ldap-sdk-commits — Notification of commits made to the project repository

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1595] trunk

[<di...@us...>]

Revision: 1595
          http://sourceforge.net/p/ldap-sdk/code/1595
Author:   dirmgr
Date:     2023-03-10 19:24:06 +0000 (Fri, 10 Mar 2023)
Log Message:
-----------
Remove everything but an updated README

Removed all source code from trunk and keep only a README file to
indicate that the LDAP SDK source code will now only be maintained
on GitHub.  The SourceForge project will still be available for the
discussion forums, mailing lists, and downloads.

Modified Paths:
--------------
    trunk/README

Removed Paths:
-------------
    trunk/CONTRIBUTING.md
    trunk/LICENSE-GPLv2.txt
    trunk/LICENSE-LGPLv2.1.txt
    trunk/LICENSE-UnboundID-LDAPSDK.txt
    trunk/LICENSE.md
    trunk/LICENSE.txt
    trunk/README.md
    trunk/SUPPORT.md
    trunk/android-ldap-client/
    trunk/build-src/
    trunk/build.bat
    trunk/build.sh
    trunk/build.xml
    trunk/dist-root/
    trunk/docs/
    trunk/ext/
    trunk/messages/
    trunk/resource/
    trunk/src/
    trunk/tests/
    trunk/version.properties

Deleted: trunk/CONTRIBUTING.md
===================================================================
--- trunk/CONTRIBUTING.md	2023-03-10 17:13:15 UTC (rev 1594)
+++ trunk/CONTRIBUTING.md	2023-03-10 19:24:06 UTC (rev 1595)
@@ -1,38 +0,0 @@
-# Contributing to the UnboundID LDAP SDK for Java
-
-Thanks for taking the time to contribute!
-
-## How can I contribute?
-
-### Reporting bugs
-
-#### Before submitting a bug report
-
-It can be helpful to review the [documentation](https://docs.ldap.com/ldap-sdk/docs/index.html) and [examples](https://docs.ldap.com/ldap-sdk/docs/examples/index.html), including the [Javadocs](https://docs.ldap.com/ldap-sdk/docs/javadoc/index.html). It's also a good idea to search the GitHub [issue tracker](https://github.com/pingidentity/ldapsdk/issues) or the SourceForge [discussion forum](https://sourceforge.net/p/ldap-sdk/discussion/1001257/) to see if your issue or one similar to it has already been reported.
-
-
-#### How do I submit a bug report?
-
-Bugs are tracked as [GitHub issues](https://guides.github.com/features/issues/). You can report a bug by submitting an issue in the project's [issue tracker](https://github.com/pingidentity/ldapsdk/issues). To help the maintainers understand and reproduce the problem, please try to provide information like the following:
-
-* A clear and descriptive title.
-* A description of what happened and a description of what you expected to happen.
-* An example with the exact steps needed to reproduce the problem. If relevant, sample code is helpful.
-
-Please understand that bug reports are reviewed and prioritized internally, and we may not be able to address all bug reports or provide an estimated time for resolution.
-
-#### Suggesting enhancements
-
-As with bugs, requests are tracked as [GitHub issues](https://guides.github.com/features/issues/). You can suggest an enhancement by submitting an issue in the project's [issue tracker](https://github.com/pingidentity/ldapsdk/issues).
-
-Please understand that enhancement requests are reviewed and prioritized internally, and we may not be able to address all requests or provide an estimated time for resolution.
-
-#### Alternate routes for submitting bugs and suggesting enhancements
-
-If you have a support contract with Ping Identity, you can get assistance with the LDAP SDK in the same way that you get support for other Ping Identity products. Contact [lda...@pi...](mailto:lda...@pi...) for more information about obtaining a support contract for the LDAP SDK.
-
-If you would rather not have your issue discussed in public, you can email bug reports or enhancement requests to [lda...@pi...](mailto:lda...@pi...).
-
-### Contributing Code Changes
-
-Ping Identity does not accept third-party code submissions.

Deleted: trunk/LICENSE-GPLv2.txt
===================================================================
--- trunk/LICENSE-GPLv2.txt	2023-03-10 17:13:15 UTC (rev 1594)
+++ trunk/LICENSE-GPLv2.txt	2023-03-10 19:24:06 UTC (rev 1595)
@@ -1,342 +0,0 @@
-                    GNU GENERAL PUBLIC LICENSE
-		       Version 2, June 1991
-
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.
- 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-			    Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Library General Public License instead.)  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
-
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-		    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
-
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software
-    interchange; or,
-
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-
-  8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
-
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and
-"any later version", you have the option of following the terms and
-conditions either of that version or of any later version published by
-the Free Software Foundation.  If the Program does not specify a
-version number of this License, you may choose any version ever
-published by the Free Software Foundation.
-
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
-			    NO WARRANTY
-
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO
-WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
-EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
-OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY
-KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
-PROGRAM IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME
-THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
-WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
-AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU
-FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
-CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
-PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
-RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
-FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF
-SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
-DAMAGES.
-
-		     END OF TERMS AND CONDITIONS
-
-	    How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these
-terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License (GPLv2 only)
-    as published by the Free Software Foundation.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, see <http://www.gnu.org/licenses>.
-
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) year name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Library General
-Public License instead of this License.
-

Deleted: trunk/LICENSE-LGPLv2.1.txt
===================================================================
--- trunk/LICENSE-LGPLv2.1.txt	2023-03-10 17:13:15 UTC (rev 1594)
+++ trunk/LICENSE-LGPLv2.1.txt	2023-03-10 19:24:06 UTC (rev 1595)
@@ -1,504 +0,0 @@
-		  GNU LESSER GENERAL PUBLIC LICENSE
-		       Version 2.1, February 1999
-
- Copyright (C) 1991, 1999 Free Software Foundation, Inc.
- 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-[This is the first released version of the Lesser GPL.  It also counts
- as the successor of the GNU Library Public License, version 2, hence
- the version number 2.1.]
-
-			    Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-Licenses are intended to guarantee your freedom to share and change
-free software--to make sure the software is free for all its users.
-
-  This license, the Lesser General Public License, applies to some
-specially designated software packages--typically libraries--of the
-Free Software Foundation and other authors who decide to use it.  You
-can use it too, but we suggest you first think carefully about whether
-this license or the ordinary General Public License is the better
-strategy to use in any particular case, based on the explanations below.
-
-  When we speak of free software, we are referring to freedom of use,
-not price.  Our General Public Licenses are designed to make sure that
-you have the freedom to distribute copies of free software (and charge
-for this service if you wish); that you receive source code or can get
-it if you want it; that you can change the software and use pieces of
-it in new free programs; and that you are informed that you can do
-these things.
-
-  To protect your rights, we need to make restrictions that forbid
-distributors to deny you these rights or to ask you to surrender these
-rights.  These restrictions translate to certain responsibilities for
-you if you distribute copies of the library or if you modify it.
-
-  For example, if you distribute copies of the library, whether gratis
-or for a fee, you must give the recipients all the rights that we gave
-you.  You must make sure that they, too, receive or can get the source
-code.  If you link other code with the library, you must provide
-complete object files to the recipients, so that they can relink them
-with the library after making changes to the library and recompiling
-it.  And you must show them these terms so they know their rights.
-
-  We protect your rights with a two-step method: (1) we copyright the
-library, and (2) we offer you this license, which gives you legal
-permission to copy, distribute and/or modify the library.
-
-  To protect each distributor, we want to make it very clear that
-there is no warranty for the free library.  Also, if the library is
-modified by someone else and passed on, the recipients should know
-that what they have is not the original version, so that the original
-author's reputation will not be affected by problems that might be
-introduced by others.
-
-  Finally, software patents pose a constant threat to the existence of
-any free program.  We wish to make sure that a company cannot
-effectively restrict the users of a free program by obtaining a
-restrictive license from a patent holder.  Therefore, we insist that
-any patent license obtained for a version of the library must be
-consistent with the full freedom of use specified in this license.
-
-  Most GNU software, including some libraries, is covered by the
-ordinary GNU General Public License.  This license, the GNU Lesser
-General Public License, applies to certain designated libraries, and
-is quite different from the ordinary General Public License.  We use
-this license for certain libraries in order to permit linking those
-libraries into non-free programs.
-
-  When a program is linked with a library, whether statically or using
-a shared library, the combination of the two is legally speaking a
-combined work, a derivative of the original library.  The ordinary
-General Public License therefore permits such linking only if the
-entire combination fits its criteria of freedom.  The Lesser General
-Public License permits more lax criteria for linking other code with
-the library.
-
-  We call this license the "Lesser" General Public License because it
-does Less to protect the user's freedom than the ordinary General
-Public License.  It also provides other free software developers Less
-of an advantage over competing non-free programs.  These disadvantages
-are the reason we use the ordinary General Public License for many
-libraries.  However, the Lesser license provides advantages in certain
-special circumstances.
-
-  For example, on rare occasions, there may be a special need to
-encourage the widest possible use of a certain library, so that it becomes
-a de-facto standard.  To achieve this, non-free programs must be
-allowed to use the library.  A more frequent case is that a free
-library does the same job as widely used non-free libraries.  In this
-case, there is little to gain by limiting the free library to free
-software only, so we use the Lesser General Public License.
-
-  In other cases, permission to use a particular library in non-free
-programs enables a greater number of people to use a large body of
-free software.  For example, permission to use the GNU C Library in
-non-free programs enables many more people to use the whole GNU
-operating system, as well as its variant, the GNU/Linux operating
-system.
-
-  Although the Lesser General Public License is Less protective of the
-users' freedom, it does ensure that the user of a program that is
-linked with the Library has the freedom and the wherewithal to run
-that program using a modified version of the Library.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.  Pay close attention to the difference between a
-"work based on the library" and a "work that uses the library".  The
-former contains code derived from the library, whereas the latter must
-be combined with the library in order to run.
-
-		  GNU LESSER GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License Agreement applies to any software library or other
-program which contains a notice placed by the copyright holder or
-other authorized party saying it may be distributed under the terms of
-this Lesser General Public License (also called "this License").
-Each licensee is addressed as "you".
-
-  A "library" means a collection of software functions and/or data
-prepared so as to be conveniently linked with application programs
-(which use some of those functions and data) to form executables.
-
-  The "Library", below, refers to any such software library or work
-which has been distributed under these terms.  A "work based on the
-Library" means either the Library or any derivative work under
-copyright law: that is to say, a work containing the Library or a
-portion of it, either verbatim or with modifications and/or translated
-straightforwardly into another language.  (Hereinafter, translation is
-included without limitation in the term "modification".)
-
-  "Source code" for a work means the preferred form of the work for
-making modifications to it.  For a library, complete source code means
-all the source code for all modules it contains, plus any associated
-interface definition files, plus the scripts used to control compilation
-and installation of the library.
-
-  Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running a program using the Library is not restricted, and output from
-such a program is covered only if its contents constitute a work based
-on the Library (independent of the use of the Library in a tool for
-writing it).  Whether that is true depends on what the Library does
-and what the program that uses the Library does.
-
-  1. You may copy and distribute verbatim copies of the Library's
-complete source code as you receive it, in any medium, provided that
-you conspicuously and appropriately publish on each copy an
-appropriate copyright notice and disclaimer of warranty; keep intact
-all the notices that refer to this License and to the absence of any
-warranty; and distribute a copy of this License along with the
-Library.
-
-  You may charge a fee for the physical act of transferring a copy,
-and you may at your option offer warranty protection in exchange for a
-fee.
-
-  2. You may modify your copy or copies of the Library or any portion
-of it, thus forming a work based on the Library, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) The modified work must itself be a software library.
-
-    b) You must cause the files modified to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    c) You must cause the whole of the work to be licensed at no
-    charge to all third parties under the terms of this License.
-
-    d) If a facility in the modified Library refers to a function or a
-    table of data to be supplied by an application program that uses
-    the facility, other than as an argument passed when the facility
-    is invoked, then you must make a good faith effort to ensure that,
-    in the event an application does not supply such function or
-    table, the facility still operates, and performs whatever part of
-    its purpose remains meaningful.
-
-    (For example, a function in a library to compute square roots has
-    a purpose that is entirely well-defined independent of the
-    application.  Therefore, Subsection 2d requires that any
-    application-supplied function or table used by this function must
-    be optional: if the application does not supply it, the square
-    root function must still compute square roots.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Library,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Library, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote
-it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Library.
-
-In addition, mere aggregation of another work not based on the Library
-with the Library (or with a work based on the Library) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
-  3. You may opt to apply the terms of the ordinary GNU General Public
-License instead of this License to a given copy of the Library.  To do
-this, you must alter all the notices that refer to this License, so
-that they refer to the ordinary GNU General Public License, version 2,
-instead of to this License.  (If a newer version than version 2 of the
-ordinary GNU General Public License has appeared, then you can specify
-that version instead if you wish.)  Do not make any other change in
-these notices.
-
-  Once this change is made in a given copy, it is irreversible for
-that copy, so the ordinary GNU General Public License applies to all
-subsequent copies and derivative works made from that copy.
-
-  This option is useful when you wish to copy part of the code of
-the Library into a program that is not a library.
-
-  4. You may copy and distribute the Library (or a portion or
-derivative of it, under Section 2) in object code or executable form
-under the terms of Sections 1 and 2 above provided that you accompany
-it with the complete corresponding machine-readable source code, which
-must be distributed under the terms of Sections 1 and 2 above on a
-medium customarily used for software interchange.
-
-  If distribution of object code is made by offering access to copy
-from a designated place, then offering equivalent access to copy the
-source code from the same place satisfies the requirement to
-distribute the source code, even though third parties are not
-compelled to copy the source along with the object code.
-
-  5. A program that contains no derivative of any portion of the
-Library, but is designed to work with the Library by being compiled or
-linked with it, is called a "work that uses the Library".  Such a
-work, in isolation, is not a derivative work of the Library, and
-therefore falls outside the scope of this License.
-
-  However, linking a "work that uses the Library" with the Library
-creates an executable that is a derivative of the Library (because it
-contains portions of the Library), rather than a "work that uses the
-library".  The executable is therefore covered by this License.
-Section 6 states terms for distribution of such executables.
-
-  When a "work that uses the Library" uses material from a header file
-that is part of the Library, the object code for the work may be a
-derivative work of the Library even though the source code is not.
-Whether this is true is especially significant if the work can be
-linked without the Library, or if the work is itself a library.  The
-threshold for this to be true is not precisely defined by law.
-
-  If such an object file uses only numerical parameters, data
-structure layouts and accessors, and small macros and small inline
-functions (ten lines or less in length), then the use of the object
-file is unrestricted, regardless of whether it is legally a derivative
-work.  (Executables containing this object code plus portions of the
-Library will still fall under Section 6.)
-
-  Otherwise, if the work is a derivative of the Library, you may
-distribute the object code for the work under the terms of Section 6.
-Any executables containing that work also fall under Section 6,
-whether or not they are linked directly with the Library itself.
-
-  6. As an exception to the Sections above, you may also combine or
-link a "work that uses the Library" with the Library to produce a
-work containing portions of the Library, and distribute that work
-under terms of your choice, provided that the terms permit
-modification of the work for the customer's own use and reverse
-engineering for debugging such modifications.
-
-  You must give prominent notice with each copy of the work that the
-Library is used in it and that the Library and its use are covered by
-this License.  You must supply a copy of this License.  If the work
-during execution displays copyright notices, you must include the
-copyright notice for the Library among them, as well as a reference
-directing the user to the copy of this License.  Also, you must do one
-of these things:
-
-    a) Accompany the work with the complete corresponding
-    machine-readable source code for the Library including whatever
-    changes were used in the work (which must be distributed under
-    Sections 1 and 2 above); and, if the work is an executable linked
-    with the Library, with the complete machine-readable "work that
-    uses the Library", as object code and/or source code, so that the
-    user can modify the Library and then relink to produce a modified
-    executable containing the modified Library.  (It is understood
-    that the user who changes the contents of definitions files in the
-    Library will not necessarily be able to recompile the application
-    to use the modified definitions.)
-
-    b) Use a suitable shared library mechanism for linking with the
-    Library.  A suitable mechanism is one that (1) uses at run time a
-    copy of the library already present on the user's computer system,
-    rather than copying library functions into the executable, and (2)
-    will operate properly with a modified version of the library, if
-    the user installs one, as long as the modified version is
-    interface-compatible with the version that the work was made with.
-
-    c) Accompany the work with a written offer, valid for at
-    least three years, to give the same user the materials
-    specified in Subsection 6a, above, for a charge no more
-    than the cost of performing this distribution.
-
-    d) If distribution of the work is made by offering access to copy
-    from a designated place, offer equivalent access to copy the above
-    specified materials from the same place.
-
-    e) Verify that the user has already received a copy of these
-    materials or that you have already sent this user a copy.
-
-  For an executable, the required form of the "work that uses the
-Library" must include any data and utility programs needed for
-reproducing the executable from it.  However, as a special exception,
-the materials to be distributed need not include anything that is
-normally distributed (in either source or binary form) with the major
-components (compiler, kernel, and so on) of the operating system on
-which the executable runs, unless that component itself accompanies
-the executable.
-
-  It may happen that this requirement contradicts the license
-restrictions of other proprietary libraries that do not normally
-accompany the operating system.  Such a contradiction means you cannot
-use both them and the Library together in an executable that you
-distribute.
-
-  7. You may place library facilities that are a work based on the
-Library side-by-side in a single library together with other library
-facilities not covered by this License, and distribute such a combined
-library, provided that the separate distribution of the work based on
-the Library and of the other library facilities is otherwise
-permitted, and provided that you do these two things:
-
-    a) Accompany the combined library with a copy of the same work
-    based on the Library, uncombined with any other library
-    facilities.  This must be distributed under the terms of the
-    Sections above.
-
-    b) Give prominent notice with the combined library of the fact
-    that part of it is a work based on the Library, and explaining
-    where to find the accompanying uncombined form of the same work.
-
-  8. You may not copy, modify, sublicense, link with, or distribute
-the Library except as expressly provided under this License.  Any
-attempt otherwise to copy, modify, sublicense, link with, or
-distribute the Library is void, and will automatically terminate your
-rights under this License.  However, parties who have received copies,
-or rights, from you under this License will not have their licenses
-terminated so long as such parties remain in full compliance.
-
-  9. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Library or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Library (or any work based on the
-Library), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Library or works based on it.
-
-  10. Each time you redistribute the Library (or any work based on the
-Library), the recipient automatically receives a license from the
-original licensor to copy, distribute, link with or modify the Library
-subject to these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties with
-this License.
-
-  11. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Library at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Library by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Library.
-
-If any portion of this section is held invalid or unenforceable under any
-particular circumstance, the balance of the section is intended to apply,
-and the section as a whole is intended to apply in other circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-
-  12. If the distribution and/or use of the Library is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Library under this License may add
-an explicit geographical distribution limitation excluding those countries,
-so that distribution is permitted only in or among countries not thus
-excluded.  In such case, this License incorporates the limitation as if
-written in the body of this License.
-
-  13. The Free Software Foundation may publish revised and/or new
-versions of the Lesser General Public License from time to time.
-Such new versions will be similar in spirit to the present version,
-but may differ in detail to address new problems or concerns.
-
-Each version is given a distinguishing version number.  If the Library
-specifies a version number of this License which applies to it and
-"any later version", you have the option of following the terms and
-conditions either of that version or of any later version published by
-the Free Software Foundation.  If the Library does not specify a
-license version number, you may choose any version ever published by
-the Free Software Foundation.
-
-  14. If you wish to incorporate parts of the Library into other free
-programs whose distribution conditions are incompatible with these,
-write to the author to ask for permission.  For software which is
-copyrighted by the Free Software Foundation, write to the Free
-Software Foundation; we sometimes make exceptions for this.  Our
-decision will be guided by the two goals of preserving the free status
-of all derivatives of our free software and of promoting the sharing
-and reuse of software generally.
-
-			    NO WARRANTY
-
-  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
-WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
-EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
-OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
-KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
-LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
-THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
-WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
-AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
-FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
-CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
-LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
-RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
-FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
-SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
-DAMAGES.
-
-		     END OF TERMS AND CONDITIONS
-
-           How to Apply These Terms to Your New Libraries
-
-  If you develop a new library, and you want it to be of the greatest
-possible use to the public, we recommend making it free software that
-everyone can redistribute and change.  You can do so by permitting
-redistribution under these terms (or, alternatively, under the terms of the
-ordinary General Public License).
-
-  To apply these terms, attach the following notices to the library.  It is
-safest to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least the
-"copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the library's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Lesser General Public
-    License as published by the Free Software Foundation; either
-    version 2.1 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Lesser General Public License for more details.
-
-    You should have received a copy of the GNU Lesser General Public
-    License along with this library; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
-
-Also add information on how to contact you by electronic and paper mail.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the library, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the
-  library `Frob' (a library for tweaking knobs) written by James Random Hacker.
-
-  <signature of Ty Coon>, 1 April 1990
-  Ty Coon, President of Vice
-
-That's all there is to it!
-
-

Deleted: trunk/LICENSE-UnboundID-LDAPSDK.txt
===================================================================
--- trunk/LICENSE-UnboundID-LDAPSDK.txt	2023-03-10 17:13:15 UTC (rev 1594)
+++ trunk/LICENSE-UnboundID-LDAPSDK.txt	2023-03-10 19:24:06 UTC (rev 1595)
@@ -1,92 +0,0 @@
-                     UnboundID LDAP SDK Free Use License
-
-THIS IS AN AGREEMENT BETWEEN YOU ("YOU") AND PING IDENTITY CORPORATION
-("PING IDENTITY") REGARDING YOUR USE OF UNBOUNDID LDAP SDK FOR JAVA AND ANY
-ASSOCIATED DOCUMENTATION, OBJECT CODE, COMPILED LIBRARIES, SOURCE CODE AND
-SOURCE FILES OR OTHER MATERIALS MADE AVAILABLE BY PING IDENTITY (COLLECTIVELY
-REFERRED TO IN THIS AGREEMENT AS THE ("SDK").
-
-BY INSTALLING, ACCESSING OR OTHERWISE USING THE SDK, YOU ACCEPT THE TERMS OF
-THIS AGREEMENT.  IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT, DO NOT
-INSTALL, ACCESS OR USE THE SDK.
-
-USE OF THE SDK.  Subject to your compliance with this Agreement, Ping Identity
-grants to You a non-exclusive, royalty-free license, under Ping Identity's
-intellectual property rights in the SDK, to use, reproduce, modify and
-distribute this release of the SDK; provided that no license is granted herein
-under any patents that may be infringed by your modifications, derivative works
-or by other works in which the SDK may be incorporated (collectively, your
-"Applications").  You may reproduce and redistribute the SDK with your
-Applications provided that you (i) include this license file and an
-unmodified copy of the unboundid-ldapsdk.jar file; and (ii) such
-redistribution is subject to a license whose terms do not conflict with or
-contradict the terms of this Agreement. You may also reproduce and redistribute
-the SDK without your Applications provided that you redistribute the SDK
-complete and unmodified (i.e., with all "read me" files, copyright notices, and
-other legal notices and terms that Ping Identity has included in the SDK).
-
-SCOPE OF LICENSES.  This Agreement does not grant You the right to use any Ping
-Identity intellectual property which is not included as part of the SDK.  The
-SDK is licensed, not sold.  This Agreement only gives You some rights to use
-the SDK.  Ping Identity reserves all other rights. Unless applicable law gives
-You more rights despite this limitation, You may use the SDK only as expressly
-permitted in this Agreement.
-
-SUPPORT.  Ping Identity is not obligated to provide any technical or other
-support ("Support Services") for the SDK to You under this Agreement. However,
-if Ping Identity chooses to provide any Support Services to You, Your use of
-such Support Services will be governed by then-current Ping Identity support
-policies.
-
-TERMINATION.  Ping Identity reserves the right to discontinue offering the SDK
-and to modify the SDK at any time in its sole discretion.  Notwithstanding
-anything contained in this Agreement to the contrary, Ping Identity may also,
-in its sole discretion, terminate or suspend access to the SDK to You or any
-end user at any time.  In addition, if you fail to comply with the terms of
-this Agreement, then any rights granted herein will be automatically terminated
-if such failure is not corrected within 30 days of the initial notification of
-such failure.  You acknowledge that termination and/or monetary damages may not
-be a sufficient remedy if You breach this Agreement and that Ping Identity will
-be entitled, without waiving any other rights or remedies, to injunctive or
-equitable relief as may be deemed proper by a court of competent jurisdiction
-in the event of a breach.  Ping Identity may also terminate this Agreement if
-the SDK becomes, or in Ping Identity's reasonable opinion is likely to become,
-the subject of a claim of intellectual property infringement or trade secret
-misappropriation.  All rights and licenses granted herein will simultaneously
-and automatically terminate upon termination of this Agreement for any reason.
-
-DISCLAIMER OF WARRANTY. THE SDK IS PROVIDED "AS IS" AND PING IDENTITY DOES NOT
-WARRANT THAT THE SDK WILL BE ERROR-FREE, VIRUS-FREE, WILL PERFORM IN AN
-UNINTERRUPTED, SECURE OR TIMELY MANNER, OR WILL INTEROPERATE WITH OTHER
-HARDWARE, SOFTWARE, SYSTEMS OR DATA.  TO THE MAXIMUM EXTENT ALLOWED BY LAW, ALL
-CONDITIONS, REPRESENTATIONS AND WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY
-OR OTHERWISE INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE (EVEN IF PING IDENTITY HAD
-BEEN INFORMED OF SUCH PURPOSE), OR NON-INFRINGEMENT OF THIRD PARTY RIGHTS ARE
-HEREBY DISCLAIMED.
-
-LIMITATION OF LIABILITY.  IN NO EVENT WILL PING IDENTITY OR ITS SUPPLIERS BE
-LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, LOST PROFITS,
-REVENUE, DATA OR DATA USE, BUSINESS INTERRUPTION, COST OF COVER, DIRECT,
-INDIRECT, SPECIAL, PUNITIVE, INCIDENTAL OR CONSEQUENTIAL DAMAGES OF ANY KIND)
-ARISING OUT OF THE USE OF OR INABILITY TO USE THE SDK OR IN ANY WAY RELATED TO
-THIS AGREEMENT, EVEN IF PING IDENTITY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-ADDITIONAL RIGHTS.  Certain states do not allow the exclusion of implied
-warranties or limitation of liability for certain kinds of damages, so the
-exclusion of limited warranties and limitation of liability set forth above may
-not apply to You.
-
-EXPORT RESTRICTIONS.  The SDK is subject to United States export control laws.
-You acknowledge and agree that You are responsible for compliance with all
-domestic and international export laws and regulations that apply to the SDK.
-
-MISCELLANEOUS.  This Agreement constitutes the entire agreement with respect to
-the SDK.  If any provision of this Agreement shall be held to be invalid,
-illegal or unenforceable, the validity, legality and enforceability of the
-remaining provisions shall in no way be affected or impaired thereby. This
-Agreement and performance hereunder shall be governed by and construed in
-accordance with the laws of the State of Texas without regard to its conflict
-of laws rules.  Any disputes related to this Agreement shall be exclusively
-litigated in the state or federal courts located in Travis County, Texas.

Deleted: trunk/LICENSE.md
===================================================================
--- trunk/LICENSE.md	2023-03-10 17:13:15 UTC (rev 1594)
+++ trunk/LICENSE.md	2023-03-10 19:24:06 UTC (rev 1595)
@@ -1,236 +0,0 @@
-# UnboundID LDAP SDK for Java License Information
-
-As of version 5.0.0, the UnboundID LDAP SDK for Java is available under the terms of the Apache License, Version 2.0, which is a very permissive OSI-approved open source license. This is the recommended license for all new uses of the LDAP SDK.  More information about the terms of the Apache License, Version 2.0, as well as the full text of the license, is provided below.
-
-Versions of the LDAP SDK prior to 5.0.0 were available under three other licenses:
-
-* The OSI-approved GNU General Public License version 2 ([GPLv2](https://raw.githubusercontent.com/pingidentity/ldapsdk/master/LICENSE-GPLv2.txt)).
-* The OSI-approved GNU Lesser General Public License version 2.1 ([LGPLv2.1](https://raw.githubusercontent.com/pingidentity/ldapsdk/master/LICENSE-LGPLv2.1.txt))
-* The not-open-source-but-still-free-to-use [UnboundID Free Use License](https://raw.githubusercontent.com/pingidentity/ldapsdk/master/LICENSE-UnboundID-LDAPSDK.txt)
-
-The LDAP SDK is still available to use under the terms of these licenses for backward compatibility (or if you simply prefer them over the Apache License for some reason).
-
-Further, licensees of Ping Identity, UnboundID, and Nokia/Alcatel-Lucent 8661 server products may also use the LDAP SDK under the terms of the server product licenses.
-
-
-## The Basic Requirements of the Apache License, Version 2.0
-
-The Apache License, Version 2.0 is very permissive, and it should be possible to use the LDAP SDK under the terms of this license in just about any application, whether open source or proprietary, and whether free or paid. You can use it privately, and you are free to distribute the LDAP SDK in source and/or compiled form, either on its own as part of a larger work. If any of the software is covered by patents, then you are granted the right to use those patents in the context of the LDAP SDK.
-
-The main requirements when using the LDAP SDK under the terms of the Apache License, Version 2.0 are as follows:
-
-* You are required to include the text of the full license (as provided below, or online at [https://www.apache.org/licenses/LICENSE-2.0](https://www.apache.org/licenses/LICENSE-2.0)) with your application.
-
-* You are not required to provide source code for the LDAP SDK, even if you make changes to it. However, if you do distribute the source code for the LDAP SDK, then you are not permitted not remove any existing copyright notices. If you distribute a modified version of the LDAP SDK source code, then you need to indicate what changes you made to it.
-
-* You cannot hold Ping Identity Corporation or any developers liable for any defects or other problems found with the software.
-
-* You are not permitted to use any Ping Identity or UnboundID trademarks.  You can say that your application uses the UnboundID LDAP SDK for Java as developed by Ping Identity Corporation, and if you distribute a modified version, then you can say that it is based on the UnboundID LDAP SDK for Java as developed by Ping Identity Corporation, but you can't use UnboundID or Ping Identity in the name of your modified version.
-
-
-## The Apache License, Version 2.0
-```
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to ...
 
[truncated message content]

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1594] tags/6.0.8/

[<di...@us...>]

Revision: 1594
          http://sourceforge.net/p/ldap-sdk/code/1594
Author:   dirmgr
Date:     2023-03-10 17:13:15 +0000 (Fri, 10 Mar 2023)
Log Message:
-----------
Created a tag for the 6.0.8 release

Added Paths:
-----------
    tags/6.0.8/

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1593] trunk

[<di...@us...>]

Revision: 1593
          http://sourceforge.net/p/ldap-sdk/code/1593
Author:   dirmgr
Date:     2023-03-08 22:17:17 +0000 (Wed, 08 Mar 2023)
Log Message:
-----------
Update documentation for filter creation

Updated the documentation so that it uses new newer, shorter method
names in cases where it demonstrates creating a filter from its
components.

Modified Paths:
--------------
    trunk/docs/advantages/security.html
    trunk/docs/getting-started/controls.html
    trunk/src/com/unboundid/ldap/sdk/Filter.java

Modified: trunk/docs/advantages/security.html
===================================================================
--- trunk/docs/advantages/security.html	2023-03-08 17:40:13 UTC (rev 1592)
+++ trunk/docs/advantages/security.html	2023-03-08 22:17:17 UTC (rev 1593)
@@ -383,10 +383,10 @@
               </p>
 
               <pre>
-Filter filter = Filter.createANDFilter(
-     Filter.createEqualityFilter("cn", searchText),
-     Filter.createEqualityFilter("sn", searchText),
-     Filter.createEqualityFilter("givenName", searchText));
+Filter filter = Filter.and(
+     Filter.equals("cn", searchText),
+     Filter.equals("sn", searchText),
+     Filter.equals("givenName", searchText));
 </pre>
 
               <p>

Modified: trunk/docs/getting-started/controls.html
===================================================================
--- trunk/docs/getting-started/controls.html	2023-03-08 17:40:13 UTC (rev 1592)
+++ trunk/docs/getting-started/controls.html	2023-03-08 22:17:17 UTC (rev 1593)
@@ -263,7 +263,7 @@
 // but without including the subentries request control.  This should not
 // return any matching entries.
 SearchRequest searchRequest = new SearchRequest("dc=example,dc=com",
-     SearchScope.SUB, Filter.createEqualityFilter("cn", "test subentry"));
+     SearchScope.SUB, Filter.equals("cn", "test subentry"));
 SearchResult resultWithoutControl = connection.search(searchRequest);
 LDAPTestUtils.assertResultCodeEquals(resultWithoutControl,
      ResultCode.SUCCESS);
@@ -380,7 +380,7 @@
 SearchRequest searchRequest = new SearchRequest(
      "uid=test.user,ou=People,dc=example,dc=com", // Base DN
      SearchScope.BASE, // Scope
-     Filter.createPresenceFilter("objectClass"), // Filter
+     Filter.present("objectClass"), // Filter
      "description"); // Attributes to return.
 SearchResultEntry entryRetrievedWithoutControl =
      connection.searchForEntry(searchRequest);
@@ -508,7 +508,7 @@
               <pre>
 SearchRequest persistentSearchRequest = new SearchRequest(
      asyncSearchListener, "dc=example,dc=com", SearchScope.SUB,
-     Filter.createPresenceFilter("objectClass"));
+     Filter.present("objectClass"));
 persistentSearchRequest.addControl(new PersistentSearchRequestControl(
      PersistentSearchChangeType.allChangeTypes(), // Notify change types.
      true, // Only return new changes, don't match existing entries.
@@ -624,7 +624,7 @@
 // first name, both in ascending order.
 SearchRequest searchRequest = new SearchRequest(
      "ou=People,dc=example,dc=com", SearchScope.SUB,
-     Filter.createEqualityFilter("objectClass", "person"));
+     Filter.equals("objectClass", "person"));
 searchRequest.addControl(new ServerSideSortRequestControl(
      new SortKey("sn"), new SortKey("givenName")));
 SearchResult lastNameAscendingResult;
@@ -714,7 +714,7 @@
 int numSearches = 0;
 int totalEntriesReturned = 0;
 SearchRequest searchRequest = new SearchRequest("dc=example,dc=com",
-     SearchScope.SUB, Filter.createEqualityFilter("objectClass", "person"));
+     SearchScope.SUB, Filter.equals("objectClass", "person"));
 ASN1OctetString resumeCookie = null;
 while (true)
 {
@@ -845,7 +845,7 @@
 int numSearches = 0;
 int totalEntriesReturned = 0;
 SearchRequest searchRequest = new SearchRequest("dc=example,dc=com",
-     SearchScope.SUB, Filter.createEqualityFilter("objectClass", "person"));
+     SearchScope.SUB, Filter.equals("objectClass", "person"));
 int vlvOffset = 1;
 int vlvContentCount = 0;
 ASN1OctetString vlvContextID = null;

Modified: trunk/src/com/unboundid/ldap/sdk/Filter.java
===================================================================
--- trunk/src/com/unboundid/ldap/sdk/Filter.java	2023-03-08 17:40:13 UTC (rev 1592)
+++ trunk/src/com/unboundid/ldap/sdk/Filter.java	2023-03-08 22:17:17 UTC (rev 1593)
@@ -200,11 +200,11 @@
  * these problems, it may be better to construct filters from their individual
  * components rather than their string representations, like:
  * <PRE>
- *   Filter f1 = Filter.createPresenceFilter("objectClass");
- *   Filter f2 = Filter.createEqualityFilter("uid", "john.doe");
- *   Filter f3 = Filter.createORFilter(
- *                    Filter.createEqualityFilter("givenName", "John"),
- *                    Filter.createEqualityFilter("givenName", "Johnathan"));
+ *   Filter f1 = Filter.present("objectClass");
+ *   Filter f2 = Filter.equals("uid", "john.doe");
+ *   Filter f3 = Filter.or(
+ *                    Filter.equals("givenName", "John"),
+ *                    Filter.equals("givenName", "Johnathan"));
  * </PRE>
  * In general, it is recommended to avoid creating filters from their string
  * representations if any of that string representation may include

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1592] trunk

[<di...@us...>]

Revision: 1592
          http://sourceforge.net/p/ldap-sdk/code/1592
Author:   dirmgr
Date:     2023-03-08 17:40:13 +0000 (Wed, 08 Mar 2023)
Log Message:
-----------
Remove subversion repository info

Updated the README to remove a reference to checking out the LDAP
SDK source code from a subversion repository rather than from git.
GitHub has announced that they will be discontinuing their support
for subversion access to git repositories, so we will no longer
provide instructions for accessing the code via subversion.

This discontinuation also means that we will stop maintaining a
mirror of the source code in a SourceForge subversion repository
(which was the original location for the open source LDAP SDK
project) because the process we used for mirroring the source code
depended on GitHub's subversion support.

Modified Paths:
--------------
    trunk/README
    trunk/README.md
    trunk/build.xml

Modified: trunk/README
===================================================================
--- trunk/README	2023-03-08 16:35:16 UTC (rev 1591)
+++ trunk/README	2023-03-08 17:40:13 UTC (rev 1592)
@@ -93,10 +93,6 @@
 
     git clone https://github.com/pingidentity/ldapsdk.git
 
-If you prefer subversion, you can instead use the command:
-
-    svn checkout https://github.com/pingidentity/ldapsdk/trunk ldapsdk-svn
-
 Once the code has been checked out, you can build the LDAP SDK by running the
 build.sh shell script on UNIX-based systems or build.bat batch file on Windows.
 Once the build has completed, the zip file containing the packaged LDAP SDK may

