap.sdk.LDAPRequest
com.unboundid.ldap.sdk.ExtendedRequest
com.unboundid.ldap.sdk.unboundidds.extensions.RevokeTOTPSharedSecretExtendedRequest
All Implemented Interfaces:
ProtocolOp, ReadOnlyLDAPRequest, Serializable
@NotMutable @ThreadSafety(level=COMPLETELY_THREADSAFE) public final class RevokeTOTPSharedSecretExtendedRequest extends ExtendedRequest
This class provides an implementation of an extended request that may be used to revoke one or all of the TOTP shared secrets for a user so that they may no longer be used to authenticate.
NOTE: This class, and other classes within the com.unboundid.ldap.sdk.unboundidds package structure, are only supported for use against Ping Identity, UnboundID, and Nokia/Alcatel-Lucent 8661 server products. These classes provide support for proprietary functionality or for external specifications that are not considered stable or mature enough to be guaranteed to work in an interoperable way with other types of LDAP servers.

This request may be invoked in one of following ways:

  • With a null authentication identity and a non-null TOTP shared secret. In this case, the authorization identity for the operation (typically the user as whom the underlying connection is authenticated, but possibly a different user if the request also includes a control like the proxied authorization or intermediate client request control that specifies and alternate authorization identity, or if the client authenticated with a SASL mechanism that included an alternate authorization identity) will be used as the authentication identity for this request, and only the specified TOTP shared secret will be removed from the user's entry while any other shared secrets that may be present in the user's entry will be preserved. If a static password is provided, then it will be verified, but if none is given then the provided TOTP shared secret will be considered sufficient proof of the user's identity.
  • With a null authentication identity, a non-null static password, and a null TOTP shared secret. In this case, the authorization identity for the operation will be used as the authentication identity for this request, and, if the provided static password is valid, then all TOTP secrets contained in the user's entry will be revoked.
  • With a non-null authentication identity and a non-null TOTP shared secret. In this case, only the provided TOTP shared secret will be removed from the specified user's account while any other shared secrets will be preserved. If a static password is provided, then it will be verified, but if none is given then the provided TOTP shared secret will be considered sufficient proof of the user's identity.
  • With a non-null authentication identity a non-null static password, and a null TOTP shared secret. In this case, if the static password is valid for the specified user, then all TOTP shared secrets for that user will be revoked.
  • With a non-null authentication identity a null static password, and a null TOTP shared secret. In this case, the authentication identity from the request must be different from the authorization identity for the operation, and the authorization identity must have the password-reset privilege. All TOTP shared secrets for the specified user will be revoked.


This extended request has an OID of 1.3.6.1.4.1.30221.2.6.58, and it must include a request value with the following encoding: 

   RevokeTOTPSharedSecretRequest ::= SEQUENCE {
        authenticationID     [0] OCTET STRING OPTIONAL,
        staticPassword       [1] OCTET STRING OPTIONAL,
        totpSharedSecret     [2] OCTET STRING OPTIONAL,
        ... }
See Also:

  • Field Details

  • Constructor Details

    • RevokeTOTPSharedSecretExtendedRequest

      public RevokeTOTPSharedSecretExtendedRequest(@Nullable String authenticationID, @Nullable String staticPassword, @Nullable String totpSharedSecret, @Nullable Control... controls)
      Creates a new revoke TOTP shared secret extended request with the provided information.
      Parameters:
      authenticationID - The authentication ID to use to identify the user for whom to revoke the TOTP shared secret. It should be a string in the form "dn:" followed by the DN of the target user, or "u:" followed by the username. It may be null if the authorization identity for the operation should be used as the authentication identity for this request.
      staticPassword - The static password of the user for whom the TOTP shared secrets are to be revoked. It may be null if the provided totpSharedSecret is non-null, or if the authenticationID is non-null and the operation's authorization identity has the password-reset privilege.
      totpSharedSecret - The base32-encoded representation of the TOTP shared secret to revoke. It may be null if all TOTP shared secrets should be purged from the target user's entry. If it is null, then either the staticPassword element must be non-null, or the authenticationID element must be non-null, must be different from the operation's authorization identity, and the authorization identity must have the password-reset privilege.
      controls - The set of controls to include in the request. It may be null or empty if there should not be any request controls.

    • RevokeTOTPSharedSecretExtendedRequest

      public RevokeTOTPSharedSecretExtendedRequest(@Nullable String authenticationID, @Nullable byte[] staticPassword, @Nullable String totpSharedSecret, @Nullable Control... controls)
      Creates a new revoke TOTP shared secret extended request with the provided information.
      Parameters:
      authenticationID - The authentication ID to use to identify the user for whom to revoke the TOTP shared secret. It should be a string in the form "dn:" followed by the DN of the target user, or "u:" followed by the username. It may be null if the authorization identity for the operation should be used as the authentication identity for this request.
      staticPassword - The static password of the user for whom the TOTP shared secrets are to be revoked. It may be null if the provided totpSharedSecret is non-null, or if the authenticationID is non-null and the operation's authorization identity has the password-reset privilege.
      totpSharedSecret - The base32-encoded representation of the TOTP shared secret to revoke. It may be null if all TOTP shared secrets should be purged from the target user's entry. If it is null, then either the staticPassword element must be non-null, or the authenticationID element must be non-null, must be different from the operation's authorization identity, and the authorization identity must have the password-reset privilege.
      controls - The set of controls to include in the request. It may be null or empty if there should not be any request controls.