Modified: trunk/README.md
===================================================================
--- trunk/README.md	2023-03-08 16:35:16 UTC (rev 1591)
+++ trunk/README.md	2023-03-08 17:40:13 UTC (rev 1592)
@@ -46,12 +46,6 @@
 git clone https://github.com/pingidentity/ldapsdk.git
 ```
 
-If you prefer subversion, you can instead use the command:
-
-```
-svn checkout https://github.com/pingidentity/ldapsdk/trunk ldapsdk-svn
-```
-
 Once the code has been checked out, you can build the LDAP SDK by running the `build.sh` shell script on UNIX-based systems or `build.bat` batch file on Windows. Once the build has completed, the zip file containing the packaged LDAP SDK may be found in the build/package directory.
 
 ## How To Get Help with the UnboundID LDAP SDK for Java

Modified: trunk/build.xml
===================================================================
--- trunk/build.xml	2023-03-08 16:35:16 UTC (rev 1591)
+++ trunk/build.xml	2023-03-08 17:40:13 UTC (rev 1592)
@@ -673,7 +673,7 @@
 
 
 
-  <!-- Get the Subversion revision number for the current source. -->
+  <!-- Get the git or svn revision for the current source. -->
   <target name="repository-info" unless="repository-info.revision">
     <mkdir dir="${repository-info.classes.dir}" />
     <javac srcdir="${repository-info.src.dir}"

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1591] trunk

[<di...@us...>]

Revision: 1591
          http://sourceforge.net/p/ldap-sdk/code/1591
Author:   dirmgr
Date:     2023-03-08 16:35:16 +0000 (Wed, 08 Mar 2023)
Log Message:
-----------
Add shorter method names for constructing filters

Added convenience methods with shorter names for constructing search
filters from their individual components.  For example, instead of
calling Filter.createANDFilter(components), you can now use
Filter.and(components), and instead of 
Filter.createEqualityFilter(attributeName, assertionValue), you can
now use Filter.equals(attributeName, assertionValue).  The existing
methods with longer names will remain available for backward
compatibility.

Modified Paths:
--------------
    trunk/docs/release-notes.html
    trunk/src/com/unboundid/ldap/sdk/Filter.java
    trunk/tests/unit/src/com/unboundid/ldap/sdk/FilterTestCase.java

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2023-03-02 21:07:49 UTC (rev 1590)
+++ trunk/docs/release-notes.html	2023-03-08 16:35:16 UTC (rev 1591)
@@ -28,6 +28,16 @@
                 </li>
 
                 <li>
+                  Added convenience methods with shorter names for constructing search filters
+                  from their individual components.  For example, instead of calling
+                  Filter.createANDFilter(components), you can now use Filter.and(components), and
+                  instead of Filter.createEqualityFilter(attributeName, assertionValue), you can
+                  now use Filter.equals(attributeName, assertionValue).  The existing methods with
+                  longer names will remain available for backward compatibility.
+                  <br><br>
+                </li>
+
+                <li>
                   Added support for encrypted PKCS #8 private keys.  Private keys can now be
                   formatted in encrypted PEM when provided with an encryption password and a set
                   of encryption properties, and the PKCS #8 PEM file reader can read encrypted

Modified: trunk/src/com/unboundid/ldap/sdk/Filter.java
===================================================================
--- trunk/src/com/unboundid/ldap/sdk/Filter.java	2023-03-02 21:07:49 UTC (rev 1590)
+++ trunk/src/com/unboundid/ldap/sdk/Filter.java	2023-03-08 16:35:16 UTC (rev 1591)
@@ -441,6 +441,10 @@
 
   /**
    * Creates a new AND search filter with the provided components.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createANDFilter(Filter...)}, but with a shorter method name for
+   * convenience.
    *
    * @param  andComponents  The set of filter components to include in the AND
    *                        filter.  It must not be {@code null}.
@@ -448,6 +452,42 @@
    * @return  The created AND search filter.
    */
   @NotNull()
+  public static Filter and(@NotNull final Filter... andComponents)
+  {
+    return createANDFilter(andComponents);
+  }
+
+
+
+  /**
+   * Creates a new AND search filter with the provided components.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createANDFilter(Collection)}, but with a shorter method name for
+   * convenience.
+   *
+   * @param  andComponents  The set of filter components to include in the AND
+   *                        filter.  It must not be {@code null}.
+   *
+   * @return  The created AND search filter.
+   */
+  @NotNull()
+  public static Filter and(@NotNull final Collection<Filter> andComponents)
+  {
+    return createANDFilter(andComponents);
+  }
+
+
+
+  /**
+   * Creates a new AND search filter with the provided components.
+   *
+   * @param  andComponents  The set of filter components to include in the AND
+   *                        filter.  It must not be {@code null}.
+   *
+   * @return  The created AND search filter.
+   */
+  @NotNull()
   public static Filter createANDFilter(@NotNull final Filter... andComponents)
   {
     Validator.ensureNotNull(andComponents);
@@ -502,6 +542,10 @@
 
   /**
    * Creates a new OR search filter with the provided components.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createORFilter(Filter...)}, but with a shorter method name for
+   * convenience.
    *
    * @param  orComponents  The set of filter components to include in the OR
    *                       filter.  It must not be {@code null}.
@@ -509,6 +553,42 @@
    * @return  The created OR search filter.
    */
   @NotNull()
+  public static Filter or(@NotNull final Filter... orComponents)
+  {
+    return createORFilter(orComponents);
+  }
+
+
+
+  /**
+   * Creates a new OR search filter with the provided components.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createORFilter(Collection)}, but with a shorter method name for
+   * convenience.
+   *
+   * @param  orComponents  The set of filter components to include in the OR
+   *                       filter.  It must not be {@code null}.
+   *
+   * @return  The created OR search filter.
+   */
+  @NotNull()
+  public static Filter or(@NotNull final Collection<Filter> orComponents)
+  {
+    return createORFilter(orComponents);
+  }
+
+
+
+  /**
+   * Creates a new OR search filter with the provided components.
+   *
+   * @param  orComponents  The set of filter components to include in the OR
+   *                       filter.  It must not be {@code null}.
+   *
+   * @return  The created OR search filter.
+   */
+  @NotNull()
   public static Filter createORFilter(@NotNull final Filter... orComponents)
   {
     Validator.ensureNotNull(orComponents);
@@ -562,6 +642,10 @@
 
   /**
    * Creates a new NOT search filter with the provided component.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createNOTFilter(Filter)}, but with a shorter method name for
+   * convenience.
    *
    * @param  notComponent  The filter component to include in this NOT filter.
    *                       It must not be {@code null}.
@@ -569,6 +653,22 @@
    * @return  The created NOT search filter.
    */
   @NotNull()
+  public static Filter not(@NotNull final Filter notComponent)
+  {
+    return createNOTFilter(notComponent);
+  }
+
+
+
+  /**
+   * Creates a new NOT search filter with the provided component.
+   *
+   * @param  notComponent  The filter component to include in this NOT filter.
+   *                       It must not be {@code null}.
+   *
+   * @return  The created NOT search filter.
+   */
+  @NotNull()
   public static Filter createNOTFilter(@NotNull final Filter notComponent)
   {
     Validator.ensureNotNull(notComponent);
@@ -581,6 +681,10 @@
 
   /**
    * Creates a new equality search filter with the provided information.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createEqualityFilter(String,String)}, but with a shorter method
+   * name for convenience.
    *
    * @param  attributeName   The attribute name for this equality filter.  It
    *                         must not be {@code null}.
@@ -590,6 +694,48 @@
    * @return  The created equality search filter.
    */
   @NotNull()
+  public static Filter equals(@NotNull final String attributeName,
+                              @NotNull final String assertionValue)
+  {
+    return createEqualityFilter(attributeName, assertionValue);
+  }
+
+
+
+  /**
+   * Creates a new equality search filter with the provided information.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createEqualityFilter(String,byte[])}, but with a shorter method
+   * name for convenience.
+   *
+   * @param  attributeName   The attribute name for this equality filter.  It
+   *                         must not be {@code null}.
+   * @param  assertionValue  The assertion value for this equality filter.  It
+   *                         must not be {@code null}.
+   *
+   * @return  The created equality search filter.
+   */
+  @NotNull()
+  public static Filter equals(@NotNull final String attributeName,
+                              @NotNull final byte[] assertionValue)
+  {
+    return createEqualityFilter(attributeName, assertionValue);
+  }
+
+
+
+  /**
+   * Creates a new equality search filter with the provided information.
+   *
+   * @param  attributeName   The attribute name for this equality filter.  It
+   *                         must not be {@code null}.
+   * @param  assertionValue  The assertion value for this equality filter.  It
+   *                         must not be {@code null}.
+   *
+   * @return  The created equality search filter.
+   */
+  @NotNull()
   public static Filter createEqualityFilter(@NotNull final String attributeName,
                             @NotNull final String assertionValue)
   {
@@ -652,6 +798,10 @@
    * Creates a new substring search filter with the provided information.  At
    * least one of the subInitial, subAny, and subFinal components must not be
    * {@code null}.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createSubstringFilter(String,String,String[],String)}, but with a
+   * shorter method name for convenience.
    *
    * @param  attributeName  The attribute name for this substring filter.  It
    *                        must not be {@code null}.
@@ -663,6 +813,60 @@
    * @return  The created substring search filter.
    */
   @NotNull()
+  public static Filter substring(@NotNull final String attributeName,
+                                 @Nullable final String subInitial,
+                                 @Nullable final String[] subAny,
+                                 @Nullable final String subFinal)
+  {
+    return createSubstringFilter(attributeName, subInitial, subAny, subFinal);
+  }
+
+
+
+  /**
+   * Creates a new substring search filter with the provided information.  At
+   * least one of the subInitial, subAny, and subFinal components must not be
+   * {@code null}.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createSubstringFilter(String,byte[],byte[][],byte[])}, but with a
+   * shorter method name for convenience.
+   *
+   * @param  attributeName  The attribute name for this substring filter.  It
+   *                        must not be {@code null}.
+   * @param  subInitial     The subInitial component for this substring filter.
+   * @param  subAny         The set of subAny components for this substring
+   *                        filter.
+   * @param  subFinal       The subFinal component for this substring filter.
+   *
+   * @return  The created substring search filter.
+   */
+  @NotNull()
+  public static Filter substring(@NotNull final String attributeName,
+                                 @Nullable final byte[] subInitial,
+                                 @Nullable final byte[][] subAny,
+                                 @Nullable final byte[] subFinal)
+  {
+    return createSubstringFilter(attributeName, subInitial, subAny, subFinal);
+  }
+
+
+
+  /**
+   * Creates a new substring search filter with the provided information.  At
+   * least one of the subInitial, subAny, and subFinal components must not be
+   * {@code null}.
+   *
+   * @param  attributeName  The attribute name for this substring filter.  It
+   *                        must not be {@code null}.
+   * @param  subInitial     The subInitial component for this substring filter.
+   * @param  subAny         The set of subAny components for this substring
+   *                        filter.
+   * @param  subFinal       The subFinal component for this substring filter.
+   *
+   * @return  The created substring search filter.
+   */
+  @NotNull()
   public static Filter createSubstringFilter(
                             @NotNull final String attributeName,
                             @Nullable final String subInitial,
@@ -826,6 +1030,10 @@
   /**
    * Creates a new substring search filter with only a subInitial (starts with)
    * component.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createSubInitialFilter(String,String)}, but with a shorter method
+   * name for convenience.
    *
    * @param  attributeName  The attribute name for this substring filter.  It
    *                        must not be {@code null}.
@@ -835,6 +1043,50 @@
    * @return  The created substring search filter.
    */
   @NotNull()
+  public static Filter subInitial(@NotNull final String attributeName,
+                                  @NotNull final String subInitial)
+  {
+    return createSubInitialFilter(attributeName, subInitial);
+  }
+
+
+
+  /**
+   * Creates a new substring search filter with only a subInitial (starts with)
+   * component.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createSubInitialFilter(String,byte[])}, but with a shorter method
+   * name for convenience.
+   *
+   * @param  attributeName  The attribute name for this substring filter.  It
+   *                        must not be {@code null}.
+   * @param  subInitial     The subInitial component for this substring filter.
+   *                        It must not be {@code null}.
+   *
+   * @return  The created substring search filter.
+   */
+  @NotNull()
+  public static Filter subInitial(@NotNull final String attributeName,
+                                  @NotNull final byte[] subInitial)
+  {
+    return createSubInitialFilter(attributeName, subInitial);
+  }
+
+
+
+  /**
+   * Creates a new substring search filter with only a subInitial (starts with)
+   * component.
+   *
+   * @param  attributeName  The attribute name for this substring filter.  It
+   *                        must not be {@code null}.
+   * @param  subInitial     The subInitial component for this substring filter.
+   *                        It must not be {@code null}.
+   *
+   * @return  The created substring search filter.
+   */
+  @NotNull()
   public static Filter createSubInitialFilter(
                             @NotNull final String attributeName,
                             @NotNull final String subInitial)
@@ -868,6 +1120,10 @@
   /**
    * Creates a new substring search filter with only a subAny (contains)
    * component.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createSubAnyFilter(String,String...)}, but with a shorter method
+   * name for convenience.
    *
    * @param  attributeName  The attribute name for this substring filter.  It
    *                        must not be {@code null}.
@@ -877,6 +1133,50 @@
    * @return  The created substring search filter.
    */
   @NotNull()
+  public static Filter subAny(@NotNull final String attributeName,
+                              @NotNull final String... subAny)
+  {
+    return createSubAnyFilter(attributeName, subAny);
+  }
+
+
+
+  /**
+   * Creates a new substring search filter with only a subAny (contains)
+   * component.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createSubAnyFilter(String,byte[]...)}, but with a shorter method
+   * name for convenience.
+   *
+   * @param  attributeName  The attribute name for this substring filter.  It
+   *                        must not be {@code null}.
+   * @param  subAny         The subAny values for this substring filter.  It
+   *                        must not be {@code null} or empty.
+   *
+   * @return  The created substring search filter.
+   */
+  @NotNull()
+  public static Filter subAny(@NotNull final String attributeName,
+                              @NotNull final byte[]... subAny)
+  {
+    return createSubAnyFilter(attributeName, subAny);
+  }
+
+
+
+  /**
+   * Creates a new substring search filter with only a subAny (contains)
+   * component.
+   *
+   * @param  attributeName  The attribute name for this substring filter.  It
+   *                        must not be {@code null}.
+   * @param  subAny         The subAny values for this substring filter.  It
+   *                        must not be {@code null} or empty.
+   *
+   * @return  The created substring search filter.
+   */
+  @NotNull()
   public static Filter createSubAnyFilter(@NotNull final String attributeName,
                                           @NotNull final String... subAny)
   {
@@ -908,6 +1208,10 @@
   /**
    * Creates a new substring search filter with only a subFinal (ends with)
    * component.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createSubFinalFilter(String,String)}, but with a shorter method
+   * name for convenience.
    *
    * @param  attributeName  The attribute name for this substring filter.  It
    *                        must not be {@code null}.
@@ -917,6 +1221,50 @@
    * @return  The created substring search filter.
    */
   @NotNull()
+  public static Filter subFinal(@NotNull final String attributeName,
+                                @NotNull final String subFinal)
+  {
+    return createSubFinalFilter(attributeName, subFinal);
+  }
+
+
+
+  /**
+   * Creates a new substring search filter with only a subFinal (ends with)
+   * component.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createSubFinalFilter(String,byte[])}, but with a shorter method
+   * name for convenience.
+   *
+   * @param  attributeName  The attribute name for this substring filter.  It
+   *                        must not be {@code null}.
+   * @param  subFinal       The subFinal component for this substring filter.
+   *                        It must not be {@code null}.
+   *
+   * @return  The created substring search filter.
+   */
+  @NotNull()
+  public static Filter subFinal(@NotNull final String attributeName,
+                                @NotNull final byte[] subFinal)
+  {
+    return createSubFinalFilter(attributeName, subFinal);
+  }
+
+
+
+  /**
+   * Creates a new substring search filter with only a subFinal (ends with)
+   * component.
+   *
+   * @param  attributeName  The attribute name for this substring filter.  It
+   *                        must not be {@code null}.
+   * @param  subFinal       The subFinal component for this substring filter.
+   *                        It must not be {@code null}.
+   *
+   * @return  The created substring search filter.
+   */
+  @NotNull()
   public static Filter createSubFinalFilter(@NotNull final String attributeName,
                                             @NotNull final String subFinal)
   {
@@ -947,6 +1295,10 @@
 
   /**
    * Creates a new greater-or-equal search filter with the provided information.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createGreaterOrEqualFilter(String,String)}, but with a shorter
+   * method name for convenience.
    *
    * @param  attributeName   The attribute name for this greater-or-equal
    *                         filter.  It must not be {@code null}.
@@ -956,6 +1308,48 @@
    * @return  The created greater-or-equal search filter.
    */
   @NotNull()
+  public static Filter greaterOrEqual(@NotNull final String attributeName,
+                                      @NotNull final String assertionValue)
+  {
+    return createGreaterOrEqualFilter(attributeName, assertionValue);
+  }
+
+
+
+  /**
+   * Creates a new greater-or-equal search filter with the provided information.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createGreaterOrEqualFilter(String,byte[])}, but with a shorter
+   * method name for convenience.
+   *
+   * @param  attributeName   The attribute name for this greater-or-equal
+   *                         filter.  It must not be {@code null}.
+   * @param  assertionValue  The assertion value for this greater-or-equal
+   *                         filter.  It must not be {@code null}.
+   *
+   * @return  The created greater-or-equal search filter.
+   */
+  @NotNull()
+  public static Filter greaterOrEqual(@NotNull final String attributeName,
+                                      @NotNull final byte[] assertionValue)
+  {
+    return createGreaterOrEqualFilter(attributeName, assertionValue);
+  }
+
+
+
+  /**
+   * Creates a new greater-or-equal search filter with the provided information.
+   *
+   * @param  attributeName   The attribute name for this greater-or-equal
+   *                         filter.  It must not be {@code null}.
+   * @param  assertionValue  The assertion value for this greater-or-equal
+   *                         filter.  It must not be {@code null}.
+   *
+   * @return  The created greater-or-equal search filter.
+   */
+  @NotNull()
   public static Filter createGreaterOrEqualFilter(
                             @NotNull final String attributeName,
                             @NotNull final String assertionValue)
@@ -1019,6 +1413,10 @@
 
   /**
    * Creates a new less-or-equal search filter with the provided information.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createLessOrEqualFilter(String,String)}, but with a shorter method
+   * name for convenience.
    *
    * @param  attributeName   The attribute name for this less-or-equal
    *                         filter.  It must not be {@code null}.
@@ -1028,6 +1426,48 @@
    * @return  The created less-or-equal search filter.
    */
   @NotNull()
+  public static Filter lessOrEqual(@NotNull final String attributeName,
+                                   @NotNull final String assertionValue)
+  {
+    return createLessOrEqualFilter(attributeName, assertionValue);
+  }
+
+
+
+  /**
+   * Creates a new less-or-equal search filter with the provided information.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createLessOrEqualFilter(String,byte[])}, but with a shorter method
+   * name for convenience.
+   *
+   * @param  attributeName   The attribute name for this less-or-equal
+   *                         filter.  It must not be {@code null}.
+   * @param  assertionValue  The assertion value for this less-or-equal
+   *                         filter.  It must not be {@code null}.
+   *
+   * @return  The created less-or-equal search filter.
+   */
+  @NotNull()
+  public static Filter lessOrEqual(@NotNull final String attributeName,
+                                   @NotNull final byte[] assertionValue)
+  {
+    return createLessOrEqualFilter(attributeName, assertionValue);
+  }
+
+
+
+  /**
+   * Creates a new less-or-equal search filter with the provided information.
+   *
+   * @param  attributeName   The attribute name for this less-or-equal
+   *                         filter.  It must not be {@code null}.
+   * @param  assertionValue  The assertion value for this less-or-equal
+   *                         filter.  It must not be {@code null}.
+   *
+   * @return  The created less-or-equal search filter.
+   */
+  @NotNull()
   public static Filter createLessOrEqualFilter(
                             @NotNull final String attributeName,
                             @NotNull final String assertionValue)
@@ -1091,6 +1531,10 @@
 
   /**
    * Creates a new presence search filter with the provided information.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createPresenceFilter(String)}, but with a shorter method name for
+   * convenience.
    *
    * @param  attributeName   The attribute name for this presence filter.  It
    *                         must not be {@code null}.
@@ -1098,6 +1542,22 @@
    * @return  The created presence search filter.
    */
   @NotNull()
+  public static Filter present(@NotNull final String attributeName)
+  {
+    return createPresenceFilter(attributeName);
+  }
+
+
+
+  /**
+   * Creates a new presence search filter with the provided information.
+   *
+   * @param  attributeName   The attribute name for this presence filter.  It
+   *                         must not be {@code null}.
+   *
+   * @return  The created presence search filter.
+   */
+  @NotNull()
   public static Filter createPresenceFilter(@NotNull final String attributeName)
   {
     Validator.ensureNotNull(attributeName);
@@ -1111,6 +1571,10 @@
   /**
    * Creates a new approximate match search filter with the provided
    * information.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createApproximateMatchFilter(String,String)}, but with a shorter
+   * method name for convenience.
    *
    * @param  attributeName   The attribute name for this approximate match
    *                         filter.  It must not be {@code null}.
@@ -1120,6 +1584,50 @@
    * @return  The created approximate match search filter.
    */
   @NotNull()
+  public static Filter approximateMatch(@NotNull final String attributeName,
+                                        @NotNull final String assertionValue)
+  {
+    return createApproximateMatchFilter(attributeName, assertionValue);
+  }
+
+
+
+  /**
+   * Creates a new approximate match search filter with the provided
+   * information.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createApproximateMatchFilter(String,byte[])}, but with a shorter
+   * method name for convenience.
+   *
+   * @param  attributeName   The attribute name for this approximate match
+   *                         filter.  It must not be {@code null}.
+   * @param  assertionValue  The assertion value for this approximate match
+   *                         filter.  It must not be {@code null}.
+   *
+   * @return  The created approximate match search filter.
+   */
+  @NotNull()
+  public static Filter approximateMatch(@NotNull final String attributeName,
+                                        @NotNull final byte[] assertionValue)
+  {
+    return createApproximateMatchFilter(attributeName, assertionValue);
+  }
+
+
+
+  /**
+   * Creates a new approximate match search filter with the provided
+   * information.
+   *
+   * @param  attributeName   The attribute name for this approximate match
+   *                         filter.  It must not be {@code null}.
+   * @param  assertionValue  The assertion value for this approximate match
+   *                         filter.  It must not be {@code null}.
+   *
+   * @return  The created approximate match search filter.
+   */
+  @NotNull()
   public static Filter createApproximateMatchFilter(
                             @NotNull final String attributeName,
                             @NotNull final String assertionValue)
@@ -1187,6 +1695,10 @@
    * Creates a new extensible match search filter with the provided
    * information.  At least one of the attribute name and matching rule ID must
    * be specified, and the assertion value must always be present.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createExtensibleMatchFilter(String,String,boolean,String)}, but
+   * with a shorter method name for convenience.
    *
    * @param  attributeName   The attribute name for this extensible match
    *                         filter.
@@ -1200,6 +1712,66 @@
    * @return  The created extensible match search filter.
    */
   @NotNull()
+  public static Filter extensibleMatch(@Nullable final String attributeName,
+                                       @Nullable final String matchingRuleID,
+                                       final boolean dnAttributes,
+                                       @NotNull final String assertionValue)
+  {
+    return createExtensibleMatchFilter(attributeName, matchingRuleID,
+         dnAttributes, assertionValue);
+  }
+
+
+
+  /**
+   * Creates a new extensible match search filter with the provided
+   * information.  At least one of the attribute name and matching rule ID must
+   * be specified, and the assertion value must always be present.
+   * <BR><BR>
+   * This method does exactly the same thing as
+   * {@link #createExtensibleMatchFilter(String,String,boolean,byte[])}, but
+   * with a shorter method name for convenience.
+   *
+   * @param  attributeName   The attribute name for this extensible match
+   *                         filter.
+   * @param  matchingRuleID  The matching rule ID for this extensible match
+   *                         filter.
+   * @param  dnAttributes    Indicates whether the match should be performed
+   *                         against attributes in the target entry's DN.
+   * @param  assertionValue  The assertion value for this extensible match
+   *                         filter.  It must not be {@code null}.
+   *
+   * @return  The created extensible match search filter.
+   */
+  @NotNull()
+  public static Filter extensibleMatch(@Nullable final String attributeName,
+                                       @Nullable final String matchingRuleID,
+                                       final boolean dnAttributes,
+                                       @NotNull final byte[] assertionValue)
+  {
+    return createExtensibleMatchFilter(attributeName, matchingRuleID,
+         dnAttributes, assertionValue);
+  }
+
+
+
+  /**
+   * Creates a new extensible match search filter with the provided
+   * information.  At least one of the attribute name and matching rule ID must
+   * be specified, and the assertion value must always be present.
+   *
+   * @param  attributeName   The attribute name for this extensible match
+   *                         filter.
+   * @param  matchingRuleID  The matching rule ID for this extensible match
+   *                         filter.
+   * @param  dnAttributes    Indicates whether the match should be performed
+   *                         against attributes in the target entry's DN.
+   * @param  assertionValue  The assertion value for this extensible match
+   *                         filter.  It must not be {@code null}.
+   *
+   * @return  The created extensible match search filter.
+   */
+  @NotNull()
   public static Filter createExtensibleMatchFilter(
                             @Nullable final String attributeName,
                             @Nullable final String matchingRuleID,
@@ -4696,11 +5268,11 @@
       case FILTER_TYPE_OR:
         if (filterType == FILTER_TYPE_AND)
         {
-          buffer.append("Filter.createANDFilter(");
+          buffer.append("Filter.and(");
         }
         else
         {
-          buffer.append("Filter.createORFilter(");
+          buffer.append("Filter.or(");
         }
         if (filterComps.length == 0)
         {
@@ -4735,7 +5307,7 @@
 
 
       case FILTER_TYPE_NOT:
-        buffer.append("Filter.createNOTFilter(");
+        buffer.append("Filter.not(");
         lineList.add(buffer.toString());
 
         final String suffix;
@@ -4751,7 +5323,7 @@
         return;
 
       case FILTER_TYPE_PRESENCE:
-        buffer.append("Filter.createPresenceFilter(");
+        buffer.append("Filter.present(");
         lineList.add(buffer.toString());
 
         buffer.setLength(0);
@@ -4775,19 +5347,19 @@
       case FILTER_TYPE_APPROXIMATE_MATCH:
         if (filterType == FILTER_TYPE_EQUALITY)
         {
-          buffer.append("Filter.createEqualityFilter(");
+          buffer.append("Filter.equals(");
         }
         else if (filterType == FILTER_TYPE_GREATER_OR_EQUAL)
         {
-          buffer.append("Filter.createGreaterOrEqualFilter(");
+          buffer.append("Filter.greaterOrEqual(");
         }
         else if (filterType == FILTER_TYPE_LESS_OR_EQUAL)
         {
-          buffer.append("Filter.createLessOrEqualFilter(");
+          buffer.append("Filter.lessOrEqual(");
         }
         else
         {
-          buffer.append("Filter.createApproximateMatchFilter(");
+          buffer.append("Filter.approximateMatch(");
         }
         lineList.add(buffer.toString());
 
@@ -4828,7 +5400,7 @@
 
 
       case FILTER_TYPE_SUBSTRING:
-        buffer.append("Filter.createSubstringFilter(");
+        buffer.append("Filter.substring(");
         lineList.add(buffer.toString());
 
         buffer.setLength(0);
@@ -4995,7 +5567,7 @@
 
 
       case FILTER_TYPE_EXTENSIBLE_MATCH:
-        buffer.append("Filter.createExtensibleMatchFilter(");
+        buffer.append("Filter.extensibleMatch(");
         lineList.add(buffer.toString());
 
         buffer.setLength(0);

Modified: trunk/tests/unit/src/com/unboundid/ldap/sdk/FilterTestCase.java
===================================================================
--- trunk/tests/unit/src/com/unboundid/ldap/sdk/FilterTestCase.java	2023-03-02 21:07:49 UTC (rev 1590)
+++ trunk/tests/unit/src/com/unboundid/ldap/sdk/FilterTestCase.java	2023-03-08 16:35:16 UTC (rev 1591)
@@ -95,7 +95,7 @@
   public void testCreateANDFilterEmptyArray()
          throws Exception
   {
-    Filter f = Filter.createANDFilter(new Filter[0]);
+    Filter f = Filter.and(new Filter[0]);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_AND);
 
@@ -167,7 +167,7 @@
       Filter.create("(foo=bar)")
     };
 
-    Filter f = Filter.createANDFilter(filterElements);
+    Filter f = Filter.and(filterElements);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_AND);
 
@@ -241,7 +241,7 @@
       Filter.create("(e=f)"),
     };
 
-    Filter f = Filter.createANDFilter(filterElements);
+    Filter f = Filter.and(filterElements);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_AND);
 
@@ -308,7 +308,7 @@
   public void testCreateANDFilterNullArray()
          throws Exception
   {
-    Filter.createANDFilter((Filter[]) null);
+    Filter.and((Filter[]) null);
   }
 
 
@@ -393,7 +393,7 @@
     ArrayList<Filter> filterList = new ArrayList<Filter>(1);
     filterList.add(Filter.create("(foo=bar)"));
 
-    Filter f = Filter.createANDFilter(filterList);
+    Filter f = Filter.and(filterList);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_AND);
 
@@ -465,7 +465,7 @@
     filterList.add(Filter.create("(c=d)"));
     filterList.add(Filter.create("(e=f)"));
 
-    Filter f = Filter.createANDFilter(filterList);
+    Filter f = Filter.and(filterList);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_AND);
 
@@ -532,7 +532,7 @@
   public void testCreateANDFilterNullList()
          throws Exception
   {
-    Filter.createANDFilter((ArrayList<Filter>) null);
+    Filter.and((ArrayList<Filter>) null);
   }
 
 
@@ -547,7 +547,7 @@
   public void testCreateORFilterEmptyArray()
          throws Exception
   {
-    Filter f = Filter.createORFilter(new Filter[0]);
+    Filter f = Filter.or(new Filter[0]);
 
     String filterString = f.toString();
     assertEquals(filterString, "(|)");
@@ -619,7 +619,7 @@
       Filter.create("(foo=bar)")
     };
 
-    Filter f = Filter.createORFilter(filterElements);
+    Filter f = Filter.or(filterElements);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_OR);
 
@@ -693,7 +693,7 @@
       Filter.create("(e=f)"),
     };
 
-    Filter f = Filter.createORFilter(filterElements);
+    Filter f = Filter.or(filterElements);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_OR);
 
@@ -760,7 +760,7 @@
   public void testCreateORFilterNull()
          throws Exception
   {
-    Filter.createORFilter((Filter[]) null);
+    Filter.or((Filter[]) null);
   }
 
 
@@ -845,7 +845,7 @@
     ArrayList<Filter> filterList = new ArrayList<Filter>(1);
     filterList.add(Filter.create("(foo=bar)"));
 
-    Filter f = Filter.createORFilter(filterList);
+    Filter f = Filter.or(filterList);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_OR);
 
@@ -917,7 +917,7 @@
     filterList.add(Filter.create("(c=d)"));
     filterList.add(Filter.create("(e=f)"));
 
-    Filter f = Filter.createORFilter(filterList);
+    Filter f = Filter.or(filterList);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_OR);
 
@@ -984,7 +984,7 @@
   public void testCreateORFilterList()
          throws Exception
   {
-    Filter.createORFilter((ArrayList<Filter>) null);
+    Filter.or((ArrayList<Filter>) null);
   }
 
 
@@ -997,7 +997,7 @@
   public void testCreateNOTFilter()
          throws Exception
   {
-    Filter f = Filter.createNOTFilter(Filter.create("(foo=bar)"));
+    Filter f = Filter.not(Filter.create("(foo=bar)"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_NOT);
 
@@ -1065,7 +1065,7 @@
   public void testCreateNOTFilterNull()
          throws Exception
   {
-    Filter.createNOTFilter(null);
+    Filter.not(null);
   }
 
 
@@ -1080,7 +1080,7 @@
   public void testCreateEqualityFilterString()
          throws Exception
   {
-    Filter f = Filter.createEqualityFilter("foo", "bar");
+    Filter f = Filter.equals("foo", "bar");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EQUALITY);
 
@@ -1156,7 +1156,7 @@
   public void testCreateEqualityFilterStringNullAttr()
          throws Exception
   {
-    Filter.createEqualityFilter(null, "bar");
+    Filter.equals(null, "bar");
   }
 
 
@@ -1171,7 +1171,7 @@
   public void testCreateEqualityFilterStringNullValue()
          throws Exception
   {
-    Filter.createEqualityFilter("foo", (String) null);
+    Filter.equals("foo", (String) null);
   }
 
 
@@ -1186,7 +1186,7 @@
   public void testCreateEqualityFilterByteArray()
          throws Exception
   {
-    Filter f = Filter.createEqualityFilter("foo", "bar".getBytes("UTF-8"));
+    Filter f = Filter.equals("foo", "bar".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EQUALITY);
 
@@ -1262,7 +1262,7 @@
   public void testCreateEqualityFilterByteArrayNullAttr()
          throws Exception
   {
-    Filter.createEqualityFilter(null, "bar".getBytes("UTF-8"));
+    Filter.equals(null, "bar".getBytes("UTF-8"));
   }
 
 
@@ -1277,7 +1277,7 @@
   public void testCreateEqualityFilterByteArrayNullValue()
          throws Exception
   {
-    Filter.createEqualityFilter("foo", (byte[]) null);
+    Filter.equals("foo", (byte[]) null);
   }
 
 
@@ -1404,12 +1404,12 @@
     final String valueString4 = "Smiley Face Emoji \uD83D\uDE00";
     final String valueString5 = "U.S. Flag Emoji \uD83C\uDDFA\uD83C\uDDF8";
 
-    final Filter f = Filter.createORFilter(
-         Filter.createEqualityFilter("cn", valueString1),
-         Filter.createEqualityFilter("cn", valueString2),
-         Filter.createEqualityFilter("cn", valueString3),
-         Filter.createEqualityFilter("cn", valueString4),
-         Filter.createEqualityFilter("cn", valueString5));
+    final Filter f = Filter.or(
+         Filter.equals("cn", valueString1),
+         Filter.equals("cn", valueString2),
+         Filter.equals("cn", valueString3),
+         Filter.equals("cn", valueString4),
+         Filter.equals("cn", valueString5));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_OR);
 
@@ -1477,7 +1477,7 @@
   public void testCreateSubstringFilterStringSubInitialOnly()
          throws Exception
   {
-    Filter f = Filter.createSubstringFilter("foo", "bar", null, null);
+    Filter f = Filter.substring("foo", "bar", null, null);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -1552,7 +1552,7 @@
   public void testCreateSubInitialFilterString()
          throws Exception
   {
-    Filter f = Filter.createSubInitialFilter("foo", "bar");
+    Filter f = Filter.subInitial("foo", "bar");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -1630,7 +1630,7 @@
   {
     String[] subAny = { "bar" };
 
-    Filter f = Filter.createSubstringFilter("foo", null, subAny, null);
+    Filter f = Filter.substring("foo", null, subAny, null);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -1700,7 +1700,7 @@
   public void testCreateSubAnyFilterSingleStringValue()
          throws Exception
   {
-    Filter f = Filter.createSubAnyFilter("foo", "bar");
+    Filter f = Filter.subAny("foo", "bar");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -1772,7 +1772,7 @@
   {
     String[] subAny = { "bar", "baz", "bat" };
 
-    Filter f = Filter.createSubstringFilter("foo", null, subAny, null);
+    Filter f = Filter.substring("foo", null, subAny, null);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -1842,7 +1842,7 @@
   public void testCreateSubAnyFilterMultipleStringValues()
          throws Exception
   {
-    Filter f = Filter.createSubAnyFilter("foo", "bar", "baz", "bat");
+    Filter f = Filter.subAny("foo", "bar", "baz", "bat");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -1912,7 +1912,7 @@
   public void testCreateSubstringFilterStringSubFinalOnly()
          throws Exception
   {
-    Filter f = Filter.createSubstringFilter("foo", null, null, "bar");
+    Filter f = Filter.substring("foo", null, null, "bar");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -1987,7 +1987,7 @@
   public void testCreateSubFinalFilterString()
          throws Exception
   {
-    Filter f = Filter.createSubFinalFilter("foo", "bar");
+    Filter f = Filter.subFinal("foo", "bar");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -2065,7 +2065,7 @@
   {
     String[] subAny = { "baz" };
 
-    Filter f = Filter.createSubstringFilter("foo", "bar", subAny, "bat");
+    Filter f = Filter.substring("foo", "bar", subAny, "bat");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -2148,7 +2148,7 @@
   {
     String[] subAny = { "bar", "baz", "bat" };
 
-    Filter f = Filter.createSubstringFilter("foo", "a", subAny, "c");
+    Filter f = Filter.substring("foo", "a", subAny, "c");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -2230,7 +2230,7 @@
   public void testCreateSubstringFilterStringNullAttr()
          throws Exception
   {
-    Filter.createSubstringFilter(null, "bar", null, null);
+    Filter.substring(null, "bar", null, null);
   }
 
 
@@ -2245,7 +2245,7 @@
   public void testCreateSubstringFilterStringNullSubstring()
          throws Exception
   {
-    Filter.createSubstringFilter("null", (String) null, null, null);
+    Filter.substring("null", (String) null, null, null);
   }
 
 
@@ -2261,7 +2261,7 @@
   public void testCreateSubstringFilterStringNullSubInitialAndFinalEmptyAny()
          throws Exception
   {
-    Filter.createSubstringFilter("null", null, new String[0], null);
+    Filter.substring("null", null, new String[0], null);
   }
 
 
@@ -2276,8 +2276,7 @@
   public void testCreateSubstringFilterByteArraySubInitialOnly()
          throws Exception
   {
-    Filter f = Filter.createSubstringFilter("foo", "bar".getBytes("UTF-8"),
-                                            null, null);
+    Filter f = Filter.substring("foo", "bar".getBytes("UTF-8"), null, null);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -2353,7 +2352,7 @@
   public void testCreateSubInitialFilterByteArray()
          throws Exception
   {
-    Filter f = Filter.createSubInitialFilter("foo", "bar".getBytes("UTF-8"));
+    Filter f = Filter.subInitial("foo", "bar".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -2431,7 +2430,7 @@
   {
     byte[][] subAny = { "bar".getBytes("UTF-8") };
 
-    Filter f = Filter.createSubstringFilter("foo", null, subAny, null);
+    Filter f = Filter.substring("foo", null, subAny, null);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -2500,7 +2499,7 @@
   public void testCreateSubAnyFilterSingleByteArrayValue()
          throws Exception
   {
-    Filter f = Filter.createSubAnyFilter("foo", "bar".getBytes("UTF-8"));
+    Filter f = Filter.subAny("foo", "bar".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -2573,7 +2572,7 @@
     byte[][] subAny = { "bar".getBytes("UTF-8"), "baz".getBytes("UTF-8"),
                         "bat".getBytes("UTF-8") };
 
-    Filter f = Filter.createSubstringFilter("foo", null, subAny, null);
+    Filter f = Filter.substring("foo", null, subAny, null);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -2643,7 +2642,7 @@
   public void testCreateSubAnyFilterMultipleByteArrayValues()
          throws Exception
   {
-    Filter f = Filter.createSubAnyFilter("foo", "bar".getBytes("UTF-8"),
+    Filter f = Filter.subAny("foo", "bar".getBytes("UTF-8"),
          "baz".getBytes("UTF-8"), "bat".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
@@ -2714,8 +2713,7 @@
   public void testCreateSubstringFilterByteArraySubFinalOnly()
          throws Exception
   {
-    Filter f = Filter.createSubstringFilter("foo", null, null,
-                                            "bar".getBytes("UTF-8"));
+    Filter f = Filter.substring("foo", null, null, "bar".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -2791,7 +2789,7 @@
   public void testCreateSubFinalFilterByteArray()
          throws Exception
   {
-    Filter f = Filter.createSubFinalFilter("foo", "bar".getBytes("UTF-8"));
+    Filter f = Filter.subFinal("foo", "bar".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -2870,8 +2868,8 @@
   {
     byte[][] subAny = { "baz".getBytes("UTF-8") };
 
-    Filter f = Filter.createSubstringFilter("foo", "bar".getBytes("UTF-8"),
-                                            subAny, "bat".getBytes("UTF-8"));
+    Filter f = Filter.substring("foo", "bar".getBytes("UTF-8"), subAny,
+         "bat".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -2956,8 +2954,8 @@
     byte[][] subAny = { "bar".getBytes("UTF-8"), "baz".getBytes("UTF-8"),
                         "bat".getBytes("UTF-8") };
 
-    Filter f = Filter.createSubstringFilter("foo", "a".getBytes("UTF-8"),
-                                            subAny, "c".getBytes("UTF-8"));
+    Filter f = Filter.substring("foo", "a".getBytes("UTF-8"), subAny,
+         "c".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -3039,7 +3037,7 @@
   public void testCreateSubstringFilterByteArrayNullAttr()
          throws Exception
   {
-    Filter.createSubstringFilter(null, "bar".getBytes("UTF-8"), null, null);
+    Filter.substring(null, "bar".getBytes("UTF-8"), null, null);
   }
 
 
@@ -3054,7 +3052,7 @@
   public void testCreateSubstringFilterByteArrayNullSubstring()
          throws Exception
   {
-    Filter.createSubstringFilter("null", (byte[]) null, null, null);
+    Filter.substring("null", (byte[]) null, null, null);
   }
 
 
@@ -3070,7 +3068,7 @@
   public void testCreateSubstringFilterByteArrayNullSubInitialAndFinalEmptyAny()
          throws Exception
   {
-    Filter.createSubstringFilter("null", null, new byte[0][], null);
+    Filter.substring("null", null, new byte[0][], null);
   }
 
 
@@ -3626,8 +3624,7 @@
       ")"
     };
 
-    Filter f = Filter.createSubstringFilter("foo", subInitial, subAny,
-                                            subFinal);
+    Filter f = Filter.substring("foo", subInitial, subAny, subFinal);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_SUBSTRING);
 
@@ -3711,7 +3708,7 @@
   public void testCreateGreaterOrEqualFilterString()
          throws Exception
   {
-    Filter f = Filter.createGreaterOrEqualFilter("foo", "bar");
+    Filter f = Filter.greaterOrEqual("foo", "bar");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_GREATER_OR_EQUAL);
 
@@ -3790,7 +3787,7 @@
   public void testCreateGreaterOrEqualFilterStringNullAttr()
          throws Exception
   {
-    Filter.createGreaterOrEqualFilter(null, "bar");
+    Filter.greaterOrEqual(null, "bar");
   }
 
 
@@ -3805,7 +3802,7 @@
   public void testCreateGreaterOrEqualFilterStringNullValue()
          throws Exception
   {
-    Filter.createGreaterOrEqualFilter("foo", (String) null);
+    Filter.greaterOrEqual("foo", (String) null);
   }
 
 
@@ -3820,8 +3817,7 @@
   public void testCreateGreaterOrEqualFilterByteArray()
          throws Exception
   {
-    Filter f = Filter.createGreaterOrEqualFilter("foo",
-                                                 "bar".getBytes("UTF-8"));
+    Filter f = Filter.greaterOrEqual("foo", "bar".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_GREATER_OR_EQUAL);
 
@@ -3897,7 +3893,7 @@
   public void testCreateGreaterOrEqualFilterByteArrayNullAttr()
          throws Exception
   {
-    Filter.createGreaterOrEqualFilter(null, "bar".getBytes("UTF-8"));
+    Filter.greaterOrEqual(null, "bar".getBytes("UTF-8"));
   }
 
 
@@ -3912,7 +3908,7 @@
   public void testCreateGreaterOrEqualFilterByteArrayNullValue()
          throws Exception
   {
-    Filter.createGreaterOrEqualFilter("foo", (byte[]) null);
+    Filter.greaterOrEqual("foo", (byte[]) null);
   }
 
 
@@ -4035,7 +4031,7 @@
          throws Exception
   {
     String valueString = "\\* Jos\u00e9 Jalape\u00f1o (on a stick) \\*";
-    Filter f = Filter.createGreaterOrEqualFilter("foo", valueString);
+    Filter f = Filter.greaterOrEqual("foo", valueString);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_GREATER_OR_EQUAL);
 
@@ -4120,7 +4116,7 @@
   public void testCreateLessOrEqualFilterString()
          throws Exception
   {
-    Filter f = Filter.createLessOrEqualFilter("foo", "bar");
+    Filter f = Filter.lessOrEqual("foo", "bar");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_LESS_OR_EQUAL);
 
@@ -4196,7 +4192,7 @@
   public void testCreateLessOrEqualFilterStringNullAttr()
          throws Exception
   {
-    Filter.createLessOrEqualFilter(null, "bar");
+    Filter.lessOrEqual(null, "bar");
   }
 
 
@@ -4211,7 +4207,7 @@
   public void testCreateLessOrEqualFilterStringNullValue()
          throws Exception
   {
-    Filter.createLessOrEqualFilter("foo", (String) null);
+    Filter.lessOrEqual("foo", (String) null);
   }
 
 
@@ -4226,7 +4222,7 @@
   public void testCreateLessOrEqualFilterByteArray()
          throws Exception
   {
-    Filter f = Filter.createLessOrEqualFilter("foo", "bar".getBytes("UTF-8"));
+    Filter f = Filter.lessOrEqual("foo", "bar".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_LESS_OR_EQUAL);
 
@@ -4302,7 +4298,7 @@
   public void testCreateLessOrEqualFilterByteArrayNullAttr()
          throws Exception
   {
-    Filter.createLessOrEqualFilter(null, "bar".getBytes("UTF-8"));
+    Filter.lessOrEqual(null, "bar".getBytes("UTF-8"));
   }
 
 
@@ -4317,7 +4313,7 @@
   public void testCreateLessOrEqualFilterByteArrayNullValue()
          throws Exception
   {
-    Filter.createLessOrEqualFilter("foo", (byte[]) null);
+    Filter.lessOrEqual("foo", (byte[]) null);
   }
 
 
@@ -4440,7 +4436,7 @@
          throws Exception
   {
     String valueString = "\\* Jos\u00e9 Jalape\u00f1o (on a stick) \\*";
-    Filter f = Filter.createLessOrEqualFilter("foo", valueString);
+    Filter f = Filter.lessOrEqual("foo", valueString);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_LESS_OR_EQUAL);
 
@@ -4524,7 +4520,7 @@
   public void testCreatePresenceFilter()
          throws Exception
   {
-    Filter f = Filter.createPresenceFilter("foo");
+    Filter f = Filter.present("foo");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_PRESENCE);
 
@@ -4594,7 +4590,7 @@
   public void testCreatePresenceFilterNullAttr()
          throws Exception
   {
-    Filter.createPresenceFilter(null);
+    Filter.present(null);
   }
 
 
@@ -4609,7 +4605,7 @@
   public void testCreateApproximateMatchFilterString()
          throws Exception
   {
-    Filter f = Filter.createApproximateMatchFilter("foo", "bar");
+    Filter f = Filter.approximateMatch("foo", "bar");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_APPROXIMATE_MATCH);
 
@@ -4685,7 +4681,7 @@
   public void testCreateApproximateMatchFilterStringNullAttr()
          throws Exception
   {
-    Filter.createApproximateMatchFilter(null, "bar");
+    Filter.approximateMatch(null, "bar");
   }
 
 
@@ -4700,7 +4696,7 @@
   public void testCreateApproximateMatchFilterStringNullValue()
          throws Exception
   {
-    Filter.createApproximateMatchFilter("foo", (String) null);
+    Filter.approximateMatch("foo", (String) null);
   }
 
 
@@ -4715,8 +4711,7 @@
   public void testCreateApproximateMatchFilterByteArray()
          throws Exception
   {
-    Filter f = Filter.createApproximateMatchFilter("foo",
-                                                   "bar".getBytes("UTF-8"));
+    Filter f = Filter.approximateMatch("foo", "bar".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_APPROXIMATE_MATCH);
 
@@ -4792,7 +4787,7 @@
   public void testCreateApproximateMatchFilterByteArrayNullAttr()
          throws Exception
   {
-    Filter.createApproximateMatchFilter(null, "bar".getBytes("UTF-8"));
+    Filter.approximateMatch(null, "bar".getBytes("UTF-8"));
   }
 
 
@@ -4807,7 +4802,7 @@
   public void testCreateApproximateMatchFilterByteArrayNullValue()
          throws Exception
   {
-    Filter.createApproximateMatchFilter("foo", (byte[]) null);
+    Filter.approximateMatch("foo", (byte[]) null);
   }
 
 
@@ -4930,7 +4925,7 @@
          throws Exception
   {
     String valueString = "\\* Jos\u00e9 Jalape\u00f1o (on a stick) \\*";
-    Filter f = Filter.createApproximateMatchFilter("foo", valueString);
+    Filter f = Filter.approximateMatch("foo", valueString);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_APPROXIMATE_MATCH);
 
@@ -5016,7 +5011,7 @@
   public void testCreateExtensibleMatchFilterStringAttr()
          throws Exception
   {
-    Filter f = Filter.createExtensibleMatchFilter("foo", null, false, "bar");
+    Filter f = Filter.extensibleMatch("foo", null, false, "bar");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -5095,7 +5090,7 @@
   public void testCreateExtensibleMatchFilterStringAttrDN()
          throws Exception
   {
-    Filter f = Filter.createExtensibleMatchFilter("foo", null, true, "bar");
+    Filter f = Filter.extensibleMatch("foo", null, true, "bar");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -5174,7 +5169,7 @@
   public void testCreateExtensibleMatchFilterStringRuleID()
          throws Exception
   {
-    Filter f = Filter.createExtensibleMatchFilter(null, "foo", false, "bar");
+    Filter f = Filter.extensibleMatch(null, "foo", false, "bar");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -5253,7 +5248,7 @@
   public void testCreateExtensibleMatchFilterStringRuleIDDN()
          throws Exception
   {
-    Filter f = Filter.createExtensibleMatchFilter(null, "foo", true, "bar");
+    Filter f = Filter.extensibleMatch(null, "foo", true, "bar");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -5332,7 +5327,7 @@
   public void testCreateExtensibleMatchFilterStringAttrRuleID()
          throws Exception
   {
-    Filter f = Filter.createExtensibleMatchFilter("foo", "bar", false, "baz");
+    Filter f = Filter.extensibleMatch("foo", "bar", false, "baz");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -5413,7 +5408,7 @@
   public void testCreateExtensibleMatchFilterStringAttrRuleIDDN()
          throws Exception
   {
-    Filter f = Filter.createExtensibleMatchFilter("foo", "bar", true, "baz");
+    Filter f = Filter.extensibleMatch("foo", "bar", true, "baz");
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -5490,7 +5485,7 @@
   @Test(expectedExceptions = { LDAPSDKUsageException.class })
   public void testCreateExtensibleMatchFilterStringNoValue()
   {
-    Filter.createExtensibleMatchFilter("foo", null, false, (String) null);
+    Filter.extensibleMatch("foo", null, false, (String) null);
   }
 
 
@@ -5503,7 +5498,7 @@
   @Test(expectedExceptions = { LDAPSDKUsageException.class })
   public void testCreateExtensibleMatchFilterStringNoAttrOrRuleID()
   {
-    Filter.createExtensibleMatchFilter(null, null, false, "bar");
+    Filter.extensibleMatch(null, null, false, "bar");
   }
 
 
@@ -5519,8 +5514,8 @@
   public void testCreateExtensibleMatchFilterByteArrayAttr()
          throws Exception
   {
-    Filter f = Filter.createExtensibleMatchFilter("foo", null, false,
-                                                  "bar".getBytes("UTF-8"));
+    Filter f = Filter.extensibleMatch("foo", null, false,
+                                      "bar".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -5599,8 +5594,8 @@
   public void testCreateExtensibleMatchFilterByteArrayAttrDN()
          throws Exception
   {
-    Filter f = Filter.createExtensibleMatchFilter("foo", null, true,
-                                                  "bar".getBytes("UTF-8"));
+    Filter f = Filter.extensibleMatch("foo", null, true,
+                                      "bar".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -5679,8 +5674,8 @@
   public void testCreateExtensibleMatchFilterByteArrayRuleID()
          throws Exception
   {
-    Filter f = Filter.createExtensibleMatchFilter(null, "foo", false,
-                                                  "bar".getBytes("UTF-8"));
+    Filter f = Filter.extensibleMatch(null, "foo", false,
+                                      "bar".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -5759,8 +5754,8 @@
   public void testCreateExtensibleMatchFilterByteArrayRuleIDDN()
          throws Exception
   {
-    Filter f = Filter.createExtensibleMatchFilter(null, "foo", true,
-                                                  "bar".getBytes("UTF-8"));
+    Filter f = Filter.extensibleMatch(null, "foo", true,
+                                      "bar".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -5839,8 +5834,8 @@
   public void testCreateExtensibleMatchFilterByteArrayAttrRuleID()
          throws Exception
   {
-    Filter f = Filter.createExtensibleMatchFilter("foo", "bar", false,
-                                                  "baz".getBytes("UTF-8"));
+    Filter f = Filter.extensibleMatch("foo", "bar", false,
+                                      "baz".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -5921,8 +5916,8 @@
   public void testCreateExtensibleMatchFilterByteArrayAttrRuleIDDN()
          throws Exception
   {
-    Filter f = Filter.createExtensibleMatchFilter("foo", "bar", true,
-                                                  "baz".getBytes("UTF-8"));
+    Filter f = Filter.extensibleMatch("foo", "bar", true,
+                                      "baz".getBytes("UTF-8"));
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -5999,7 +5994,7 @@
   @Test(expectedExceptions = { LDAPSDKUsageException.class })
   public void testCreateExtensibleMatchFilterByteArrayNoValue()
   {
-    Filter.createExtensibleMatchFilter("foo", null, false, (byte[]) null);
+    Filter.extensibleMatch("foo", null, false, (byte[]) null);
   }
 
 
@@ -6015,8 +6010,7 @@
   public void testCreateExtensibleMatchFilterByteArrayNoAttrOrRuleID()
          throws Exception
   {
-    Filter.createExtensibleMatchFilter(null, null, false,
-                                       "bar".getBytes("UTF-8"));
+    Filter.extensibleMatch(null, null, false, "bar".getBytes("UTF-8"));
   }
 
 
@@ -6543,8 +6537,7 @@
          throws Exception
   {
     String valueString = "\\* Jos\u00e9 Jalape\u00f1o (on a stick) \\*";
-    Filter f = Filter.createExtensibleMatchFilter("foo", null, true,
-                                                  valueString);
+    Filter f = Filter.extensibleMatch("foo", null, true, valueString);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -6626,8 +6619,7 @@
          throws Exception
   {
     String valueString = "\\* Jos\u00e9 Jalape\u00f1o (on a stick) \\*";
-    Filter f = Filter.createExtensibleMatchFilter(null, "foo", true,
-                                                  valueString);
+    Filter f = Filter.extensibleMatch(null, "foo", true, valueString);
 
     assertEquals(f.getFilterType(), Filter.FILTER_TYPE_EXTENSIBLE_MATCH);
 
@@ -7195,9 +7187,9 @@
     {
       assertEquals(parsedFilter.matchesEntry(e),
            expected.booleanValue());
-      assertEquals(Filter.createNOTFilter(parsedFilter).matchesEntry(e),
+      assertEquals(Filter.not(parsedFilter).matchesEntr...
 
[truncated message content]

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1590] trunk

[<di...@us...>]

Revision: 1590
          http://sourceforge.net/p/ldap-sdk/code/1590
Author:   dirmgr
Date:     2023-03-02 21:07:49 +0000 (Thu, 02 Mar 2023)
Log Message:
-----------
Add RFC 9371 and link to IANA PEN registry

Updated the set of LDAP-related specifications to include RFC 9371,
which describes the procedures for registering private enterprise
numbers (PENs), which may be used when defining your own object
identifiers for custom schema elements or other purposes.  The OID
registry document has also been updated to provide a link to this
RFC and to the IANA PEN registry.

Modified Paths:
--------------
    trunk/docs/ldap-oid-reference.html
    trunk/docs/release-notes.html
    trunk/docs/specs/rfcs.html
    trunk/tests/unit/src/com/unboundid/util/OIDRegistryTestCase.java

Added Paths:
-----------
    trunk/docs/specs/rfc9371.txt

Modified: trunk/docs/ldap-oid-reference.html
===================================================================
--- trunk/docs/ldap-oid-reference.html	2023-02-10 21:58:14 UTC (rev 1589)
+++ trunk/docs/ldap-oid-reference.html	2023-03-02 21:07:49 UTC (rev 1590)
@@ -10,6 +10,10 @@
                 Object identifiers are used throughout LDAP, but they are particularly common in schema elements, controls, and extended operations. This document provides a table of some of the most common OIDs used in LDAP along with a brief explanation of their purpose and (when applicable) a reference to the appropriate specification.
               </p>
 
+              <p>
+                If you need to define OIDs for your own use (for example, for defining custom attribute types or object classes), you may use the <a href="https://www.iana.org/assignments/enterprise-numbers/" target="_blank">IANA Private Enterprise Numbers (PENs) registry</a> provides an option to request an official OID base, as per <a href="${BASE}specs/rfc9371.txt" target="_blank">RFC 9371</a>.
+              </p>
+
               <table border="1" cellpadding="5" cellspacing="0">
                 <tr>
                   <th align="left">OID</th>

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2023-02-10 21:58:14 UTC (rev 1589)
+++ trunk/docs/release-notes.html	2023-03-02 21:07:49 UTC (rev 1590)
@@ -67,6 +67,15 @@
                 </li>
 
                 <li>
+                  Updated the set of LDAP-related specifications to include RFC 9371, which
+                  describes the procedures for registering private enterprise numbers (PENs),
+                  which may be used when defining your own object identifiers for custom schema
+                  elements or other purposes.  The OID registry document has also been updated to
+                  provide a link to this RFC and to the IANA PEN registry.
+                  <br><br>
+                </li>
+
+                <li>
                   Updated documentation to include the latest versions of
                   draft-howard-gssapi-aead, draft-ietf-kitten-scram-2fa, draft-melnikov-scram-bis,
                   and draft-reitzenstein-kitten-opaque in the set of LDAP-related specifications.

Added: trunk/docs/specs/rfc9371.txt
===================================================================
--- trunk/docs/specs/rfc9371.txt	                        (rev 0)
+++ trunk/docs/specs/rfc9371.txt	2023-03-02 21:07:49 UTC (rev 1590)
@@ -0,0 +1,273 @@
+
+
+
+
+Internet Engineering Task Force (IETF)                          A. Baber
+Request for Comments: 9371                                          IANA
+Category: Informational                                       P. Hoffman
+ISSN: 2070-1721                                                    ICANN
+                                                              March 2023
+
+
+     Registration Procedures for Private Enterprise Numbers (PENs)
+
+Abstract
+
+   This document describes how Private Enterprise Numbers (PENs) are
+   registered by IANA.  It shows how to request a new PEN and how to
+   modify a current PEN.  It also gives a brief overview of PEN uses.
+
+Status of This Memo
+
+   This document is not an Internet Standards Track specification; it is
+   published for informational purposes.
+
+   This document is a product of the Internet Engineering Task Force
+   (IETF).  It represents the consensus of the IETF community.  It has
+   received public review and has been approved for publication by the
+   Internet Engineering Steering Group (IESG).  Not all documents
+   approved by the IESG are candidates for any level of Internet
+   Standard; see Section 2 of RFC 7841.
+
+   Information about the current status of this document, any errata,
+   and how to provide feedback on it may be obtained at
+   https://www.rfc-editor.org/info/rfc9371.
+
+Copyright Notice
+
+   Copyright (c) 2023 IETF Trust and the persons identified as the
+   document authors.  All rights reserved.
+
+   This document is subject to BCP 78 and the IETF Trust's Legal
+   Provisions Relating to IETF Documents
+   (https://trustee.ietf.org/license-info) in effect on the date of
+   publication of this document.  Please review these documents
+   carefully, as they describe your rights and restrictions with respect
+   to this document.  Code Components extracted from this document must
+   include Revised BSD License text as described in Section 4.e of the
+   Trust Legal Provisions and are provided without warranty as described
+   in the Revised BSD License.
+
+Table of Contents
+
+   1.  Introduction
+     1.1.  Uses of PENs
+   2.  PEN Assignment
+     2.1.  Requesting a PEN Assignment
+     2.2.  Modifying an Existing Record
+     2.3.  Deleting a PEN Record
+   3.  PEN Registry Specifics
+   4.  IANA Considerations
+   5.  Security Considerations
+   6.  References
+     6.1.  Normative References
+     6.2.  Informative References
+   Acknowledgements
+   Authors' Addresses
+
+1.  Introduction
+
+   Private Enterprise Numbers (PENs) are identifiers that can be used
+   anywhere that an ASN.1 object identifier (OID) [ASN1] can be used.
+   Originally, PENs were developed so that organizations that needed to
+   identify themselves in Simple Network Management Protocol (SNMP)
+   [RFC3411] Management Information Base (MIB) configurations could do
+   so easily.  PENs are also useful in any application or configuration
+   language that needs OIDs to identify organizations.
+
+   The IANA Functions Operator, referred to in this document as "IANA",
+   manages and maintains the PEN registry in consultation with the IESG.
+   PENs are issued from an OID prefix that was assigned to IANA.  That
+   OID prefix is 1.3.6.1.4.1.  Using the (now archaic) notation of
+   ownership names in the OID tree, that corresponds to:
+
+   1   3   6   1        4       1
+   iso.org.dod.internet.private.enterprise
+
+   A PEN is an OID that begins with the PEN prefix.  Thus, the OID
+   1.3.6.1.4.1.32473 is a PEN.
+
+1.1.  Uses of PENs
+
+   Once a PEN has been assigned to an organization, individual, or other
+   entity, that assignee can use the PEN by itself (possibly to
+   represent the assignee) or as the root of other OIDs associated with
+   the assignee.  For example, if an assignee is assigned the PEN
+   1.3.6.1.4.1.32473, it might use 1.3.6.1.4.1.32473.7 to identify a
+   protocol extension and use 1.3.6.1.4.1.32473.12.3 to identify a set
+   of algorithms that it supports in a protocol.
+
+   Neither IANA nor the IETF can control how an assignee uses its PEN.
+   In fact, no one can exert such control: that is the meaning of
+   "private" in "private enterprise number".  Similarly, no one can
+   prevent an assignee that is not the registered owner of a PEN from
+   using that PEN, or any PEN, however they want.
+
+   A very common use of PENs is to give unique identifiers in IETF
+   protocols.  SNMP MIB configuration files use PENs for identifying the
+   origin of values.  Protocols that use PENs as identifiers of
+   extension mechanisms include RADIUS [RFC2865], Diameter [RFC6733],
+   Syslog [RFC5424], RSVP [RFC5284], and vCard [RFC6350].
+
+2.  PEN Assignment
+
+   PENs are assigned by IANA.  The registry is located at
+   <https://www.iana.org/assignments/enterprise-numbers>, and requests
+   for new assignments or the modification of existing assignments can
+   also be submitted at that URL.
+
+   IANA maintains the PEN registry in accordance with the "First Come
+   First Served" registration policy described in [RFC8126].  Values are
+   assigned sequentially.
+
+2.1.  Requesting a PEN Assignment
+
+   Requests for assignment must provide the name of the assignee, the
+   name of a public contact who can respond to questions about the
+   assignment, and contact information that can be used to verify change
+   requests.  The contact's name and email address will be included in
+   the public registry.
+
+   A prospective assignee may request multiple PENs, but obtaining one
+   PEN and making internal sub-assignments is typically more
+   appropriate.  (Sub-assignments should not be reported to IANA.)
+
+   IANA may refuse to process abusive requests.
+
+2.2.  Modifying an Existing Record
+
+   Any of the information associated with a registered value can be
+   modified, including the name of the assignee.
+
+   Modification requests require authorization by a representative of
+   the assignee.  Authorization will be validated either with
+   information kept on file with IANA or with other identifying
+   documentation, if necessary.
+
+2.3.  Deleting a PEN Record
+
+   Although such requests are rare, registrations can be deleted.  When
+   a registration is deleted, all identifying information is removed
+   from the registry, and the value is marked as "returned."  Returned
+   values will not be made available for reassignment until all other
+   unassigned values have been exhausted; as can be seen in Section 3,
+   the unassigned values are unlikely to ever run out.
+
+3.  PEN Registry Specifics
+
+   The range for values after the PEN prefix is 0 to 2**32-1.  The
+   values 0 and 4294967295 (2**32-1) are reserved.  Note that while the
+   original PEN definition had no upper bound for the value after the
+   PEN prefix, there is now an upper bound due to some IETF protocols
+   limiting the size of that value.  For example, Diameter [RFC6733]
+   limits the value to 2**32-1.
+
+   There is a PEN number, 32473, reserved for use as an example in
+   documentation.  This reservation is described in [RFC5612].
+
+   Values in the registry that have unclear ownership are marked
+   "Reserved".  These values will not be reassigned to a new company or
+   individual without consulting the IESG.
+
+4.  IANA Considerations
+
+   Per this document, IANA has made the following changes to the PEN
+   registry:
+
+   *  Values 2187, 2188, 3513, 4164, 4565, 4600, 4913, 4999, 5099, 5144,
+      5201, 5683, 5777, 6260, 6619, 14827, 16739, 26975, and the range
+      from 11670 to 11769, which had been missing from the registry,
+      have been listed as "Reserved."  As described in [RFC8126],
+      reserved values can be released by the IESG.
+
+   *  This document has been listed in the registry's "Reference" field.
+
+   *  "First Come First Served" has been listed as its registration
+      procedure.
+
+5.  Security Considerations
+
+   Registering PENs does not introduce any significant security
+   considerations.
+
+   There is no cryptographic binding of a registrant in the PEN registry
+   and the PEN(s) assigned to them.  Thus, the entries in the PEN
+   registry cannot be used to validate the ownership of a PEN in use.
+   For example, if the PEN 1.3.6.1.4.1.32473 is seen in a protocol as
+   indicating the owner of some data, there is no way to securely
+   correlate that use with the name and assignee of the owner listed in
+   the PEN registry.
+
+6.  References
+
+6.1.  Normative References
+
+   [RFC8126]  Cotton, M., Leiba, B., and T. Narten, "Guidelines for
+              Writing an IANA Considerations Section in RFCs", BCP 26,
+              RFC 8126, DOI 10.17487/RFC8126, June 2017,
+              <https://www.rfc-editor.org/info/rfc8126>.
+
+6.2.  Informative References
+
+   [ASN1]     ITU-T, "Information technology - ASN.1 encoding rules:
+              Specification of Basic Encoding Rules (BER), Canonical
+              Encoding Rules (CER) and Distinguished Encoding Rules
+              (DER)", ITU-T Recommendation X.690, February 2021,
+              <https://www.itu.int/rec/T-REC-X.690/en>.
+
+   [RFC2865]  Rigney, C., Willens, S., Rubens, A., and W. Simpson,
+              "Remote Authentication Dial In User Service (RADIUS)",
+              RFC 2865, DOI 10.17487/RFC2865, June 2000,
+              <https://www.rfc-editor.org/info/rfc2865>.
+
+   [RFC3411]  Harrington, D., Presuhn, R., and B. Wijnen, "An
+              Architecture for Describing Simple Network Management
+              Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
+              DOI 10.17487/RFC3411, December 2002,
+              <https://www.rfc-editor.org/info/rfc3411>.
+
+   [RFC5284]  Swallow, G. and A. Farrel, "User-Defined Errors for RSVP",
+              RFC 5284, DOI 10.17487/RFC5284, August 2008,
+              <https://www.rfc-editor.org/info/rfc5284>.
+
+   [RFC5424]  Gerhards, R., "The Syslog Protocol", RFC 5424,
+              DOI 10.17487/RFC5424, March 2009,
+              <https://www.rfc-editor.org/info/rfc5424>.
+
+   [RFC5612]  Eronen, P. and D. Harrington, "Enterprise Number for
+              Documentation Use", RFC 5612, DOI 10.17487/RFC5612, August
+              2009, <https://www.rfc-editor.org/info/rfc5612>.
+
+   [RFC6350]  Perreault, S., "vCard Format Specification", RFC 6350,
+              DOI 10.17487/RFC6350, August 2011,
+              <https://www.rfc-editor.org/info/rfc6350>.
+
+   [RFC6733]  Fajardo, V., Ed., Arkko, J., Loughney, J., and G. Zorn,
+              Ed., "Diameter Base Protocol", RFC 6733,
+              DOI 10.17487/RFC6733, October 2012,
+              <https://www.rfc-editor.org/info/rfc6733>.
+
+Acknowledgements
+
+   An earlier draft version of this document was authored by Pearl Liang
+   and Alexey Melnikov.  Additional significant contributions have come
+   from Dan Romascanu, Bert Wijnen, David Conrad, Michelle Cotton, and
+   Benoit Claise.
+
+Authors' Addresses
+
+   Amanda Baber
+   Internet Assigned Numbers Authority
+   PTI/ICANN
+   12025 Waterfront Drive
+   Los Angeles,  90094
+   United States of America
+   Email: ama...@ia...
+
+
+   Paul Hoffman
+   ICANN
+   12025 Waterfront Drive
+   Los Angeles,  90094
+   United States of America
+   Email: pau...@ic...

Modified: trunk/docs/specs/rfcs.html
===================================================================
--- trunk/docs/specs/rfcs.html	2023-02-10 21:58:14 UTC (rev 1589)
+++ trunk/docs/specs/rfcs.html	2023-03-02 21:07:49 UTC (rev 1590)
@@ -794,6 +794,12 @@
     Obsoletes:  <a href="rfc5653.txt">RFC 5653</a>
     <br><br>
   </li>
+
+  <li>
+    <a href="rfc9371.txt">RFC 9371</a>:  Registration Procedures for Private Enterprise Numbers
+                                      (PENs)
+    <br><br>
+  </li>
 </ul>
 
 

Modified: trunk/tests/unit/src/com/unboundid/util/OIDRegistryTestCase.java
===================================================================
--- trunk/tests/unit/src/com/unboundid/util/OIDRegistryTestCase.java	2023-02-10 21:58:14 UTC (rev 1589)
+++ trunk/tests/unit/src/com/unboundid/util/OIDRegistryTestCase.java	2023-03-02 21:07:49 UTC (rev 1590)
@@ -320,6 +320,17 @@
            "reference to the appropriate specification.");
       w.println(baseIndent + "</p>");
       w.println();
+      w.println(baseIndent + "<p>");
+      w.println(baseIndent + "  If you need to define OIDs for your own use " +
+           "(for example, for defining custom attribute types or object " +
+           "classes), you may use the <a " +
+           "href=\"https://www.iana.org/assignments/enterprise-numbers/\" " +
+           "target=\"_blank\">IANA Private Enterprise Numbers (PENs) " +
+           "registry</a> provides an option to request an official OID base, " +
+           "as per <a href=\"${BASE}specs/rfc9371.txt\" " +
+           "target=\"_blank\">RFC 9371</a>.");
+      w.println(baseIndent + "</p>");
+      w.println();
       w.println(baseIndent + "<table border=\"1\" cellpadding=\"5\" " +
            "cellspacing=\"0\">");
       w.println(baseIndent + "  <tr>");

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1589] trunk

[<di...@us...>]

Revision: 1589
          http://sourceforge.net/p/ldap-sdk/code/1589
Author:   dirmgr
Date:     2023-02-10 21:58:14 +0000 (Fri, 10 Feb 2023)
Log Message:
-----------
Update the OID registry JSON file

Updated the OID registry JSON file to include OIDs for
administrative alerts being added to the Ping Identity Directory
Server.

Modified Paths:
--------------
    trunk/docs/ldap-oid-reference.html
    trunk/resource/oid-registry.json

Modified: trunk/docs/ldap-oid-reference.html
===================================================================
--- trunk/docs/ldap-oid-reference.html	2023-02-07 23:12:49 UTC (rev 1588)
+++ trunk/docs/ldap-oid-reference.html	2023-02-10 21:58:14 UTC (rev 1589)
@@ -3732,6 +3732,21 @@
                   <td>Ping Identity Directory Server</td>
                 </tr>
                 <tr>
+                  <td>1.3.6.1.4.1.30221.2.10.3.194</td>
+                  <td><tt>encryption-settings-database-inaccessible</tt> Administrative Alert</td>
+                  <td>Ping Identity Directory Server</td>
+                </tr>
+                <tr>
+                  <td>1.3.6.1.4.1.30221.2.10.3.195</td>
+                  <td><tt>encryption-settings-database-prolonged-outage</tt> Administrative Alert</td>
+                  <td>Ping Identity Directory Server</td>
+                </tr>
+                <tr>
+                  <td>1.3.6.1.4.1.30221.2.10.3.196</td>
+                  <td><tt>encryption-settings-database-access-restored</tt> Administrative Alert</td>
+                  <td>Ping Identity Directory Server</td>
+                </tr>
+                <tr>
                   <td>1.3.6.1.4.1.30221.2.12.1</td>
                   <td>Excluding Attributes from Search Result Entries Feature</td>
                   <td>Ping Identity Directory Server</td>

Modified: trunk/resource/oid-registry.json
===================================================================
--- trunk/resource/oid-registry.json	2023-02-07 23:12:49 UTC (rev 1588)
+++ trunk/resource/oid-registry.json	2023-02-10 21:58:14 UTC (rev 1589)
@@ -741,6 +741,9 @@
 { "oid":"1.3.6.1.4.1.30221.2.10.3.191", "name":"topology-registry-secret-key-deleted", "type":"Administrative Alert", "origin":"Ping Identity Directory Server" }
 { "oid":"1.3.6.1.4.1.30221.2.10.3.192", "name":"replace-certificate-succeeded", "type":"Administrative Alert", "origin":"Ping Identity Directory Server" }
 { "oid":"1.3.6.1.4.1.30221.2.10.3.193", "name":"replace-certificate-failed", "type":"Administrative Alert", "origin":"Ping Identity Directory Server" }
+{ "oid":"1.3.6.1.4.1.30221.2.10.3.194", "name":"encryption-settings-database-inaccessible", "type":"Administrative Alert", "origin":"Ping Identity Directory Server" }
+{ "oid":"1.3.6.1.4.1.30221.2.10.3.195", "name":"encryption-settings-database-prolonged-outage", "type":"Administrative Alert", "origin":"Ping Identity Directory Server" }
+{ "oid":"1.3.6.1.4.1.30221.2.10.3.196", "name":"encryption-settings-database-access-restored", "type":"Administrative Alert", "origin":"Ping Identity Directory Server" }
 { "oid":"1.3.6.1.4.1.30221.2.12.1", "name":"Excluding Attributes from Search Result Entries", "type":"Feature", "origin":"Ping Identity Directory Server" }
 { "oid":"1.3.6.1.4.1.30221.2.12.2", "name":"Subordinate Subtree Search Scope", "type":"Feature", "origin":"Ping Identity Directory Server" }
 { "oid":"1.3.6.1.4.1.30221.2.12.3", "name":"Changelog Attribute Indexing", "type":"Feature", "origin":"Ping Identity Directory Server" }

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1588] trunk

[<di...@us...>]

Revision: 1588
          http://sourceforge.net/p/ldap-sdk/code/1588
Author:   dirmgr
Date:     2023-02-07 23:12:49 +0000 (Tue, 07 Feb 2023)
Log Message:
-----------
Add an ObjectTrio class

Added a new ObjectTrio utility class that can be useful in cases
where only a single object is allowed but three typed objects are
needed (e.g., when you want to return three typed items from a
method).

Modified Paths:
--------------
    trunk/docs/release-notes.html

Added Paths:
-----------
    trunk/src/com/unboundid/util/ObjectTrio.java
    trunk/tests/unit/src/com/unboundid/util/ObjectTrioTestCase.java

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2023-01-27 23:48:04 UTC (rev 1587)
+++ trunk/docs/release-notes.html	2023-02-07 23:12:49 UTC (rev 1588)
@@ -60,6 +60,13 @@
                 </li>
 
                 <li>
+                  Added a new ObjectTrio utility class that can be useful in cases where only a
+                  single object is allowed but three typed objects are needed (e.g., when you want
+                  to return three typed items from a method).
+                  <br><br>
+                </li>
+
+                <li>
                   Updated documentation to include the latest versions of
                   draft-howard-gssapi-aead, draft-ietf-kitten-scram-2fa, draft-melnikov-scram-bis,
                   and draft-reitzenstein-kitten-opaque in the set of LDAP-related specifications.

Added: trunk/src/com/unboundid/util/ObjectTrio.java
===================================================================
--- trunk/src/com/unboundid/util/ObjectTrio.java	                        (rev 0)
+++ trunk/src/com/unboundid/util/ObjectTrio.java	2023-02-07 23:12:49 UTC (rev 1588)
@@ -0,0 +1,271 @@
+/*
+ * Copyright 2023 Ping Identity Corporation
+ * All Rights Reserved.
+ */
+/*
+ * Copyright 2023 Ping Identity Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * Copyright (C) 2023 Ping Identity Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (GPLv2 only)
+ * or the terms of the GNU Lesser General Public License (LGPLv2.1 only)
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses>.
+ */
+package com.unboundid.util;
+
+
+
+import java.io.Serializable;
+
+
+
+/**
+ * This class provides a typed trio of objects.  It may be used whenever three
+ * objects are required but only one is allowed (e.g., returning three values
+ * from a method).
+ *
+ * @param  <F>  The type of the first object.
+ * @param  <S>  The type of the second object.
+ * @param  <T>  The type of the third object.
+ */
+@NotMutable()
+@ThreadSafety(level=ThreadSafetyLevel.COMPLETELY_THREADSAFE)
+public final class ObjectTrio<F,S,T>
+       implements Serializable
+{
+  /**
+   * The serial version UID for this serializable class.
+   */
+  private static final long serialVersionUID = 1205337843902801247L;
+
+
+
+  // The first object in this trio.
+  @Nullable private final F first;
+
+  // The second object in this trio.
+  @Nullable private final S second;
+
+  // The third object in this trio.
+  @Nullable private final T third;
+
+
+
+  /**
+   * Creates a new object trio with the provided elements.
+   *
+   * @param  first   The first object in this trio.
+   * @param  second  The second object in this trio.
+   * @param  third   The third object in this trio.
+   */
+  public ObjectTrio(@Nullable final F first,
+                    @Nullable final S second,
+                    @Nullable final T third)
+  {
+    this.first = first;
+    this.second = second;
+    this.third = third;
+  }
+
+
+
+  /**
+   * Retrieves the first object in  this trio.
+   *
+   * @return  The first object in this trio.
+   */
+  @Nullable()
+  public F getFirst()
+  {
+    return first;
+  }
+
+
+
+  /**
+   * Retrieves the second object in this trio.
+   *
+   * @return  The second object in this trio.
+   */
+  @Nullable()
+  public S getSecond()
+  {
+    return second;
+  }
+
+
+
+  /**
+   * Retrieves the third object in this trio.
+   *
+   * @return  The third object in this trio.
+   */
+  @Nullable()
+  public T getThird()
+  {
+    return third;
+  }
+
+
+
+  /**
+   * Retrieves a hash code for this object trio.
+   *
+   * @return  A hash code for this object trio.
+   */
+  @Override()
+  public int hashCode()
+  {
+    int h = 0;
+
+    if (first != null)
+    {
+      h += first.hashCode();
+    }
+
+    if (second != null)
+    {
+      h += second.hashCode();
+    }
+
+    if (third != null)
+    {
+      h += third.hashCode();
+    }
+
+    return h;
+  }
+
+
+
+  /**
+   * Indicates whether the provided object is equal to this object trio.
+   *
+   * @param  o  The object for which to make the determination.
+   *
+   * @return  {@code true} if the provided object is equal to this object trio,
+   *          or {@code false} if not.
+   */
+  @Override()
+  public boolean equals(@Nullable final Object o)
+  {
+    if (o == null)
+    {
+      return false;
+    }
+
+    if (o == this)
+    {
+      return true;
+    }
+
+    if (o instanceof ObjectTrio)
+    {
+      final ObjectTrio<?,?,?> t = (ObjectTrio<?,?,?>) o;
+      if (first == null)
+      {
+        if (t.first != null)
+        {
+          return false;
+        }
+      }
+      else
+      {
+        if (! first.equals(t.first))
+        {
+          return false;
+        }
+      }
+
+      if (second == null)
+      {
+        if (t.second != null)
+        {
+          return false;
+        }
+      }
+      else
+      {
+        if (! second.equals(t.second))
+        {
+          return false;
+        }
+      }
+
+      if (third == null)
+      {
+        if (t.third != null)
+        {
+          return false;
+        }
+      }
+      else
+      {
+        if (! third.equals(t.third))
+        {
+          return false;
+        }
+      }
+
+      return true;
+    }
+
+    return false;
+  }
+
+
+
+  /**
+   * Retrieves a string representation of this object trio.
+   *
+   * @return  A string representation of this object trio.
+   */
+  @Override()
+  @NotNull()
+  public String toString()
+  {
+    final StringBuilder buffer = new StringBuilder();
+    toString(buffer);
+    return buffer.toString();
+  }
+
+
+
+  /**
+   * Appends a string representation of this object trio to the provided buffer.
+   *
+   * @param  buffer  The buffer to which the information should be appended.
+   */
+  public void toString(@NotNull final StringBuilder buffer)
+  {
+    buffer.append("ObjectTrio(first=");
+    buffer.append(String.valueOf(first));
+    buffer.append(", second=");
+    buffer.append(String.valueOf(second));
+    buffer.append(", third=");
+    buffer.append(String.valueOf(third));
+    buffer.append(')');
+  }
+}

Added: trunk/tests/unit/src/com/unboundid/util/ObjectTrioTestCase.java
===================================================================
--- trunk/tests/unit/src/com/unboundid/util/ObjectTrioTestCase.java	                        (rev 0)
+++ trunk/tests/unit/src/com/unboundid/util/ObjectTrioTestCase.java	2023-02-07 23:12:49 UTC (rev 1588)
@@ -0,0 +1,279 @@
+/*
+ * Copyright 2011-2023 Ping Identity Corporation
+ * All Rights Reserved.
+ */
+/*
+ * Copyright 2011-2023 Ping Identity Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * Copyright (C) 2011-2023 Ping Identity Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (GPLv2 only)
+ * or the terms of the GNU Lesser General Public License (LGPLv2.1 only)
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses>.
+ */
+package com.unboundid.util;
+
+
+
+import org.testng.annotations.DataProvider;
+import org.testng.annotations.Test;
+
+import com.unboundid.ldap.sdk.LDAPSDKTestCase;
+
+
+
+/**
+ * This class provides a set of test cases for the {@code ObjectTrio} class.
+ */
+public final class ObjectTrioTestCase
+       extends LDAPSDKTestCase
+{
+  /**
+   * Tests the behavior for an object trio in which all three elements are
+   * non-{@code null}.
+   *
+   * @throws  Exception  If an unexpected problem occurs.
+   */
+  @Test()
+  public void testAllNonNull()
+         throws Exception
+  {
+    final ObjectTrio<String,Boolean,Integer> trio =
+         new ObjectTrio<>("foo", true, 1234);
+    assertNotNull(trio);
+
+    assertNotNull(trio.getFirst());
+    assertEquals(trio.getFirst(), "foo");
+
+    assertNotNull(trio.getSecond());
+    assertEquals(trio.getSecond(), Boolean.TRUE);
+
+    assertNotNull(trio.getThird());
+    assertEquals(trio.getThird(), Integer.valueOf(1234));
+
+    assertEquals(trio.hashCode(),
+         ("foo".hashCode() + Boolean.TRUE.hashCode() +
+              Integer.valueOf(1234).hashCode()));
+
+    assertTrue(trio.equals(new ObjectTrio<>("foo", true, 1234)));
+
+    assertNotNull(trio.toString());
+    assertEquals(trio.toString(), "ObjectTrio(first=foo, second=true, " +
+         "third=1234)");
+  }
+
+
+
+  /**
+   * Tests the behavior for an object trio in which all three elements are
+   * {@code null}.
+   *
+   * @throws  Exception  If an unexpected problem occurs.
+   */
+  @Test()
+  public void testAllNull()
+         throws Exception
+  {
+    final ObjectTrio<String,Boolean,Integer> trio =
+         new ObjectTrio<>(null, null, null);
+    assertNotNull(trio);
+
+    assertNull(trio.getFirst());
+    assertNull(trio.getSecond());
+    assertNull(trio.getThird());
+
+    assertEquals(trio.hashCode(), 0);
+
+    assertTrue(trio.equals(new ObjectTrio<>(null, null, null)));
+
+    assertNotNull(trio.toString());
+    assertEquals(trio.toString(), "ObjectTrio(first=null, second=null, " +
+         "third=null)");
+  }
+
+
+
+  /**
+   * Tests the behavior for an object trio in which there are a mix of
+   * {@code null} and non-{@code null} elements.
+   *
+   * @throws  Exception  If an unexpected problem occurs.
+   */
+  @Test()
+  public void testSomeNull()
+         throws Exception
+  {
+    final ObjectTrio<String,String,String> trio =
+         new ObjectTrio<>("foo", null, "bar");
+    assertNotNull(trio);
+
+    assertNotNull(trio.getFirst());
+    assertEquals(trio.getFirst(), "foo");
+
+    assertNull(trio.getSecond());
+
+    assertNotNull(trio.getThird());
+    assertEquals(trio.getThird(), "bar");
+
+    assertEquals(trio.hashCode(),
+         ("foo".hashCode() + "bar".hashCode()));
+
+    assertTrue(trio.equals(new ObjectTrio<>("foo", null, "bar")));
+
+    assertNotNull(trio.toString());
+    assertEquals(trio.toString(), "ObjectTrio(first=foo, second=null, " +
+         "third=bar)");
+  }
+
+
+
+  /**
+   * Tests the behavior of the {@code equals} method.
+   *
+   * @param  o  The object to use for testing.
+   * @param  m  Indicates whether to expect the provided object to match the
+   *            given test object.
+   *
+   * @throws  Exception  If an unexpected problem occurs.
+   */
+  @Test(dataProvider="equalsData")
+  public void testEquals(final Object o, final boolean m)
+         throws Exception
+  {
+    final ObjectTrio<String,String,String> t =
+         new ObjectTrio<>("foo", "bar", "baz");
+
+    assertTrue(t.equals(t));
+
+    assertEquals(t.equals(o), m);
+
+    if (o != null)
+    {
+      assertEquals(o.equals(t), m);
+    }
+
+    assertFalse(t.equals(null));
+
+    assertFalse(t.equals("foo"));
+
+    assertTrue(t.equals(new ObjectTrio<>("foo", "bar", "baz")));
+
+    assertTrue(t.equals(new ObjectTrio<Object,Object,Object>(
+         "foo", "bar", "baz")));
+
+    assertFalse(t.equals(new ObjectTrio<>(1, 2, 3)));
+
+    assertFalse(t.equals(new ObjectTrio<>("different", "bar", "baz")));
+
+    assertFalse(t.equals(new ObjectTrio<>("foo", "different", "baz")));
+
+    assertFalse(t.equals(new ObjectTrio<>("foo", "bar", "different")));
+
+    assertFalse(t.equals(new ObjectTrio<>(null, null, null)));
+  }
+
+
+
+  /**
+   * Provides a set of data for use in testing the {@code equals} method.
+   *
+   * @return  A set of data for use in testing the {@code equals} method.
+   *
+   * @throws  Exception  If an unexpected problem occurs.
+   */
+  @DataProvider(name="equalsData")
+  public Object[][] getEqualsData()
+         throws Exception
+  {
+    return new Object[][]
+    {
+      new Object[]
+      {
+        null,
+        false
+      },
+
+      new Object[]
+      {
+        "foo",
+        false
+      },
+
+      new Object[]
+      {
+        new ObjectTrio<>("foo", "bar", "baz"),
+        true
+      },
+
+      new Object[]
+      {
+        new ObjectTrio<Object,Object,Object>("foo", "bar", "baz"),
+        true
+      },
+
+      new Object[]
+      {
+        new ObjectTrio<>("foo", "foo", "baz"),
+        false
+      },
+
+      new Object[]
+      {
+        new ObjectTrio<>("foo", "bar", "foo"),
+        false
+      },
+
+      new Object[]
+      {
+        new ObjectTrio<>("foo", "bar", "bar"),
+        false
+      },
+
+      new Object[]
+      {
+        new ObjectTrio<>(null, "bar", "baz"),
+        false
+      },
+
+      new Object[]
+      {
+        new ObjectTrio<>("foo", null, "baz"),
+        false
+      },
+
+      new Object[]
+      {
+        new ObjectTrio<>("foo", "bar", null),
+        false
+      },
+
+      new Object[]
+      {
+        new ObjectTrio<>(1, 2, 3),
+        false
+      },
+    };
+  }
+}

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1587] trunk

[<di...@us...>]

Revision: 1587
          http://sourceforge.net/p/ldap-sdk/code/1587
Author:   dirmgr
Date:     2023-01-27 23:48:04 +0000 (Fri, 27 Jan 2023)
Log Message:
-----------
Passphrase-encrypted output stream improvements

Updated the passphrase-encrypted output stream to use a higher
key factory iteration count by default.  When using the strongest
available 256-bit AES encryption, it now follows the latest OWASP
recommendation of 600,000 PBKDF2 iterations.  The key factory
iteration count can still be explicitly specified when creating a
new output stream if an alternative iteration count is desired, and
the default iteration count can now be overridden with a system
property.

Updated the passphrase-encrypted output stream to make it possible
to create a new output stream with the encryption header from a
previously created encryption header.  This will make it possible to
reuse the previously derived key (with a different initialization
vector), which will be substantially faster when using the same
passphrase to encrypt multiple output streams than needing to
re-derive the key for each stream.

Modified Paths:
--------------
    trunk/docs/release-notes.html
    trunk/messages/unboundid-ldapsdk-util.properties
    trunk/src/com/unboundid/util/PassphraseEncryptedOutputStream.java
    trunk/src/com/unboundid/util/PassphraseEncryptedStreamHeader.java
    trunk/src/com/unboundid/util/PassphraseEncryptionCipherType.java
    trunk/tests/unit/src/com/unboundid/util/PassphraseEncryptedStreamsTestCase.java

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2023-01-16 20:46:51 UTC (rev 1586)
+++ trunk/docs/release-notes.html	2023-01-27 23:48:04 UTC (rev 1587)
@@ -40,6 +40,26 @@
                 </li>
 
                 <li>
+                  Updated the passphrase-encrypted output stream to use a higher key factory
+                  iteration count by default.  When using the strongest available 256-bit AES
+                  encryption, it now follows the latest OWASP recommendation of 600,000 PBKDF2
+                  iterations.  The key factory iteration count can still be explicitly specified
+                  when creating a new output stream if an alternative iteration count is desired,
+                  and the default iteration count can now be overridden with a system property.
+                  <br><br>
+                </li>
+
+                <li>
+                  Updated the passphrase-encrypted output stream to make it possible to create a
+                  new output stream with the encryption header from a previously created
+                  encryption header.  This will make it possible to reuse the previously derived
+                  key (with a different initialization vector), which will be substantially faster
+                  when using the same passphrase to encrypt multiple output streams than needing
+                  to re-derive the key for each stream.
+                  <br><br>
+                </li>
+
+                <li>
                   Updated documentation to include the latest versions of
                   draft-howard-gssapi-aead, draft-ietf-kitten-scram-2fa, draft-melnikov-scram-bis,
                   and draft-reitzenstein-kitten-opaque in the set of LDAP-related specifications.

Modified: trunk/messages/unboundid-ldapsdk-util.properties
===================================================================
--- trunk/messages/unboundid-ldapsdk-util.properties	2023-01-16 20:46:51 UTC (rev 1586)
+++ trunk/messages/unboundid-ldapsdk-util.properties	2023-01-27 23:48:04 UTC (rev 1587)
@@ -953,6 +953,9 @@
 ERR_PW_ENCRYPTED_HEADER_NO_KEY_AVAILABLE=Unable to create a cipher from the \
   passphrase-encrypted stream header because no passphrase was provided when \
   decoding the header.
+ERR_PW_ENCRYPTED_STREAM_HEADER_COPY_WITHOUT_SECRET_KEY=Unable to create a copy \
+  of an existing passphrase-encrypted stream header with a new initialization \
+  vector because the provided header does not include a secret key.
 ERR_CLOSEABLE_LOCK_TRY_LOCK_TIMEOUT=Unable to acquire the closeable lock with \
   a timeout of {0}.
 ERR_CLOSEABLE_RW_LOCK_TRY_LOCK_WRITE_TIMEOUT=Unable to acquire the closeable \

Modified: trunk/src/com/unboundid/util/PassphraseEncryptedOutputStream.java
===================================================================
--- trunk/src/com/unboundid/util/PassphraseEncryptedOutputStream.java	2023-01-16 20:46:51 UTC (rev 1586)
+++ trunk/src/com/unboundid/util/PassphraseEncryptedOutputStream.java	2023-01-27 23:48:04 UTC (rev 1587)
@@ -84,6 +84,90 @@
 public final class PassphraseEncryptedOutputStream
      extends OutputStream
 {
+  /**
+   * The default PBKDF2 iteration count that should be used for the
+   * {@link PassphraseEncryptionCipherType#AES_128} cipher type.
+   */
+  public static final int DEFAULT_AES_128_CIPHER_TYPE_ITERATION_COUNT;
+
+
+
+  /**
+   * The default PBKDF2 iteration count that should be used for the
+   * {@link PassphraseEncryptionCipherType#AES_256} cipher type.
+   */
+  public static final int DEFAULT_AES_256_CIPHER_TYPE_ITERATION_COUNT;
+
+
+
+  /**
+   * The name of a system property that can be used to override the default
+   * PBKDF2 iteration count for the
+   * {@link PassphraseEncryptionCipherType#AES_128} cipher type.
+   */
+  @NotNull public static final String
+       PROPERTY_DEFAULT_AES_128_CIPHER_TYPE_ITERATION_COUNT =
+            PassphraseEncryptedOutputStream.class.getName() +
+                 ".defaultAES128CipherTypeIterationCount";
+
+
+
+  /**
+   * The name of a system property that can be used to override the default
+   * PBKDF2 iteration count for the
+   * {@link PassphraseEncryptionCipherType#AES_256} cipher type.
+   */
+  @NotNull public static final String
+       PROPERTY_DEFAULT_AES_256_CIPHER_TYPE_ITERATION_COUNT =
+            PassphraseEncryptedOutputStream.class.getName() +
+                 ".defaultAES256CipherTypeIterationCount";
+
+
+
+  static
+  {
+    int defaultAES128IterationCount = 100_000;
+    final String defaultAES128IterationCountPropertyValue =
+         StaticUtils.setSystemProperty(
+              PROPERTY_DEFAULT_AES_128_CIPHER_TYPE_ITERATION_COUNT, null);
+    if (defaultAES128IterationCountPropertyValue != null)
+    {
+      try
+      {
+        defaultAES128IterationCount =
+             Integer.parseInt(defaultAES128IterationCountPropertyValue);
+      }
+      catch (final Exception e)
+      {
+        Debug.debugException(e);
+      }
+    }
+
+    DEFAULT_AES_128_CIPHER_TYPE_ITERATION_COUNT = defaultAES128IterationCount;
+
+
+    int defaultAES256IterationCount = 600_000;
+    final String defaultAES256IterationCountPropertyValue =
+         StaticUtils.setSystemProperty(
+              PROPERTY_DEFAULT_AES_256_CIPHER_TYPE_ITERATION_COUNT, null);
+    if (defaultAES256IterationCountPropertyValue != null)
+    {
+      try
+      {
+        defaultAES256IterationCount =
+             Integer.parseInt(defaultAES256IterationCountPropertyValue);
+      }
+      catch (final Exception e)
+      {
+        Debug.debugException(e);
+      }
+    }
+
+    DEFAULT_AES_256_CIPHER_TYPE_ITERATION_COUNT = defaultAES256IterationCount;
+  }
+
+
+
   // The cipher output stream that will be used to actually write the
   // encrypted output.
   @NotNull private final CipherOutputStream cipherOutputStream;
@@ -537,6 +621,58 @@
 
 
   /**
+   * Creates a new passphrase-encrypted output stream that wraps the provided
+   * output stream and reuses the same derived secret key as the given
+   * stream header (although with a newly computed initialization vector).  This
+   * can dramatically reduce the cost of creating a new passphrase-encrypted
+   * output stream with the same underlying password and settings without the
+   * need to recompute the key.
+   *
+   * @param  header
+   *              The existing passphrase-encrypted stream header that contains
+   *              the details to use for the encryption.  It must not be
+   *              {@code null}, and it must have an associated secret key.
+   * @param  wrappedOutputStream
+   *              The output stream to which the encrypted data (optionally
+   *              preceded by a header with details about the encryption) will
+   *              be written.  It must not be {@code null}.
+   * @param  writeHeaderToStream
+   *              Indicates whether to write the generated
+   *              {@link PassphraseEncryptedStreamHeader} to the provided
+   *              {@code wrappedOutputStream} before any encrypted data so that
+   *              a {@link PassphraseEncryptedInputStream} can read it to obtain
+   *              information necessary for decrypting the data.  If this is
+   *              {@code false}, then the {@link #getEncryptionHeader()} method
+   *              must be used to obtain the encryption header so that it can be
+   *              stored elsewhere and provided to the
+   *              {@code PassphraseEncryptedInputStream} constructor.
+   *
+   * @throws  GeneralSecurityException  If a problem is encountered while
+   *                                    initializing the encryption.
+   *
+   * @throws  IOException  If a problem is encountered while writing the
+   *                       encryption header to the underlying output stream.
+   */
+  public PassphraseEncryptedOutputStream(
+              @NotNull final PassphraseEncryptedStreamHeader header,
+              @NotNull final OutputStream wrappedOutputStream,
+final boolean writeHeaderToStream)
+         throws GeneralSecurityException, IOException
+  {
+    encryptionHeader = header.withNewCipherInitializationVector();
+
+    final Cipher cipher = encryptionHeader.createCipher(Cipher.ENCRYPT_MODE);
+    if (writeHeaderToStream)
+    {
+      encryptionHeader.writeTo(wrappedOutputStream);
+    }
+
+    cipherOutputStream = new CipherOutputStream(wrappedOutputStream, cipher);
+  }
+
+
+
+  /**
    * Writes an encrypted representation of the provided byte to the underlying
    * output stream.
    *

Modified: trunk/src/com/unboundid/util/PassphraseEncryptedStreamHeader.java
===================================================================
--- trunk/src/com/unboundid/util/PassphraseEncryptedStreamHeader.java	2023-01-16 20:46:51 UTC (rev 1586)
+++ trunk/src/com/unboundid/util/PassphraseEncryptedStreamHeader.java	2023-01-27 23:48:04 UTC (rev 1587)
@@ -1077,6 +1077,48 @@
 
 
   /**
+   * Creates a copy of this passphrase-encrypted stream header that use a
+   * newly-computed initialization vector.  The new stream header can be used to
+   * create a new passphrase-encrypted output stream that safely leverages an
+   * already computed secret key to dramatically reduce the cost of creating a
+   * new stream from the same underlying passphrase.
+   *
+   * @return  The new passphrase-encrypted stream header that was created.
+   *
+   * @throws  GeneralSecurityException  If a problem occurs while creating a
+   *                                    copy of this passphrase-encrypted stream
+   *                                    header with a new initialization vector.
+   */
+  @NotNull()
+  PassphraseEncryptedStreamHeader withNewCipherInitializationVector()
+       throws GeneralSecurityException
+  {
+    if (secretKey == null)
+    {
+      throw new InvalidKeyException(
+           ERR_PW_ENCRYPTED_STREAM_HEADER_COPY_WITHOUT_SECRET_KEY.get());
+    }
+
+    final byte[] newInitializationVector =
+         new byte[cipherInitializationVector.length];
+    ThreadLocalSecureRandom.get().nextBytes(newInitializationVector);
+
+    final ObjectPair<byte[],byte[]> headerPair = encode(keyFactoryAlgorithm,
+         keyFactoryIterationCount, this.keyFactorySalt, keyFactoryKeyLengthBits,
+         cipherTransformation, newInitializationVector, keyIdentifier,
+         secretKey, macAlgorithm);
+    final byte[] newEncodedHeader = headerPair.getFirst();
+    final byte[] newMACValue = headerPair.getSecond();
+
+    return new PassphraseEncryptedStreamHeader(keyFactoryAlgorithm,
+         keyFactoryIterationCount, keyFactorySalt, keyFactoryKeyLengthBits,
+         cipherTransformation, newInitializationVector, keyIdentifier,
+         secretKey, macAlgorithm, newMACValue, newEncodedHeader);
+  }
+
+
+
+  /**
    * Retrieves a string representation of this passphrase-encrypted stream
    * header.
    *

Modified: trunk/src/com/unboundid/util/PassphraseEncryptionCipherType.java
===================================================================
--- trunk/src/com/unboundid/util/PassphraseEncryptionCipherType.java	2023-01-16 20:46:51 UTC (rev 1586)
+++ trunk/src/com/unboundid/util/PassphraseEncryptionCipherType.java	2023-01-27 23:48:04 UTC (rev 1587)
@@ -52,8 +52,10 @@
   /**
    * Cipher settings that use a 128-bit AES cipher.
    */
-  AES_128("AES/CBC/PKCS5Padding", 128, "PBKDF2WithHmacSHA1", 16_384, 16, 16,
-       "HmacSHA256"),
+  AES_128("AES/CBC/PKCS5Padding", 128, "PBKDF2WithHmacSHA1",
+       PassphraseEncryptedOutputStream.
+            DEFAULT_AES_128_CIPHER_TYPE_ITERATION_COUNT,
+       16, 16, "HmacSHA256"),
 
 
 
@@ -60,8 +62,10 @@
   /**
    * Cipher settings that use a 256-bit AES cipher.
    */
-  AES_256("AES/CBC/PKCS5Padding", 256, "PBKDF2WithHmacSHA512", 131_072, 16, 16,
-       "HmacSHA512");
+  AES_256("AES/CBC/PKCS5Padding", 256, "PBKDF2WithHmacSHA512",
+       PassphraseEncryptedOutputStream.
+            DEFAULT_AES_256_CIPHER_TYPE_ITERATION_COUNT,
+       16, 16, "HmacSHA512");
 
 
 

Modified: trunk/tests/unit/src/com/unboundid/util/PassphraseEncryptedStreamsTestCase.java
===================================================================
--- trunk/tests/unit/src/com/unboundid/util/PassphraseEncryptedStreamsTestCase.java	2023-01-16 20:46:51 UTC (rev 1586)
+++ trunk/tests/unit/src/com/unboundid/util/PassphraseEncryptedStreamsTestCase.java	2023-01-27 23:48:04 UTC (rev 1587)
@@ -585,7 +585,9 @@
       assertNotNull(header.getKeyFactoryAlgorithm());
       assertEquals(header.getKeyFactoryAlgorithm(), "PBKDF2WithHmacSHA1");
 
-      assertEquals(header.getKeyFactoryIterationCount(), 16_384);
+      assertEquals(header.getKeyFactoryIterationCount(),
+           PassphraseEncryptionCipherType.AES_128.
+                getKeyFactoryIterationCount());
 
       assertNotNull(header.getKeyFactorySalt());
       assertEquals(header.getKeyFactorySalt().length, 16);