    • RevokeTOTPSharedSecretExtendedRequest

      public RevokeTOTPSharedSecretExtendedRequest(@Nullable String authenticationID, @Nullable ASN1OctetString staticPassword, @Nullable String totpSharedSecret, @Nullable Control... controls)
      Creates a new revoke TOTP shared secret extended request with the provided information.
      Parameters:
      authenticationID - The authentication ID to use to identify the user for whom to revoke the TOTP shared secret. It should be a string in the form "dn:" followed by the DN of the target user, or "u:" followed by the username. It may be null if the authorization identity for the operation should be used as the authentication identity for this request.
      staticPassword - The static password of the user for whom the TOTP shared secrets are to be revoked. It may be null if the provided totpSharedSecret is non-null, or if the authenticationID is non-null and the operation's authorization identity has the password-reset privilege.
      totpSharedSecret - The base32-encoded representation of the TOTP shared secret to revoke. It may be null if all TOTP shared secrets should be purged from the target user's entry. If it is null, then either the staticPassword element must be non-null, or the authenticationID element must be non-null, must be different from the operation's authorization identity, and the authorization identity must have the password-reset privilege.
      controls - The set of controls to include in the request. It may be null or empty if there should not be any request controls.

    • RevokeTOTPSharedSecretExtendedRequest

      public RevokeTOTPSharedSecretExtendedRequest(@NotNull ExtendedRequest request) throws LDAPException
      Creates a new revoke TOTP shared secret extended request that is decoded from the provided generic extended request.
      Parameters:
      request - The generic extended request to decode as a revoke TOTP shared secret request.
      Throws:
      LDAPException - If a problem is encountered while attempting to decode the provided request.

  • Method Details

    • getAuthenticationID

      @Nullable public String getAuthenticationID()
      Retrieves the authentication ID that identifies the user for whom to revoke the TOTP shared secrets, if provided.
      Returns:
      The authentication ID that identifies the target user, or null if the shared secrets are to be revoked for the operation's authorization identity.

    • getStaticPasswordString

      @Nullable public String getStaticPasswordString()
      Retrieves the string representation of the static password for the target user, if provided.
      Returns:
      The string representation of the static password for the target user, or null if no static password was provided.

    • getStaticPasswordBytes

      @Nullable public byte[] getStaticPasswordBytes()
      Retrieves the bytes that comprise the static password for the target user, if provided.
      Returns:
      The bytes that comprise the static password for the target user, or null if no static password was provided.

    • getTOTPSharedSecret

      @Nullable public String getTOTPSharedSecret()
      Retrieves the base32-encoded representation of the TOTP shared secret to be revoked, if provided.
      Returns:
      The base32-encoded representation of the TOTP shared secret to be revoked, or null if all of the user's TOTP shared secrets should be revoked.

    • duplicate

      @NotNull public RevokeTOTPSharedSecretExtendedRequest duplicate()
      Creates a new instance of this LDAP request that may be modified without impacting this request.. Subclasses should override this method to return a duplicate of the appropriate type.
      Specified by:
      duplicate in interface ReadOnlyLDAPRequest
      Overrides:
      duplicate in class ExtendedRequest
      Returns:
      A new instance of this LDAP request that may be modified without impacting this request.

    • duplicate

      @NotNull public RevokeTOTPSharedSecretExtendedRequest duplicate(@Nullable Control[] controls)
      Creates a new instance of this LDAP request that may be modified without impacting this request. The provided controls will be used for the new request instead of duplicating the controls from this request.. Subclasses should override this method to return a duplicate of the appropriate type.
      Specified by:
      duplicate in interface ReadOnlyLDAPRequest
      Overrides:
      duplicate in class ExtendedRequest
      Parameters:
      controls - The set of controls to include in the duplicate request.
      Returns:
      A new instance of this LDAP request that may be modified without impacting this request.

    • getExtendedRequestName

      @NotNull public String getExtendedRequestName()
      Retrieves the user-friendly name for the extended request, if available. If no user-friendly name has been defined, then the OID will be returned.
      Overrides:
      getExtendedRequestName in class ExtendedRequest
      Returns:
      The user-friendly name for this extended request, or the OID if no user-friendly name is available.

    • toString

      public void toString(@NotNull StringBuilder buffer)
      Appends a string representation of this request to the provided buffer.
      Specified by:
      toString in interface ProtocolOp
      Specified by:
      toString in interface ReadOnlyLDAPRequest
      Overrides:
      toString in class ExtendedRequest
      Parameters:
      buffer - The buffer to which to append a string representation of this request.