@@ -1115,4 +1117,157 @@
     assertNotNull(header.getKeyIdentifier());
     assertEquals(header.getKeyIdentifier(), "different-key-id");
   }
+
+
+
+  /**
+   * Tests the behavior when creating a passphrase-encrypted output streams from
+   * an existing passphrase-encrypted stream header, which allows for reusing
+   * the same derived key without the need to recompute it.
+   *
+   * @throws  Exception  If an unexpected problem occurs.
+   */
+  @Test()
+  public void testDerivedKeyReuse()
+         throws Exception
+  {
+    // Define the data to be encrypted.
+    final List<String> linesToEncrypt = Arrays.asList(
+         "This is some data that will be encrypted.",
+         "So is this.",
+         "And this.");
+
+    // Get the path to a file to which encrypted data will be written.
+    final File encryptedFile = createTempFile();
+    assertTrue(encryptedFile.delete());
+
+
+    // Create the properties that will be used for the encryption.
+    final PassphraseEncryptedOutputStreamProperties properties =
+         new PassphraseEncryptedOutputStreamProperties(
+              PassphraseEncryptionCipherType.getStrongestAvailableCipherType());
+    properties.setKeyIdentifier("the-key-identifier");
+    properties.setWriteHeaderToStream(true);
+
+
+    // Create an initial passphrase-encrypted output stream and use it to
+    // encrypt the data.
+    final PassphraseEncryptedStreamHeader encryptionHeader1;
+    final char[] encryptionPassphrase =
+         "this-is-the-encryption-passphrase".toCharArray();
+    final File outputFile1 = createTempFile();
+    assertTrue(outputFile1.delete());
+    try (FileOutputStream fileOutputStream = new FileOutputStream(outputFile1);
+         PassphraseEncryptedOutputStream encryptedOutputStream =
+              new PassphraseEncryptedOutputStream(encryptionPassphrase,
+                   fileOutputStream, properties);
+         PrintStream printStream = new PrintStream(encryptedOutputStream))
+    {
+      for (final String line : linesToEncrypt)
+      {
+        printStream.println(line);
+      }
+
+      encryptionHeader1 = encryptedOutputStream.getEncryptionHeader();
+    }
+
+
+    // Create a second passphrase-encrypted output stream with the same header
+    // as the first stream and also use it to encrypt the data.
+    final PassphraseEncryptedStreamHeader encryptionHeader2;
+    final File outputFile2 = createTempFile();
+    assertTrue(outputFile2.delete());
+    try (FileOutputStream fileOutputStream = new FileOutputStream(outputFile2);
+         PassphraseEncryptedOutputStream encryptedOutputStream =
+              new PassphraseEncryptedOutputStream(encryptionHeader1,
+                   fileOutputStream, true);
+         PrintStream printStream = new PrintStream(encryptedOutputStream))
+    {
+      for (final String line : linesToEncrypt)
+      {
+        printStream.println(line);
+      }
+
+      encryptionHeader2 = encryptedOutputStream.getEncryptionHeader();
+    }
+
+
+    // Make sure that the two output files are comprised of different sets of
+    // bytes.
+    final byte[] file1Bytes = StaticUtils.readFileBytes(outputFile1);
+    final byte[] file2Bytes = StaticUtils.readFileBytes(outputFile2);
+    assertFalse(Arrays.equals(file1Bytes, file2Bytes));
+
+
+    // Make sure that the two encryption headers are the same, except for the
+    // initialization vector.
+    assertEquals(encryptionHeader1.getKeyFactoryAlgorithm(),
+         encryptionHeader2.getKeyFactoryAlgorithm());
+    assertEquals(encryptionHeader1.getKeyFactoryIterationCount(),
+         encryptionHeader2.getKeyFactoryIterationCount());
+    assertEquals(encryptionHeader1.getKeyFactorySalt(),
+         encryptionHeader2.getKeyFactorySalt());
+    assertEquals(encryptionHeader1.getKeyFactoryKeyLengthBits(),
+         encryptionHeader2.getKeyFactoryKeyLengthBits());
+    assertEquals(encryptionHeader1.getCipherTransformation(),
+         encryptionHeader2.getCipherTransformation());
+    assertEquals(encryptionHeader1.getKeyIdentifier(),
+         encryptionHeader2.getKeyIdentifier());
+    assertEquals(encryptionHeader1.getMACAlgorithm(),
+         encryptionHeader2.getMACAlgorithm());
+    assertFalse(Arrays.equals(encryptionHeader1.getCipherInitializationVector(),
+         encryptionHeader2.getCipherInitializationVector()));
+
+
+    // Make sure that we can decrypt both files with the same passphrase, and
+    // that the decrypted contents are identical.
+    final ArrayList<String> decryptedLines = new ArrayList<>();
+    try (FileInputStream fileInputStream = new FileInputStream(outputFile1);
+         PassphraseEncryptedInputStream encryptedInputStream =
+              new PassphraseEncryptedInputStream(encryptionPassphrase,
+                   fileInputStream);
+         InputStreamReader encryptedStreamReader =
+              new InputStreamReader(encryptedInputStream);
+         BufferedReader bufferedReader =
+              new BufferedReader(encryptedStreamReader))
+    {
+      while (true)
+      {
+        final String line = bufferedReader.readLine();
+        if (line == null)
+        {
+          break;
+        }
+
+        decryptedLines.add(line);
+      }
+
+      assertEquals(decryptedLines, linesToEncrypt);
+    }
+
+
+    decryptedLines.clear();
+    try (FileInputStream fileInputStream = new FileInputStream(outputFile2);
+         PassphraseEncryptedInputStream encryptedInputStream =
+              new PassphraseEncryptedInputStream(encryptionPassphrase,
+                   fileInputStream);
+         InputStreamReader encryptedStreamReader =
+              new InputStreamReader(encryptedInputStream);
+         BufferedReader bufferedReader =
+              new BufferedReader(encryptedStreamReader))
+    {
+      while (true)
+      {
+        final String line = bufferedReader.readLine();
+        if (line == null)
+        {
+          break;
+        }
+
+        decryptedLines.add(line);
+      }
+
+      assertEquals(decryptedLines, linesToEncrypt);
+    }
+  }
 }

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1586] trunk/docs

[<di...@us...>]

Revision: 1586
          http://sourceforge.net/p/ldap-sdk/code/1586
Author:   dirmgr
Date:     2023-01-16 20:46:51 +0000 (Mon, 16 Jan 2023)
Log Message:
-----------
Update LDAP drafts

Updated documentation to include the latest versions of
draft-howard-gssapi-aead, draft-ietf-kitten-scram-2fa,
draft-melnikov-scram-bis, and draft-reitzenstein-kitten-opaque in
the set of LDAP-related specifications.

Modified Paths:
--------------
    trunk/docs/release-notes.html
    trunk/docs/specs/internet-drafts.html

Added Paths:
-----------
    trunk/docs/specs/draft-howard-gssapi-aead-01.txt
    trunk/docs/specs/draft-ietf-kitten-scram-2fa-02.txt
    trunk/docs/specs/draft-melnikov-scram-bis-02.txt
    trunk/docs/specs/draft-reitzenstein-kitten-opaque-02.txt

Removed Paths:
-------------
    trunk/docs/specs/draft-ietf-kitten-scram-2fa-01.txt
    trunk/docs/specs/draft-melnikov-scram-bis-00.txt

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2023-01-10 23:46:02 UTC (rev 1585)
+++ trunk/docs/release-notes.html	2023-01-16 20:46:51 UTC (rev 1586)
@@ -38,6 +38,13 @@
                   obtaining the private key when it is encrypted form.
                   <br><br>
                 </li>
+
+                <li>
+                  Updated documentation to include the latest versions of
+                  draft-howard-gssapi-aead, draft-ietf-kitten-scram-2fa, draft-melnikov-scram-bis,
+                  and draft-reitzenstein-kitten-opaque in the set of LDAP-related specifications.
+                  <br><br>
+                </li>
               </ul>
 
               <p></p>

Added: trunk/docs/specs/draft-howard-gssapi-aead-01.txt
===================================================================
--- trunk/docs/specs/draft-howard-gssapi-aead-01.txt	                        (rev 0)
+++ trunk/docs/specs/draft-howard-gssapi-aead-01.txt	2023-01-16 20:46:51 UTC (rev 1586)
@@ -0,0 +1,504 @@
+
+
+
+
+Network Working Group                                          L. Howard
+Internet-Draft                                                      PADL
+Intended status: Experimental                             6 January 2023
+Expires: 10 July 2023
+
+
+                    AEAD Modes for Kerberos GSS-API
+                      draft-howard-gssapi-aead-01
+
+Abstract
+
+   This document updates RFC4121 with support for encryption mechanisms
+   that can authenticate associated data such as Counter with CBC-MAC
+   (CCM) and Galois/Counter Mode (GCM).  These mechanisms are often more
+   performant and need not expand the message as much as conventional
+   modes.
+
+Status of This Memo
+
+   This Internet-Draft is submitted in full conformance with the
+   provisions of BCP 78 and BCP 79.
+
+   Internet-Drafts are working documents of the Internet Engineering
+   Task Force (IETF).  Note that other groups may also distribute
+   working documents as Internet-Drafts.  The list of current Internet-
+   Drafts is at https://datatracker.ietf.org/drafts/current/.
+
+   Internet-Drafts are draft documents valid for a maximum of six months
+   and may be updated, replaced, or obsoleted by other documents at any
+   time.  It is inappropriate to use Internet-Drafts as reference
+   material or to cite them other than as "work in progress."
+
+   This Internet-Draft will expire on 10 July 2023.
+
+Copyright Notice
+
+   Copyright (c) 2023 IETF Trust and the persons identified as the
+   document authors.  All rights reserved.
+
+   This document is subject to BCP 78 and the IETF Trust's Legal
+   Provisions Relating to IETF Documents (https://trustee.ietf.org/
+   license-info) in effect on the date of publication of this document.
+   Please review these documents carefully, as they describe your rights
+   and restrictions with respect to this document.  Code Components
+   extracted from this document must include Revised BSD License text as
+   described in Section 4.e of the Trust Legal Provisions and are
+   provided without warranty as described in the Revised BSD License.
+
+
+
+
+Howard                    Expires 10 July 2023                  [Page 1]
+
+Internet-Draft       AEAD Modes for Kerberos GSS-API        January 2023
+
+
+Table of Contents
+
+   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
+   2.  Requirements notation . . . . . . . . . . . . . . . . . . . .   2
+   3.  Authenticated Encryption with Associated Data (AEAD)
+           Overview  . . . . . . . . . . . . . . . . . . . . . . . .   2
+   4.  Updates to RFC 2743 . . . . . . . . . . . . . . . . . . . . .   3
+     4.1.  GSS_Wrap_AEAD . . . . . . . . . . . . . . . . . . . . . .   3
+     4.2.  GSS_Unwrap_AEAD . . . . . . . . . . . . . . . . . . . . .   4
+   5.  Updates to RFC 4121 . . . . . . . . . . . . . . . . . . . . .   4
+     5.1.  Support for Associated Data . . . . . . . . . . . . . . .   4
+     5.2.  Existing Encryption Types . . . . . . . . . . . . . . . .   5
+     5.3.  Native AEAD Encryption Types  . . . . . . . . . . . . . .   5
+       5.3.1.  Restriction on Native AEAD Usage  . . . . . . . . . .   5
+       5.3.2.  Application-provided Cipherstate  . . . . . . . . . .   5
+       5.3.3.  Encryption and Checksum Operations  . . . . . . . . .   6
+       5.3.4.  DCE RPC Interoperability  . . . . . . . . . . . . . .   7
+   6.  Security Considerations . . . . . . . . . . . . . . . . . . .   8
+   7.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .   8
+   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   8
+     8.1.  Normative References  . . . . . . . . . . . . . . . . . .   8
+     8.2.  Informative References  . . . . . . . . . . . . . . . . .   9
+   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   9
+
+1.  Introduction
+
+   This document updates [RFC4121] with support for encryption
+   mechanisms that support Authenticated Encryption with Associated Data
+   (AEAD).  These mechanisms often have performance advantage over
+   conventional encryption modes as they can be efficiently parallelized
+   and do not expand the plaintext when encrypting.
+
+   In addition, this document defines new GSS-API functions for
+   protecting associated data in addition to a plaintext.
+
+2.  Requirements notation
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+   document are to be interpreted as described in [RFC2119].
+
+3.  Authenticated Encryption with Associated Data (AEAD) Overview
+
+   The Kerberos 5 GSS-API mechanism specified in [RFC4121] provides for
+   the authenticated encryption of plaintext, that is, it provides both
+   for confidentiality and a way to check the for integrity and
+   authenticity.
+
+
+
+
+Howard                    Expires 10 July 2023                  [Page 2]
+
+Internet-Draft       AEAD Modes for Kerberos GSS-API        January 2023
+
+
+   It can be useful in many applications to provide for the integrity
+   and authenticity of some additional unencrypted data; this is termed
+   Authenticated Encryption with Associated Data (AEAD).  This can be
+   done by the generic composition of existing encryption and checksum
+   mechanisms, or using algorithms which specifically provide for AEAD
+   (see [RFC5116]).  The latter class of algorithms, referred to as
+   native AEAD, may have additional constraints (further described in
+   [KRB-AEAD]).
+
+4.  Updates to RFC 2743
+
+   [RFC2743] is updated with variations of GSS_Wrap() and GSS_Unwrap()
+   that permit the inclusion of associated data to be authenticated
+   along with a plaintext.
+
+
+   // TBD: do we allow interleaved plaintext and associated data (which
+   // SSPI does and indeed requires for DCE), or do we limit it to a
+   // single octet string each?  If the former, we need to define
+   // GSS_Wrap_IOV instead of GSS_Wrap_AEAD (and the Unwrap
+   // equivalents).
+
+4.1.  GSS_Wrap_AEAD
+
+   Inputs:
+
+   *  context_handle CONTEXT HANDLE,
+
+   *  conf_req_flag BOOLEAN,
+
+   *  qop_req INTEGER, -- 0 specifies default QOP
+
+   *  input_assoc_data OCTET STRING, -- associated data
+
+   *  input_message OCTET STRING -- plaintext
+
+   Outputs:
+
+   *  major_status INTEGER,
+
+   *  minor_status INTEGER,
+
+   *  conf_state BOOLEAN,
+
+   *  output_message OCTET STRING -- caller must release with
+      GSS_Release_buffer()
+
+
+
+
+
+Howard                    Expires 10 July 2023                  [Page 3]
+
+Internet-Draft       AEAD Modes for Kerberos GSS-API        January 2023
+
+
+   Performs the data origin authentication, data integrity and
+   (optionally) data confidentiality functions of GSS_Wrap(),
+   additionally integrity protecting the data in input_assoc_data.
+   Return values are as for GSS_Wrap().  Note that output_message does
+   not include the data in input_assoc_data.
+
+4.2.  GSS_Unwrap_AEAD
+
+   Inputs:
+
+   *  context_handle CONTEXT HANDLE,
+
+   *  input_message OCTET STRING, -- plaintext
+
+   *  input_assoc_data OCTET STRING -- associated data
+
+   Outputs:
+
+   *  conf_state BOOLEAN,
+
+   *  qop_state INTEGER,
+
+   *  major_status INTEGER,
+
+   *  minor_status INTEGER,
+
+   *  output_message OCTET STRING -- caller must release with
+      GSS_Release_buffer()
+
+   Processes a data element generated (and optionally encrypted) by
+   GSS_Wrap(), provided as input_message, additionally validating the
+   data origin and integrity of input_assoc_data.  Return values are as
+   for GSS_Unwrap().  Note that output_message does not include the data
+   in input_assoc_data.
+
+5.  Updates to RFC 4121
+
+5.1.  Support for Associated Data
+
+   The generation of per-message tokens using the GSS_Wrap_AEAD() and
+   GSS_Unwrap_AEAD() functions is identical to GSS_Wrap() and
+   GSS_Unwrap(), except that:
+
+   *  the encrypt-with-ad and decrypt-with-ad functions are used instead
+      of the encrypt and decrypt functions (respectively)
+
+   *  the input_assoc_data parameter is passed as the associated data
+
+
+
+
+Howard                    Expires 10 July 2023                  [Page 4]
+
+Internet-Draft       AEAD Modes for Kerberos GSS-API        January 2023
+
+
+   *  the is-longterm parameter is always false
+
+5.2.  Existing Encryption Types
+
+   For existing encryption mechanisms that use a generic composition of
+   encryption and checksum functions (such as the Simplified Profile in
+   [RFC3961]), the only operative difference to [RFC4121] is that the
+   associated data is prepended to the plaintext before invoking the
+   checksum function.  As such, for these encryption types
+   GSS_Wrap_AEAD() with no associated data has an identical output to
+   GSS_Wrap().
+
+5.3.  Native AEAD Encryption Types
+
+   When used with native AEAD encryption types as defined in [KRB-AEAD],
+   the generation of [RFC4121] per-message tokens is modified as
+   described below.
+
+5.3.1.  Restriction on Native AEAD Usage
+
+   Implementations SHALL NOT use native AEAD encryption types where the
+   deterministic cipherstate length is less than 12 octets (96 bytes).
+
+
+   // TBD: if we want to support CCM with a 32-bit counter, we could
+   // remove the Filler byte and reduce the required cipherstate length
+   // to 11 octets.  However, this may make it more difficult to use
+   // TLS-oriented CCM implementations that expose the Fixed-Common and
+   // Fixed-Distinct nonce components independently.
+
+   Native AEAD encryption types not supporting long-term keys MUST NOT
+   be used as ticket session keys, only as authenticator subkeys.
+   [RFC4537] SHOULD be used to indicate initiator support.
+
+5.3.2.  Application-provided Cipherstate
+
+   The cipherstate for each invocation of encrypt-with-ad or decrypt-
+   with-ad is given as follows.  (For consistency with [RFC4121] the
+   following definition uses 0-based indexing.)
+
+
+
+
+
+
+
+
+
+
+
+
+Howard                    Expires 10 July 2023                  [Page 5]
+
+Internet-Draft       AEAD Modes for Kerberos GSS-API        January 2023
+
+
+            +==========+=========+===========================+
+            | Octet no |   Name  |        Description        |
+            +==========+=========+===========================+
+            |   0..1   |  TOK_ID | Identification field, per |
+            |          |         |   RFC4121 Section 4.2.6   |
+            +----------+---------+---------------------------+
+            |    2     |  Flags  |   Attributes field, per   |
+            |          |         |   RFC4121 Section 4.2.6   |
+            +----------+---------+---------------------------+
+            |    3     |  Filler |    One octet of the hex   |
+            |          |         |          value FF         |
+            +----------+---------+---------------------------+
+            |  4..11   | SND_SEQ |   Sequence number field,  |
+            |          |         | per RFC4121 Section 4.2.6 |
+            +----------+---------+---------------------------+
+            |   12..   |         | Remaining octets (if any) |
+            |          |         |      are set to zero      |
+            +----------+---------+---------------------------+
+
+                                 Table 1
+
+   The output cipherstate from the encrypt-with-ad and decrypt-with-ad
+   functions is discarded as it is always specified explicitly as
+   described above.
+
+   The use of application-managed cipherstate allows the per-message
+   token size be reduced by omitting the confounder and encrypted copy
+   of the token header.  There is no limit on the number or size of
+   messages that can be protected beyond those imposed by the sequence
+   number size and the underlying cryptosystem.
+
+5.3.3.  Encryption and Checksum Operations
+
+   This text amends [RFC4121] Section 4.2.4.
+
+   In Wrap tokens that provide for confidentiality, the first 16 octets
+   of the token (the "header", as defined in [RFC4121] Section 4.2.6)
+   SHALL NOT be appended to the plaintext data before encryption.
+   Instead, the TOK_ID, Flags and SND_SEQ fields of the token header are
+   protected by the initialization vector (cipherstate).  The EC field
+   is unprotected, a change from [RFC4121].  For the native AEAD
+   encryption types profiled in [KRB-AEAD] Section 5, EC SHALL be zero
+   (except when GSS_C_DCE_STYLE is in use, see below).  This
+   specification does not support native AEAD encryption types that
+   require the plaintext to be padded.
+
+
+
+
+
+
+Howard                    Expires 10 July 2023                  [Page 6]
+
+Internet-Draft       AEAD Modes for Kerberos GSS-API        January 2023
+
+
+   In Wrap tokens that do not provide for confidentiality, the first 16
+   octets of the token SHALL NOT be appended to the to-be-signed
+   plaintext data.  As with Wrap tokens that do provide for
+   confidentiality, all fields except EC and RRC are protected by the
+   initialization vector.  For the AEAD encryption types defined in
+   [KRB-AEAD] Section 5, EC SHALL be sixteen, reflecting the tag length
+   of 16 octets (128 bits).
+
+   The receiver MUST explicitly validate the EC field.  Owing to this
+   specification not supporting native AEAD encryption types that
+   require padding and protecting the token header with the
+   initialization vector, all encryption can be done in-place and there
+   is no need to rotate the emitted token (see [RFC4121] Section 4.2.5).
+   As such the RRC field SHALL contain the hex value 00 00.
+
+   Because native AEAD encryption types lack an explicit checksum
+   operation, MIC tokens are generated similarly to Wrap tokens, using
+   the encrypt-with-ad function passing the to-be-signed data as the
+   associated data and using a plaintext length of zero.  The key usage
+   and initialization vector serve to disambiguate MIC from Wrap tokens.
+   The octet string output by the encrypt-with-ad function contains the
+   authentication tag, which is placed in the SGN_CKSUM field of the
+   token.
+
+5.3.4.  DCE RPC Interoperability
+
+   Existing implementations that support the GSS_C_DCE_STYLE context
+   flag will, when this flag is in set, set EC for Wrap tokens with
+   confidentiality to the underlying cipher's block size and use an
+   effective Right Rotation Count (RRC) of EC + RRC bytes.  This
+   document does not specify otherwise.
+
+   When GSS_C_DCE_STYLE is set, receivers MUST verify that the otherwise
+   unprotected EC field is the underlying cipher's block size for Wrap
+   tokens with confidentiality.  (For Wrap tokens without
+   confidentiality, the EC field remains the length of the
+   authentication tag.)
+
+   DCE interleaves plaintext and associated data; because native AEAD
+   algorithms may require associated data to be processed before any
+   plaintext, any plaintext and associated data must each be coalesced
+   before encrypting or decrypting.  This document does not specify an
+   API for processing interleaved plaintext and associated data.
+
+
+
+
+
+
+
+
+Howard                    Expires 10 July 2023                  [Page 7]
+
+Internet-Draft       AEAD Modes for Kerberos GSS-API        January 2023
+
+
+6.  Security Considerations
+
+   The combination of a context-specific session key and the presence of
+   the the TOK_ID and SND_SEQ fields in the cipherstate guarantees that
+   the key/IV combination is safe from reuse.  The allows native AEAD
+   modes such as [GCM] and [CCM] to be used securely.
+
+   Because the initialization vector has a deterministic (but non-
+   repeating) construction, it is safe for use with GCM without any
+   limitation on the number of invocations of the authenticated
+   encryption function other than that imposed by the requirement that
+   the cipherstate not repeat.  (Section 8.3 of [GCM] imposes an
+   invocation limit of 2^32 where the cipherstate is randomly generated
+   or is a length other than 96 bits.)
+
+   When using native AEAD encryption types, the EC and RRC fields are
+   unprotected, however they are well known constants which can be
+   validated by the peer.
+
+   The reordering of plaintext and associated data for GSS_C_DCE_STYLE
+   interoperability may be problematic where the plaintext and
+   associated data lengths are variable.
+
+7.  Acknowledgements
+
+   The author would like to thank the following individuals for their
+   comments and suggestions: Nicolas Williams and Greg Hudson.
+
+8.  References
+
+8.1.  Normative References
+
+   [RFC2119]  Bradner, S. and RFC Publisher, "Key words for use in RFCs
+              to Indicate Requirement Levels", BCP 14, RFC 2119,
+              DOI 10.17487/RFC2119, March 1997,
+              <https://www.rfc-editor.org/info/rfc2119>.
+
+   [RFC2743]  Linn, J. and RFC Publisher, "Generic Security Service
+              Application Program Interface Version 2, Update 1",
+              RFC 2743, DOI 10.17487/RFC2743, January 2000,
+              <https://www.rfc-editor.org/info/rfc2743>.
+
+   [RFC4121]  Zhu, L., Jaganathan, K., Hartman, S., and RFC Publisher,
+              "The Kerberos Version 5 Generic Security Service
+              Application Program Interface (GSS-API) Mechanism: Version
+              2", RFC 4121, DOI 10.17487/RFC4121, July 2005,
+              <https://www.rfc-editor.org/info/rfc4121>.
+
+
+
+
+Howard                    Expires 10 July 2023                  [Page 8]
+
+Internet-Draft       AEAD Modes for Kerberos GSS-API        January 2023
+
+
+   [RFC4537]  Zhu, L., Leach, P., Jaganathan, K., and RFC Publisher,
+              "Kerberos Cryptosystem Negotiation Extension", RFC 4537,
+              DOI 10.17487/RFC4537, June 2006,
+              <https://www.rfc-editor.org/info/rfc4537>.
+
+   [KRB-AEAD] Howard, L., "AEAD Encryption Types for Kerberos 5", Work
+              in Progress, Internet-Draft, draft-howard-krb-aead-00,
+              December 2015,
+              <https://www.ietf.org/id/draft-howard-krb-aead-00.txt>.
+
+8.2.  Informative References
+
+   [RFC3961]  Raeburn, K. and RFC Publisher, "Encryption and Checksum
+              Specifications for Kerberos 5", RFC 3961,
+              DOI 10.17487/RFC3961, February 2005,
+              <https://www.rfc-editor.org/info/rfc3961>.
+
+   [RFC5116]  McGrew, D. and RFC Publisher, "An Interface and Algorithms
+              for Authenticated Encryption", RFC 5116,
+              DOI 10.17487/RFC5116, January 2008,
+              <https://www.rfc-editor.org/info/rfc5116>.
+
+   [CCM]      Dworkin, M., "Recommendation for Block Cipher Modes of
+              Operation: The CCM Mode for Authentication and
+              Confidentiality", May 2004,
+              <http://csrc.nist.gov/publications/nistpubs/800-38C/SP-
+              800-38C.pdf>.
+
+   [GCM]      Dworkin, M., "Recommendation for Block Cipher Modes of
+              Operation: Galois/Counter Mode (GCM) and GMAC", November
+              2007, <http://csrc.nist.gov/publications/nistpubs/800-38D/
+              SP-800-38D.pdf>.
+
+Author's Address
+
+   Luke Howard
+   PADL Software
+   PO Box 59
+   Central Park VIC 3145
+   Australia
+   Email: lu...@pa...
+
+
+
+
+
+
+
+
+
+
+Howard                    Expires 10 July 2023                  [Page 9]

Deleted: trunk/docs/specs/draft-ietf-kitten-scram-2fa-01.txt
===================================================================
--- trunk/docs/specs/draft-ietf-kitten-scram-2fa-01.txt	2023-01-10 23:46:02 UTC (rev 1585)
+++ trunk/docs/specs/draft-ietf-kitten-scram-2fa-01.txt	2023-01-16 20:46:51 UTC (rev 1586)
@@ -1,448 +0,0 @@
-
-
-
-
-Network Working Group                                        A. Melnikov
-Internet-Draft                                                 Isode Ltd
-Intended status: Standards Track                         25 January 2022
-Expires: 29 July 2022
-
-
-      Extensions to Salted Challenge Response (SCRAM) for 2 factor
-                             authentication
-                     draft-ietf-kitten-scram-2fa-01
-
-Abstract
-
-   This specification describes an extension to family of Simple
-   Authentication and Security Layer (SASL; RFC 4422) authentication
-   mechanisms called the Salted Challenge Response Authentication
-   Mechanism (SCRAM), which provides support for 2 factor
-   authentication.  It also includes a separate extension for quick
-   reauthentication.
-
-   This specification also gives an example of how TOTP (RFC 6238) can
-   be used as the second factor.
-
-Status of This Memo
-
-   This Internet-Draft is submitted in full conformance with the
-   provisions of BCP 78 and BCP 79.
-
-   Internet-Drafts are working documents of the Internet Engineering
-   Task Force (IETF).  Note that other groups may also distribute
-   working documents as Internet-Drafts.  The list of current Internet-
-   Drafts is at https://datatracker.ietf.org/drafts/current/.
-
-   Internet-Drafts are draft documents valid for a maximum of six months
-   and may be updated, replaced, or obsoleted by other documents at any
-   time.  It is inappropriate to use Internet-Drafts as reference
-   material or to cite them other than as "work in progress."
-
-   This Internet-Draft will expire on 29 July 2022.
-
-Copyright Notice
-
-   Copyright (c) 2022 IETF Trust and the persons identified as the
-   document authors.  All rights reserved.
-
-   This document is subject to BCP 78 and the IETF Trust's Legal
-   Provisions Relating to IETF Documents (https://trustee.ietf.org/
-   license-info) in effect on the date of publication of this document.
-   Please review these documents carefully, as they describe your rights
-
-
-
-Melnikov                  Expires 29 July 2022                  [Page 1]
-
-Internet-Draft            SCRAM 2FA extensions              January 2022
-
-
-   and restrictions with respect to this document.  Code Components
-   extracted from this document must include Revised BSD License text as
-   described in Section 4.e of the Trust Legal Provisions and are
-   provided without warranty as described in the Revised BSD License.
-
-Table of Contents
-
-   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
-   2.  Conventions Used in This Document . . . . . . . . . . . . . .   3
-     2.1.  Terminology . . . . . . . . . . . . . . . . . . . . . . .   3
-     2.2.  Notation  . . . . . . . . . . . . . . . . . . . . . . . .   3
-   3.  SCRAM Extension for 2FA . . . . . . . . . . . . . . . . . . .   3
-   4.  SCRAM Extension for reauthentication  . . . . . . . . . . . .   4
-   5.  Formal Syntax . . . . . . . . . . . . . . . . . . . . . . . .   4
-   6.  Use of TOTP with SCRAM  . . . . . . . . . . . . . . . . . . .   5
-   7.  Example . . . . . . . . . . . . . . . . . . . . . . . . . . .   6
-   8.  Open Issues . . . . . . . . . . . . . . . . . . . . . . . . .   6
-   9.  Security Considerations . . . . . . . . . . . . . . . . . . .   6
-   10. IANA Considerations . . . . . . . . . . . . . . . . . . . . .   7
-   11. Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .   7
-   12. Normative References  . . . . . . . . . . . . . . . . . . . .   7
-   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   8
-
-1.  Introduction
-
-   SCRAM [RFC5802] is a password based SASL [RFC4422] authentication
-   mechanism that provides (among other things) mutual authentication
-   and binding to an external security layer such as TLS.
-
-   Two-factor authentication (2FA) is a way to add additional security
-   to an authentication exchange.  The first "factor" is a password.
-   The second "factor" is a verification code retrieved from an
-   application on a mobile device or computer.  2FA is conceptually
-   similar to a security token device that banks in some countries
-   require for online banking.  Other names for 2FA systems include OTP
-   (one-time password) and TOTP (Time-based One-time Password algorithm,
-   such as [RFC6238]).
-
-   This specification describes an extension to SCRAM to provide 2
-   factor authentication.  SCRAM already relies on passwords for
-   authentication.  This document specifies how second "factors" can be
-   incorporated into SCRAM authentication.  It also includes a separate
-   (but frequently used together with the 2 factor authentication)
-   extension for quick reauthentication.
-
-
-
-
-
-
-
-Melnikov                  Expires 29 July 2022                  [Page 2]
-
-Internet-Draft            SCRAM 2FA extensions              January 2022
-
-
-2.  Conventions Used in This Document
-
-   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
-   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
-   document are to be interpreted as described in [RFC2119].
-
-   Formal syntax is defined by [RFC5234] including the core rules
-   defined in Appendix B of [RFC5234].
-
-   Example lines prefaced by "C:" are sent by the client and ones
-   prefaced by "S:" by the server.  If a single "C:" or "S:" label
-   applies to multiple lines, then the line breaks between those lines
-   are for editorial clarity only, and are not part of the actual
-   protocol exchange.
-
-2.1.  Terminology
-
-   This document uses several terms defined in [RFC4949] ("Internet
-   Security Glossary") including the following: authentication,
-   authentication exchange, authentication information, brute force,
-   challenge-response, cryptographic hash function, dictionary attack,
-   eavesdropping, hash result, keyed hash, man-in-the-middle, nonce,
-   one-way encryption function, password, replay attack and salt.
-   Readers not familiar with these terms should use that glossary as a
-   reference.  Other terms defined in [RFC5802] are also used in this
-   document.
-
-2.2.  Notation
-
-   This document reuses notation defined in SCRAM.
-
-3.  SCRAM Extension for 2FA
-
-   This extension doesn't add any extra roundtrips to SCRAM
-   authentication.  SCRAM was designed to be extensible, so it allows
-   for optional and mandatory attributes, which covered by MAC codes.
-   Second "factors" are conveyed in the second message ("client-final-
-   message-without-proof" ABNF production) sent from the client to the
-   server.
-
-   This extension doesn't change how the client authenticates the
-   server.
-
-   The server authenticates the client after receiving the second
-   message as described in Section 3 of [RFC5802] If the client included
-   "type" and "second-factor" attributes defined in this document (see
-   Section 5) and the server supports the specified second factor type,
-   the server verifies content of the "second-factor" according to the
-
-
-
-Melnikov                  Expires 29 July 2022                  [Page 3]
-
-Internet-Draft            SCRAM 2FA extensions              January 2022
-
-
-   "type".  If the second factor verification fails, the server MUST
-   fail authentication and SHOULD return either "replayed-second-factor"
-   or "invalid-second-factor" error in the "e" attribute.  [[It would be
-   possible to make the extra attributes mandatory by using SCRAM's
-   "m=", but the text above doesn't do that.  This is one of open issues
-   to resolve.]]
-
-4.  SCRAM Extension for reauthentication
-
-   This reauthentication extension to SCRAM allows the server to return
-   a token that can be used for quick reauthentication and bypasses 2
-   factor authentication prompt to the user.  The reauthentication token
-   is randomly generated value.  The reauthentication token is returned
-   in the "o" attribute that is appended to the end of the "server-
-   final-message".
-
-   [[Note: it would be possible to extend SCRAM itself to do
-   reauthentication, by including an earlier received reauthentication
-   token in the "client-first-message" of a subsequent SCRAM
-   authentication.  This will also turn off the server checking for 2
-   factor authentication information, unless the reauthentication
-   attempt is rejected by the server.  In the meantime, this document
-   presents a couple of other alternatives on how to use other SASL
-   mechanisms with the reauthentication token.]]
-
-   When the CLIENT-KEY/CLIENT-KEY-PLUS mechanism (see draft-cridland-
-   kitten-clientkey) is used for the reauthentication after a successful
-   SCRAM authentication, the reauthentication token is the Client Secret
-   Key.  [[Need to also somehow convey token expiration?]]
-
-   When the HT-* mechanism (see draft-schmaus-kitten-sasl-ht) is used
-   for the reauthentication after a successful SCRAM authentication, the
-   reauthentication token is the draft-schmaus-kitten-sasl-ht token.
-   [[Note that the HT hash should probably match the SCRAM hash used.]]
-
-5.  Formal Syntax
-
-   This document defines the following new SCRAM attributes:
-
-   *  t: This attribute specifies the type of second factor.  [[Create
-      IANA registry for these?]] This document defines one type: "totp".
-      If this attribute is specified, the "f" attribute MUST also be
-      specified.
-
-   *  f: This attribute specifies the value of the second factor.  For
-      "t=totp" it is 6 digit decimal number.  [[Use 8 digits per Rick
-      van Rein?]] This attribute MUST be ignored unless the "t"
-      attribute is also specified.
-
-
-
-Melnikov                  Expires 29 July 2022                  [Page 4]
-
-Internet-Draft            SCRAM 2FA extensions              January 2022
-
-
-   *  o: This attribute specifies the base64-encoded value of the
-      reauthentication token.
-
-   The following syntax specification uses the Augmented Backus-Naur
-   Form (ABNF) notation as specified in [RFC5234].
-
-      type            = "t=" type-value
-                    ; Complies with "attr-val" syntax.
-      type-value      = "totp" / value
-                    ; Type of second factor.
-                    ; Should be registered with IANA.
-      second-factor   = "f=" second-factor-value
-                    ; Complies with "attr-val" syntax.
-      second-factor-value = 6DIGIT / value
-                    ; 6DIGIT when "t=totp"
-      server-error-value-ext =
-              "replayed-second-factor" /
-              "invalid-second-factor" /
-              "second-factor-value-missing"
-
-      value = <as defined in RFC 5802>
-
-
-      reauth-token = "o=" base64
-                        ;; base64 encoding of reauthentication
-                        ;; token.
-
-
-6.  Use of TOTP with SCRAM
-
-   When TOTP is used with SCRAM, the following values for "t" and "f"
-   attributes (see Section 5 for their generic syntax) are used:
-
-   *  t: This attribute specifies the type of second factor.  For TOTP
-      the value is "totp".  If this attribute is specified, the "f"
-      attribute MUST also be specified.
-
-   *  f: This attribute specifies the value of the second factor.  For
-      "t=totp" it is 6 digit decimal number.  This attribute MUST be
-      ignored unless the "t" attribute is also specified.
-
-   A TOTP URI is specified with the following ABNF:
-
-
-
-
-
-
-
-
-
-Melnikov                  Expires 29 July 2022                  [Page 5]
-
-Internet-Draft            SCRAM 2FA extensions              January 2022
-
-
-   totp-uri = "otpauth" "://" "totp/" label "?secret=" secret
-              "&issuer=" issuer
-   label = issuer (":" / "%3A") identity
-   identity = 1*CHAR ; URI-encoded SASL identity
-   secret = 40 * HEXCHAR ; Base32 (hex) encoded secret with no padding.
-   issuer = 1*CHAR ; Issuer name.
-
-
-7.  Example
-
-   The following example extends the example from Section 5 of [RFC5802]
-   to demonstrate use of TOTP:
-
-     C: n,,n=user,r=fyko+d2lbbFgONRv9qkxdawL
-     S: r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,s=QSXCR+Q6sek8bf92,
-        i=4096
-     C: c=biws,r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,
-        t=totp,f=776804,p=v0X8v3Bz2T0CJGbJQyF0X+HI4Ts=
-     S: v=lz59pqV8S7suAoZWja4dJRkFsKQ=
-
-
-   Please note that TOTP extension described in this document works in
-   the same way with SCRAM-SHA-256/SCRAM-SHA-256-PLUS, SCRAM-SHA-512/
-   SCRAM-SHA-512-PLUS or any other SCRAM variants that use other hash
-   functions.
-
-8.  Open Issues
-
-   Simon Josefsson: should this be a new SASL mechanism name, e.g.
-   CROTP-SHA-256?
-
-   Simon Josefsson: cookie option for fast reauthentication?  Alexey:
-   can do or just used CLIENT-KEY (draft-cridland-kitten-clientkey)?
-
-   Rick van Rein: specify a HOTP variant as well?
-
-   Rick van Rein: use TOTP with 6 or 8 digits?  Register both variants?
-
-9.  Security Considerations
-
-   Unless an external security layer (such as TLS) is also used, the OTP
-   value is sent in unencrypted/unhashed form from the client to the
-   server, which allows an attacker to read the OTP value and perform a
-   race with the server to validate the OTP.
-
-   TBD
-
-
-
-
-
-Melnikov                  Expires 29 July 2022                  [Page 6]
-
-Internet-Draft            SCRAM 2FA extensions              January 2022
-
-
-10.  IANA Considerations
-
-   IANA is requested to update the definition of the SASL family SCRAM
-   in the SASL Mechanism registry established by [RFC4422] to also point
-   to this document.
-
-   IANA is also requested to create a new subregistry of "SASL
-   mechanism" for registering second factor schemes used in the "t"
-   attribute as specified in this document.
-
-   The registration template is as follows:
-
-
-   SCRAM Second Factor Scheme Name:
-   Pointer to specification text:
-   Notes (optional):
-
-
-   The registration procedure for the above subregistry is Expert
-   Review.
-
-   IANA is requested to register a new value in the subregistry defined
-   above:
-
-
-   SCRAM Second Factor Scheme Name: TOTP
-   Pointer to specification text: [[ this document ]]
-   Notes (optional): (none)
-
-
-11.  Acknowledgements
-
-   Thank you to Stephen Farrell for motivating creation of this document
-   and to Dave Cridland for describing how TOTP can be used with XMPP in
-   XEP-0400.  Thank you to Rick van Rein and Simon Josefsson for
-   comments and corrections, but all final errors in this document
-   remain mine.
-
-12.  Normative References
-
-   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
-              Requirement Levels", BCP 14, RFC 2119,
-              DOI 10.17487/RFC2119, March 1997,
-              <https://www.rfc-editor.org/info/rfc2119>.
-
-
-
-
-
-
-
-Melnikov                  Expires 29 July 2022                  [Page 7]
-
-Internet-Draft            SCRAM 2FA extensions              January 2022
-
-
-   [RFC4422]  Melnikov, A., Ed. and K. Zeilenga, Ed., "Simple
-              Authentication and Security Layer (SASL)", RFC 4422,
-              DOI 10.17487/RFC4422, June 2006,
-              <https://www.rfc-editor.org/info/rfc4422>.
-
-   [RFC4949]  Shirey, R., "Internet Security Glossary, Version 2",
-              FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007,
-              <https://www.rfc-editor.org/info/rfc4949>.
-
-   [RFC5234]  Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax
-              Specifications: ABNF", STD 68, RFC 5234,
-              DOI 10.17487/RFC5234, January 2008,
-              <https://www.rfc-editor.org/info/rfc5234>.
-
-   [RFC5802]  Newman, C., Menon-Sen, A., Melnikov, A., and N. Williams,
-              "Salted Challenge Response Authentication Mechanism
-              (SCRAM) SASL and GSS-API Mechanisms", RFC 5802,
-              DOI 10.17487/RFC5802, July 2010,
-              <https://www.rfc-editor.org/info/rfc5802>.
-
-   [RFC6238]  M'Raihi, D., Machani, S., Pei, M., and J. Rydell, "TOTP:
-              Time-Based One-Time Password Algorithm", RFC 6238,
-              DOI 10.17487/RFC6238, May 2011,
-              <https://www.rfc-editor.org/info/rfc6238>.
-
-Author's Address
-
-   Alexey Melnikov
-   Isode Ltd
-
-   Email: Ale...@is...
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Melnikov                  Expires 29 July 2022                  [Page 8]

Added: trunk/docs/specs/draft-ietf-kitten-scram-2fa-02.txt
===================================================================
--- trunk/docs/specs/draft-ietf-kitten-scram-2fa-02.txt	                        (rev 0)
+++ trunk/docs/specs/draft-ietf-kitten-scram-2fa-02.txt	2023-01-16 20:46:51 UTC (rev 1586)
@@ -0,0 +1,672 @@
+
+
+
+
+Network Working Group                                        A. Melnikov
+Internet-Draft                                                 Isode Ltd
+Intended status: Standards Track                         13 January 2023
+Expires: 17 July 2023
+
+
+      Extensions to Salted Challenge Response (SCRAM) for 2 factor
+                             authentication
+                     draft-ietf-kitten-scram-2fa-02
+
+Abstract
+
+   This specification describes an extension to family of Simple
+   Authentication and Security Layer (SASL; RFC 4422) authentication
+   mechanisms called the Salted Challenge Response Authentication
+   Mechanism (SCRAM), which provides support for 2 factor
+   authentication.  It also includes a separate extension for quick
+   reauthentication.
+
+   This specification also gives an example of how TOTP (RFC 6238) can
+   be used as the second factor.
+
+Status of This Memo
+
+   This Internet-Draft is submitted in full conformance with the
+   provisions of BCP 78 and BCP 79.
+
+   Internet-Drafts are working documents of the Internet Engineering
+   Task Force (IETF).  Note that other groups may also distribute
+   working documents as Internet-Drafts.  The list of current Internet-
+   Drafts is at https://datatracker.ietf.org/drafts/current/.
+
+   Internet-Drafts are draft documents valid for a maximum of six months
+   and may be updated, replaced, or obsoleted by other documents at any
+   time.  It is inappropriate to use Internet-Drafts as reference
+   material or to cite them other than as "work in progress."
+
+   This Internet-Draft will expire on 17 July 2023.
+
+Copyright Notice
+
+   Copyright (c) 2023 IETF Trust and the persons identified as the
+   document authors.  All rights reserved.
+
+   This document is subject to BCP 78 and the IETF Trust's Legal
+   Provisions Relating to IETF Documents (https://trustee.ietf.org/
+   license-info) in effect on the date of publication of this document.
+   Please review these documents carefully, as they describe your rights
+
+
+
+Melnikov                  Expires 17 July 2023                  [Page 1]
+
+Internet-Draft            SCRAM 2FA extensions              January 2023
+
+
+   and restrictions with respect to this document.  Code Components
+   extracted from this document must include Revised BSD License text as
+   described in Section 4.e of the Trust Legal Provisions and are
+   provided without warranty as described in the Revised BSD License.
+
+Table of Contents
+
+   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
+   2.  Conventions Used in This Document . . . . . . . . . . . . . .   3
+     2.1.  Terminology . . . . . . . . . . . . . . . . . . . . . . .   3
+     2.2.  Notation  . . . . . . . . . . . . . . . . . . . . . . . .   3
+   3.  SCRAM Extension for 2FA . . . . . . . . . . . . . . . . . . .   3
+   4.  SCRAM Extension for reauthentication  . . . . . . . . . . . .   4
+   5.  Formal Syntax . . . . . . . . . . . . . . . . . . . . . . . .   4
+   6.  Use of TOTP with SCRAM  . . . . . . . . . . . . . . . . . . .   5
+   7.  Example . . . . . . . . . . . . . . . . . . . . . . . . . . .   6
+   8.  Use of FIDO CTAP1/U2F with SCRAM  . . . . . . . . . . . . . .   6
+   9.  Open Issues . . . . . . . . . . . . . . . . . . . . . . . . .   9
+   10. Security Considerations . . . . . . . . . . . . . . . . . . .   9
+   11. IANA Considerations . . . . . . . . . . . . . . . . . . . . .  10
+   12. Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  10
+   13. Normative References  . . . . . . . . . . . . . . . . . . . .  10
+   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  12
+
+1.  Introduction
+
+   SCRAM [RFC5802] is a password based SASL [RFC4422] authentication
+   mechanism that provides (among other things) mutual authentication
+   and binding to an external security layer such as TLS.
+
+   Two-factor authentication (2FA) is a way to add additional security
+   to an authentication exchange.  The first "factor" is a password.
+   The second "factor" is a verification code retrieved from an
+   application on a mobile device or computer.  2FA is conceptually
+   similar to a security token device that banks in some countries
+   require for online banking.  Some examples of 2FA systems are OTP
+   (one-time password) and TOTP (Time-based One-time Password algorithm,
+   such as [RFC6238]).
+
+   This specification describes an extension to SCRAM to provide 2
+   factor authentication.  SCRAM already relies on passwords for
+   authentication.  This document specifies how second "factors" can be
+   incorporated into SCRAM authentication.  It also includes a separate
+   (but frequently used together with the 2 factor authentication)
+   extension for quick reauthentication.
+
+
+
+
+
+
+Melnikov                  Expires 17 July 2023                  [Page 2]
+
+Internet-Draft            SCRAM 2FA extensions              January 2023
+
+
+2.  Conventions Used in This Document
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+   document are to be interpreted as described in [RFC2119].
+
+   Formal syntax is defined by [RFC5234] including the core rules
+   defined in Appendix B of [RFC5234].
+
+   Example lines prefaced by "C:" are sent by the client and ones
+   prefaced by "S:" by the server.  If a single "C:" or "S:" label
+   applies to multiple lines, then the line breaks between those lines
+   are for editorial clarity only, and are not part of the actual
+   protocol exchange.
+
+2.1.  Terminology
+
+   This document uses several terms defined in [RFC4949] ("Internet
+   Security Glossary") including the following: authentication,
+   authentication exchange, authentication information, brute force,
+   challenge-response, cryptographic hash function, dictionary attack,
+   eavesdropping, hash result, keyed hash, man-in-the-middle, nonce,
+   one-way encryption function, password, replay attack and salt.
+   Readers not familiar with these terms should use that glossary as a
+   reference.  Other terms defined in [RFC5802] are also used in this
+   document.
+
+2.2.  Notation
+
+   This document reuses notation defined in SCRAM.
+
+3.  SCRAM Extension for 2FA
+
+   This extension doesn't add any extra roundtrips to SCRAM
+   authentication.  SCRAM was designed to be extensible, so it allows
+   for optional and mandatory attributes, which covered by MAC codes.
+   Second "factors" are conveyed in the second message ("client-final-
+   message-without-proof" ABNF production) sent from the client to the
+   server.
+
+   This extension doesn't change how the client authenticates the
+   server.  This extension also doesn't cover enrollment with a 2FA
+   system, such enrollment happends out-of-band.
+
+   The server authenticates the client after receiving the second
+   message as described in Section 3 of [RFC5802] If the client included
+   "type" and "second-factor" attributes defined in this document (see
+   Section 5) and the server supports the specified second factor type,
+
+
+
+Melnikov                  Expires 17 July 2023                  [Page 3]
+
+Internet-Draft            SCRAM 2FA extensions              January 2023
+
+
+   the server verifies content of the "second-factor" according to the
+   "type".  If the second factor verification fails, the server MUST
+   fail authentication and SHOULD return either "replayed-second-factor"
+   or "invalid-second-factor" error in the "e" attribute.  [[It would be
+   possible to make the extra attributes mandatory by using SCRAM's
+   "m=", but the text above doesn't do that.  This is one of open issues
+   to resolve.]]
+
+4.  SCRAM Extension for reauthentication
+
+   This reauthentication extension to SCRAM allows the server to return
+   a token that can be used for quick reauthentication and bypasses 2
+   factor authentication prompt to the user.  The reauthentication token
+   is a randomly generated value.The reauthentication token is returned
+   in the "o" attribute that is appended to the end of the "server-
+   final-message".
+
+   [[Note: it would be possible to extend SCRAM itself to do
+   reauthentication, by including an earlier received reauthentication
+   token in the "client-first-message" of a subsequent SCRAM
+   authentication.  This will also turn off the server checking for 2
+   factor authentication information, unless the reauthentication
+   attempt is rejected by the server.  In the meantime, this document
+   presents a couple of other alternatives on how to use other SASL
+   mechanisms with the reauthentication token.]]
+
+   When the HT-* mechanism [draft-schmaus-kitten-sasl-ht] is used for
+   the reauthentication after a successful SCRAM authentication, the
+   reauthentication token is the SASL-HT token (see
+   [draft-schmaus-kitten-sasl-ht]).  [[Note that the HT hash should
+   probably match the SCRAM hash used or "be better".]]
+
+   When the CLIENT-KEY/CLIENT-KEY-PLUS mechanism (see draft-cridland-
+   kitten-clientkey) is used for the reauthentication after a successful
+   SCRAM authentication, the reauthentication token is the Client Secret
+   Key.  [[Need to also somehow convey token expiration?]]
+
+5.  Formal Syntax
+
+   This document defines the following new SCRAM attributes:
+
+   *  t: This attribute specifies the type of second factor.  This
+      document defines two possible types: "totp" (see Section 6) and
+      "ctap1" (see Section 8).  If this attribute is specified, the "f"
+      attribute MUST also be specified.
+
+
+
+
+
+
+Melnikov                  Expires 17 July 2023                  [Page 4]
+
+Internet-Draft            SCRAM 2FA extensions              January 2023
+
+
+   *  f: This attribute specifies the value of the second factor.  For
+      "t=totp" it is 6 digit decimal number.  [[Use 8 digits per Rick
+      van Rein?]] This attribute MUST be ignored unless the "t"
+      attribute is also specified.
+
+   *  l: This attribute is used by some second factors (e.g.  CTAP1) to
+      specify the challenge returned by the SCRAM server.
+
+   *  o: This attribute specifies the base64-encoded value of the
+      reauthentication token.
+
+   The following syntax specification uses the Augmented Backus-Naur
+   Form (ABNF) notation as specified in [RFC5234].
+
+   type            = "t=" type-value
+                 ; Complies with "attr-val" syntax.
+                 ; Returned in client-final-message.
+   type-value      = "totp" / "ctap1" / value
+                 ; Type of second factor.
+                 ; Should be registered with IANA.
+   second-factor   = "f=" second-factor-value
+                 ; Complies with "attr-val" syntax.
+                 ; Returned in client-final-message.
+   second-factor-value = 6DIGIT / value
+                 ; 6DIGIT when "t=totp".
+   server-challenge = "l=" base64
+                 ; Data returned by SCRAM server in server-first-message
+                 ; to be used for construction of second-factor-value.
+
+   server-error-value-ext =
+           "replayed-second-factor" /
+           "invalid-second-factor" /
+           "second-factor-value-missing"
+
+   value = <as defined in RFC 5802>
+
+
+   reauth-token = "o=" base64
+                  ; base64 encoding of reauthentication
+                  ; token.
+                  ; Returned in server-final-message.
+
+
+6.  Use of TOTP with SCRAM
+
+   When TOTP is used with SCRAM, the following values for "t" and "f"
+   attributes (see Section 5 for their generic syntax) are used:
+
+
+
+
+Melnikov                  Expires 17 July 2023                  [Page 5]
+
+Internet-Draft            SCRAM 2FA extensions              January 2023
+
+
+   *  t: This attribute specifies the type of second factor.  For TOTP
+      the value is "totp".  If this attribute is specified, the "f"
+      attribute MUST also be specified.
+
+   *  f: This attribute specifies the value of the second factor.  For
+      "t=totp" it is 6 digit decimal number.  This attribute MUST be
+      ignored unless the "t" attribute is also specified.
+
+   A TOTP URI is specified with the following ABNF:
+
+   totp-uri = "otpauth" "://" "totp/" label "?secret=" secret
+              "&issuer=" issuer
+   label = issuer (":" / "%3A") identity
+   identity = 1*CHAR ; URI-encoded SASL identity
+   secret = 40 * HEXCHAR ; Base32 (hex) encoded secret with no padding.
+   issuer = 1*CHAR ; Issuer name.
+
+
+7.  Example
+
+   The following example extends the example from Section 5 of [RFC5802]
+   to demonstrate use of TOTP:
+
+     C: n,,n=user,r=fyko+d2lbbFgONRv9qkxdawL
+     S: r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,s=QSXCR+Q6sek8bf92,
+        i=4096
+     C: c=biws,r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,
+        t=totp,f=776804,p=v0X8v3Bz2T0CJGbJQyF0X+HI4Ts=
+     S: v=lz59pqV8S7suAoZWja4dJRkFsKQ=
+
+
+   Please note that TOTP extension described in this document works in
+   the same way with SCRAM-SHA-256/SCRAM-SHA-256-PLUS, SCRAM-SHA-512/
+   SCRAM-SHA-512-PLUS or any other SCRAM variants that use other hash
+   functions.
+
+8.  Use of FIDO CTAP1/U2F with SCRAM
+
+   Note that this section describes steps to achieve Client-to-
+   Authenticator Protocols v1 (CTAP1)/U2F 2FA in terms of CTAP2 API.
+
+   When FIDO CTAP1/U2F is used with SCRAM, the following values for "t",
+   "l" and "f" attributes (see Section 5 for their generic syntax) are
+   used:
+
+   *  t: This attribute specifies the type of second factor.  For FIDO
+      CTAP1/U2F the value is "ctap1".  If this attribute is specified,
+      the "f" attribute MUST also be specified.
+
+
+
+Melnikov                  Expires 17 July 2023                  [Page 6]
+
+Internet-Draft            SCRAM 2FA extensions              January 2023
+
+
+   *  l: base64-encoded challenge as returned by SCRAM server.
+
+   *  f: This attribute specifies the value of the second factor.  For
+      "t=ctap1" it is the CBOR-serialized value of
+      authenticatorGetAssertionResponse map described below.  This
+      attribute MUST be ignored unless the "t" attribute is also
+      specified.
+
+   SCRAM client sends U2F_AUTHENTICATE command formatted as specified in
+   [FIDO-U2F-Raw-Message-Formats] to the authenticator (e.g. a USB or
+   NFC device).
+
+   The "P1" framing parameter to U2F_AUTHENTICATE is a single octet
+   parameter defined as follows:
+
+   *  If "up" is set to false, set it to 0x08 (dont-enforce-user-
+      presence-and-sign).
+
+   *  For USB, set it to 0x07 (check-only).  This should prevent call
+      getting blocked on waiting for user input.  If response returns
+      success, then call again setting the enforce-user-presence-and-
+      sign.
+
+   *  For NFC, set it to 0x03 (enforce-user-presence-and-sign).  The tap
+      has already provided the presence and won't block.
+
+   The "P2" framing parameter to U2F_AUTHENTICATE is a single octet that
+   always has the value 0x00.
+
+   The "request-data" framing parameter (u2fAuthenticateRequest) to
+   U2F_AUTHENTICATE is constructed as follows:
+
+   *  The clientData structure (see Section 5.8.1 of [W3C_webauthn_3])
+      is filled in as follows:
+
+      -  The "type" field has value "webauthn.get".
+
+      -  The "challenge" field contains the base64url encoding of the
+         challenge provided by the Relying Party.  This is the value of
+         the "l" attribute described above.  (Note, possibly need to
+         base64-decode and base64url-encode.)
+
+      -  The "origin" field contains the origin of the SCRAM client in
+         the format specified in [RFC6454], for example
+         "smtp://client.example.net:587".
+
+      -  Other fields are specified in Section 5.8.1 of
+         [W3C_webauthn_3].
+
+
+
+Melnikov                  Expires 17 July 2023                  [Page 7]
+
+Internet-Draft            SCRAM 2FA extensions              January 2023
+
+
+   *  Use clientDataHash parameter of [CTAP2] request as CTAP1/U2F
+      challenge parameter (32 bytes).
+
+   *  Let rpIdHash be a byte string of size 32 initialized with SHA-256
+      hash of rp.id parameter as CTAP1/U2F application parameter (32
+      bytes).  (The rp.id parameter is the hostname of the SCRAM
+      server.)
+
+   *  Let credentialId is the byte string initialized with the id for
+      this PublicKeyCredentialDescriptor.
+
+   *  Let keyHandleLength be a byte initialized with length of
+      credentialId byte string.
+
+   *  Let u2fAuthenticateRequest be a byte string with the following
+      structure:
+
+   +===================+=============+=================================+
+   | Length (in        | Description | Value                           |
+   | bytes)            |             |                                 |
+   +===================+=============+=================================+
+   | 32                | Challenge   | Initialized with clientDataHash |
+   |                   | parameter   | parameter bytes.                |
+   +-------------------+-------------+---------------------------------+
+   | 32                | Application | Initialized with rpIdHash       |
+   |                   | parameter   | bytes.                          |
+   +-------------------+-------------+---------------------------------+
+   | 1                 | Key handle  | Initialized with                |
+   |                   | length      | keyHandleLength's value.        |
+   +-------------------+-------------+---------------------------------+
+   | keyHandleLength   | Key handle  | Initialized with credentialId   |
+   |                   |             | bytes.                          |
+   +-------------------+-------------+---------------------------------+
+
+                                  Table 1
+
+   Generate authenticatorData from the U2F authentication response
+   message received from the authenticator:
+
+   *  Copy bits 0 (the UP bit) and bit 1 from the CTAP2/U2F response
+      user presence byte to bits 0 and 1 of the CTAP2 flags,
+      respectively.  Set all other bits of flags to zero.  Note: bit
+      zero is the least significant bit.  See also Authenticator Data
+      section of [W3C_webauthn_3].
+
+   *  Let signCount be a 4-byte unsigned integer initialized with CTAP1/
+      U2F response counter field.
+
+
+
+
+Melnikov                  Expires 17 July 2023                  [Page 8]
+
+Internet-Draft            SCRAM 2FA extensions              January 2023
+
+
+   Let authenticatorData is a byte string of following structure:
+
+   +===================+============================+==================+
+   | Length (in bytes) | Description                | Value            |
+   +===================+============================+==================+
+   | 32                | SHA-256 hash of            | Initialized with |
+   |                   | the rp.id.                 | rpIdHash bytes.  |
+   +-------------------+----------------------------+------------------+
+   | 1                 | Flags                      | Initialized with |
+   |                   |                            | flags' value.    |
+   +-------------------+----------------------------+------------------+
+   | 4                 | Signature counter          | Initialized with |
+   |                   | (signCount)                | signCount bytes. |
+   +-------------------+----------------------------+------------------+
+
+                                  Table 2
+
+   Let authenticatorGetAssertionResponse be a CBOR map with the
+   following keys whose values are as follows:
+
+   *  Set 0x01 with the credential from allowList that whose response
+      succeeded.
+
+   *  Set 0x02 with authenticatorData bytes.
+
+   *  Set 0x03 with signature field from CTAP1/U2F authentication
+      response message.  Note: An ASN.1-encoded ECDSA signature value
+      ranges over 8-72 bytes in length.
+
+9.  Open Issues
+
+   Simon Josefsson: should this be a new SASL mechanism name, e.g.
+   CROTP-SHA-256?
+
+   Should we pick between TOTP and FIDO2 (CTAP1)?
+
+   Rick van Rein: specify a HOTP variant as well?
+
+   Rick van Rein: use TOTP with 6 or 8 digits?  Register both variants?
+
+10.  Security Considerations
+
+   Unless an external security layer (such as TLS) is also used, the OTP
+   value is sent in unencrypted/unhashed form from the client to the
+   server, which allows an attacker to read the OTP value and perform a
+   race with the server to validate the OTP.
+
+   TBD
+
+
+
+Melnikov                  Expires 17 July 2023                  [Page 9]
+
+Internet-Draft            SCRAM 2FA extensions              January 2023
+
+
+11.  IANA Considerations
+
+   IANA is requested to update the definition of the SASL family SCRAM
+   in the SASL Mechanism registry established by [RFC4422] to also point
+   to this document.
+
+   IANA is also requested to create a new subregistry of "SASL
+   mechanism" for registering second factor schemes used in the "t"
+   attribute as specified in this document.
+
+   The registration template is as follows:
+
+
+   SCRAM Second Factor Scheme Name:
+   Pointer to specification text:
+   Notes (optional):
+
+
+   The registration procedure for the above subregistry is Expert
+   Review.
+
+   IANA is requested to register a new value in the subregistry defined
+   above:
+
+
+   SCRAM Second Factor Scheme Name: TOTP
+   Pointer to specification text: [[ this document ]]
+   Notes (optional): (none)
+
+
+12.  Acknowledgements
+
+   Thank you to Stephen Farrell for motivating creation of this document
+   and to Dave Cridland for describing how TOTP can be used with XMPP in
+   XEP-0400.  Thank you to Rick van Rein, Simon Josefsson and Ludovic
+   Bocquet for comments and corrections, but all final errors in this
+   document remain mine.
+
+13.  Normative References
+
+   [CTAP2]    Bradley, J., Hodges, J., Jones, M., Kumar, A., Lindemann,
+              R., and J. Verrept, "Client to Authenticator Prot...
 
[truncated message content]

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1585] trunk

[<di...@us...>]

Revision: 1585
          http://sourceforge.net/p/ldap-sdk/code/1585
Author:   dirmgr
Date:     2023-01-10 23:46:02 +0000 (Tue, 10 Jan 2023)
Log Message:
-----------
Add getServerSet methods to connection pools

Updated the LDAPConnectionPool and LDAPThreadLocalConnectionPool
classes to add getServerSet methods that can be used to retrieve
the server set used to establish new connections for the pool.

Modified Paths:
--------------
    trunk/docs/release-notes.html
    trunk/src/com/unboundid/ldap/sdk/LDAPConnectionPool.java
    trunk/src/com/unboundid/ldap/sdk/LDAPThreadLocalConnectionPool.java
    trunk/tests/unit/src/com/unboundid/ldap/sdk/UpdateConnectionPoolBindRequestAndServerSetTestCase.java

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2023-01-06 23:50:29 UTC (rev 1584)
+++ trunk/docs/release-notes.html	2023-01-10 23:46:02 UTC (rev 1585)
@@ -21,6 +21,13 @@
                 </li>
 
                 <li>
+                  Updated the LDAPConnectionPool and LDAPThreadLocalConnectionPool classes to add
+                  getServerSet methods that can be used to retrieve the server set used to
+                  establish new connections for the pool.
+                  <br><br>
+                </li>
+
+                <li>
                   Added support for encrypted PKCS #8 private keys.  Private keys can now be
                   formatted in encrypted PEM when provided with an encryption password and a set
                   of encryption properties, and the PKCS #8 PEM file reader can read encrypted

Modified: trunk/src/com/unboundid/ldap/sdk/LDAPConnectionPool.java
===================================================================
--- trunk/src/com/unboundid/ldap/sdk/LDAPConnectionPool.java	2023-01-06 23:50:29 UTC (rev 1584)
+++ trunk/src/com/unboundid/ldap/sdk/LDAPConnectionPool.java	2023-01-10 23:46:02 UTC (rev 1585)
@@ -2481,6 +2481,21 @@
 
 
   /**
+   * Retrieves the server set that should be used to establish new connections
+   * for use in this connection pool.
+   *
+   * @return  The server set that should be used to establish new connections
+   *          for use in this connection pool.
+   */
+  @NotNull()
+  public ServerSet getServerSet()
+  {
+    return serverSet;
+  }
+
+
+
+  /**
    * Specifies the server set that should be used to establish new connections
    * for use in this connection pool.  Existing connections will not be
    * affected.

Modified: trunk/src/com/unboundid/ldap/sdk/LDAPThreadLocalConnectionPool.java
===================================================================
--- trunk/src/com/unboundid/ldap/sdk/LDAPThreadLocalConnectionPool.java	2023-01-06 23:50:29 UTC (rev 1584)
+++ trunk/src/com/unboundid/ldap/sdk/LDAPThreadLocalConnectionPool.java	2023-01-10 23:46:02 UTC (rev 1585)
@@ -1292,6 +1292,21 @@
 
 
   /**
+   * Retrieves the server set that should be used to establish new connections
+   * for use in this connection pool.
+   *
+   * @return  The server set that should be used to establish new connections
+   *          for use in this connection pool.
+   */
+  @NotNull()
+  public ServerSet getServerSet()
+  {
+    return serverSet;
+  }
+
+
+
+  /**
    * Specifies the server set that should be used to establish new connections
    * for use in this connection pool.  Existing connections will not be
    * affected.

Modified: trunk/tests/unit/src/com/unboundid/ldap/sdk/UpdateConnectionPoolBindRequestAndServerSetTestCase.java
===================================================================
--- trunk/tests/unit/src/com/unboundid/ldap/sdk/UpdateConnectionPoolBindRequestAndServerSetTestCase.java	2023-01-06 23:50:29 UTC (rev 1584)
+++ trunk/tests/unit/src/com/unboundid/ldap/sdk/UpdateConnectionPoolBindRequestAndServerSetTestCase.java	2023-01-10 23:46:02 UTC (rev 1585)
@@ -438,9 +438,10 @@
     ds3.startListening();
 
 
+    final ServerSet serverSet1 =
+         new SingleServerSet("127.0.0.1", ds1.getListenPort());
     try (LDAPConnectionPool pool =
-              new LDAPConnectionPool(
-                   new SingleServerSet("127.0.0.1", ds1.getListenPort()),
+              new LDAPConnectionPool(serverSet1,
                    new SimpleBindRequest("cn=Directory Manager", "password"),
                    1, 1))
     {
@@ -451,9 +452,16 @@
 
 
       // Update the server so that new connections will be established to ds2.
-      pool.setServerSet(new SingleServerSet("127.0.0.1", ds2.getListenPort()));
+      assertNotNull(pool.getServerSet());
+      assertSame(pool.getServerSet(), serverSet1);
 
+      final ServerSet serverSet2 =
+           new SingleServerSet("127.0.0.1", ds2.getListenPort());
+      pool.setServerSet(serverSet2);
+      assertNotNull(pool.getServerSet());
+      assertSame(pool.getServerSet(), serverSet2);
 
+
       // Make sure that the existing connection is still connected to ds1.
       conn = pool.getConnection();
       assertEquals(conn.getConnectedPort(), ds1.getListenPort());
@@ -475,6 +483,8 @@
       catch (final LDAPSDKUsageException e)
       {
         // This was expected.
+        assertNotNull(pool.getServerSet());
+        assertSame(pool.getServerSet(), serverSet2);
       }
 
 
@@ -486,7 +496,11 @@
 
 
       // Set the server set so that new connections will be established to ds3.
-      pool.setServerSet(new SingleServerSet("127.0.0.1", ds3.getListenPort()));
+      final ServerSet serverSet3 =
+           new SingleServerSet("127.0.0.1", ds3.getListenPort());
+      pool.setServerSet(serverSet3);
+      assertNotNull(pool.getServerSet());
+      assertSame(pool.getServerSet(), serverSet3);
 
 
       // Make sure that new connections are established to ds3.
@@ -547,9 +561,15 @@
 
 
       // Update the server so that new connections will be established to ds2.
-      pool.setServerSet(new SingleServerSet("127.0.0.1", ds2.getListenPort()));
+      assertNotNull(pool.getServerSet());
 
+      final ServerSet serverSet2 =
+           new SingleServerSet("127.0.0.1", ds2.getListenPort());
+      pool.setServerSet(serverSet2);
+      assertNotNull(pool.getServerSet());
+      assertSame(pool.getServerSet(), serverSet2);
 
+
       // Make sure that the existing connection is still connected to ds1.
       conn = pool.getConnection();
       assertEquals(conn.getConnectedPort(), ds1.getListenPort());
@@ -571,6 +591,8 @@
       catch (final LDAPSDKUsageException e)
       {
         // This was expected.
+        assertNotNull(pool.getServerSet());
+        assertSame(pool.getServerSet(), serverSet2);
       }
 
 
@@ -582,7 +604,11 @@
 
 
       // Set the server set so that new connections will be established to ds3.
-      pool.setServerSet(new SingleServerSet("127.0.0.1", ds3.getListenPort()));
+      final ServerSet serverSet3 =
+           new SingleServerSet("127.0.0.1", ds3.getListenPort());
+      pool.setServerSet(serverSet3);
+      assertNotNull(pool.getServerSet());
+      assertSame(pool.getServerSet(), serverSet3);
 
 
       // Make sure that new connections are established to ds3.
@@ -630,9 +656,10 @@
     ds3.startListening();
 
 
+    final ServerSet serverSet1 =
+         new SingleServerSet("127.0.0.1", ds1.getListenPort());
     try (LDAPThreadLocalConnectionPool pool =
-              new LDAPThreadLocalConnectionPool(
-                   new SingleServerSet("127.0.0.1", ds1.getListenPort()),
+              new LDAPThreadLocalConnectionPool(serverSet1,
                    new SimpleBindRequest("cn=Directory Manager", "password")))
     {
       // Make sure that the connection is initially established to ds1.
@@ -642,9 +669,16 @@
 
 
       // Update the server so that new connections will be established to ds2.
-      pool.setServerSet(new SingleServerSet("127.0.0.1", ds2.getListenPort()));
+      assertNotNull(pool.getServerSet());
+      assertSame(pool.getServerSet(), serverSet1);
 
+      final ServerSet serverSet2 =
+           new SingleServerSet("127.0.0.1", ds2.getListenPort());
+      pool.setServerSet(serverSet2);
+      assertNotNull(pool.getServerSet());
+      assertSame(pool.getServerSet(), serverSet2);
 
+
       // Make sure that the existing connection is still connected to ds1.
       conn = pool.getConnection();
       assertEquals(conn.getConnectedPort(), ds1.getListenPort());
@@ -666,6 +700,8 @@
       catch (final LDAPSDKUsageException e)
       {
         // This was expected.
+        assertNotNull(pool.getServerSet());
+        assertSame(pool.getServerSet(), serverSet2);
       }
 
 
@@ -677,7 +713,11 @@
 
 
       // Set the server set so that new connections will be established to ds3.
-      pool.setServerSet(new SingleServerSet("127.0.0.1", ds3.getListenPort()));
+      final ServerSet serverSet3 =
+           new SingleServerSet("127.0.0.1", ds3.getListenPort());
+      pool.setServerSet(serverSet3);
+      assertNotNull(pool.getServerSet());
+      assertSame(pool.getServerSet(), serverSet3);
 
 
       // Make sure that new connections are established to ds3.
@@ -739,9 +779,15 @@
 
 
       // Update the server so that new connections will be established to ds2.
-      pool.setServerSet(new SingleServerSet("127.0.0.1", ds2.getListenPort()));
+      assertNotNull(pool.getServerSet());
 
+      final ServerSet serverSet2 =
+           new SingleServerSet("127.0.0.1", ds2.getListenPort());
+      pool.setServerSet(serverSet2);
+      assertNotNull(pool.getServerSet());
+      assertSame(pool.getServerSet(), serverSet2);
 
+
       // Make sure that the existing connection is still connected to ds1.
       conn = pool.getConnection();
       assertEquals(conn.getConnectedPort(), ds1.getListenPort());
@@ -763,6 +809,8 @@
       catch (final LDAPSDKUsageException e)
       {
         // This was expected.
+        assertNotNull(pool.getServerSet());
+        assertSame(pool.getServerSet(), serverSet2);
       }
 
 
@@ -774,7 +822,11 @@
 
 
       // Set the server set so that new connections will be established to ds3.
-      pool.setServerSet(new SingleServerSet("127.0.0.1", ds3.getListenPort()));
+      final ServerSet serverSet3 =
+           new SingleServerSet("127.0.0.1", ds3.getListenPort());
+      pool.setServerSet(serverSet3);
+      assertNotNull(pool.getServerSet());
+      assertSame(pool.getServerSet(), serverSet3);
 
 
       // Make sure that new connections are established to ds3.

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1584] trunk

[<di...@us...>]

Revision: 1584
          http://sourceforge.net/p/ldap-sdk/code/1584
Author:   dirmgr
Date:     2023-01-06 23:50:29 +0000 (Fri, 06 Jan 2023)
Log Message:
-----------
Updated cert data RCKSC to handle encrypted DER

Updated the CertificateDataReplaceCertificateKeyStoreContent class
to handle reading encrypted private keys in DER form.

Modified Paths:
--------------
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContent.java
    trunk/tests/unit/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContentTestCase.java

Modified: trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContent.java
===================================================================
--- trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContent.java	2023-01-06 20:32:32 UTC (rev 1583)
+++ trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContent.java	2023-01-06 23:50:29 UTC (rev 1584)
@@ -63,6 +63,7 @@
 import com.unboundid.util.ThreadSafetyLevel;
 import com.unboundid.util.Validator;
 import com.unboundid.util.ssl.cert.CertException;
+import com.unboundid.util.ssl.cert.PKCS8EncryptionHandler;
 import com.unboundid.util.ssl.cert.PKCS8PEMFileReader;
 import com.unboundid.util.ssl.cert.PKCS8PrivateKey;
 import com.unboundid.util.ssl.cert.X509Certificate;
@@ -572,7 +573,7 @@
       // If the first byte is 0x30, then that indicates it's a DER sequence.
       if (firstByte == 0x30)
       {
-        return readDERPrivateKey(file, bis);
+        return readDERPrivateKey(file, bis, encryptionPassword);
       }
 
 
@@ -601,10 +602,13 @@
   /**
    * Reads a DER-formatted PKCS #8 private key from the provided input stream.
    *
-   * @param  file         The file with which the provided input stream is
-   *                      associated.  It must not be {@code null}.
-   * @param  inputStream  The input stream from which the private key will be
-   *                      read.  It must not be {@code null}.
+   * @param  file                The file with which the provided input stream
+   *                             is associated.  It must not be {@code null}.
+   * @param  inputStream         The input stream from which the private key
+   *                             will be read.  It must not be {@code null}.
+   * @param  encryptionPassword  The password to use to decrypt the encrypted
+   *                             private key.  It may be {@code null} if the
+   *                             private key is not encrypted.
    *
    * @return  The bytes that comprise the encoded PKCS #8 private key.
    *
@@ -614,7 +618,8 @@
   @NotNull()
   private static byte[] readDERPrivateKey(
                @NotNull final File file,
-               @NotNull final InputStream inputStream)
+               @NotNull final InputStream inputStream,
+               @Nullable final char[] encryptionPassword)
           throws LDAPException
   {
     try (ASN1StreamReader asn1Reader = new ASN1StreamReader(inputStream))
@@ -627,9 +632,20 @@
                   file.getAbsolutePath()));
       }
 
-      return element.encode();
+      final byte[] elementsBytes = element.encode();
+      if (encryptionPassword == null)
+      {
+        return elementsBytes;
+      }
+      else
+      {
+        final PKCS8PrivateKey privateKey =
+             PKCS8EncryptionHandler.decryptPrivateKey(elementsBytes,
+                  encryptionPassword);
+        return privateKey.getPKCS8PrivateKeyBytes();
+      }
     }
-    catch (final IOException e)
+    catch (final Exception e)
     {
       Debug.debugException(e);
 

Modified: trunk/tests/unit/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContentTestCase.java
===================================================================
--- trunk/tests/unit/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContentTestCase.java	2023-01-06 20:32:32 UTC (rev 1583)
+++ trunk/tests/unit/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContentTestCase.java	2023-01-06 23:50:29 UTC (rev 1584)
@@ -361,12 +361,13 @@
 
   /**
    * Tests the behavior when trying to create certificate data from files
-   * that contain the DER representations of certificates and private keys.
+   * that contain the DER representations of certificates and (unencrypted)
+   * private keys.
    *
    * @throws  Exception  If an unexpected problem occurs.
    */
   @Test()
-  public void testCreateFromDERFiles()
+  public void testCreateFromDERFilesWithUnencryptedPrivateKey()
          throws Exception
   {
     // Generate a self-signed Ca certificate.
@@ -510,6 +511,171 @@
       outputStream.write(caCertDER);
     }
 
+    assertEquals(
+         CertificateDataReplaceCertificateKeyStoreContent.readCertificateChain(
+              combinedCertFile).size(),
+         2);
+  }
+
+
+
+  /**
+   * Tests the behavior when trying to create certificate data from files
+   * that contain the DER representations of certificates and (encrypted)
+   * private keys.
+   *
+   * @throws  Exception  If an unexpected problem occurs.
+   */
+  @Test()
+  public void testCreateFromDERFilesWithEncryptedPrivateKey()
+         throws Exception
+  {
+    // Generate a self-signed Ca certificate.
+    final String keyStorePath = getTestFilePath();
+    final String caCertPath = getTestFilePath();
+    final ByteArrayOutputStream out = new ByteArrayOutputStream();
+    assertEquals(
+         ManageCertificates.main(null, out, out,
+              "generate-self-signed-certificate",
+              "--keystore", keyStorePath,
+              "--keystore-password", "password",
+              "--alias", "ca-cert",
+              "--subject-dn", "CN=Example CA,O=Example Corp,C=US",
+              "--days-valid", "7300",
+              "--output-file", caCertPath,
+              "--output-format", "DER"),
+         ResultCode.SUCCESS,
+         StaticUtils.toUTF8String(out.toByteArray()));
+
+
+    // Generate a certificate signing request for a server certificate.
+    out.reset();
+    final String serverCertRequestPath = getTestFilePath();
+    assertEquals(
+         ManageCertificates.main(null, out, out,
+              "generate-certificate-signing-request",
+              "--keystore", keyStorePath,
+              "--keystore-password", "password",
+              "--alias", "server-cert",
+              "--subject-dn", "CN=ds.example.com,O=Example Corp,C=US",
+              "--output-file", serverCertRequestPath,
+              "--output-format", "DER"),
+         ResultCode.SUCCESS,
+         StaticUtils.toUTF8String(out.toByteArray()));
+
+
+    // Sign the certificate signing request.
+    out.reset();
+    final String serverCertPath = getTestFilePath();
+    assertEquals(
+         ManageCertificates.main(null, out, out,
+              "sign-certificate-signing-request",
+              "--keystore", keyStorePath,
+              "--keystore-password", "password",
+              "--signing-certificate-alias", "ca-cert",
+              "--request-input-file", serverCertRequestPath,
+              "--certificate-output-file", serverCertPath,
+              "--output-format", "DER",
+              "--days-valid", "365",
+              "--include-requested-extensions",
+              "--no-prompt"),
+         ResultCode.SUCCESS,
+         StaticUtils.toUTF8String(out.toByteArray()));
+
+
+    // Import the signed certificate chain into the key store.
+    out.reset();
+    assertEquals(
+         ManageCertificates.main(null, out, out,
+              "import-certificate",
+              "--keystore", keyStorePath,
+              "--keystore-password", "password",
+              "--alias", "server-cert",
+              "--certificate-file", serverCertPath,
+              "--certificate-file", caCertPath,
+              "--no-prompt"),
+         ResultCode.SUCCESS,
+         StaticUtils.toUTF8String(out.toByteArray()));
+
+
+    // Export the private key for the server certificate.
+    out.reset();
+    final String serverKeyPath = getTestFilePath();
+    final File encryptionPasswordFile =
+         createTempFile("this-is-the-private-key-encryption-password");
+    assertEquals(
+         ManageCertificates.main(null, out, out,
+              "export-private-key",
+              "--keystore", keyStorePath,
+              "--keystore-password", "password",
+              "--alias", "server-cert",
+              "--output-file", serverKeyPath,
+              "--output-format", "DER",
+              "--encryption-password-file",
+                   encryptionPasswordFile.getAbsolutePath()),
+         ResultCode.SUCCESS,
+         StaticUtils.toUTF8String(out.toByteArray()));
+
+
+    // Make sure that we can create a certificate data object with the DER
+    // certificate chain and private key.
+    CertificateDataReplaceCertificateKeyStoreContent c =
+         new CertificateDataReplaceCertificateKeyStoreContent(
+              Arrays.asList(
+                   new File(serverCertPath),
+                   new File(caCertPath)),
+              new File(serverKeyPath),
+              encryptionPasswordFile);
+
+    c = CertificateDataReplaceCertificateKeyStoreContent.decodeInternal(
+         c.encode());
+    assertNotNull(c);
+
+    assertNotNull(c.getCertificateChainData());
+    assertEquals(c.getCertificateChainData().size(), 2);
+
+    assertNotNull(c.getPrivateKeyData());
+
+
+    // Make sure that we can create a certificate data object with the DER
+    // certificate chain without the private key.
+    c = new CertificateDataReplaceCertificateKeyStoreContent(
+              Arrays.asList(
+                   new File(serverCertPath),
+                   new File(caCertPath)),
+              NULL_FILE);
+
+    c = CertificateDataReplaceCertificateKeyStoreContent.decodeInternal(
+         c.encode());
+    assertNotNull(c);
+
+    assertNotNull(c.getCertificateChainData());
+    assertEquals(c.getCertificateChainData().size(), 2);
+
+    assertNull(c.getPrivateKeyData());
+
+
+    // Also cover the readCertificateChain method that takes an array of files.
+    assertEquals(
+         CertificateDataReplaceCertificateKeyStoreContent.readCertificateChain(
+              new File(serverCertPath),
+              new File(caCertPath)).size(),
+         2);
+
+
+    // Concatenate the files together into a single file and verify that
+    // the readCertificateChain method will still get both certificates.
+    final byte[] serverCertDER = StaticUtils.readFileBytes(serverCertPath);
+    final byte[] caCertDER = StaticUtils.readFileBytes(caCertPath);
+
+    final File combinedCertFile = createTempFile();
+    assertTrue(combinedCertFile.delete());
+    try (FileOutputStream outputStream = new FileOutputStream(combinedCertFile))
+    {
+      outputStream.write(serverCertDER);
+      outputStream.write(caCertDER);
+    }
+
     assertEquals(
          CertificateDataReplaceCertificateKeyStoreContent.readCertificateChain(
               combinedCertFile).size(),

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1583] trunk

[<di...@us...>]

Revision: 1583
          http://sourceforge.net/p/ldap-sdk/code/1583
Author:   dirmgr
Date:     2023-01-06 20:32:32 +0000 (Fri, 06 Jan 2023)
Log Message:
-----------
Update cert data RCKSC to read PK PW from file

Updated the CertificateDataReplaceCertificateKeyStoreContent class
so that its support for encrypted private keys reads the encryption
password from a file rather than having it provided as a character
array.

Modified Paths:
--------------
    trunk/messages/unboundid-ldapsdk-unboundid-extop.properties
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContent.java
    trunk/tests/unit/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContentTestCase.java

Modified: trunk/messages/unboundid-ldapsdk-unboundid-extop.properties
===================================================================
--- trunk/messages/unboundid-ldapsdk-unboundid-extop.properties	2023-01-06 18:08:29 UTC (rev 1582)
+++ trunk/messages/unboundid-ldapsdk-unboundid-extop.properties	2023-01-06 20:32:32 UTC (rev 1583)
@@ -909,6 +909,8 @@
   decode DER-encoded certificate information from file ''{0}'':  {1}
 ERR_CD_KSC_DECODE_PEM_CERT_ERROR=An error occurred while attempting to \
   decode PEM-encoded certificate information from file ''{0}'':  {1}
+ERR_CD_KSC_ERROR_READING_PW_FILE=An error occurred while attempting to read \
+  the PKCS #8 private key encryption password from file ''{0}'':  {1}
 ERR_CD_KSC_DECODE_ERROR_EMPTY_PK_FILE=Unable to read PKCS #8 private key \
   information from file ''{0}'' because the file is empty.
 ERR_CD_KSC_DECODE_ERROR_READING_PK_FILE=An error occurred while attempting to \

Modified: trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContent.java
===================================================================
--- trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContent.java	2023-01-06 18:08:29 UTC (rev 1582)
+++ trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContent.java	2023-01-06 20:32:32 UTC (rev 1583)
@@ -57,6 +57,7 @@
 import com.unboundid.util.NotMutable;
 import com.unboundid.util.NotNull;
 import com.unboundid.util.Nullable;
+import com.unboundid.util.PasswordFileReader;
 import com.unboundid.util.StaticUtils;
 import com.unboundid.util.ThreadSafety;
 import com.unboundid.util.ThreadSafetyLevel;
@@ -210,27 +211,24 @@
    * Creates a new instance of this key store content object with the provided
    * information.
    *
-   * @param  certificateChainFiles  A list containing one or more files from
-   *                                which to read the PEM or DER representations
-   *                                of the X.509 certificates to include in
-   *                                the new certificate chain.  The order of
-   *                                the files, and the order of the certificates
-   *                                in each file, should be arranged such that
-   *                                the first certificate read is the end-entity
-   *                                certificate and each subsequent certificate
-   *                                is the issuer for the previous.  This must
-   *                                not be {@code null} or empty.
-   * @param  privateKeyFile         A file from which to read the PEM or DER
-   *                                representation of the PKCS #8 private key
-   *                                for the end-entity certificate in the chain.
-   *                                This may be {@code null} if the new
-   *                                end-entity certificate uses the same private
-   *                                key as the certificate currently in use in
-   *                                the server.
-   * @param  privateKeyEncryptionPassword
-   *              The password needed to decrypt the private key if it is
-   *              encrypted.  This may be {@code null} if the private key is not
-   *              encrypted.
+   * @param  certificateChainFiles
+   *              A list containing one or more files from which to read the PEM
+   *              or DER representations of the X.509 certificates to include in
+   *              the new certificate chain.  The order of the files, and the
+   *              order of the certificates in each file, should be arranged
+   *              such that the first certificate read is the end-entity
+   *              certificate and each subsequent certificate is the issuer for
+   *              the previous.  This must not be {@code null} or empty.
+   * @param  privateKeyFile
+   *              A file from which to read the PEM or DER representation of the
+   *              PKCS #8 private key for the end-entity certificate in the
+   *              chain.  This may be {@code null} if the new end-entity
+   *              certificate uses the same private key as the certificate
+   *              currently in use in the server.
+   * @param  privateKeyEncryptionPasswordFile
+   *              A file that contains the password needed to decrypt the
+   *              private key if it is encrypted.  This may be {@code null} if
+   *              the private key is not encrypted.
    *
    * @throws  LDAPException  If a problem occurs while trying to read or parse
    *                         data contained in any of the provided files.
@@ -238,12 +236,13 @@
   public CertificateDataReplaceCertificateKeyStoreContent(
               @NotNull final List<File> certificateChainFiles,
               @Nullable final File privateKeyFile,
-              @Nullable final char[] privateKeyEncryptionPassword)
+              @Nullable final File privateKeyEncryptionPasswordFile)
          throws LDAPException
   {
     this(readCertificateChain(certificateChainFiles),
          ((privateKeyFile == null) ? null :
-              readPrivateKey(privateKeyFile, privateKeyEncryptionPassword)));
+              readPrivateKey(privateKeyFile,
+                   privateKeyEncryptionPasswordFile)));
   }
 
 
@@ -498,11 +497,12 @@
    * Reads a PKCS #8 private key from the given file.  The file must contain the
    * PEM or DER representation of a single private key.
    *
-   * @param  file                The file from which the private key should be
-   *                             read.  It must not be {@code null}.
-   * @param  encryptionPassword  The password needed to decrypt the private key
-   *                             if it is encrypted.  It may be {@code null} if
-   *                             the private key is not encrypted.
+   * @param  file                    The file from which the private key should
+   *                                 be read.  It must not be {@code null}.
+   * @param  encryptionPasswordFile  The file containing the password needed to
+   *                                 decrypt the private key if it is encrypted.
+   *                                 It may be {@code null} if the private key
+   *                                 is not encrypted.
    *
    * @return  The encoded representation of the PKCS #8 private key that was
    *          read.
@@ -512,7 +512,7 @@
    */
   @NotNull()
   public static byte[] readPrivateKey(@NotNull final File file,
-                                      @Nullable final char[] encryptionPassword)
+              @Nullable final File encryptionPasswordFile)
          throws LDAPException
   {
     Validator.ensureNotNull(file,
@@ -520,6 +520,37 @@
               "readPrivateKey.file must not be null.");
 
 
+    // If there is an encryption password file, then read the password.
+    final char[] encryptionPassword;
+    if (encryptionPasswordFile == null)
+    {
+      encryptionPassword = null;
+    }
+    else
+    {
+      final PasswordFileReader passwordFileReader = new PasswordFileReader();
+      try
+      {
+        encryptionPassword =
+             passwordFileReader.readPassword(encryptionPasswordFile);
+      }
+      catch (final LDAPException e)
+      {
+        Debug.debugException(e);
+        throw e;
+      }
+      catch (final Exception e)
+      {
+        Debug.debugException(e);
+        throw new LDAPException(ResultCode.LOCAL_ERROR,
+             ERR_CD_KSC_ERROR_READING_PW_FILE.get(
+                  encryptionPasswordFile.getAbsolutePath(),
+                  StaticUtils.getExceptionMessage(e)),
+             e);
+      }
+    }
+
+
     // Open the file for reading.
     try (FileInputStream fis = new FileInputStream(file);
          BufferedInputStream bis = new BufferedInputStream(fis))
@@ -556,6 +587,13 @@
                 StaticUtils.getExceptionMessage(e)),
            e);
     }
+    finally
+    {
+      if (encryptionPassword != null)
+      {
+        Arrays.fill(encryptionPassword, '\u0000');
+      }
+    }
   }
 
 

Modified: trunk/tests/unit/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContentTestCase.java
===================================================================
--- trunk/tests/unit/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContentTestCase.java	2023-01-06 18:08:29 UTC (rev 1582)
+++ trunk/tests/unit/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContentTestCase.java	2023-01-06 20:32:32 UTC (rev 1583)
@@ -305,7 +305,7 @@
                    new File(serverCertPath),
                    new File(caCertPath)),
               new File(serverKeyPath),
-              "encryption-password".toCharArray());
+              createTempFile("encryption-password"));
 
     c = CertificateDataReplaceCertificateKeyStoreContent.decodeInternal(
          c.encode());

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1582] trunk

[<di...@us...>]

Revision: 1582
          http://sourceforge.net/p/ldap-sdk/code/1582
Author:   dirmgr
Date:     2023-01-06 18:08:29 +0000 (Fri, 06 Jan 2023)
Log Message:
-----------
Add DN.getDNRelativeToBaseDN

Added a DN.getDNRelativeToBaseDN method that may be used to retrieve
the portion of a DN that is relative to a given base DN (that is,
the portion of a DN with the given base DN stripped off).

Modified Paths:
--------------
    trunk/docs/release-notes.html
    trunk/messages/unboundid-ldapsdk-ldap.properties
    trunk/src/com/unboundid/ldap/sdk/DN.java
    trunk/tests/unit/src/com/unboundid/ldap/sdk/DNTestCase.java

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2023-01-02 17:08:44 UTC (rev 1581)
+++ trunk/docs/release-notes.html	2023-01-06 18:08:29 UTC (rev 1582)
@@ -14,6 +14,13 @@
 
               <ul>
                 <li>
+                  Added a DN.getDNRelativeToBaseDN method that may be used to retrieve the portion
+                  of a DN that is relative to a given base DN (that is, the portion of a DN with
+                  the given base DN stripped off).
+                  <br><br>
+                </li>
+
+                <li>
                   Added support for encrypted PKCS #8 private keys.  Private keys can now be
                   formatted in encrypted PEM when provided with an encryption password and a set
                   of encryption properties, and the PKCS #8 PEM file reader can read encrypted

Modified: trunk/messages/unboundid-ldapsdk-ldap.properties
===================================================================
--- trunk/messages/unboundid-ldapsdk-ldap.properties	2023-01-02 17:08:44 UTC (rev 1581)
+++ trunk/messages/unboundid-ldapsdk-ldap.properties	2023-01-06 18:08:29 UTC (rev 1582)
@@ -92,7 +92,6 @@
 ERR_CONTROLS_DECODE_ELEMENT_NOT_SEQUENCE=Unable to decode the provided \
   sequence as a set of controls because one of the elements could not be \
   decoded as a control sequence:  {0}
-
 ERR_DELETE_INTERRUPTED=Delete processing was interrupted while waiting for a \
   response from server {0}.
 ERR_DN_ENDS_WITH_COMMA=Unable to parse string ''{0}'' as a DN because it ends \
@@ -738,6 +737,9 @@
 ERR_DN_MATCHES_UNSUPPORTED_SCOPE=Unable to determine whether DN ''{0}'' \
   matches the specified base and scope because the provided scope ''{1}'' is \
   not supported for this determination.
+ERR_DN_FULL_DN_NOT_DESCENDANT_OF_BASE=Unable to obtain the portion of full DN \
+  ''{0}'' that is relative to base DN ''{1}'' because the full DN is neither \
+  a descendant of nor equal to the base DN.
 ERR_CONNECT_THREAD_INTERRUPTED=A thread was interrupted while waiting for the \
   connect thread to establish a connection to {0}:{1,number,0}:  {2}
 ERR_CONNECT_THREAD_TIMEOUT=Unable to establish a connection to server \

Modified: trunk/src/com/unboundid/ldap/sdk/DN.java
===================================================================
--- trunk/src/com/unboundid/ldap/sdk/DN.java	2023-01-02 17:08:44 UTC (rev 1581)
+++ trunk/src/com/unboundid/ldap/sdk/DN.java	2023-01-06 18:08:29 UTC (rev 1582)
@@ -1892,4 +1892,92 @@
   {
     return new DN(s1, schema).compareTo(new DN(s2, schema));
   }
+
+
+
+  /**
+   * Retrieves a string that represents the portion of the provided full DN that
+   * is relative to the given base DN (that is, the full DN with the base DN
+   * stripped off).  For example, if the provided full DN is
+   * "uid=jdoe,ou=People,dc=example,dc=com" and the base DN is
+   * "dc=example,dc=com", then the returned DN will be "uid=jdoe,ou=People".
+   *
+   * @param  fullDN  The full DN for which to obtain the portion relative to the
+   *                 base DN.  It must not be {@code null}, and it must
+   *                 represent a valid DN that is a descendant of or equal to
+   *                 the base DN.
+   * @param  baseDN  The base DN to strip off of the provided full DN.  It must
+   *                 not be {@code null}, and it must be an ancestor of or equal
+   *                 to the full DN.
+   *
+   * @return  A string representation of the DN that represents the portion of
+   *          the full DN that is relative to the base DN, an empty string if
+   *          the full DN is equal to the base DN, or the provided full DN if
+   *          the base DN represents the null DN.
+   *
+   * @throws  LDAPException  If either of the provided strings is not a valid
+   *                         DN, or if the provided full DN is not an ancestor
+   *                         of or equal to the given base DN.
+   */
+  @NotNull()
+  public static String getDNRelativeToBaseDN(@NotNull final String fullDN,
+                                             @NotNull final String baseDN)
+         throws LDAPException
+  {
+    final DN parsedFullDN = new DN(fullDN);
+    final DN parsedBaseDN = new DN(baseDN);
+    return getDNRelativeToBaseDN(parsedFullDN, parsedBaseDN).toString();
+  }
+
+
+
+  /**
+   * Retrieves a portion of the provided full DN that is relative to the given
+   * base DN (that is, the full DN with the base DN stripped off).  For example,
+   * if the provided full DN is "uid=jdoe,ou=People,dc=example,dc=com" and the
+   * base DN is "dc=example,dc=com", then the returned DN will be
+   * "uid=jdoe,ou=People".
+   *
+   * @param  fullDN  The full DN for which to obtain the portion relative to the
+   *                 base DN.  It must not be {@code null}, and it must be a
+   *                 descendant of or equal to the base DN.
+   * @param  baseDN  The base DN to strip off of the provided full DN.  It must
+   *                 not be {@code null}, and it must be an ancestor of or equal
+   *                 to the full DN.
+   *
+   * @return  A DN that represents the portion of the full DN that is relative
+   *          to the base DN, {@link #NULL_DN} if the full DN is equal to the
+   *          base DN, or the provided full DN if the base DN is the null DN.
+   *
+   * @throws  LDAPException  If the provided full DN is not an ancestor of or
+   *                         equal to the given base DN.
+   */
+  @NotNull()
+  public static DN getDNRelativeToBaseDN(@NotNull final DN fullDN,
+                                         @NotNull final DN baseDN)
+         throws LDAPException
+  {
+    if (baseDN.isNullDN())
+    {
+      return fullDN;
+    }
+
+    if (! fullDN.isDescendantOf(baseDN, true))
+    {
+      throw new LDAPException(ResultCode.PARAM_ERROR,
+           ERR_DN_FULL_DN_NOT_DESCENDANT_OF_BASE.get(String.valueOf(fullDN),
+                String.valueOf(baseDN)));
+    }
+
+    final RDN[] fullRDNs = fullDN.getRDNs();
+    final RDN[] baseRDNs = baseDN.getRDNs();
+    if (fullRDNs.length == baseRDNs.length)
+    {
+      return NULL_DN;
+    }
+
+    final RDN[] relativeRDNs = new RDN[fullRDNs.length - baseRDNs.length];
+    System.arraycopy(fullRDNs, 0, relativeRDNs, 0, relativeRDNs.length);
+    return new DN(relativeRDNs);
+  }
 }

Modified: trunk/tests/unit/src/com/unboundid/ldap/sdk/DNTestCase.java
===================================================================
--- trunk/tests/unit/src/com/unboundid/ldap/sdk/DNTestCase.java	2023-01-02 17:08:44 UTC (rev 1581)
+++ trunk/tests/unit/src/com/unboundid/ldap/sdk/DNTestCase.java	2023-01-06 18:08:29 UTC (rev 1582)
@@ -1977,4 +1977,79 @@
     assertEquals(dn.toNormalizedString(),
          "case-exact-attr=This Is A Test,dc=example,dc=com");
   }
+
+
+
+  /**
+   * Provides test coverage for the getDNRelativeToBaseDN method.
+   *
+   * @throws  Exception  If an unexpected problem occurs.
+   */
+  @Test()
+  public void testGetDNRelativeToBaseDN()
+         throws Exception
+  {
+    assertDNsEqual(
+         DN.getDNRelativeToBaseDN("uid=jdoe,ou=People,dc=example,dc=com",
+              "dc=example,dc=com"),
+         "uid=jdoe,ou=People");
+
+    assertDNsEqual(
+         DN.getDNRelativeToBaseDN("ou=People,dc=example,dc=com",
+              "dc=example,dc=com"),
+         "ou=People");
+
+    assertDNsEqual(
+         DN.getDNRelativeToBaseDN("dc=example,dc=com", "dc=example,dc=com"),
+         "");
+
+    assertDNsEqual(
+         DN.getDNRelativeToBaseDN("dc=example,dc=com", ""),
+         "dc=example,dc=com");
+
+    try
+    {
+      DN.getDNRelativeToBaseDN("o=example1", "o=example2");
+      fail("Expected an exception when the full DN and base DN have no " +
+           "components in common.");
+    }
+    catch (final LDAPException e)
+    {
+      // This was expected
+    }
+
+    try
+    {
+      DN.getDNRelativeToBaseDN("ou=test1,dc=example,dc=com",
+           "ou=test2,dc=example,dc=com");
+      fail("Expected an exception when the full DN and base DN are peers.");
+    }
+    catch (final LDAPException e)
+    {
+      // This was expected
+    }
+
+    try
+    {
+      DN.getDNRelativeToBaseDN("dc=example,dc=com",
+           "ou=test,dc=example,dc=com");
+      fail("Expected an exception when the full DN is an ancestor of the " +
+           "base DN.");
+    }
+    catch (final LDAPException e)
+    {
+      // This was expected
+    }
+
+    try
+    {
+      DN.getDNRelativeToBaseDN("", "dc=example,dc=com");
+      fail("Expected an exception when the full DN is empty and the base DN " +
+           "is not.");
+    }
+    catch (final LDAPException e)
+    {
+      // This was expected
+    }
+  }
 }

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1581] trunk

[<di...@us...>]

Revision: 1581
          http://sourceforge.net/p/ldap-sdk/code/1581
Author:   dirmgr
Date:     2023-01-02 17:08:44 +0000 (Mon, 02 Jan 2023)
Log Message:
-----------
Update copyrights to include the year 2023

Modified Paths:
--------------
    trunk/LICENSE.txt
    trunk/android-ldap-client/AndroidManifest.xml
    trunk/android-ldap-client/res/layout/layout_define_server.xml
    trunk/android-ldap-client/res/layout/layout_list_servers.xml
    trunk/android-ldap-client/res/layout/layout_popup.xml
    trunk/android-ldap-client/res/layout/layout_popup_menu.xml
    trunk/android-ldap-client/res/layout/layout_search_server.xml
    trunk/android-ldap-client/res/layout/layout_view_entry.xml
    trunk/android-ldap-client/res/layout/layout_view_ldif.xml
    trunk/android-ldap-client/res/values/strings.xml
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/AddServer.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/AddToContactsOnClickListener.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/AttributeMapper.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/EMailAddressOptions.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/EMailClickListener.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/EditServer.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/GenericAttributeClickListener.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/GenericAttributeOptions.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/HeaderClickListener.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/HeaderOptions.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/LDAPClient.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/ListSearchResults.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/ListSearchResultsOptions.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/ListServerOptions.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/Logger.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/MapClickListener.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/PhoneNumberClickListener.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/PhoneNumberOptions.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/PopUp.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/PostalAddressOptions.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/SearchServer.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/SearchThread.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/ServerInstance.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/ServerTestInvoker.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/StringProvider.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/TestServerThread.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/ViewEntry.java
    trunk/android-ldap-client/src/com/unboundid/android/ldap/client/ViewLDIF.java
    trunk/build-src/copydocs/com/unboundid/buildtools/copydocs/CopyDocs.java
    trunk/build-src/digest/com/unboundid/buildtools/digest/GenerateDigest.java
    trunk/build-src/graalvmnativeimageresources/com/unboundid/buildtools/graalvmnativeimageresources/GenerateGraalVMNativeImageResourceConfigJSON.java
    trunk/build-src/messages/com/unboundid/buildtools/messages/GenerateMessages.java
    trunk/build-src/repositoryinfo/com/unboundid/buildtools/repositoryinfo/RepositoryInfo.java
    trunk/build-src/sanitycheck/com/unboundid/buildtools/sanitycheck/SanityCheck.java
    trunk/build-src/testngfileset/com/unboundid/buildtools/testngfileset/GenerateTestNGFilesetDescriptor.java
    trunk/build-src/toolusage/com/unboundid/buildtools/toolusage/GenerateToolUsage.java
    trunk/build.bat
    trunk/build.sh
    trunk/build.xml
    trunk/dist-root/LICENSE.txt
    trunk/dist-root/README.txt
    trunk/dist-root/tools/.script-util.bat
    trunk/dist-root/tools/.script-util.sh
    trunk/dist-root/tools/authrate
    trunk/dist-root/tools/authrate.bat
    trunk/dist-root/tools/base64
    trunk/dist-root/tools/base64.bat
    trunk/dist-root/tools/collect-support-data
    trunk/dist-root/tools/collect-support-data.bat
    trunk/dist-root/tools/deliver-one-time-password
    trunk/dist-root/tools/deliver-one-time-password.bat
    trunk/dist-root/tools/deliver-password-reset-token
    trunk/dist-root/tools/deliver-password-reset-token.bat
    trunk/dist-root/tools/dump-dns
    trunk/dist-root/tools/dump-dns.bat
    trunk/dist-root/tools/generate-schema-from-source
    trunk/dist-root/tools/generate-schema-from-source.bat
    trunk/dist-root/tools/generate-source-from-schema
    trunk/dist-root/tools/generate-source-from-schema.bat
    trunk/dist-root/tools/generate-totp-shared-secret
    trunk/dist-root/tools/generate-totp-shared-secret.bat
    trunk/dist-root/tools/identify-references-to-missing-entries
    trunk/dist-root/tools/identify-references-to-missing-entries.bat
    trunk/dist-root/tools/identify-unique-attribute-conflicts
    trunk/dist-root/tools/identify-unique-attribute-conflicts.bat
    trunk/dist-root/tools/in-memory-directory-server
    trunk/dist-root/tools/in-memory-directory-server.bat
    trunk/dist-root/tools/indent-ldap-filter
    trunk/dist-root/tools/indent-ldap-filter.bat
    trunk/dist-root/tools/ldap-debugger
    trunk/dist-root/tools/ldap-debugger.bat
    trunk/dist-root/tools/ldap-diff
    trunk/dist-root/tools/ldap-diff.bat
    trunk/dist-root/tools/ldap-result-code
    trunk/dist-root/tools/ldap-result-code.bat
    trunk/dist-root/tools/ldapcompare
    trunk/dist-root/tools/ldapcompare.bat
    trunk/dist-root/tools/ldapdelete
    trunk/dist-root/tools/ldapdelete.bat
    trunk/dist-root/tools/ldapmodify
    trunk/dist-root/tools/ldapmodify.bat
    trunk/dist-root/tools/ldappasswordmodify
    trunk/dist-root/tools/ldappasswordmodify.bat
    trunk/dist-root/tools/ldapsearch
    trunk/dist-root/tools/ldapsearch.bat
    trunk/dist-root/tools/ldif-diff
    trunk/dist-root/tools/ldif-diff.bat
    trunk/dist-root/tools/ldifmodify
    trunk/dist-root/tools/ldifmodify.bat
    trunk/dist-root/tools/ldifsearch
    trunk/dist-root/tools/ldifsearch.bat
    trunk/dist-root/tools/manage-account
    trunk/dist-root/tools/manage-account.bat
    trunk/dist-root/tools/manage-certificates
    trunk/dist-root/tools/manage-certificates.bat
    trunk/dist-root/tools/modrate
    trunk/dist-root/tools/modrate.bat
    trunk/dist-root/tools/move-subtree
    trunk/dist-root/tools/move-subtree.bat
    trunk/dist-root/tools/oid-lookup
    trunk/dist-root/tools/oid-lookup.bat
    trunk/dist-root/tools/parallel-update
    trunk/dist-root/tools/parallel-update.bat
    trunk/dist-root/tools/register-yubikey-otp-device
    trunk/dist-root/tools/register-yubikey-otp-device.bat
    trunk/dist-root/tools/search-and-mod-rate
    trunk/dist-root/tools/search-and-mod-rate.bat
    trunk/dist-root/tools/searchrate
    trunk/dist-root/tools/searchrate.bat
    trunk/dist-root/tools/split-ldif
    trunk/dist-root/tools/split-ldif.bat
    trunk/dist-root/tools/subtree-accessibility
    trunk/dist-root/tools/subtree-accessibility.bat
    trunk/dist-root/tools/summarize-access-log
    trunk/dist-root/tools/summarize-access-log.bat
    trunk/dist-root/tools/transform-ldif
    trunk/dist-root/tools/transform-ldif.bat
    trunk/dist-root/tools/validate-ldap-schema
    trunk/dist-root/tools/validate-ldap-schema.bat
    trunk/dist-root/tools/validate-ldif
    trunk/dist-root/tools/validate-ldif.bat
    trunk/ext/checkstyle/ldapsdk-checkstyle.xml
    trunk/ext/checkstyle/ldapsdk-unit-checkstyle.xml
    trunk/messages/unboundid-ldapsdk-args.properties
    trunk/messages/unboundid-ldapsdk-asn1.properties
    trunk/messages/unboundid-ldapsdk-cert.properties
    trunk/messages/unboundid-ldapsdk-controls.properties
    trunk/messages/unboundid-ldapsdk-experimental.properties
    trunk/messages/unboundid-ldapsdk-extop.properties
    trunk/messages/unboundid-ldapsdk-interceptor.properties
    trunk/messages/unboundid-ldapsdk-json-log.properties
    trunk/messages/unboundid-ldapsdk-json.properties
    trunk/messages/unboundid-ldapsdk-jsonfilter.properties
    trunk/messages/unboundid-ldapsdk-ldap.properties
    trunk/messages/unboundid-ldapsdk-ldif.properties
    trunk/messages/unboundid-ldapsdk-listener.properties
    trunk/messages/unboundid-ldapsdk-log-syntax.properties
    trunk/messages/unboundid-ldapsdk-log.properties
    trunk/messages/unboundid-ldapsdk-matchingrules.properties
    trunk/messages/unboundid-ldapsdk-monitor.properties
    trunk/messages/unboundid-ldapsdk-persist.properties
    trunk/messages/unboundid-ldapsdk-protocol.properties
    trunk/messages/unboundid-ldapsdk-schema.properties
    trunk/messages/unboundid-ldapsdk-ssl.properties
    trunk/messages/unboundid-ldapsdk-task.properties
    trunk/messages/unboundid-ldapsdk-text-log.properties
    trunk/messages/unboundid-ldapsdk-tools.properties
    trunk/messages/unboundid-ldapsdk-transformations.properties
    trunk/messages/unboundid-ldapsdk-unboundid-controls.properties
    trunk/messages/unboundid-ldapsdk-unboundid-extop.properties
    trunk/messages/unboundid-ldapsdk-unboundidds.properties
    trunk/messages/unboundid-ldapsdk-util.properties
    trunk/resource/unboundid-ldapsdk.pom
    trunk/src/com/unboundid/asn1/ASN1BigInteger.java
    trunk/src/com/unboundid/asn1/ASN1BitString.java
    trunk/src/com/unboundid/asn1/ASN1Boolean.java
    trunk/src/com/unboundid/asn1/ASN1Buffer.java
    trunk/src/com/unboundid/asn1/ASN1BufferSequence.java
    trunk/src/com/unboundid/asn1/ASN1BufferSet.java
    trunk/src/com/unboundid/asn1/ASN1Constants.java
    trunk/src/com/unboundid/asn1/ASN1Element.java
    trunk/src/com/unboundid/asn1/ASN1Enumerated.java
    trunk/src/com/unboundid/asn1/ASN1Exception.java
    trunk/src/com/unboundid/asn1/ASN1GeneralizedTime.java
    trunk/src/com/unboundid/asn1/ASN1IA5String.java
    trunk/src/com/unboundid/asn1/ASN1Integer.java
    trunk/src/com/unboundid/asn1/ASN1Long.java
    trunk/src/com/unboundid/asn1/ASN1Null.java
    trunk/src/com/unboundid/asn1/ASN1NumericString.java
    trunk/src/com/unboundid/asn1/ASN1ObjectIdentifier.java
    trunk/src/com/unboundid/asn1/ASN1OctetString.java
    trunk/src/com/unboundid/asn1/ASN1PrintableString.java
    trunk/src/com/unboundid/asn1/ASN1Sequence.java
    trunk/src/com/unboundid/asn1/ASN1Set.java
    trunk/src/com/unboundid/asn1/ASN1StreamReader.java
    trunk/src/com/unboundid/asn1/ASN1StreamReaderSequence.java
    trunk/src/com/unboundid/asn1/ASN1StreamReaderSet.java
    trunk/src/com/unboundid/asn1/ASN1UTCTime.java
    trunk/src/com/unboundid/asn1/ASN1UTF8String.java
    trunk/src/com/unboundid/asn1/ASN1Writer.java
    trunk/src/com/unboundid/asn1/InternalASN1Helper.java
    trunk/src/com/unboundid/asn1/package-info.java
    trunk/src/com/unboundid/ldap/listener/AccessLogRequestHandler.java
    trunk/src/com/unboundid/ldap/listener/Base64PasswordEncoderOutputFormatter.java
    trunk/src/com/unboundid/ldap/listener/CannedResponseRequestHandler.java
    trunk/src/com/unboundid/ldap/listener/ClearInMemoryPasswordEncoder.java
    trunk/src/com/unboundid/ldap/listener/ConcurrentRequestLimiterRequestHandler.java
    trunk/src/com/unboundid/ldap/listener/HexPasswordEncoderOutputFormatter.java
    trunk/src/com/unboundid/ldap/listener/InMemoryDirectoryServer.java
    trunk/src/com/unboundid/ldap/listener/InMemoryDirectoryServerConfig.java
    trunk/src/com/unboundid/ldap/listener/InMemoryDirectoryServerEqualityAttributeIndex.java
    trunk/src/com/unboundid/ldap/listener/InMemoryDirectoryServerPassword.java
    trunk/src/com/unboundid/ldap/listener/InMemoryDirectoryServerSnapshot.java
    trunk/src/com/unboundid/ldap/listener/InMemoryDirectoryServerTool.java
    trunk/src/com/unboundid/ldap/listener/InMemoryExtendedOperationHandler.java
    trunk/src/com/unboundid/ldap/listener/InMemoryListenerConfig.java
    trunk/src/com/unboundid/ldap/listener/InMemoryPasswordEncoder.java
    trunk/src/com/unboundid/ldap/listener/InMemoryRequestHandler.java
    trunk/src/com/unboundid/ldap/listener/InMemorySASLBindHandler.java
    trunk/src/com/unboundid/ldap/listener/IntermediateResponseTransformer.java
    trunk/src/com/unboundid/ldap/listener/JSONAccessLogRequestHandler.java
    trunk/src/com/unboundid/ldap/listener/LDAPDebuggerRequestHandler.java
    trunk/src/com/unboundid/ldap/listener/LDAPListener.java
    trunk/src/com/unboundid/ldap/listener/LDAPListenerClientConnection.java
    trunk/src/com/unboundid/ldap/listener/LDAPListenerConfig.java
    trunk/src/com/unboundid/ldap/listener/LDAPListenerExceptionHandler.java
    trunk/src/com/unboundid/ldap/listener/LDAPListenerRequestHandler.java
    trunk/src/com/unboundid/ldap/listener/PLAINBindHandler.java
    trunk/src/com/unboundid/ldap/listener/PasswordEncoderOutputFormatter.java
    trunk/src/com/unboundid/ldap/listener/PasswordModifyExtendedOperationHandler.java
    trunk/src/com/unboundid/ldap/listener/ProxyRequestHandler.java
    trunk/src/com/unboundid/ldap/listener/ProxySearchResultListener.java
    trunk/src/com/unboundid/ldap/listener/RateLimiterRequestHandler.java
    trunk/src/com/unboundid/ldap/listener/ReadOnlyInMemoryDirectoryServerConfig.java
    trunk/src/com/unboundid/ldap/listener/RequestControlPreProcessor.java
    trunk/src/com/unboundid/ldap/listener/SaltedMessageDigestInMemoryPasswordEncoder.java
    trunk/src/com/unboundid/ldap/listener/SearchEntryParer.java
    trunk/src/com/unboundid/ldap/listener/SearchEntryTransformer.java
    trunk/src/com/unboundid/ldap/listener/SearchReferenceTransformer.java
    trunk/src/com/unboundid/ldap/listener/SelfSignedCertificateGenerator.java
    trunk/src/com/unboundid/ldap/listener/StartTLSRequestHandler.java
    trunk/src/com/unboundid/ldap/listener/ToCodeRequestHandler.java
    trunk/src/com/unboundid/ldap/listener/TransactionExtendedOperationHandler.java
    trunk/src/com/unboundid/ldap/listener/UnsaltedMessageDigestInMemoryPasswordEncoder.java
    trunk/src/com/unboundid/ldap/listener/WhoAmIExtendedOperationHandler.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedAddRequest.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedAddResult.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedCompareRequest.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedCompareResult.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedDeleteRequest.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedDeleteResult.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedExtendedRequest.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedExtendedResult.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedIntermediateResponse.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedModifyDNRequest.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedModifyDNResult.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedModifyRequest.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedModifyResult.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedRequest.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedResult.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedSASLBindRequest.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedSASLBindResult.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedSearchEntry.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedSearchReference.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedSearchRequest.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedSearchResult.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedSimpleBindRequest.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryInterceptedSimpleBindResult.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryOperationInterceptor.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InMemoryOperationInterceptorRequestHandler.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InterceptedAddOperation.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InterceptedCompareOperation.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InterceptedDeleteOperation.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InterceptedExtendedOperation.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InterceptedIntermediateResponse.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InterceptedModifyDNOperation.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InterceptedModifyOperation.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InterceptedOperation.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InterceptedSASLBindOperation.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InterceptedSearchEntry.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InterceptedSearchOperation.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InterceptedSearchReference.java
    trunk/src/com/unboundid/ldap/listener/interceptor/InterceptedSimpleBindOperation.java
    trunk/src/com/unboundid/ldap/listener/package-info.java
    trunk/src/com/unboundid/ldap/matchingrules/AcceptAllSimpleMatchingRule.java
    trunk/src/com/unboundid/ldap/matchingrules/BooleanMatchingRule.java
    trunk/src/com/unboundid/ldap/matchingrules/CaseExactStringMatchingRule.java
    trunk/src/com/unboundid/ldap/matchingrules/CaseIgnoreListMatchingRule.java
    trunk/src/com/unboundid/ldap/matchingrules/CaseIgnoreStringMatchingRule.java
    trunk/src/com/unboundid/ldap/matchingrules/DistinguishedNameMatchingRule.java
    trunk/src/com/unboundid/ldap/matchingrules/GeneralizedTimeMatchingRule.java
    trunk/src/com/unboundid/ldap/matchingrules/IntegerMatchingRule.java
    trunk/src/com/unboundid/ldap/matchingrules/MatchingRule.java
    trunk/src/com/unboundid/ldap/matchingrules/NumericStringMatchingRule.java
    trunk/src/com/unboundid/ldap/matchingrules/OctetStringMatchingRule.java
    trunk/src/com/unboundid/ldap/matchingrules/SimpleMatchingRule.java
    trunk/src/com/unboundid/ldap/matchingrules/TelephoneNumberComparisonPolicy.java
    trunk/src/com/unboundid/ldap/matchingrules/TelephoneNumberMatchingRule.java
    trunk/src/com/unboundid/ldap/matchingrules/TelephoneNumberValidationPolicy.java
    trunk/src/com/unboundid/ldap/matchingrules/package-info.java
    trunk/src/com/unboundid/ldap/protocol/AbandonRequestProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/AddRequestProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/AddResponseProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/BindRequestProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/BindResponseProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/CompareRequestProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/CompareResponseProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/DeleteRequestProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/DeleteResponseProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/ExtendedRequestProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/ExtendedResponseProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/GenericResponseProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/IntermediateResponseProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/LDAPMessage.java
    trunk/src/com/unboundid/ldap/protocol/LDAPResponse.java
    trunk/src/com/unboundid/ldap/protocol/ModifyDNRequestProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/ModifyDNResponseProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/ModifyRequestProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/ModifyResponseProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/ProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/SearchRequestProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/SearchResultDoneProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/SearchResultEntryProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/SearchResultReferenceProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/UnbindRequestProtocolOp.java
    trunk/src/com/unboundid/ldap/protocol/package-info.java
    trunk/src/com/unboundid/ldap/sdk/ANONYMOUSBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/AbstractConnectionPool.java
    trunk/src/com/unboundid/ldap/sdk/AddRequest.java
    trunk/src/com/unboundid/ldap/sdk/AggregateLDAPConnectionPoolHealthCheck.java
    trunk/src/com/unboundid/ldap/sdk/AggregatePostConnectProcessor.java
    trunk/src/com/unboundid/ldap/sdk/AsyncCompareHelper.java
    trunk/src/com/unboundid/ldap/sdk/AsyncCompareResultListener.java
    trunk/src/com/unboundid/ldap/sdk/AsyncHelper.java
    trunk/src/com/unboundid/ldap/sdk/AsyncRequestID.java
    trunk/src/com/unboundid/ldap/sdk/AsyncResultListener.java
    trunk/src/com/unboundid/ldap/sdk/AsyncSearchHelper.java
    trunk/src/com/unboundid/ldap/sdk/AsyncSearchResultListener.java
    trunk/src/com/unboundid/ldap/sdk/AsyncTimeoutTimerTask.java
    trunk/src/com/unboundid/ldap/sdk/Attribute.java
    trunk/src/com/unboundid/ldap/sdk/BasicAsyncCompareResultListener.java
    trunk/src/com/unboundid/ldap/sdk/BasicAsyncResultListener.java
    trunk/src/com/unboundid/ldap/sdk/BasicAsyncSearchResultListener.java
    trunk/src/com/unboundid/ldap/sdk/BindRequest.java
    trunk/src/com/unboundid/ldap/sdk/BindResult.java
    trunk/src/com/unboundid/ldap/sdk/CRAMMD5BindRequest.java
    trunk/src/com/unboundid/ldap/sdk/CachingNameResolver.java
    trunk/src/com/unboundid/ldap/sdk/ChangeLogEntry.java
    trunk/src/com/unboundid/ldap/sdk/ChangeType.java
    trunk/src/com/unboundid/ldap/sdk/CommonAsyncHelper.java
    trunk/src/com/unboundid/ldap/sdk/CompactAttribute.java
    trunk/src/com/unboundid/ldap/sdk/CompactEntry.java
    trunk/src/com/unboundid/ldap/sdk/CompareRequest.java
    trunk/src/com/unboundid/ldap/sdk/CompareResult.java
    trunk/src/com/unboundid/ldap/sdk/ConnectThread.java
    trunk/src/com/unboundid/ldap/sdk/ConnectionClosedResponse.java
    trunk/src/com/unboundid/ldap/sdk/Control.java
    trunk/src/com/unboundid/ldap/sdk/DIGESTMD5BindRequest.java
    trunk/src/com/unboundid/ldap/sdk/DIGESTMD5BindRequestProperties.java
    trunk/src/com/unboundid/ldap/sdk/DN.java
    trunk/src/com/unboundid/ldap/sdk/DNEntrySource.java
    trunk/src/com/unboundid/ldap/sdk/DNEscapingStrategy.java
    trunk/src/com/unboundid/ldap/sdk/DNSSRVRecordServerSet.java
    trunk/src/com/unboundid/ldap/sdk/DecodeableControl.java
    trunk/src/com/unboundid/ldap/sdk/DefaultNameResolver.java
    trunk/src/com/unboundid/ldap/sdk/DeleteRequest.java
    trunk/src/com/unboundid/ldap/sdk/DereferencePolicy.java
    trunk/src/com/unboundid/ldap/sdk/DiscardAsyncListener.java
    trunk/src/com/unboundid/ldap/sdk/DisconnectHandler.java
    trunk/src/com/unboundid/ldap/sdk/DisconnectInfo.java
    trunk/src/com/unboundid/ldap/sdk/DisconnectType.java
    trunk/src/com/unboundid/ldap/sdk/EXTERNALBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/Entry.java
    trunk/src/com/unboundid/ldap/sdk/EntrySorter.java
    trunk/src/com/unboundid/ldap/sdk/EntrySource.java
    trunk/src/com/unboundid/ldap/sdk/EntrySourceException.java
    trunk/src/com/unboundid/ldap/sdk/ExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/ExtendedResult.java
    trunk/src/com/unboundid/ldap/sdk/FailoverServerSet.java
    trunk/src/com/unboundid/ldap/sdk/FastestConnectServerSet.java
    trunk/src/com/unboundid/ldap/sdk/FastestConnectThread.java
    trunk/src/com/unboundid/ldap/sdk/FewestConnectionsServerSet.java
    trunk/src/com/unboundid/ldap/sdk/Filter.java
    trunk/src/com/unboundid/ldap/sdk/FullLDAPInterface.java
    trunk/src/com/unboundid/ldap/sdk/GSSAPIBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/GSSAPIBindRequestProperties.java
    trunk/src/com/unboundid/ldap/sdk/GSSAPIChannelBindingType.java
    trunk/src/com/unboundid/ldap/sdk/GenericSASLBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/GetEntryLDAPConnectionPoolHealthCheck.java
    trunk/src/com/unboundid/ldap/sdk/IntermediateResponse.java
    trunk/src/com/unboundid/ldap/sdk/IntermediateResponseListener.java
    trunk/src/com/unboundid/ldap/sdk/InternalSDKHelper.java
    trunk/src/com/unboundid/ldap/sdk/JSONControlDecodeHelper.java
    trunk/src/com/unboundid/ldap/sdk/JSONLDAPConnectionLogger.java
    trunk/src/com/unboundid/ldap/sdk/JSONLDAPConnectionLoggerProperties.java
    trunk/src/com/unboundid/ldap/sdk/LDAPBindException.java
    trunk/src/com/unboundid/ldap/sdk/LDAPConnection.java
    trunk/src/com/unboundid/ldap/sdk/LDAPConnectionInfo.java
    trunk/src/com/unboundid/ldap/sdk/LDAPConnectionInternals.java
    trunk/src/com/unboundid/ldap/sdk/LDAPConnectionLogger.java
    trunk/src/com/unboundid/ldap/sdk/LDAPConnectionOptions.java
    trunk/src/com/unboundid/ldap/sdk/LDAPConnectionPool.java
    trunk/src/com/unboundid/ldap/sdk/LDAPConnectionPoolHealthCheck.java
    trunk/src/com/unboundid/ldap/sdk/LDAPConnectionPoolHealthCheckResult.java
    trunk/src/com/unboundid/ldap/sdk/LDAPConnectionPoolHealthCheckThread.java
    trunk/src/com/unboundid/ldap/sdk/LDAPConnectionPoolStatistics.java
    trunk/src/com/unboundid/ldap/sdk/LDAPConnectionReader.java
    trunk/src/com/unboundid/ldap/sdk/LDAPConnectionStatistics.java
    trunk/src/com/unboundid/ldap/sdk/LDAPEntrySource.java
    trunk/src/com/unboundid/ldap/sdk/LDAPException.java
    trunk/src/com/unboundid/ldap/sdk/LDAPExtendedOperationException.java
    trunk/src/com/unboundid/ldap/sdk/LDAPInterface.java
    trunk/src/com/unboundid/ldap/sdk/LDAPReadWriteConnectionPool.java
    trunk/src/com/unboundid/ldap/sdk/LDAPRequest.java
    trunk/src/com/unboundid/ldap/sdk/LDAPResult.java
    trunk/src/com/unboundid/ldap/sdk/LDAPRuntimeException.java
    trunk/src/com/unboundid/ldap/sdk/LDAPSearchException.java
    trunk/src/com/unboundid/ldap/sdk/LDAPThreadLocalConnectionPool.java
    trunk/src/com/unboundid/ldap/sdk/LDAPURL.java
    trunk/src/com/unboundid/ldap/sdk/MockableLDAPConnection.java
    trunk/src/com/unboundid/ldap/sdk/Modification.java
    trunk/src/com/unboundid/ldap/sdk/ModificationType.java
    trunk/src/com/unboundid/ldap/sdk/ModifyDNRequest.java
    trunk/src/com/unboundid/ldap/sdk/ModifyRequest.java
    trunk/src/com/unboundid/ldap/sdk/NameResolver.java
    trunk/src/com/unboundid/ldap/sdk/OAUTHBEARERBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/OAUTHBEARERBindRequestProperties.java
    trunk/src/com/unboundid/ldap/sdk/OAUTHBEARERBindResult.java
    trunk/src/com/unboundid/ldap/sdk/OperationType.java
    trunk/src/com/unboundid/ldap/sdk/PLAINBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/ParallelPoolCloser.java
    trunk/src/com/unboundid/ldap/sdk/ParallelPoolCloserTask.java
    trunk/src/com/unboundid/ldap/sdk/ParallelPoolConnector.java
    trunk/src/com/unboundid/ldap/sdk/ParallelPoolConnectorTask.java
    trunk/src/com/unboundid/ldap/sdk/PasswordExpirationLDAPConnectionPoolHealthCheck.java
    trunk/src/com/unboundid/ldap/sdk/PasswordProvider.java
    trunk/src/com/unboundid/ldap/sdk/PostConnectProcessor.java
    trunk/src/com/unboundid/ldap/sdk/PruneUnneededConnectionsLDAPConnectionPoolHealthCheck.java
    trunk/src/com/unboundid/ldap/sdk/RDN.java
    trunk/src/com/unboundid/ldap/sdk/RDNNameValuePair.java
    trunk/src/com/unboundid/ldap/sdk/ReadFromFilePasswordProvider.java
    trunk/src/com/unboundid/ldap/sdk/ReadOnlyAddRequest.java
    trunk/src/com/unboundid/ldap/sdk/ReadOnlyCompareRequest.java
    trunk/src/com/unboundid/ldap/sdk/ReadOnlyDeleteRequest.java
    trunk/src/com/unboundid/ldap/sdk/ReadOnlyEntry.java
    trunk/src/com/unboundid/ldap/sdk/ReadOnlyLDAPRequest.java
    trunk/src/com/unboundid/ldap/sdk/ReadOnlyModifyDNRequest.java
    trunk/src/com/unboundid/ldap/sdk/ReadOnlyModifyRequest.java
    trunk/src/com/unboundid/ldap/sdk/ReadOnlySearchRequest.java
    trunk/src/com/unboundid/ldap/sdk/ReferralConnector.java
    trunk/src/com/unboundid/ldap/sdk/ResponseAcceptor.java
    trunk/src/com/unboundid/ldap/sdk/ResultCode.java
    trunk/src/com/unboundid/ldap/sdk/RetainConnectExceptionReferralConnector.java
    trunk/src/com/unboundid/ldap/sdk/RootDSE.java
    trunk/src/com/unboundid/ldap/sdk/RoundRobinDNSServerSet.java
    trunk/src/com/unboundid/ldap/sdk/RoundRobinServerSet.java
    trunk/src/com/unboundid/ldap/sdk/SASLBindInProgressException.java
    trunk/src/com/unboundid/ldap/sdk/SASLBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/SASLClientBindHandler.java
    trunk/src/com/unboundid/ldap/sdk/SASLQualityOfProtection.java
    trunk/src/com/unboundid/ldap/sdk/SCRAMBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/SCRAMClientFinalMessage.java
    trunk/src/com/unboundid/ldap/sdk/SCRAMClientFirstMessage.java
    trunk/src/com/unboundid/ldap/sdk/SCRAMSHA1BindRequest.java
    trunk/src/com/unboundid/ldap/sdk/SCRAMSHA256BindRequest.java
    trunk/src/com/unboundid/ldap/sdk/SCRAMSHA512BindRequest.java
    trunk/src/com/unboundid/ldap/sdk/SCRAMServerFinalMessage.java
    trunk/src/com/unboundid/ldap/sdk/SCRAMServerFirstMessage.java
    trunk/src/com/unboundid/ldap/sdk/SRVRecord.java
    trunk/src/com/unboundid/ldap/sdk/SRVRecordPrioritySet.java
    trunk/src/com/unboundid/ldap/sdk/SRVRecordSet.java
    trunk/src/com/unboundid/ldap/sdk/SearchRequest.java
    trunk/src/com/unboundid/ldap/sdk/SearchResult.java
    trunk/src/com/unboundid/ldap/sdk/SearchResultEntry.java
    trunk/src/com/unboundid/ldap/sdk/SearchResultListener.java
    trunk/src/com/unboundid/ldap/sdk/SearchResultReference.java
    trunk/src/com/unboundid/ldap/sdk/SearchResultReferenceEntrySourceException.java
    trunk/src/com/unboundid/ldap/sdk/SearchScope.java
    trunk/src/com/unboundid/ldap/sdk/ServerSet.java
    trunk/src/com/unboundid/ldap/sdk/ServerSetBlacklistManager.java
    trunk/src/com/unboundid/ldap/sdk/ServerSetBlacklistManagerTimerTask.java
    trunk/src/com/unboundid/ldap/sdk/SimpleBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/SingleServerSet.java
    trunk/src/com/unboundid/ldap/sdk/StartTLSPostConnectProcessor.java
    trunk/src/com/unboundid/ldap/sdk/ToCodeArgHelper.java
    trunk/src/com/unboundid/ldap/sdk/ToCodeHelper.java
    trunk/src/com/unboundid/ldap/sdk/UnsolicitedNotificationHandler.java
    trunk/src/com/unboundid/ldap/sdk/UpdatableLDAPRequest.java
    trunk/src/com/unboundid/ldap/sdk/WriteTimeoutHandler.java
    trunk/src/com/unboundid/ldap/sdk/controls/AssertionRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/AuthorizationIdentityRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/AuthorizationIdentityResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/ContentSyncDoneControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/ContentSyncInfoIntermediateResponse.java
    trunk/src/com/unboundid/ldap/sdk/controls/ContentSyncInfoType.java
    trunk/src/com/unboundid/ldap/sdk/controls/ContentSyncRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/ContentSyncRequestMode.java
    trunk/src/com/unboundid/ldap/sdk/controls/ContentSyncState.java
    trunk/src/com/unboundid/ldap/sdk/controls/ContentSyncStateControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/ControlHelper.java
    trunk/src/com/unboundid/ldap/sdk/controls/DontUseCopyRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/DraftLDUPSubentriesRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/EntryChangeNotificationControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/ManageDsaITRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/MatchedValuesFilter.java
    trunk/src/com/unboundid/ldap/sdk/controls/MatchedValuesRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/PasswordExpiredControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/PasswordExpiringControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/PermissiveModifyRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/PersistentSearchChangeType.java
    trunk/src/com/unboundid/ldap/sdk/controls/PersistentSearchRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/PostReadRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/PostReadResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/PreReadRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/PreReadResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/ProxiedAuthorizationV1RequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/ProxiedAuthorizationV2RequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/RFC3672SubentriesRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/ServerSideSortRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/ServerSideSortResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/SimplePagedResultsControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/SortKey.java
    trunk/src/com/unboundid/ldap/sdk/controls/SubentriesRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/SubtreeDeleteRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/TransactionSpecificationRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/VirtualListViewRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/VirtualListViewResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/controls/package-info.java
    trunk/src/com/unboundid/ldap/sdk/examples/AuthRate.java
    trunk/src/com/unboundid/ldap/sdk/examples/AuthRateThread.java
    trunk/src/com/unboundid/ldap/sdk/examples/Base64Tool.java
    trunk/src/com/unboundid/ldap/sdk/examples/IdentifyReferencesToMissingEntries.java
    trunk/src/com/unboundid/ldap/sdk/examples/IdentifyUniqueAttributeConflicts.java
    trunk/src/com/unboundid/ldap/sdk/examples/IndentLDAPFilter.java
    trunk/src/com/unboundid/ldap/sdk/examples/LDAPCompare.java
    trunk/src/com/unboundid/ldap/sdk/examples/LDAPDebugger.java
    trunk/src/com/unboundid/ldap/sdk/examples/LDAPDebuggerShutdownListener.java
    trunk/src/com/unboundid/ldap/sdk/examples/LDAPModify.java
    trunk/src/com/unboundid/ldap/sdk/examples/LDAPSearch.java
    trunk/src/com/unboundid/ldap/sdk/examples/ModRate.java
    trunk/src/com/unboundid/ldap/sdk/examples/ModRateThread.java
    trunk/src/com/unboundid/ldap/sdk/examples/SearchAndModRate.java
    trunk/src/com/unboundid/ldap/sdk/examples/SearchAndModRateThread.java
    trunk/src/com/unboundid/ldap/sdk/examples/SearchRate.java
    trunk/src/com/unboundid/ldap/sdk/examples/SearchRateAsyncListener.java
    trunk/src/com/unboundid/ldap/sdk/examples/SearchRateThread.java
    trunk/src/com/unboundid/ldap/sdk/examples/TestLDAPSDKPerformance.java
    trunk/src/com/unboundid/ldap/sdk/examples/ValidateLDIF.java
    trunk/src/com/unboundid/ldap/sdk/examples/package-info.java
    trunk/src/com/unboundid/ldap/sdk/experimental/ActiveDirectoryDirSyncControl.java
    trunk/src/com/unboundid/ldap/sdk/experimental/ControlHelper.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftBeheraLDAPPasswordPolicy10ErrorType.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftBeheraLDAPPasswordPolicy10RequestControl.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftBeheraLDAPPasswordPolicy10ResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftBeheraLDAPPasswordPolicy10WarningType.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftChuLDAPLogSchema00AbandonEntry.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftChuLDAPLogSchema00AddEntry.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftChuLDAPLogSchema00BindEntry.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftChuLDAPLogSchema00CompareEntry.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftChuLDAPLogSchema00DeleteEntry.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftChuLDAPLogSchema00Entry.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftChuLDAPLogSchema00ExtendedEntry.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftChuLDAPLogSchema00ModifyDNEntry.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftChuLDAPLogSchema00ModifyEntry.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftChuLDAPLogSchema00SearchEntry.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftChuLDAPLogSchema00UnbindEntry.java
    trunk/src/com/unboundid/ldap/sdk/experimental/DraftZeilengaLDAPNoOp12RequestControl.java
    trunk/src/com/unboundid/ldap/sdk/experimental/package-info.java
    trunk/src/com/unboundid/ldap/sdk/extensions/AbortedTransactionExtendedResult.java
    trunk/src/com/unboundid/ldap/sdk/extensions/CancelExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/extensions/EndTransactionExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/extensions/EndTransactionExtendedResult.java
    trunk/src/com/unboundid/ldap/sdk/extensions/NoticeOfDisconnectionExtendedResult.java
    trunk/src/com/unboundid/ldap/sdk/extensions/PasswordModifyExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/extensions/PasswordModifyExtendedResult.java
    trunk/src/com/unboundid/ldap/sdk/extensions/StartTLSExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/extensions/StartTransactionExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/extensions/StartTransactionExtendedResult.java
    trunk/src/com/unboundid/ldap/sdk/extensions/WhoAmIExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/extensions/WhoAmIExtendedResult.java
    trunk/src/com/unboundid/ldap/sdk/extensions/package-info.java
    trunk/src/com/unboundid/ldap/sdk/migrate/jndi/JNDIConverter.java
    trunk/src/com/unboundid/ldap/sdk/migrate/jndi/JNDIExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/migrate/jndi/JNDIExtendedResponse.java
    trunk/src/com/unboundid/ldap/sdk/migrate/jndi/package-info.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/IterableEnumeration.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/JavaToLDAPSocketFactory.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPAttribute.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPAttributeSet.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPBind.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPConnection.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPConstraints.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPControl.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPDN.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPEntry.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPException.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPExtendedOperation.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPExtendedResponse.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPInterruptedException.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPModification.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPModificationSet.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPRebind.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPRebindAuth.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPReferralException.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPResponse.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPSearchConstraints.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPSearchResults.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPSocketFactory.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPToJavaSocketFactory.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/LDAPUrl.java
    trunk/src/com/unboundid/ldap/sdk/migrate/ldapjdk/package-info.java
    trunk/src/com/unboundid/ldap/sdk/package-info.java
    trunk/src/com/unboundid/ldap/sdk/persist/DefaultOIDAllocator.java
    trunk/src/com/unboundid/ldap/sdk/persist/DefaultObjectEncoder.java
    trunk/src/com/unboundid/ldap/sdk/persist/FieldInfo.java
    trunk/src/com/unboundid/ldap/sdk/persist/FilterUsage.java
    trunk/src/com/unboundid/ldap/sdk/persist/GenerateSchemaFromSource.java
    trunk/src/com/unboundid/ldap/sdk/persist/GenerateSourceFromSchema.java
    trunk/src/com/unboundid/ldap/sdk/persist/GetterInfo.java
    trunk/src/com/unboundid/ldap/sdk/persist/LDAPDNField.java
    trunk/src/com/unboundid/ldap/sdk/persist/LDAPEntryField.java
    trunk/src/com/unboundid/ldap/sdk/persist/LDAPField.java
    trunk/src/com/unboundid/ldap/sdk/persist/LDAPGetter.java
    trunk/src/com/unboundid/ldap/sdk/persist/LDAPObject.java
    trunk/src/com/unboundid/ldap/sdk/persist/LDAPObjectHandler.java
    trunk/src/com/unboundid/ldap/sdk/persist/LDAPPersistException.java
    trunk/src/com/unboundid/ldap/sdk/persist/LDAPPersister.java
    trunk/src/com/unboundid/ldap/sdk/persist/LDAPSetter.java
    trunk/src/com/unboundid/ldap/sdk/persist/OIDAllocator.java
    trunk/src/com/unboundid/ldap/sdk/persist/ObjectEncoder.java
    trunk/src/com/unboundid/ldap/sdk/persist/ObjectSearchListener.java
    trunk/src/com/unboundid/ldap/sdk/persist/PersistFilterType.java
    trunk/src/com/unboundid/ldap/sdk/persist/PersistUtils.java
    trunk/src/com/unboundid/ldap/sdk/persist/PersistedObjects.java
    trunk/src/com/unboundid/ldap/sdk/persist/SearchListenerBridge.java
    trunk/src/com/unboundid/ldap/sdk/persist/SetterInfo.java
    trunk/src/com/unboundid/ldap/sdk/persist/TypeInfo.java
    trunk/src/com/unboundid/ldap/sdk/persist/package-info.java
    trunk/src/com/unboundid/ldap/sdk/schema/AttributeSyntaxDefinition.java
    trunk/src/com/unboundid/ldap/sdk/schema/AttributeTypeDefinition.java
    trunk/src/com/unboundid/ldap/sdk/schema/AttributeUsage.java
    trunk/src/com/unboundid/ldap/sdk/schema/DITContentRuleDefinition.java
    trunk/src/com/unboundid/ldap/sdk/schema/DITStructureRuleDefinition.java
    trunk/src/com/unboundid/ldap/sdk/schema/EntryValidator.java
    trunk/src/com/unboundid/ldap/sdk/schema/MatchingRuleDefinition.java
    trunk/src/com/unboundid/ldap/sdk/schema/MatchingRuleUseDefinition.java
    trunk/src/com/unboundid/ldap/sdk/schema/NameFormDefinition.java
    trunk/src/com/unboundid/ldap/sdk/schema/ObjectClassDefinition.java
    trunk/src/com/unboundid/ldap/sdk/schema/ObjectClassType.java
    trunk/src/com/unboundid/ldap/sdk/schema/Schema.java
    trunk/src/com/unboundid/ldap/sdk/schema/SchemaElement.java
    trunk/src/com/unboundid/ldap/sdk/schema/SchemaElementType.java
    trunk/src/com/unboundid/ldap/sdk/schema/SchemaValidator.java
    trunk/src/com/unboundid/ldap/sdk/schema/ValidateLDAPSchema.java
    trunk/src/com/unboundid/ldap/sdk/schema/package-info.java
    trunk/src/com/unboundid/ldap/sdk/transformations/AddAttributeTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/EntryTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/ExcludeAllEntriesTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/ExcludeAttributeTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/ExcludeChangeTypeTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/ExcludeEntryTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/FlattenSubtreeTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/LDIFChangeRecordTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/MoveSubtreeTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/PreEncodedLDIFEntry.java
    trunk/src/com/unboundid/ldap/sdk/transformations/RedactAttributeTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/RenameAttributeTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/ReplaceAttributeTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/ReplaceWithCounterTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/ScrambleAttributeTransformation.java
    trunk/src/com/unboundid/ldap/sdk/transformations/TransformLDIF.java
    trunk/src/com/unboundid/ldap/sdk/transformations/package-info.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/AES256EncodedPassword.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/AES256EncodedPasswordSecretKey.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/AlarmEntry.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/AlarmSeverity.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/AlertEntry.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/AlertSeverity.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/ChangeLogEntryAttributeExceededMaxValuesCount.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/ChangeLogEntryAttributeExceededMaxValuesException.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/DeliverOneTimePassword.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/DeliverPasswordResetToken.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/LDAPConnectionHandlerConfiguration.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/Launcher.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/ModifiablePasswordPolicyStateJSON.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/ModifiablePasswordPolicyStateJSONBuilder.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/ModifiablePasswordPolicyStateJSONField.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/MoveSubtree.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/MoveSubtreeAccessibilitySearchListener.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/MoveSubtreeListener.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/MoveSubtreeResult.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/MoveSubtreeTxnSearchListener.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/OneTimePassword.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/PasswordPolicyStateJSON.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/PasswordPolicyStateJSONField.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/RegisterYubiKeyOTPDevice.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/ReusableTOTPBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/SingleUseTOTPBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/SoftDeletedEntry.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/TopologyRegistryTrustManager.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/TopologyRegistryTrustManagerProperties.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/UnboundIDCertificatePlusPasswordBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/UnboundIDChangeLogEntry.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/UnboundIDDeliveredOTPBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/UnboundIDExternallyProcessedAuthenticationBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/UnboundIDRootDSE.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/UnboundIDTOTPBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/UnboundIDYubiKeyOTPBindRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/AccountUsableRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/AccountUsableResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/AdministrativeOperationRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/AssuredReplicationLocalLevel.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/AssuredReplicationRemoteLevel.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/AssuredReplicationRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/AssuredReplicationResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/AssuredReplicationServerResult.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/AssuredReplicationServerResultCode.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/AttributeRight.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/AuthenticationFailureReason.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/BatchedTransactionSpecificationRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/ControlHelper.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/EffectiveRightsEntry.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/EntryRight.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/ExcludeBranchRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/ExtendedSchemaInfoRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GeneratePasswordRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GeneratePasswordResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GetAuthorizationEntryRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GetAuthorizationEntryResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GetBackendSetIDRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GetBackendSetIDResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GetEffectiveRightsRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GetPasswordPolicyStateIssuesRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GetPasswordPolicyStateIssuesResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GetRecentLoginHistoryRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GetRecentLoginHistoryResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GetServerIDRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GetServerIDResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GetUserResourceLimitsRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/GetUserResourceLimitsResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/HardDeleteRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/IgnoreNoUserModificationRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/InteractiveTransactionSpecificationRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/InteractiveTransactionSpecificationResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/IntermediateClientRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/IntermediateClientRequestValue.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/IntermediateClientResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/IntermediateClientResponseValue.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/JSONFormattedControlDecodeBehavior.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/JSONFormattedRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/JSONFormattedResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/JoinBaseDN.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/JoinRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/JoinRequestValue.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/JoinResultControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/JoinRule.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/JoinedEntry.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/MatchingEntryCountRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/MatchingEntryCountRequestControlProperties.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/MatchingEntryCountResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/MatchingEntryCountType.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/NameWithEntryUUIDRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/NoOpRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/OperationPurposeRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/OverrideSearchLimitsRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/PasswordPolicyErrorType.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/PasswordPolicyRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/PasswordPolicyResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/PasswordPolicyWarningType.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/PasswordQualityRequirementValidationResult.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/PasswordUpdateBehaviorRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/PasswordUpdateBehaviorRequestControlProperties.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/PasswordValidationDetailsRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/PasswordValidationDetailsResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/PasswordValidationDetailsResponseType.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/PermitUnindexedSearchRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/PurgePasswordRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/RealAttributesOnlyRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/RecentLoginHistory.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/RecentLoginHistoryAttempt.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/RejectUnindexedSearchRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/ReplicationRepairRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/RetainIdentityRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/RetirePasswordRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/ReturnConflictEntriesRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/RouteToBackendSetRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/RouteToBackendSetRoutingType.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/RouteToServerRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/SoftDeleteRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/SoftDeleteResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/SoftDeletedEntryAccessRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/SuppressOperationalAttributeUpdateRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/SuppressReferentialIntegrityUpdatesRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/SuppressType.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/TransactionSettingsBackendLockBehavior.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/TransactionSettingsCommitDurability.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/TransactionSettingsRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/TransactionSettingsResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/UndeleteRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/UniquenessMultipleAttributeBehavior.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/UniquenessRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/UniquenessRequestControlProperties.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/UniquenessResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/UniquenessValidationLevel.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/UniquenessValidationResult.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/UnsolicitedCancelResponseControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/VirtualAttributesOnlyRequestControl.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/controls/package-info.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/examples/DumpDNs.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/examples/FilterComparator.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/examples/GenericFilter.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/examples/SubtreeAccessibility.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/examples/SummarizeAccessLog.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/examples/package-info.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/AllAttributesChangeSelectionCriteria.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/AnyAttributesChangeSelectionCriteria.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/BeginningOfChangelogStartingPoint.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContent.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/ChangeTimeStartingPoint.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/ChangelogBatchChangeSelectionCriteria.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/ChangelogBatchStartingPoint.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/ChangelogEntryIntermediateResponse.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/ChangelogEntryListener.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/ClearMissedNotificationChangesAlarmExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CollectSupportDataArchiveFragmentIntermediateResponse.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CollectSupportDataExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CollectSupportDataExtendedRequestProperties.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CollectSupportDataExtendedResult.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CollectSupportDataIntermediateResponseListener.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CollectSupportDataLogCaptureWindow.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CollectSupportDataOutputIntermediateResponse.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CollectSupportDataOutputStream.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/ConsumeSingleUseTokenExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/DefaultChangelogEntryListener.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/DeleteNotificationDestinationExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/DeleteNotificationSubscriptionExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/DeliverOneTimePasswordExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/DeliverOneTimePasswordExtendedResult.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/DeliverPasswordResetTokenExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/DeliverPasswordResetTokenExtendedResult.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/DeliverSingleUseTokenExtendedRequest.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/DeliverSingleUseTokenExtendedResult.java
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/DeregisterYubiKeyOTPDeviceExtendedRequ...
 
[truncated message content]

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1580] trunk

[<di...@us...>]

Revision: 1580
          http://sourceforge.net/p/ldap-sdk/code/1580
Author:   dirmgr
Date:     2022-12-09 21:21:56 +0000 (Fri, 09 Dec 2022)
Log Message:
-----------
Add support for encrypted PKCS #8 private keys

Added support for encrypted PKCS #8 private keys.  Private keys can
now be formatted in encrypted PEM when provided with an encryption
password and a set of encryption properties, and the PKCS #8 PEM
file reader can read encrypted private keys when provided with the
encryption password.  The manage-certificates export-private-key
command has been updated to support writing an encrypted
representation of the private key in either PEM or DER form, and
manage-certificates import-certificate has been updated to support
obtaining the private key when it is encrypted form.

Modified Paths:
--------------
    trunk/docs/release-notes.html
    trunk/messages/unboundid-ldapsdk-cert.properties
    trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContent.java
    trunk/src/com/unboundid/util/ssl/PEMFileKeyManager.java
    trunk/src/com/unboundid/util/ssl/cert/ManageCertificates.java
    trunk/src/com/unboundid/util/ssl/cert/PKCS8PEMFileReader.java
    trunk/src/com/unboundid/util/ssl/cert/PKCS8PrivateKey.java
    trunk/tests/unit/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContentTestCase.java
    trunk/tests/unit/src/com/unboundid/util/ssl/cert/ManageCertificatesTestCase.java

Added Paths:
-----------
    trunk/src/com/unboundid/util/ssl/cert/PKCS5AlgorithmIdentifier.java
    trunk/src/com/unboundid/util/ssl/cert/PKCS8EncryptionHandler.java
    trunk/src/com/unboundid/util/ssl/cert/PKCS8EncryptionProperties.java
    trunk/tests/unit/src/com/unboundid/util/ssl/cert/PKCS5AlgorithmIdentifierTestCase.java
    trunk/tests/unit/src/com/unboundid/util/ssl/cert/PKCS8EncryptionHandlerTestCase.java
    trunk/tests/unit/src/com/unboundid/util/ssl/cert/PKCS8EncryptionPropertiesTestCase.java

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2022-12-08 17:49:08 UTC (rev 1579)
+++ trunk/docs/release-notes.html	2022-12-09 21:21:56 UTC (rev 1580)
@@ -6,6 +6,30 @@
 
               <h2>Release Notes</h2>
 
+              <h3>Version 6.0.8</h3>
+
+              <p>
+                The following changes were made between the 6.0.7 and 6.0.8 releases:
+              </p>
+
+              <ul>
+                <li>
+                  Added support for encrypted PKCS #8 private keys.  Private keys can now be
+                  formatted in encrypted PEM when provided with an encryption password and a set
+                  of encryption properties, and the PKCS #8 PEM file reader can read encrypted
+                  private keys when provided with the encryption password.  The
+                  manage-certificates export-private-key command has been updated to support
+                  writing an encrypted representation of the private key in either PEM or DER
+                  form, and manage-certificates import-certificate has been updated to support
+                  obtaining the private key when it is encrypted form.
+                  <br><br>
+                </li>
+              </ul>
+
+              <p></p>
+
+
+
               <h3>Version 6.0.7</h3>
 
               <p>

Modified: trunk/messages/unboundid-ldapsdk-cert.properties
===================================================================
--- trunk/messages/unboundid-ldapsdk-cert.properties	2022-12-08 17:49:08 UTC (rev 1579)
+++ trunk/messages/unboundid-ldapsdk-cert.properties	2022-12-09 21:21:56 UTC (rev 1580)
@@ -545,6 +545,23 @@
   optional when using the PEM format, but required when using the DER \
   format.  If no output file is provided, then the exported private key will \
   be written to standard output.
+INFO_MANAGE_CERTS_SC_EXPIRT_KEY_ARG_ENC_PW_DESC=The password to use to encrypt \
+  the exported private key.  At most one of the --encryption-password, \
+  --encryption-password-file, and --prompt-for-encryption-password arguments \
+  may be provided.  If none of those arguments is provided, then the private \
+  key will not be encrypted.
+INFO_MANAGE_CERTS_SC_EXPORT_KEY_ARG_ENC_PW_FILE_DESC=The path to a file \
+  containing the password to use to encrypt the exported private key.  If \
+  provided, the file must exist, must contain only one line, and that line \
+  must consist only of the clear-text encryption password.  At most one of the \
+  --encryption-password, --encryption-password-file, and \
+  --prompt-for-encryption-password arguments may be provided.  If none of \
+  those arguments is provided, then the private key will not be encrypted.
+INFO_MANAGE_CERTS_SC_EXPORT_KEY_ARG_PROMPT_FOR_ENC_PW=Interactively prompt for \
+  the password to use to encrypt the exported private key.  At most one of the \
+  --encryption-password, --encryption-password-file, and \
+  --prompt-for-encryption-password arguments may be provided.  If none of \
+  those arguments is provided, then the private key will not be encrypted.
 INFO_MANAGE_CERTS_SC_EXPORT_KEY_EXAMPLE_1=Export the private key for the \
   ''server-cert'' certificate to standard output in PEM format.
 INFO_MANAGE_CERTS_SC_EXPORT_KEY_EXAMPLE_2=Export the private key for the \
@@ -670,6 +687,25 @@
   password that does not match the key store password, then one of the \
   --private-key-password, --private-key-password-file, or \
   --prompt-for-private-key-password arguments should be provided.
+INFO_MANAGE_CERTS_SC_IMPORT_CERT_ARG_ENC_PW_DESC=The password used to encrypt \
+  the private key being imported.  At most one of the --encryption-password, \
+  --encryption-password-file, and --prompt-for-encryption-password arguments \
+  may be provided.  If none of those arguments is provided, then it will be \
+  assumed that the private key is not encrypted.
+INFO_MANAGE_CERTS_SC_IMPORT_CERT_ARG_ENC_PW_FILE_DESC=The path to a file \
+  containing the password used to encrypt the private key being imported.  If \
+  provided, the file must exist, must contain only one line, and that line \
+  must consist only of the clear-text encryption password.  At most one of the \
+  --encryption-password, --encryption-password-file, and \
+  --prompt-for-encryption-password arguments may be provided.  If none of \
+  those arguments is provided, then it will be assumed that the private key is \
+  not encrypted.
+INFO_MANAGE_CERTS_SC_IMPORT_CERT_ARG_PROMPT_FOR_ENC_PW_DESC=Interactively \
+  prompt for the password used to encrypt the private key being imported.  At \
+  most one of the --encryption-password, --encryption-password-file, and \
+  --prompt-for-encryption-password arguments may be provided.  If none of \
+  those arguments is provided, then it will be assumed that the private key is \
+  not encrypted.
 INFO_MANAGE_CERTS_SC_IMPORT_CERT_ARG_NO_PROMPT_DESC=Import the certificates \
   without prompting the end user.  By default, the certificates will be \
   displayed and the user will be interactively prompted about whether to \
@@ -2624,6 +2660,17 @@
 INFO_MANAGE_CERTS_KEY_KS_PW_NEW_PROMPT_2=Confirm the key store password:
 ERR_MANAGE_CERTS_KEY_KS_PW_PROMPT_MISMATCH=ERROR:  The provided passwords do \
   not match.
+ERR_MANAGE_CERTS_GET_PK_ENC_PW_ERROR_READING_FILE=ERROR:  An error occurred \
+  while attempting to read the private key encryption password from file \
+  ''{0}'':  {1}
+INFO_MANAGE_CERTS_GET_PK_ENC_PW_PROMPT_DECRYPT=Enter the password used to \
+  encrypt the private key:
+INFO_MANAGE_CERTS_GET_PK_ENC_PW_PROMPT_ENCRYPT_1=Enter the password to use to \
+  encrypt the private key:
+INFO_MANAGE_CERTS_GET_PK_ENC_PW_PROMPT_ENCRYPT_2=Confirm the private key \
+  encryption password:
+INFO_MANAGE_CERTS_GET_PK_ENC_PW_PROMPT_MISMATCH=ERROR:  The private key \
+  encryption passwords do not match.
 ERR_MANAGE_CERTS_PROMPT_FOR_PW_EMPTY_PW=ERROR:  The password must not be empty.
 ERR_MANAGE_CERTS_PROMPT_FOR_YES_NO_INVALID_RESPONSE=ERROR:  Your response \
   must be either ''yes'' or ''no''.
@@ -2718,6 +2765,11 @@
   PEM-encoded private key from file ''{0}'' because the file contains \
   multiple ''BEGIN PRIVATE KEY'' headers.  A private key file may only \
   contain a single private key.
+ERR_MANAGE_CERTS_READ_PK_FROM_FILE_PK_ENCRYPTED_NO_PW=ERROR:  File ''{0}'' \
+  appears to contain the PEM representation of an encrypted private key, but \
+  no encryption password was provided.  Use one of the --encryption-password, \
+  --encryption-password-file, or --prompt-for-encryption-password arguments to \
+  specify the encryption password.
 ERR_MANAGE_CERTS_READ_PK_FROM_FILE_END_WITHOUT_BEGIN=ERROR:  Unable to read \
   a PEM-encoded private key from file ''{0}'' because the file contains an \
   ''END PRIVATE KEY'' footer without a corresponding ''BEGIN PRIVATE KEY'' \
@@ -2917,6 +2969,9 @@
 ERR_PKCS8_PEM_READER_REPEATED_BEGIN=Unable to read a PEM-encoded PKCS #8 \
   private key because an unexpected ''{0}'' header was found after having \
   already begun the process of decoding a private key.
+ERR_PKCS8_PEM_READER_NO_PW_FOR_ENCRYPTED_KEY=Unable to read a PEM-encoded \
+  PKCS #8 private key because the private key is encrypted but no encryption \
+  password was provided.
 ERR_PKCS8_PEM_READER_END_WITHOUT_BEGIN=Unable to read a PEM-encoded PKCS #8 \
   private key because an unexpected ''{0}'' footer was found without a \
   preceding ''{1}'' header.
@@ -2928,3 +2983,99 @@
 ERR_PKCS8_PEM_READER_DATA_WITHOUT_BEGIN=Unable to read a PEM-encoded PKCS #8 \
   private key because unexpected data was found before encountering a \
   ''{0}'' header.
+INFO_PKCS5_ALG_ID_DESC_PBES2=The PBES2 encryption scheme
+INFO_PKCS5_ALG_ID_DESC_PBKDF2=The PBKDF2 key derivation function
+INFO_PKCS5_ALG_ID_DESC_HMAC_SHA_1=The HMAC-SHA-1 pseudorandom function
+INFO_PKCS5_ALG_ID_DESC_HMAC_SHA_224=The HMAC-SHA-224 pseudorandom function
+INFO_PKCS5_ALG_ID_DESC_HMAC_SHA_256=The HMAC-SHA-256 pseudorandom function
+INFO_PKCS5_ALG_ID_DESC_HMAC_SHA_384=The HMAC-SHA-384 pseudorandom function
+INFO_PKCS5_ALG_ID_DESC_HMAC_SHA_512=The HMAC-SHA-512 pseudorandom function
+INFO_PKCS5_ALG_ID_DESC_DES_EDE_CBC_PAD=The DESede/CBC/PKCS5Padding cipher \
+  transformation
+INFO_PKCS5_ALG_ID_DESC_AES_128_CBC_PAD=The 128-bit AES/CBC/PKCS5Padding \
+  cipher transformation
+INFO_PKCS5_ALG_ID_DESC_AES_192_CBC_PAD=The 192-bit AES/CBC/PKCS5Padding \
+  cipher transformation
+INFO_PKCS5_ALG_ID_DESC_AES_256_CBC_PAD=The 256-bit AES/CBC/PKCS5Padding \
+  cipher transformation
+ERR_PKCS8_ENC_HANDLER_CANNOT_PARSE_AS_ENC_KEY_SEQUENCE=Unable to decode an \
+  encrypted PKCS #8 private key because the encrypted key bytes cannot be \
+  parsed as a valid DER sequence.
+ERR_PKCS8_ENC_HANDLER_SEQUENCE_UNEXPECTED_ENC_KEY_ELEMENT_COUNT=Unable to \
+  decode an encrypted PKCS #8 private key because the encrypted key sequence \
+  did not contain the expected 2 elements (intended to represent the \
+  encryption scheme algorithm identifier and the encrypted key data).  The \
+  number of elements in the sequence was {0,number,0}.
+ERR_PKCS8_ENC_HANDLER_KEY_SCHEME_ELEMENT_NOT_SEQUENCE=Unable to decode an \
+  encrypted PKCS #8 private key because the first element of the encrypted \
+  key sequence could not be parsed as a sequence (intended to hold the \
+  encryption scheme algorithm identifier).
+ERR_PKCS8_ENC_HANDLER_SEQUENCE_UNEXPECTED_KEY_SCHEME_ELEMENT_COUNT=Unable to \
+  decode an encrypted PKCS #8 private key because the encryption scheme \
+  sequence did not contain the expected 2 elements (intended to represent \
+  the encryption scheme OID and parameters).  The number of elements in the \
+  sequence was {0,number,0}.
+ERR_PKCS8_ENC_HANDLER_CANNOT_PARSE_KEY_SCHEME_OID=Unable to decode an \
+  encrypted PKCS #8 private key because the first element of the encryption \
+  scheme sequence could not be parsed as an OID intended to identify the \
+  encryption scheme algorithm.
+ERR_PKCS8_ENC_HANDLER_ENC_SCHEME_NOT_PBES2=Unable to decode an encrypted \
+  PKCS #8 private key because it used an unsupported encryption scheme \
+  algorithm with OID ''{0}''.  Only the PBES2 encryption scheme is supported.
+ERR_PKCS8_ENC_HANDLER_PBES2_PARAMS_NOT_SEQUENCE=Unable to decode an encrypted \
+  PKCS #8 private key because the PBES2 algorithm parameters could not be \
+  parsed as a sequence (intended to hold the algorithm identifiers for the \
+  key derivation function and encryption algorithm).
+ERR_PKCS8_ENC_HANDLER_PBES2_UNEXPECTED_PARAMS_SEQUENCE_ELEMENT_COUNT=Unable \
+  to decode an encrypted PKCS #8 private key because the PBES2 algorithm \
+  parameters sequence did not contain the expected 2 elements (intended to \
+  represent the algorithm identifiers for the key derivation function and \
+  encryption algorithm).  The number of elements in the sequence was \
+  {0,number,0}.
+ERR_PKCS8_ENC_HANDLER_UNSUPPORTED_KDF=Unable to decode an encrypted PKCS #8 \
+  private key because the PBES2 algorithm parameters sequence indicated that \
+  it uses an unsupported key derivation function with OID ''{0}''.  Only the \
+  PKBDF2 key derivation function is supported.
+ERR_PKCS8_ENC_HANDLER_UNSUPPORTED_PBKDF2_PRF=Unable to decode an encrypted \
+  PKCS #8 private key because the PBKDF2 key derivation function uses an \
+  unsupported pseudorandom function with oid ''{0}''.
+ERR_PKCS8_ENC_HANDLER_CANNOT_DECODE_KDF_SETTINGS=Unable to decode an \
+  encrypted PKCS #8 private key because an unexpected error occurred while \
+  attempting to decode the key derivation function settings:  {0}
+ERR_PKCS8_ENC_HANDLER_UNSUPPORTED_CIPHER=Unable to decode an encrypted PKCS \
+  #8 private key because the PBES2 algorithm parameters sequence indicated \
+  that it uses an unsupported cipher transformation with OID ''{0}''.
+ERR_PKCS8_ENC_HANDLER_CANNOT_DECODE_CIPHER_SETTINGS=Unable to decode an \
+  encrypted PKCS #8 private key because an unexpected error occurred while \
+  attempting to decode the encryption cipher settings:  {0}
+ERR_PKCS8_ENC_HANDLER_CANNOT_CREATE_DEC_SECRET_KEY=Unable to decode an \
+  encrypted PKCS #8 private key because an error occurred while attempting to \
+  create the secret key using the ''{0}'' algorithm with the provided \
+  password:  {1}
+ERR_PKCS8_ENC_HANDLER_CANNOT_CREATE_DEC_CIPHER=Unable to decode an encrypted \
+  PKCS #8 private key because an error occurred while attempting to create a \
+  cipher using the ''{0}'' cipher transformation:  {1}
+ERR_PKCS8_ENC_HANDLER_CANNOT_DECRYPT_KEY=Unable to decode an encrypted \
+  PKCS #8 private key because an error occurred while attempting to decrypt \
+  the encrypted key data using the ''{0}'' cipher transformation:  {1}
+ERR_PKCS8_ENC_HANDLER_CANNOT_PARSE_DECRYPTED_KEY=Unable to decode an \
+  encrypted PKCS #8 private key because although the encrypted key data was \
+  successfully decrypted using the ''{0}'' cipher transformation, the \
+  decrypted key could not be parsed as a valid PKCS #8 secret key:  {1}
+ERR_PKCS8_ENC_PROPS_INVALID_KEY_FACTORY_PRF_ALG=Unable to use {0} ({1}) as a \
+  key factory pseudorandom function because that identifier does not \
+  represent a supported pseudorandom function.
+ERR_PKCS8_ENC_PROPS_INVALID_CIPHER_TRANSFORMATION_ALG=Unable to use {0} ({1}) \
+  as a cipher transformation because that identifier does not represent a \
+  supported cipher transformation.
+ERR_PKCS8_ENC_HANDLER_CANNOT_CREATE_ENC_SECRET_KEY=Unable to encrypt the \
+  provided PKCS #8 private key because an error occurred while attempting to \
+  create the secret key using the ''{0}'' algorithm with the provided \
+  password:  {1}
+ERR_PKCS8_ENC_HANDLER_CANNOT_CREATE_ENC_CIPHER=Unable to encrypt the provided \
+  PKCS #8 private key because an error occurred while attempting to create a \
+  cipher using the ''{0}'' cipher transformation:  {1}
+ERR_PKCS8_ENC_HANDLER_CANNOT_ENCRYPT_PRIVATE_KEY=Unable to encrypt the \
+  provided PKCS #8 private key using the ''{0}'' cipher transformation:  {1}
+ERR_PKCS8_ENC_HANDLER_CANNOT_ENCODE_ENC_PRIVATE_KEY=Unable to encode the \
+  encrypted PKCS #8 private key:  {0}

Modified: trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContent.java
===================================================================
--- trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContent.java	2022-12-08 17:49:08 UTC (rev 1579)
+++ trunk/src/com/unboundid/ldap/sdk/unboundidds/extensions/CertificateDataReplaceCertificateKeyStoreContent.java	2022-12-09 21:21:56 UTC (rev 1580)
@@ -189,7 +189,8 @@
    *                                This may be {@code null} if the new
    *                                end-entity certificate uses the same private
    *                                key as the certificate currently in use in
-   *                                the server.
+   *                                the server.  The private key must not be
+   *                                encrypted.
    *
    * @throws  LDAPException  If a problem occurs while trying to read or parse
    *                         data contained in any of the provided files.
@@ -206,6 +207,48 @@
 
 
   /**
+   * Creates a new instance of this key store content object with the provided
+   * information.
+   *
+   * @param  certificateChainFiles  A list containing one or more files from
+   *                                which to read the PEM or DER representations
+   *                                of the X.509 certificates to include in
+   *                                the new certificate chain.  The order of
+   *                                the files, and the order of the certificates
+   *                                in each file, should be arranged such that
+   *                                the first certificate read is the end-entity
+   *                                certificate and each subsequent certificate
+   *                                is the issuer for the previous.  This must
+   *                                not be {@code null} or empty.
+   * @param  privateKeyFile         A file from which to read the PEM or DER
+   *                                representation of the PKCS #8 private key
+   *                                for the end-entity certificate in the chain.
+   *                                This may be {@code null} if the new
+   *                                end-entity certificate uses the same private
+   *                                key as the certificate currently in use in
+   *                                the server.
+   * @param  privateKeyEncryptionPassword
+   *              The password needed to decrypt the private key if it is
+   *              encrypted.  This may be {@code null} if the private key is not
+   *              encrypted.
+   *
+   * @throws  LDAPException  If a problem occurs while trying to read or parse
+   *                         data contained in any of the provided files.
+   */
+  public CertificateDataReplaceCertificateKeyStoreContent(
+              @NotNull final List<File> certificateChainFiles,
+              @Nullable final File privateKeyFile,
+              @Nullable final char[] privateKeyEncryptionPassword)
+         throws LDAPException
+  {
+    this(readCertificateChain(certificateChainFiles),
+         ((privateKeyFile == null) ? null :
+              readPrivateKey(privateKeyFile, privateKeyEncryptionPassword)));
+  }
+
+
+
+  /**
    * Reads a certificate chain from the given file or set of files.  Each file
    * must contain the PEM or DER representations of one or more X.509
    * certificates.  If a file contains multiple certificates, all certificates
@@ -446,6 +489,32 @@
   public static byte[] readPrivateKey(@NotNull final File file)
          throws LDAPException
   {
+    return readPrivateKey(file, null);
+  }
+
+
+
+  /**
+   * Reads a PKCS #8 private key from the given file.  The file must contain the
+   * PEM or DER representation of a single private key.
+   *
+   * @param  file                The file from which the private key should be
+   *                             read.  It must not be {@code null}.
+   * @param  encryptionPassword  The password needed to decrypt the private key
+   *                             if it is encrypted.  It may be {@code null} if
+   *                             the private key is not encrypted.
+   *
+   * @return  The encoded representation of the PKCS #8 private key that was
+   *          read.
+   *
+   * @throws  LDAPException  If a problem occurs while trying to read from
+   *                         or parse the content of the specified file.
+   */
+  @NotNull()
+  public static byte[] readPrivateKey(@NotNull final File file,
+                                      @Nullable final char[] encryptionPassword)
+         throws LDAPException
+  {
     Validator.ensureNotNull(file,
          "CertificateDataReplaceCertificateKeyStoreContent." +
               "readPrivateKey.file must not be null.");
@@ -477,7 +546,7 @@
 
 
       // Assume that the file is PEM-formatted.
-      return readPEMPrivateKey(file, bis);
+      return readPEMPrivateKey(file, bis, encryptionPassword);
     }
     catch (final IOException e)
     {
@@ -540,10 +609,13 @@
   /**
    * Reads a PEM-formatted PKCS #8 private key from the provided input stream.
    *
-   * @param  file         The file with which the provided input stream is
-   *                      associated.  It must not be {@code null}.
-   * @param  inputStream  The input stream from which the private key will be
-   *                      read.  It must not be {@code null}.
+   * @param  file                The file with which the provided input stream
+   *                             is associated.  It must not be {@code null}.
+   * @param  inputStream         The input stream from which the private key
+   *                             will be read.  It must not be {@code null}.
+   * @param  encryptionPassword  The password needed to decrypt the private key
+   *                             if it is encrypted.  It may be {@code null} if
+   *                             the private key is not encrypted.
    *
    * @return  The bytes that comprise the encoded PKCS #8 private key.
    *
@@ -556,13 +628,14 @@
   @NotNull()
   private static byte[] readPEMPrivateKey(
                @NotNull final File file,
-               @NotNull final InputStream inputStream)
+               @NotNull final InputStream inputStream,
+               @Nullable final char[] encryptionPassword)
           throws IOException, LDAPException
   {
     try (PKCS8PEMFileReader pemReader = new PKCS8PEMFileReader(inputStream))
     {
       final PKCS8PrivateKey privateKey = pemReader.readPrivateKey();
-      if (pemReader.readPrivateKey() != null)
+      if (pemReader.readPrivateKey(encryptionPassword) != null)
       {
         throw new LDAPException(ResultCode.DECODING_ERROR,
              ERR_CD_KSC_DECODE_MULTIPLE_PEM_KEYS_IN_FILE.get(

Modified: trunk/src/com/unboundid/util/ssl/PEMFileKeyManager.java
===================================================================
--- trunk/src/com/unboundid/util/ssl/PEMFileKeyManager.java	2022-12-08 17:49:08 UTC (rev 1579)
+++ trunk/src/com/unboundid/util/ssl/PEMFileKeyManager.java	2022-12-09 21:21:56 UTC (rev 1580)
@@ -114,28 +114,24 @@
   /**
    * Creates a new instance of this key manager with the provided PEM files.
    *
-   * @param  certificateChainPEMFile  The file containing the PEM-formatted
-   *                                  X.509 representations of the certificates
-   *                                  in the certificate chain.  This must not
-   *                                  be {@code null}, the file must exist, and
-   *                                  it must contain at least one certificate
-   *                                  (the end entity certificate), but may
-   *                                  contain additional certificates as needed
-   *                                  for the complete certificate chain.
-   *                                  Certificates should be ordered such that
-   *                                  the first certificate must be the end
-   *                                  entity certificate, and each subsequent
-   *                                  certificate must be the issuer for the
-   *                                  previous certificate.  The chain does not
-   *                                  need to be complete as long as the peer
-   *                                  may be expected to have prior knowledge of
-   *                                  any missing issuer certificates.
-   * @param  privateKeyPEMFile        The file containing the PEM-formatted
-   *                                  PKCS #8 representation of the private key
-   *                                  for the end entity certificate.  This must
-   *                                  not be {@code null}, the file must exist,
-   *                                  and it must contain exactly one
-   *                                  PEM-encoded private key.
+   * @param  certificateChainPEMFile
+   *              The file containing the PEM-formatted X.509 representations of
+   *              the certificates in the certificate chain.  This must not be
+   *              {@code null}, the file must exist, and it must contain at
+   *              least one certificate (the end entity certificate), but may
+   *              contain additional certificates as needed for the complete
+   *              certificate chain.  Certificates should be ordered such that
+   *              the first certificate must be the end entity certificate, and
+   *              each subsequent certificate must be the issuer for the
+   *              previous certificate.  The chain does not need to be complete
+   *              as long as the peer may be expected to have prior knowledge of
+   *              any missing issuer certificates.
+   * @param  privateKeyPEMFile
+   *              The file containing the PEM-formatted PKCS #8 representation
+   *              of the private key for the end entity certificate.  This must
+   *              not be {@code null}, the file must exist, and it must contain
+   *              exactly one PEM-encoded private key.  The private key must not
+   *              be encrypted.
    *
    * @throws  KeyStoreException  If there is a problem with any of the provided
    *                             PEM files.
@@ -152,31 +148,67 @@
   /**
    * Creates a new instance of this key manager with the provided PEM files.
    *
-   * @param  certificateChainPEMFiles  The files containing the PEM-formatted
-   *                                   X.509 representations of the certificates
-   *                                   in the certificate chain.  This must not
-   *                                   be {@code null} or empty.  Each file must
-   *                                   exist and must contain at least one
-   *                                   certificate.  The files will be processed
-   *                                   in the order in which they are provided.
-   *                                   The first certificate in the first file
-   *                                   must be the end entity certificate, and
-   *                                   each subsequent certificate must be the
-   *                                   issuer for the previous certificate.  The
-   *                                   chain does not need to be complete as
-   *                                   long as the peer may be expected to have
-   *                                   prior knowledge of any missing issuer
-   *                                   certificates.
-   * @param  privateKeyPEMFile         The file containing the PEM-formatted
-   *                                   PKCS #8 representation of the private key
-   *                                   for the end entity certificate.  This
-   *                                   must not be {@code null}, the file must
-   *                                   exist, and it must contain exactly one
-   *                                   PEM-encoded private key.
+   * @param  certificateChainPEMFile
+   *              The file containing the PEM-formatted X.509 representations of
+   *              the certificates in the certificate chain.  This must not be
+   *              {@code null}, the file must exist, and it must contain at
+   *              least one certificate (the end entity certificate), but may
+   *              contain additional certificates as needed for the complete
+   *              certificate chain.  Certificates should be ordered such that
+   *              the first certificate must be the end entity certificate, and
+   *              each subsequent certificate must be the issuer for the
+   *              previous certificate.  The chain does not need to be complete
+   *              as long as the peer may be expected to have prior knowledge of
+   *              any missing issuer certificates.
+   * @param  privateKeyPEMFile
+   *              The file containing the PEM-formatted PKCS #8 representation
+   *              of the private key for the end entity certificate.  This must
+   *              not be {@code null}, the file must exist, and it must contain
+   *              exactly one PEM-encoded private key.  The private key may
+   *              optionally be encrypted.
+   * @param  privateKeyEncryptionPassword
+   *              The password needed to decrypt the private key if it is
+   *              encrypted.  This may be {@code null} if the private key is not
+   *              encrypted.
    *
    * @throws  KeyStoreException  If there is a problem with any of the provided
    *                             PEM files.
    */
+  public PEMFileKeyManager(@NotNull final File certificateChainPEMFile,
+                           @NotNull final File privateKeyPEMFile,
+                           @Nullable final char[] privateKeyEncryptionPassword)
+         throws KeyStoreException
+  {
+    this(Collections.singletonList(certificateChainPEMFile), privateKeyPEMFile,
+         privateKeyEncryptionPassword);
+  }
+
+
+
+  /**
+   * Creates a new instance of this key manager with the provided PEM files.
+   *
+   * @param  certificateChainPEMFiles
+   *              The files containing the PEM-formatted X.509 representations
+   *              of the certificates in the certificate chain.  This must not
+   *              be {@code null} or empty.  Each file must exist and must
+   *              contain at least one certificate.  The files will be processed
+   *              in the order in which they are provided.  The first
+   *              certificate in the first file must be the end entity
+   *              certificate, and each subsequent certificate must be the
+   *              issuer for the previous certificate.  The chain does not need
+   *              to be complete as long as the peer may be expected to have
+   *              prior knowledge of any missing issuer certificates.
+   * @param  privateKeyPEMFile
+   *              The file containing the PEM-formatted PKCS #8 representation
+   *              of the private key for the end entity certificate.  This must
+   *              not be {@code null}, the file must exist, and it must contain
+   *              exactly one PEM-encoded private key.  The private key must not
+   *              be encrypted.
+   *
+   * @throws  KeyStoreException  If there is a problem with any of the provided
+   *                             PEM files.
+   */
   public PEMFileKeyManager(@NotNull final File[] certificateChainPEMFiles,
                            @NotNull final File privateKeyPEMFile)
          throws KeyStoreException
@@ -189,35 +221,108 @@
   /**
    * Creates a new instance of this key manager with the provided PEM files.
    *
-   * @param  certificateChainPEMFiles  The files containing the PEM-formatted
-   *                                   X.509 representations of the certificates
-   *                                   in the certificate chain.  This must not
-   *                                   be {@code null} or empty.  Each file must
-   *                                   exist and must contain at least one
-   *                                   certificate.  The files will be processed
-   *                                   in the order in which they are provided.
-   *                                   The first certificate in the first file
-   *                                   must be the end entity certificate, and
-   *                                   each subsequent certificate must be the
-   *                                   issuer for the previous certificate.  The
-   *                                   chain does not need to be complete as
-   *                                   long as the peer may be expected to have
-   *                                   prior knowledge of any missing issuer
-   *                                   certificates.
-   * @param  privateKeyPEMFile         The file containing the PEM-formatted
-   *                                   PKCS #8 representation of the private key
-   *                                   for the end entity certificate.  This
-   *                                   must not be {@code null}, the file must
-   *                                   exist, and it must contain exactly one
-   *                                   PEM-encoded private key.
+   * @param  certificateChainPEMFiles
+   *              The files containing the PEM-formatted X.509 representations
+   *              of the certificates in the certificate chain.  This must not
+   *              be {@code null} or empty.  Each file must exist and must
+   *              contain at least one certificate.  The files will be processed
+   *              in the order in which they are provided.  The first
+   *              certificate in the first file must be the end entity
+   *              certificate, and each subsequent certificate must be the
+   *              issuer for the previous certificate.  The chain does not need
+   *              to be complete as long as the peer may be expected to have
+   *              prior knowledge of any missing issuer certificates.
+   * @param  privateKeyPEMFile
+   *              The file containing the PEM-formatted PKCS #8 representation
+   *              of the private key for the end entity certificate.  This must
+   *              not be {@code null}, the file must exist, and it must contain
+   *              exactly one PEM-encoded private key.  The private key may
+   *              optionally be encrypted.
+   * @param  privateKeyEncryptionPassword
+   *              The password needed to decrypt the private key if it is
+   *              encrypted.  This may be {@code null} if the private key is not
+   *              encrypted.
    *
    * @throws  KeyStoreException  If there is a problem with any of the provided
    *                             PEM files.
    */
+  public PEMFileKeyManager(@NotNull final File[] certificateChainPEMFiles,
+                           @NotNull final File privateKeyPEMFile,
+                           @Nullable final char[] privateKeyEncryptionPassword)
+         throws KeyStoreException
+  {
+    this(StaticUtils.toList(certificateChainPEMFiles), privateKeyPEMFile,
+         privateKeyEncryptionPassword);
+  }
+
+
+
+  /**
+   * Creates a new instance of this key manager with the provided PEM files.
+   *
+   * @param  certificateChainPEMFiles
+   *              The files containing the PEM-formatted X.509 representations
+   *              of the certificates in the certificate chain.  This must not
+   *              be {@code null} or empty.  Each file must exist and must
+   *              contain at least one certificate.  The files will be processed
+   *              in the order in which they are provided.  The first
+   *              certificate in the first file must be the end entity
+   *              certificate, and each subsequent certificate must be the
+   *              issuer for the previous certificate.  The chain does not need
+   *              to be complete as long as the peer may be expected to have
+   *              prior knowledge of any missing issuer certificates.
+   * @param  privateKeyPEMFile
+   *              The file containing the PEM-formatted PKCS #8 representation
+   *              of the private key for the end entity certificate.  This must
+   *              not be {@code null}, the file must exist, and it must contain
+   *              exactly one PEM-encoded private key.  The private key must not
+   *              be encrypted.
+   *
+   * @throws  KeyStoreException  If there is a problem with any of the provided
+   *                             PEM files.
+   */
   public PEMFileKeyManager(@NotNull final List<File> certificateChainPEMFiles,
                            @NotNull final File privateKeyPEMFile)
          throws KeyStoreException
   {
+    this(certificateChainPEMFiles, privateKeyPEMFile, null);
+  }
+
+
+
+  /**
+   * Creates a new instance of this key manager with the provided PEM files.
+   *
+   * @param  certificateChainPEMFiles
+   *              The files containing the PEM-formatted X.509 representations
+   *              of the certificates in the certificate chain.  This must not
+   *              be {@code null} or empty.  Each file must exist and must
+   *              contain at least one certificate.  The files will be processed
+   *              in the order in which they are provided.  The first
+   *              certificate in the first file must be the end entity
+   *              certificate, and each subsequent certificate must be the
+   *              issuer for the previous certificate.  The chain does not need
+   *              to be complete as long as the peer may be expected to have
+   *              prior knowledge of any missing issuer certificates.
+   * @param  privateKeyPEMFile
+   *              The file containing the PEM-formatted PKCS #8 representation
+   *              of the private key for the end entity certificate.  This must
+   *              not be {@code null}, the file must exist, and it must contain
+   *              exactly one PEM-encoded private key.  The private key may
+   *              optionally be encrypted.
+   * @param  privateKeyEncryptionPassword
+   *              The password needed to decrypt the private key if it is
+   *              encrypted.  This may be {@code null} if the private key is not
+   *              encrypted.
+   *
+   * @throws  KeyStoreException  If there is a problem with any of the provided
+   *                             PEM files.
+   */
+  public PEMFileKeyManager(@NotNull final List<File> certificateChainPEMFiles,
+                           @NotNull final File privateKeyPEMFile,
+                           @Nullable final char[] privateKeyEncryptionPassword)
+         throws KeyStoreException
+  {
     Validator.ensureNotNullWithMessage(certificateChainPEMFiles,
          "PEMFileKeyManager.certificateChainPEMFiles must not be null.");
     Validator.ensureFalse(certificateChainPEMFiles.isEmpty(),
@@ -226,7 +331,8 @@
          "PEMFileKeyManager.privateKeyPEMFile must not be null.");
 
     certificateChain = readCertificateChain(certificateChainPEMFiles);
-    privateKey = readPrivateKey(privateKeyPEMFile);
+    privateKey = readPrivateKey(privateKeyPEMFile,
+         privateKeyEncryptionPassword);
 
 
     // Compute a SHA-256 fingerprint for the certificate to use as the alias.
@@ -370,12 +476,16 @@
    * Reads the private key from the provided PEM file.
    *
    *
-   * @param  privateKeyPEMFile         The file containing the PEM-formatted
-   *                                   PKCS #8 representation of the private key
-   *                                   for the end entity certificate.  This
-   *                                   must not be {@code null}, the file must
-   *                                   exist, and it must contain exactly one
-   *                                   PEM-encoded private key.
+   * @param  privateKeyPEMFile
+   *              The file containing the PEM-formatted PKCS #8 representation
+   *              of the private key for the end entity certificate.  This must
+   *              not be {@code null}, the file must exist, and it must contain
+   *              exactly one PEM-encoded private key.  The private key may
+   *              optionally be encrypted.
+   * @param  encryptionPassword
+   *              The password needed to decrypt the private key if it is
+   *              encrypted.  This may be {@code null} if the private key is not
+   *              encrypted.
    *
    * @return  The private key that was read.
    *
@@ -384,7 +494,8 @@
    */
   @NotNull()
   private static PrivateKey readPrivateKey(
-               @NotNull final File privateKeyPEMFile)
+               @NotNull final File privateKeyPEMFile,
+               @Nullable final char[] encryptionPassword)
           throws KeyStoreException
   {
     if (! privateKeyPEMFile.exists())
@@ -396,7 +507,7 @@
 
     try (PKCS8PEMFileReader r = new PKCS8PEMFileReader(privateKeyPEMFile))
     {
-      final PKCS8PrivateKey privateKey = r.readPrivateKey();
+      final PKCS8PrivateKey privateKey = r.readPrivateKey(encryptionPassword);
       if (privateKey == null)
       {
         throw new KeyStoreException(
@@ -404,7 +515,7 @@
                   privateKeyPEMFile.getAbsolutePath()));
       }
 
-      if (r.readPrivateKey() != null)
+      if (r.readPrivateKey(encryptionPassword) != null)
       {
         throw new KeyStoreException(
              ERR_PEM_FILE_KEY_MANAGER_MULTIPLE_KEYS_IN_FILE.get(

Modified: trunk/src/com/unboundid/util/ssl/cert/ManageCertificates.java
===================================================================
--- trunk/src/com/unboundid/util/ssl/cert/ManageCertificates.java	2022-12-08 17:49:08 UTC (rev 1579)
+++ trunk/src/com/unboundid/util/ssl/cert/ManageCertificates.java	2022-12-09 21:21:56 UTC (rev 1580)
@@ -1004,6 +1004,28 @@
     exportKeyOutputFile.addLongIdentifier("filename", true);
     exportKeyParser.addArgument(exportKeyOutputFile);
 
+    final StringArgument exportKeyEncryptionPassword = new StringArgument(null,
+         "encryption-password", false, 1,
+         INFO_MANAGE_CERTS_PLACEHOLDER_PASSWORD.get(),
+         INFO_MANAGE_CERTS_SC_EXPIRT_KEY_ARG_ENC_PW_DESC.get());
+    exportKeyEncryptionPassword.addLongIdentifier("encryptionPassword", true);
+    exportKeyParser.addArgument(exportKeyEncryptionPassword);
+
+    final FileArgument exportKeyEncryptionPasswordFile = new FileArgument(null,
+       "encryption-password-file", false, 1, null,
+         INFO_MANAGE_CERTS_SC_EXPORT_KEY_ARG_ENC_PW_FILE_DESC.get(), true, true,
+         true, false);
+    exportKeyEncryptionPasswordFile.addLongIdentifier("encryptionPasswordFile",
+         true);
+    exportKeyParser.addArgument(exportKeyEncryptionPasswordFile);
+
+    final BooleanArgument exportKeyPromptForEncryptionPassword =
+         new BooleanArgument(null, "prompt-for-encryption-password", 1,
+              INFO_MANAGE_CERTS_SC_EXPORT_KEY_ARG_PROMPT_FOR_ENC_PW.get());
+    exportKeyPromptForEncryptionPassword.addLongIdentifier(
+         "promptForEncryptionPassword", true);
+    exportKeyParser.addArgument(exportKeyPromptForEncryptionPassword);
+
     exportKeyParser.addRequiredArgumentSet(exportKeyKeystorePassword,
          exportKeyKeystorePasswordFile, exportKeyPromptForKeystorePassword);
     exportKeyParser.addExclusiveArgumentSet(exportKeyKeystorePassword,
@@ -1010,6 +1032,8 @@
          exportKeyKeystorePasswordFile, exportKeyPromptForKeystorePassword);
     exportKeyParser.addExclusiveArgumentSet(exportKeyPKPassword,
          exportKeyPKPasswordFile, exportKeyPromptForPKPassword);
+    exportKeyParser.addExclusiveArgumentSet(exportKeyEncryptionPassword,
+         exportKeyEncryptionPasswordFile, exportKeyPromptForEncryptionPassword);
 
     final LinkedHashMap<String[],String> exportKeyExamples =
          new LinkedHashMap<>(StaticUtils.computeMapCapacity(2));
@@ -1213,6 +1237,29 @@
     importCertPromptForPKPassword.addLongIdentifier("promptForKeyPIN", true);
     importCertParser.addArgument(importCertPromptForPKPassword);
 
+    final StringArgument importCertEncryptionPassword = new StringArgument(null,
+         "encryption-password", false, 1,
+         INFO_MANAGE_CERTS_PLACEHOLDER_PASSWORD.get(),
+         INFO_MANAGE_CERTS_SC_IMPORT_CERT_ARG_ENC_PW_DESC.get());
+    importCertEncryptionPassword.addLongIdentifier("encryptionPassword", true);
+    importCertEncryptionPassword.setSensitive(true);
+    importCertParser.addArgument(importCertEncryptionPassword);
+
+    final FileArgument importCertEncryptionPasswordFile = new FileArgument(null,
+         "encryption-password-file", false, 1, null,
+         INFO_MANAGE_CERTS_SC_IMPORT_CERT_ARG_ENC_PW_FILE_DESC.get(), true,
+         true, true, false);
+    importCertEncryptionPasswordFile.addLongIdentifier("encryptionPasswordFile",
+         true);
+    importCertParser.addArgument(importCertEncryptionPasswordFile);
+
+    final BooleanArgument importCertPromptForEncryptionPassword =
+         new BooleanArgument(null, "prompt-for-encryption-password",
+        INFO_MANAGE_CERTS_SC_IMPORT_CERT_ARG_PROMPT_FOR_ENC_PW_DESC.get());
+    importCertPromptForEncryptionPassword.addLongIdentifier(
+         "promptForEncryptionPassword", true);
+    importCertParser.addArgument(importCertPromptForEncryptionPassword);
+
     final BooleanArgument importCertNoPrompt = new BooleanArgument(null,
          "no-prompt", 1,
          INFO_MANAGE_CERTS_SC_IMPORT_CERT_ARG_NO_PROMPT_DESC.get());
@@ -1233,6 +1280,9 @@
          importCertKeystorePasswordFile, importCertPromptForKeystorePassword);
     importCertParser.addExclusiveArgumentSet(importCertPKPassword,
          importCertPKPasswordFile, importCertPromptForPKPassword);
+    importCertParser.addExclusiveArgumentSet(importCertEncryptionPassword,
+         importCertEncryptionPasswordFile,
+         importCertPromptForEncryptionPassword);
 
     final LinkedHashMap<String[],String> importCertExamples =
          new LinkedHashMap<>(StaticUtils.computeMapCapacity(2));
@@ -5388,6 +5438,20 @@
     }
 
 
+    // Get the password to use to encrypt the private key when it is exported.
+    final char[] encryptionPassword;
+    try
+    {
+      encryptionPassword = getPrivateKeyEncryptionPassword(false);
+    }
+    catch (final LDAPException le)
+    {
+      Debug.debugException(le);
+      wrapErr(0, WRAP_COLUMN, le.getMessage());
+      return le.getResultCode();
+    }
+
+
     // Get the private key to export.
     final PrivateKey privateKey;
     try
@@ -5451,11 +5515,23 @@
       {
         if (exportPEM)
         {
-          writePEMPrivateKey(printStream, privateKey.getEncoded());
+          writePEMPrivateKey(printStream, privateKey.getEncoded(),
+               encryptionPassword);
         }
         else
         {
-          printStream.write(privateKey.getEncoded());
+          if (encryptionPassword == null)
+          {
+            printStream.write(privateKey.getEncoded());
+          }
+          else
+          {
+            final byte[] encryptedPrivateKey =
+                 PKCS8EncryptionHandler.encryptPrivateKey(
+                      privateKey.getEncoded(), encryptionPassword,
+                      new PKCS8EncryptionProperties());
+            printStream.write(encryptedPrivateKey);
+          }
         }
       }
       catch (final Exception e)
@@ -5577,6 +5653,21 @@
     }
 
 
+    // See if there is a password to use to decrypt the private key that is
+    // being imported.
+    final char[] encryptionPassword;
+    try
+    {
+      encryptionPassword = getPrivateKeyEncryptionPassword(true);
+    }
+    catch (final LDAPException le)
+    {
+      Debug.debugException(le);
+      wrapErr(0, WRAP_COLUMN, le.getMessage());
+      return le.getResultCode();
+    }
+
+
     // If a private key file was specified, then read the private key.
     final PKCS8PrivateKey privateKey;
     if (privateKeyFile == null)
@@ -5587,7 +5678,7 @@
     {
       try
       {
-        privateKey = readPrivateKeyFromFile(privateKeyFile);
+        privateKey = readPrivateKeyFromFile(privateKeyFile, encryptionPassword);
       }
       catch (final LDAPException le)
       {
@@ -11040,23 +11131,57 @@
    * Writes a PEM-encoded representation of the provided encoded private key to
    * the given print stream.
    *
-   * @param  printStream        The print stream to which the PEM-encoded
-   *                            private key should be written.  It must not be
-   *                            {@code null}.
-   * @param  encodedPrivateKey  The bytes that comprise the encoded private key.
-   *                            It must not be {@code null}.
+   * @param  printStream         The print stream to which the PEM-encoded
+   *                             private key should be written.  It must not be
+   *                             {@code null}.
+   * @param  encodedPrivateKey   The bytes that comprise the encoded private
+   *                             key.  It must not be {@code null}.
+   * @param  encryptionPassword  The password to use to encrypt the private key.
+   *                             It may be {@code null} if the private key
+   *                             should not be encrypted.
+   *
+   * @throws  LDAPException  If a problem occurs while trying write the private
+   *                         key.
    */
   private static void writePEMPrivateKey(
                            @NotNull final PrintStream printStream,
-                           @NotNull final byte[] encodedPrivateKey)
+                           @NotNull final byte[] encodedPrivateKey,
+                           @Nullable final char[] encryptionPassword)
+          throws LDAPException
   {
-    final String certBase64 = Base64.encode(encodedPrivateKey);
-    printStream.println("-----BEGIN PRIVATE KEY-----");
-    for (final String line : StaticUtils.wrapLine(certBase64, 64))
+    if (encryptionPassword == null)
     {
-      printStream.println(line);
+      final String certBase64 = Base64.encode(encodedPrivateKey);
+      printStream.println("-----BEGIN PRIVATE KEY-----");
+      for (final String line : StaticUtils.wrapLine(certBase64, 64))
+      {
+        printStream.println(line);
+      }
+      printStream.println("-----END PRIVATE KEY-----");
     }
-    printStream.println("-----END PRIVATE KEY-----");
+    else
+    {
+      final byte[] encryptedPrivateKey;
+      try
+      {
+        encryptedPrivateKey = PKCS8EncryptionHandler.encryptPrivateKey(
+             encodedPrivateKey, encryptionPassword,
+             new PKCS8EncryptionProperties());
+      }
+      catch (final CertException e)
+      {
+        Debug.debugException(e);
+        throw new LDAPException(ResultCode.LOCAL_ERROR, e.getMessage(), e);
+      }
+
+      final String encryptedCertBase64 = Base64.encode(encryptedPrivateKey);
+      printStream.println("-----BEGIN ENCRYPTED PRIVATE KEY-----");
+      for (final String line : StaticUtils.wrapLine(encryptedCertBase64, 64))
+      {
+        printStream.println(line);
+      }
+      printStream.println("-----END ENCRYPTED PRIVATE KEY-----");
+    }
   }
 
 
@@ -11329,6 +11454,99 @@
 
 
   /**
+   * Retrieves the password used to encrypt a private key.
+   *
+   * @param  forDecrypt  Indicates whether the password will be used to decrypt
+   *                     the private key rather than to encrypt it.
+   *
+   * @return  The password used to encrypt a private key, or {@code null} if no
+   *          encryption password was specified.
+   *
+   * @throws  LDAPException  If a problem is encountered while trying to get the
+   *                         keystore password.
+   */
+  @Nullable()
+  private char[] getPrivateKeyEncryptionPassword(final boolean forDecrypt)
+          throws LDAPException
+  {
+    final StringArgument passwordArgument =
+         subCommandParser.getStringArgument("encryption-password");
+    if ((passwordArgument != null) && passwordArgument.isPresent())
+    {
+      return passwordArgument.getValue().toCharArray();
+    }
+
+
+    final FileArgument passwordFileArgument =
+         subCommandParser.getFileArgument("encryption-password-file");
+    if ((passwordFileArgument != null) && passwordFileArgument.isPresent())
+    {
+      final File f = passwordFileArgument.getValue();
+      try
+      {
+        return getPasswordFileReader().readPassword(f);
+      }
+      catch (final LDAPException e)
+      {
+        Debug.debugException(e);
+        throw e;
+      }
+      catch (final Exception e)
+      {
+        Debug.debugException(e);
+        throw new LDAPException(ResultCode.LOCAL_ERROR,
+             ERR_MANAGE_CERTS_GET_PK_ENC_PW_ERROR_READING_FILE.get(
+                  f.getAbsolutePath(), StaticUtils.getExceptionMessage(e)),
+             e);
+      }
+    }
+
+
+    final BooleanArgument promptArgument = subCommandParser.getBooleanArgument(
+         "prompt-for-encryption-password");
+    if ((promptArgument != null) && promptArgument.isPresent())
+    {
+      out();
+      if (forDecrypt)
+      {
+        // We'll be decrypting an existing private key, so we only need to
+        // prompt for the password once.
+        return promptForPassword(
+             INFO_MANAGE_CERTS_GET_PK_ENC_PW_PROMPT_DECRYPT.get(), false);
+      }
+      else
+      {
+        // We'll be encrypting the private key, so we need to prompt twice to
+        // confirm that the entered password is what the user intended.
+        while (true)
+        {
+          final char[] pwChars = promptForPassword(
+               INFO_MANAGE_CERTS_GET_PK_ENC_PW_PROMPT_ENCRYPT_1.get(), false);
+          final char[] confirmChars = promptForPassword(
+               INFO_MANAGE_CERTS_GET_PK_ENC_PW_PROMPT_ENCRYPT_2.get(), true);
+
+          if (Arrays.equals(pwChars, confirmChars))
+          {
+            Arrays.fill(confirmChars, '\u0000');
+            return pwChars;
+          }
+          else
+          {
+            wrapErr(0, WRAP_COLUMN,
+                 INFO_MANAGE_CERTS_GET_PK_ENC_PW_PROMPT_MISMATCH.get());
+            err();
+          }
+        }
+      }
+    }
+
+
+    return null;
+  }
+
+
+
+  /**
    * Prompts for a password and retrieves the value that the user entered.
    *
    * @param  prompt      The prompt to display to the user.
@@ -12163,8 +12381,11 @@
    * Reads a private key from the specified file.  The file must exist and must
    * contain exactly one PEM-encoded or DER-encoded PKCS #8 private key.
    *
-   * @param  f  The path to the private key file to read.  It must not be
-   *            {@code null}.
+   * @param  f                   The path to the private key file to read.  It
+   *                             must not be {@code null}.
+   * @param  encryptionPassword  The password to use to encrypt the private key.
+   *                             It may be {@code null} if the private key is
+   *                             not encrypted.
    *
    * @return  The private key read from the file.
    *
@@ -12172,7 +12393,8 @@
    *                         private key.
    */
   @NotNull()
-  static PKCS8PrivateKey readPrivateKeyFromFile(@NotNull final File f)
+  static PKCS8PrivateKey readPrivateKeyFromFile(@NotNull final File f,
+              @Nullable final char[] encryptionPassword)
          throws LDAPException
   {
     // Read the first byte of the file to see if it contains DER-formatted data,
@@ -12234,7 +12456,15 @@
           {
             try
             {
-              privateKey = new PKCS8PrivateKey(pkElement.encode());
+              if (encryptionPassword == null)
+              {
+                privateKey = new PKCS8PrivateKey(pkElement.encode());
+              }
+              else
+              {
+                privateKey = PKCS8EncryptionHandler.decryptPrivateKey(
+                     pkElement.encode(), encryptionPassword);
+              }
             }
             catch (final Exception e)
             {
@@ -12260,6 +12490,7 @@
         {
           boolean inKey = false;
           boolean isRSAKey = false;
+          boolean isEncryptedKey = false;
           final StringBuilder buffer = new StringBuilder();
           while (true)
           {
@@ -12292,7 +12523,8 @@
             }
 
             if (line.equals("-----BEGIN PRIVATE KEY-----") ||
-                 line.equals("-----BEGIN RSA PRIVATE KEY-----"))
+                 line.equals("-----BEGIN RSA PRIVATE KEY-----") ||
+                 line.equals("-----BEGIN ENCRYPTED PRIVATE KEY-----"))
             {
               if (inKey)
               {
@@ -12313,10 +12545,21 @@
                 {
                   isRSAKey = true;
                 }
+                else if (line.equals("-----BEGIN ENCRYPTED PRIVATE KEY-----"))
+                {
+                  isEncryptedKey = true;
+                  if (encryptionPassword == null)
+                  {
+                    throw new LDAPException(ResultCode.PARAM_ERROR,
+                         ERR_MANAGE_CERTS_READ_PK_FROM_FILE_PK_ENCRYPTED_NO_PW.
+                              get(f.getAbsolutePath()));
+                  }
+                }
               }
             }
             else if (line.equals("-----END PRIVATE KEY-----") ||
-                 line.equals("-----END RSA PRIVATE KEY-----"))
+                 line.equals("-----END RSA PRIVATE KEY-----") ||
+                 line.equals("-----END ENCRYPTED PRIVATE KEY-----"))
             {
               if (! inKey)
               {
@@ -12348,7 +12591,15 @@
 
               try
               {
-                privateKey = new PKCS8PrivateKey(pkBytes);
+                if (isEncryptedKey)
+                {
+                  privateKey = PKCS8EncryptionHandler.
+                       decryptPrivateKey(pkBytes, encryptionPassword);
+                }
+                else
+                {
+                  privateKey = new PKCS8PrivateKey(pkBytes);
+                }
               }
               catch (final CertException e)
               {

Added: trunk/src/com/unboundid/util/ssl/cert/PKCS5AlgorithmIdentifier.java
===================================================================
--- trunk/src/com/unboundid/util/ssl/cert/PKCS5AlgorithmIdentifier.java	                        (rev 0)
+++ trunk/src/com/unboundid/util/ssl/cert/PKCS5AlgorithmIdentifier.java	2022-12-09 21:21:56 UTC (rev 1580)
@@ -0,0 +1,574 @@
+/*
+ * Copyright 2022 Ping Identity Corporation
+ * All Rights Reserved.
+ */
+/*
+ * Copyright 2022 Ping Identity Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/*
+ * Copyright (C) 2022 Ping Identity Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (GPLv2 only)
+ * or the terms of the GNU Lesser General Public License (LGPLv2.1 only)
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses>.
+ */
+package com.unboundid.util.ssl.cert;
+
...
 
[truncated message content]

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1579] trunk

[<di...@us...>]

Revision: 1579
          http://sourceforge.net/p/ldap-sdk/code/1579
Author:   dirmgr
Date:     2022-12-08 17:49:08 +0000 (Thu, 08 Dec 2022)
Log Message:
-----------
Post-6.0.7 release updates

Updated the LDAP SDK version so that subsequent builds will have a
version number of 6.0.8.  Preserved a copy of the 6.0.7 public API
to ensure that we will maintain backward compatibility with it.

Modified Paths:
--------------
    trunk/tests/unit/src/com/unboundid/ldap/sdk/APITestCase.java
    trunk/version.properties

Added Paths:
-----------
    trunk/resource/public-api-6.0.7.txt

Added: trunk/resource/public-api-6.0.7.txt
===================================================================
--- trunk/resource/public-api-6.0.7.txt	                        (rev 0)
+++ trunk/resource/public-api-6.0.7.txt	2022-12-08 17:49:08 UTC (rev 1579)
@@ -0,0 +1,16712 @@
+@Extensible class com.unboundid.ldap.listener.InMemoryExtendedOperationHandler constructor public com.unboundid.ldap.listener.InMemoryExtendedOperationHandler()
+@Extensible class com.unboundid.ldap.listener.InMemoryExtendedOperationHandler method public abstract com.unboundid.ldap.sdk.ExtendedResult processExtendedOperation(com.unboundid.ldap.listener.InMemoryRequestHandler,int,com.unboundid.ldap.sdk.ExtendedRequest)
+@Extensible class com.unboundid.ldap.listener.InMemoryExtendedOperationHandler method public abstract java.lang.String getExtendedOperationHandlerName()
+@Extensible class com.unboundid.ldap.listener.InMemoryExtendedOperationHandler method public abstract java.util.List<java.lang.String> getSupportedExtendedRequestOIDs()
+@Extensible class com.unboundid.ldap.listener.InMemoryExtendedOperationHandler method public java.lang.String toString()
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder constructor protected com.unboundid.ldap.listener.InMemoryPasswordEncoder(java.lang.String,com.unboundid.ldap.listener.PasswordEncoderOutputFormatter)
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method protected abstract boolean passwordMatches(byte[],byte[],com.unboundid.ldap.sdk.ReadOnlyEntry) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method protected abstract byte[] encodePassword(byte[],com.unboundid.ldap.sdk.ReadOnlyEntry,java.util.List<com.unboundid.ldap.sdk.Modification>) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method protected abstract byte[] extractClearPassword(byte[],com.unboundid.ldap.sdk.ReadOnlyEntry) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method protected abstract void ensurePreEncodedPasswordAppearsValid(byte[],com.unboundid.ldap.sdk.ReadOnlyEntry,java.util.List<com.unboundid.ldap.sdk.Modification>) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public abstract void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final boolean clearPasswordMatchesEncodedPassword(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.ReadOnlyEntry) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final boolean passwordStartsWithPrefix(com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final com.unboundid.asn1.ASN1OctetString encodePassword(com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.ReadOnlyEntry,java.util.List<com.unboundid.ldap.sdk.Modification>) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final com.unboundid.asn1.ASN1OctetString extractClearPasswordFromEncodedPassword(com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.ReadOnlyEntry) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final com.unboundid.ldap.listener.PasswordEncoderOutputFormatter getOutputFormatter()
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final java.lang.String getPrefix()
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final java.lang.String toString()
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final void ensurePreEncodedPasswordAppearsValid(com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.ReadOnlyEntry,java.util.List<com.unboundid.ldap.sdk.Modification>) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemorySASLBindHandler constructor public com.unboundid.ldap.listener.InMemorySASLBindHandler()
+@Extensible class com.unboundid.ldap.listener.InMemorySASLBindHandler method public abstract com.unboundid.ldap.sdk.BindResult processSASLBind(com.unboundid.ldap.listener.InMemoryRequestHandler,int,com.unboundid.ldap.sdk.DN,com.unboundid.asn1.ASN1OctetString,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.InMemorySASLBindHandler method public abstract java.lang.String getSASLMechanismName()
+@Extensible class com.unboundid.ldap.listener.InMemorySASLBindHandler method public java.lang.String toString()
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler constructor public com.unboundid.ldap.listener.LDAPListenerRequestHandler()
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.listener.LDAPListenerRequestHandler newInstance(com.unboundid.ldap.listener.LDAPListenerClientConnection) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processAddRequest(int,com.unboundid.ldap.protocol.AddRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processBindRequest(int,com.unboundid.ldap.protocol.BindRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processCompareRequest(int,com.unboundid.ldap.protocol.CompareRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processDeleteRequest(int,com.unboundid.ldap.protocol.DeleteRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processExtendedRequest(int,com.unboundid.ldap.protocol.ExtendedRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processModifyDNRequest(int,com.unboundid.ldap.protocol.ModifyDNRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processModifyRequest(int,com.unboundid.ldap.protocol.ModifyRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processSearchRequest(int,com.unboundid.ldap.protocol.SearchRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public void closeInstance()
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public void processAbandonRequest(int,com.unboundid.ldap.protocol.AbandonRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public void processUnbindRequest(int,com.unboundid.ldap.protocol.UnbindRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.PasswordEncoderOutputFormatter constructor public com.unboundid.ldap.listener.PasswordEncoderOutputFormatter()
+@Extensible class com.unboundid.ldap.listener.PasswordEncoderOutputFormatter method public abstract byte[] format(byte[]) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.PasswordEncoderOutputFormatter method public abstract byte[] unFormat(byte[]) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.PasswordEncoderOutputFormatter method public abstract void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.listener.PasswordEncoderOutputFormatter method public final java.lang.String toString()
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor constructor public com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor()
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processAddRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedAddRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processAddResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedAddResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processCompareRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedCompareRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processCompareResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedCompareResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processDeleteRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedDeleteRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processDeleteResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedDeleteResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processExtendedRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedExtendedRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processExtendedResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedExtendedResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processIntermediateResponse(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedIntermediateResponse)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processModifyDNRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedModifyDNRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processModifyDNResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedModifyDNResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processModifyRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedModifyRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processModifyResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedModifyResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSASLBindRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSASLBindRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSASLBindResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSASLBindResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSearchEntry(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchEntry)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSearchReference(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchReference)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSearchRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSearchResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSimpleBindRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSimpleBindRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSimpleBindResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSimpleBindResult)
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule constructor public com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule()
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule method public abstract com.unboundid.asn1.ASN1OctetString normalize(com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule method public abstract com.unboundid.asn1.ASN1OctetString normalizeSubstring(com.unboundid.asn1.ASN1OctetString,byte)
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule method public boolean matchesAnyValue(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString[])
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule method public boolean matchesSubstring(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString[],com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule method public boolean valuesMatch(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule method public int compareValues(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule constructor protected com.unboundid.ldap.matchingrules.MatchingRule()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule field public static final byte SUBSTRING_TYPE_SUBANY
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule field public static final byte SUBSTRING_TYPE_SUBFINAL
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule field public static final byte SUBSTRING_TYPE_SUBINITIAL
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract boolean matchesSubstring(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString[],com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract boolean valuesMatch(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract com.unboundid.asn1.ASN1OctetString normalize(com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract com.unboundid.asn1.ASN1OctetString normalizeSubstring(com.unboundid.asn1.ASN1OctetString,byte) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract int compareValues(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract java.lang.String getEqualityMatchingRuleName()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract java.lang.String getEqualityMatchingRuleOID()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract java.lang.String getOrderingMatchingRuleName()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract java.lang.String getOrderingMatchingRuleOID()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract java.lang.String getSubstringMatchingRuleName()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract java.lang.String getSubstringMatchingRuleOID()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public boolean matchesAnyValue(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString[]) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public java.lang.String getEqualityMatchingRuleNameOrOID()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public java.lang.String getOrderingMatchingRuleNameOrOID()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public java.lang.String getSubstringMatchingRuleNameOrOID()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule getDefaultEqualityMatchingRule()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule getDefaultOrderingMatchingRule()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule getDefaultSubstringMatchingRule()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectEqualityMatchingRule(java.lang.String)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectEqualityMatchingRule(java.lang.String,com.unboundid.ldap.sdk.schema.Schema)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectEqualityMatchingRule(java.lang.String,java.lang.String,com.unboundid.ldap.sdk.schema.Schema)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectMatchingRuleForSyntax(java.lang.String)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectOrderingMatchingRule(java.lang.String)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectOrderingMatchingRule(java.lang.String,com.unboundid.ldap.sdk.schema.Schema)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectOrderingMatchingRule(java.lang.String,java.lang.String,com.unboundid.ldap.sdk.schema.Schema)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectSubstringMatchingRule(java.lang.String)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectSubstringMatchingRule(java.lang.String,com.unboundid.ldap.sdk.schema.Schema)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectSubstringMatchingRule(java.lang.String,java.lang.String,com.unboundid.ldap.sdk.schema.Schema)
+@Extensible class com.unboundid.ldap.matchingrules.SimpleMatchingRule constructor public com.unboundid.ldap.matchingrules.SimpleMatchingRule()
+@Extensible class com.unboundid.ldap.matchingrules.SimpleMatchingRule method public boolean matchesAnyValue(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString[]) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.SimpleMatchingRule method public boolean matchesSubstring(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString[],com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.SimpleMatchingRule method public boolean valuesMatch(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.SimpleMatchingRule method public int compareValues(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.BindRequest constructor protected com.unboundid.ldap.sdk.BindRequest(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.BindRequest field protected static final com.unboundid.asn1.ASN1Integer VERSION_ELEMENT
+@Extensible class com.unboundid.ldap.sdk.BindRequest method protected abstract com.unboundid.ldap.sdk.BindResult process(com.unboundid.ldap.sdk.LDAPConnection,int) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.BindRequest method protected com.unboundid.ldap.sdk.LDAPResult process(com.unboundid.ldap.sdk.LDAPConnection,int) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public abstract com.unboundid.ldap.sdk.BindRequest duplicate()
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public abstract com.unboundid.ldap.sdk.BindRequest duplicate(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public abstract java.lang.String getBindType()
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public com.unboundid.ldap.sdk.BindRequest getRebindRequest(java.lang.String,int)
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public com.unboundid.ldap.sdk.LDAPRequest duplicate()
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public com.unboundid.ldap.sdk.LDAPRequest duplicate(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public final com.unboundid.ldap.sdk.OperationType getOperationType()
+@Extensible class com.unboundid.ldap.sdk.BindResult constructor protected com.unboundid.ldap.sdk.BindResult(com.unboundid.ldap.sdk.BindResult)
+@Extensible class com.unboundid.ldap.sdk.BindResult constructor public com.unboundid.ldap.sdk.BindResult(com.unboundid.ldap.sdk.LDAPException)
+@Extensible class com.unboundid.ldap.sdk.BindResult constructor public com.unboundid.ldap.sdk.BindResult(com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.BindResult constructor public com.unboundid.ldap.sdk.BindResult(int,com.unboundid.ldap.sdk.ResultCode,java.lang.String,java.lang.String,java.lang.String[],com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.BindResult constructor public com.unboundid.ldap.sdk.BindResult(int,com.unboundid.ldap.sdk.ResultCode,java.lang.String,java.lang.String,java.lang.String[],com.unboundid.ldap.sdk.Control[],com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.sdk.BindResult method public com.unboundid.asn1.ASN1OctetString getServerSASLCredentials()
+@Extensible class com.unboundid.ldap.sdk.BindResult method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.Control constructor protected com.unboundid.ldap.sdk.Control()
+@Extensible class com.unboundid.ldap.sdk.Control constructor protected com.unboundid.ldap.sdk.Control(com.unboundid.ldap.sdk.Control)
+@Extensible class com.unboundid.ldap.sdk.Control constructor public com.unboundid.ldap.sdk.Control(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.Control constructor public com.unboundid.ldap.sdk.Control(java.lang.String,boolean)
+@Extensible class com.unboundid.ldap.sdk.Control constructor public com.unboundid.ldap.sdk.Control(java.lang.String,boolean,com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.sdk.Control method public com.unboundid.util.json.JSONObject toJSONControl()
+@Extensible class com.unboundid.ldap.sdk.Control method public final boolean equals(java.lang.Object)
+@Extensible class com.unboundid.ldap.sdk.Control method public final boolean hasValue()
+@Extensible class com.unboundid.ldap.sdk.Control method public final boolean isCritical()
+@Extensible class com.unboundid.ldap.sdk.Control method public final com.unboundid.asn1.ASN1OctetString getValue()
+@Extensible class com.unboundid.ldap.sdk.Control method public final com.unboundid.asn1.ASN1Sequence encode()
+@Extensible class com.unboundid.ldap.sdk.Control method public final int hashCode()
+@Extensible class com.unboundid.ldap.sdk.Control method public final java.lang.String getOID()
+@Extensible class com.unboundid.ldap.sdk.Control method public final void writeTo(com.unboundid.asn1.ASN1Buffer)
+@Extensible class com.unboundid.ldap.sdk.Control method public java.lang.String getControlName()
+@Extensible class com.unboundid.ldap.sdk.Control method public java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.Control method public static com.unboundid.asn1.ASN1Sequence encodeControls(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.Control method public static com.unboundid.ldap.sdk.Control decode(com.unboundid.asn1.ASN1Sequence) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.Control method public static com.unboundid.ldap.sdk.Control decode(java.lang.String,boolean,com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.Control method public static com.unboundid.ldap.sdk.Control decodeJSONControl(com.unboundid.util.json.JSONObject,boolean,boolean) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.Control method public static com.unboundid.ldap.sdk.Control readFrom(com.unboundid.asn1.ASN1StreamReader) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.Control method public static com.unboundid.ldap.sdk.Control[] decodeControls(com.unboundid.asn1.ASN1Sequence) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.Control method public static void deregisterDecodeableControl(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.Control method public static void registerDecodeableControl(java.lang.String,com.unboundid.ldap.sdk.DecodeableControl)
+@Extensible class com.unboundid.ldap.sdk.Control method public static void registerDecodeableControl(java.lang.String,java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.Control method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest constructor protected com.unboundid.ldap.sdk.ExtendedRequest(com.unboundid.ldap.sdk.ExtendedRequest)
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest constructor public com.unboundid.ldap.sdk.ExtendedRequest(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest constructor public com.unboundid.ldap.sdk.ExtendedRequest(java.lang.String,com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest constructor public com.unboundid.ldap.sdk.ExtendedRequest(java.lang.String,com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest constructor public com.unboundid.ldap.sdk.ExtendedRequest(java.lang.String,com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest field protected static final byte TYPE_EXTENDED_REQUEST_OID
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest field protected static final byte TYPE_EXTENDED_REQUEST_VALUE
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method protected com.unboundid.ldap.sdk.ExtendedResult process(com.unboundid.ldap.sdk.LDAPConnection,int) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method protected com.unboundid.ldap.sdk.LDAPResult process(com.unboundid.ldap.sdk.LDAPConnection,int) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public com.unboundid.asn1.ASN1Element encodeProtocolOp()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public com.unboundid.ldap.sdk.ExtendedRequest duplicate()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public com.unboundid.ldap.sdk.ExtendedRequest duplicate(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public com.unboundid.ldap.sdk.LDAPRequest duplicate()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public com.unboundid.ldap.sdk.LDAPRequest duplicate(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final boolean hasValue()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final byte getProtocolOpType()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final com.unboundid.asn1.ASN1OctetString getValue()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final com.unboundid.ldap.sdk.OperationType getOperationType()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final int getLastMessageID()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final java.lang.String getOID()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final void writeTo(com.unboundid.asn1.ASN1Buffer)
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public java.lang.String getExtendedRequestName()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public void toCode(java.util.List<java.lang.String>,java.lang.String,int,boolean)
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult constructor protected com.unboundid.ldap.sdk.ExtendedResult(com.unboundid.ldap.sdk.ExtendedResult)
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult constructor public com.unboundid.ldap.sdk.ExtendedResult(com.unboundid.ldap.sdk.LDAPException)
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult constructor public com.unboundid.ldap.sdk.ExtendedResult(com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult constructor public com.unboundid.ldap.sdk.ExtendedResult(int,com.unboundid.ldap.sdk.ResultCode,java.lang.String,java.lang.String,java.lang.String[],java.lang.String,com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult method public final boolean hasValue()
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult method public final com.unboundid.asn1.ASN1OctetString getValue()
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult method public final java.lang.String getOID()
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult method public java.lang.String getExtendedResultName()
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult method public java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse constructor protected com.unboundid.ldap.sdk.IntermediateResponse(com.unboundid.ldap.sdk.IntermediateResponse)
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse constructor public com.unboundid.ldap.sdk.IntermediateResponse(int,java.lang.String,com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse constructor public com.unboundid.ldap.sdk.IntermediateResponse(int,java.lang.String,com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse constructor public com.unboundid.ldap.sdk.IntermediateResponse(java.lang.String,com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse constructor public com.unboundid.ldap.sdk.IntermediateResponse(java.lang.String,com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse field protected static final byte TYPE_INTERMEDIATE_RESPONSE_OID
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse field protected static final byte TYPE_INTERMEDIATE_RESPONSE_VALUE
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public final com.unboundid.asn1.ASN1OctetString getValue()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public final com.unboundid.ldap.sdk.Control getControl(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public final com.unboundid.ldap.sdk.Control[] getControls()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public final java.lang.String getOID()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public final java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public int getMessageID()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public java.lang.String getIntermediateResponseName()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public java.lang.String valueToString()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger constructor public com.unboundid.ldap.sdk.LDAPConnectionLogger()
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logAbandonRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,int,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logAddRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ReadOnlyAddRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logAddResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logBindRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.SASLBindRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logBindRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.SimpleBindRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logBindResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.BindResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logCompareRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ReadOnlyCompareRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logCompareResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logConnect(com.unboundid.ldap.sdk.LDAPConnectionInfo,java.lang.String,java.net.InetAddress,int)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logConnectFailure(com.unboundid.ldap.sdk.LDAPConnectionInfo,java.lang.String,int,com.unboundid.ldap.sdk.LDAPException)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logDeleteRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ReadOnlyDeleteRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logDeleteResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logDisconnect(com.unboundid.ldap.sdk.LDAPConnectionInfo,java.lang.String,int,com.unboundid.ldap.sdk.DisconnectType,java.lang.String,java.lang.Throwable)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logExtendedRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ExtendedRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logExtendedResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ExtendedResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logIntermediateResponse(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.IntermediateResponse)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logModifyDNRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ReadOnlyModifyDNRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logModifyDNResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logModifyRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ReadOnlyModifyRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logModifyResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logSearchEntry(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.SearchResultEntry)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logSearchReference(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.SearchResultReference)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logSearchRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ReadOnlySearchRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logSearchResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.SearchResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logUnbindRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck constructor public com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck()
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public final java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void ensureConnectionValidAfterAuthentication(com.unboundid.ldap.sdk.LDAPConnection,com.unboundid.ldap.sdk.BindResult) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void ensureConnectionValidAfterException(com.unboundid.ldap.sdk.LDAPConnection,com.unboundid.ldap.sdk.LDAPException) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void ensureConnectionValidForCheckout(com.unboundid.ldap.sdk.LDAPConnection) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void ensureConnectionValidForContinuedUse(com.unboundid.ldap.sdk.LDAPConnection) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void ensureConnectionValidForRelease(com.unboundid.ldap.sdk.LDAPConnection) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void ensureNewConnectionValid(com.unboundid.ldap.sdk.LDAPConnection) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void performPoolMaintenance(com.unboundid.ldap.sdk.AbstractConnectionPool)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest constructor protected com.unboundid.ldap.sdk.LDAPRequest(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public abstract com.unboundid.ldap.sdk.OperationType getOperationType()
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public abstract int getLastMessageID()
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public abstract void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final boolean followReferrals(com.unboundid.ldap.sdk.LDAPConnection)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final boolean hasControl()
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final boolean hasControl(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final com.unboundid.ldap.sdk.Control getControl(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final com.unboundid.ldap.sdk.Control[] getControls()
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final com.unboundid.ldap.sdk.IntermediateResponseListener getIntermediateResponseListener()
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final com.unboundid.ldap.sdk.ReferralConnector getReferralConnector(com.unboundid.ldap.sdk.LDAPConnection)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final java.util.List<com.unboundid.ldap.sdk.Control> getControlList()
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final long getResponseTimeoutMillis(com.unboundid.ldap.sdk.LDAPConnection)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final void setFollowReferrals(java.lang.Boolean)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final void setIntermediateResponseListener(com.unboundid.ldap.sdk.IntermediateResponseListener)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final void setReferralConnector(com.unboundid.ldap.sdk.ReferralConnector)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final void setResponseTimeoutMillis(long)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult constructor protected com.unboundid.ldap.sdk.LDAPResult(com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPResult constructor public com.unboundid.ldap.sdk.LDAPResult(int,com.unboundid.ldap.sdk.ResultCode)
+@Extensible class com.unboundid.ldap.sdk.LDAPResult constructor public com.unboundid.ldap.sdk.LDAPResult(int,com.unboundid.ldap.sdk.ResultCode,java.lang.String,java.lang.String,java.lang.String[],com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.LDAPResult constructor public com.unboundid.ldap.sdk.LDAPResult(int,com.unboundid.ldap.sdk.ResultCode,java.lang.String,java.lang.String,java.util.List<java.lang.String>,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final boolean hasResponseControl()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final boolean hasResponseControl(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final com.unboundid.ldap.sdk.Control getResponseControl(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final com.unboundid.ldap.sdk.Control[] getResponseControls()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final com.unboundid.ldap.sdk.OperationType getOperationType()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final com.unboundid.ldap.sdk.ResultCode getResultCode()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final int getMessageID()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final java.lang.String getDiagnosticMessage()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final java.lang.String getMatchedDN()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final java.lang.String[] getReferralURLs()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public java.lang.String getResultString()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection constructor public com.unboundid.ldap.sdk.MockableLDAPConnection(com.unboundid.ldap.sdk.LDAPConnection)
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.BindResult bind(com.unboundid.ldap.sdk.BindRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.BindResult bind(java.lang.String,java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.CompareResult compare(com.unboundid.ldap.sdk.CompareRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.CompareResult compare(com.unboundid.ldap.sdk.ReadOnlyCompareRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.CompareResult compare(java.lang.String,java.lang.String,java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.ExtendedResult processExtendedOperation(com.unboundid.ldap.sdk.ExtendedRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.ExtendedResult processExtendedOperation(java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.ExtendedResult processExtendedOperation(java.lang.String,com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult add(com.unboundid.ldap.sdk.AddRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult add(com.unboundid.ldap.sdk.Entry) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult add(com.unboundid.ldap.sdk.ReadOnlyAddRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult add(java.lang.String,com.unboundid.ldap.sdk.Attribute...) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult add(java.lang.String,java.util.Collection<com.unboundid.ldap.sdk.Attribute>) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult add(java.lang.String...) throws com.unboundid.ldif.LDIFException,com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult delete(com.unboundid.ldap.sdk.DeleteRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult delete(com.unboundid.ldap.sdk.ReadOnlyDeleteRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult delete(java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modify(com.unboundid.ldap.sdk.ModifyRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modify(com.unboundid.ldap.sdk.ReadOnlyModifyRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modify(java.lang.String,com.unboundid.ldap.sdk.Modification) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modify(java.lang.String,com.unboundid.ldap.sdk.Modification...) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modify(java.lang.String,java.util.List<com.unboundid.ldap.sdk.Modification>) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modify(java.lang.String...) throws com.unboundid.ldif.LDIFException,com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modifyDN(com.unboundid.ldap.sdk.ModifyDNRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modifyDN(com.unboundid.ldap.sdk.ReadOnlyModifyDNRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modifyDN(java.lang.String,java.lang.String,boolean) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modifyDN(java.lang.String,java.lang.String,boolean,java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.RootDSE getRootDSE() throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(com.unboundid.ldap.sdk.ReadOnlySearchRequest) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(com.unboundid.ldap.sdk.SearchRequest) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(com.unboundid.ldap.sdk.SearchResultListener,java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.DereferencePolicy,int,int,boolean,com.unboundid.ldap.sdk.Filter,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(com.unboundid.ldap.sdk.SearchResultListener,java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.DereferencePolicy,int,int,boolean,java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(com.unboundid.ldap.sdk.SearchResultListener,java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.Filter,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(com.unboundid.ldap.sdk.SearchResultListener,java.lang.String,com.unboundid.ldap.sdk.SearchScope,java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.DereferencePolicy,int,int,boolean,com.unboundid.ldap.sdk.Filter,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.DereferencePolicy,int,int,boolean,java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.Filter,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(java.lang.String,com.unboundid.ldap.sdk.SearchScope,java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry getEntry(java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry getEntry(java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry searchForEntry(com.unboundid.ldap.sdk.ReadOnlySearchRequest) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry searchForEntry(com.unboundid.ldap.sdk.SearchRequest) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry searchForEntry(java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.DereferencePolicy,int,boolean,com.unboundid.ldap.sdk.Filter,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry searchForEntry(java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.DereferencePolicy,int,boolean,java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry searchForEntry(java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.Filter,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry searchForEntry(java.lang.String,com.unboundid.ldap.sdk.SearchScope,java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.schema.Schema getSchema() throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.schema.Schema getSchema(java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public final com.unboundid.ldap.sdk.LDAPConnection getWrappedConnection()
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public void close()
+@Extensible class com.unboundid.ldap.sdk.NameResolver constructor protected com.unboundid.ldap.sdk.NameResolver()
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public abstract void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public final java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public java.lang.String getCanonicalHostName(java.net.InetAddress)
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public java.lang.String getHostName(java.net.InetAddress)
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public java.net.InetAddress getByName(java.lang.String) throws java.net.UnknownHostException,java.lang.SecurityException
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public java.net.InetAddress getLocalHost() throws java.net.UnknownHostException,java.lang.SecurityException
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public java.net.InetAddress getLoopbackAddress()
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public java.net.InetAddress[] getAllByName(java.lang.String) throws java.net.UnknownHostException,java.lang.SecurityException
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public static void setJVMSuccessfulLookupCacheTTLSeconds(int)
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public static void setJVMUnsuccessfulLookupCacheTTLSeconds(int)
+@Extensible class com.unboundid.ldap.sdk.PasswordProvider constructor public com.unboundid.ldap.sdk.PasswordProvider()
+@Extensible class com.unboundid.ldap.sdk.PasswordProvider method public abstract byte[] getPasswordBytes() throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.SASLBindRequest constructor protected com.unboundid.ldap.sdk.SASLBindRequest(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.SASLBindRequest field protected static final byte CRED_TYPE_SASL
+@Extensible class com.unboundid.ldap.sdk.SASLBindRequest method protected final com.unboundid.ldap.sdk.BindResult sendBindRequest(com.unboundid.ldap.sdk.LDAPConnection,java.lang.String,com.unboundid.asn1.ASN1Oct...
 
[truncated message content]

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1578] tags/6.0.7/

[<di...@us...>]

Revision: 1578
          http://sourceforge.net/p/ldap-sdk/code/1578
Author:   dirmgr
Date:     2022-12-08 17:46:36 +0000 (Thu, 08 Dec 2022)
Log Message:
-----------
Create a tag for the 6.0.7 release

Added Paths:
-----------
    tags/6.0.7/

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1577] trunk

[<di...@us...>]

Revision: 1577
          http://sourceforge.net/p/ldap-sdk/code/1577
Author:   dirmgr
Date:     2022-11-28 20:14:12 +0000 (Mon, 28 Nov 2022)
Log Message:
-----------
Fix an issue with mutually dependent arguments

Fixed a bug in the argument parser's support for mutually dependent
arguments.  In a mutually dependent argument set, if any one of the
arguments is provided, then all of the other arguments in the set
must also be provided, but there was a problem with support for sets
containing three or more elements.  In such cases, the argument
parser would only enforce that at least two arguments from the set
were present.

Modified Paths:
--------------
    trunk/docs/release-notes.html
    trunk/src/com/unboundid/util/args/ArgumentParser.java
    trunk/tests/unit/src/com/unboundid/util/args/ArgumentParserTestCase.java

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2022-11-07 15:25:49 UTC (rev 1576)
+++ trunk/docs/release-notes.html	2022-11-28 20:14:12 UTC (rev 1577)
@@ -28,6 +28,16 @@
                 </li>
 
                 <li>
+                  Fixed a bug in the argument parser's support for mutually dependent arguments.
+                  In a mutually dependent argument set, if any one of the arguments is provided,
+                  then all of the other arguments in the set must also be provided, but there was
+                  a problem with support for sets containing three or more elements.  In such
+                  cases, the argument parser would only enforce that at least two arguments from
+                  the set were present.
+                  <br><br>
+                </li>
+
+                <li>
                   Added JSONObject methods for retrieving fields by name using case-insensitive
                   matching.  By default, JSON field names are treated in a case-sensitive manner,
                   but new methods allow them to be retrieved in a case-insensitive manner.

Modified: trunk/src/com/unboundid/util/args/ArgumentParser.java
===================================================================
--- trunk/src/com/unboundid/util/args/ArgumentParser.java	2022-11-07 15:25:49 UTC (rev 1576)
+++ trunk/src/com/unboundid/util/args/ArgumentParser.java	2022-11-28 20:14:12 UTC (rev 1577)
@@ -55,7 +55,6 @@
 import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
-import java.util.HashSet;
 import java.util.Iterator;
 import java.util.LinkedHashSet;
 import java.util.LinkedHashMap;
@@ -1488,12 +1487,14 @@
                 " that is not registered with the argument parser.");
     }
 
-    final Set<Argument> allArgsSet = new HashSet<>(arguments);
-    for (final Argument a : allArgsSet)
+    final List<Argument> allArgsList = new ArrayList<>(arguments);
+    for (int i=0; i < allArgsList.size(); i++)
     {
-      final Set<Argument> dependentArgs = new HashSet<>(allArgsSet);
-      dependentArgs.remove(a);
-      addDependentArgumentSet(a, dependentArgs);
+      for (int j=(i+1); j < allArgsList.size(); j++)
+      {
+        addDependentArgumentSet(allArgsList.get(i), allArgsList.get(j));
+        addDependentArgumentSet(allArgsList.get(j), allArgsList.get(i));
+      }
     }
   }
 

Modified: trunk/tests/unit/src/com/unboundid/util/args/ArgumentParserTestCase.java
===================================================================
--- trunk/tests/unit/src/com/unboundid/util/args/ArgumentParserTestCase.java	2022-11-07 15:25:49 UTC (rev 1576)
+++ trunk/tests/unit/src/com/unboundid/util/args/ArgumentParserTestCase.java	2022-11-28 20:14:12 UTC (rev 1577)
@@ -604,13 +604,15 @@
 
     assertNotNull(p.getDependentArgumentSets());
     assertFalse(p.getDependentArgumentSets().isEmpty());
-    assertEquals(p.getDependentArgumentSets().size(), 2);
+    assertEquals(p.getDependentArgumentSets().size(), 2,
+         String.valueOf(p.getDependentArgumentSets()));
 
     p.addMutuallyDependentArgumentSet(c, d, e);
 
     assertNotNull(p.getDependentArgumentSets());
     assertFalse(p.getDependentArgumentSets().isEmpty());
-    assertEquals(p.getDependentArgumentSets().size(), 5);
+    assertEquals(p.getDependentArgumentSets().size(), 8,
+         String.valueOf(p.getDependentArgumentSets()));
 
     try
     {
@@ -702,6 +704,104 @@
     {
       // This was expected.
     }
+
+
+    // Make sure that the parser properly rejects attempts to use mutually
+    // dependent arguments without each other.
+    try
+    {
+      p.reset();
+      p.parse(new String[] { "-a" });
+      fail("Expected an exception when providing a but not b");
+    }
+    catch (final ArgumentException ex)
+    {
+      // This was expected.
+    }
+
+    try
+    {
+      p.reset();
+      p.parse(new String[] { "-b" });
+      fail("Expected an exception when providing b but not a");
+    }
+    catch (final ArgumentException ex)
+    {
+      // This was expected.
+    }
+
+    p.reset();
+    p.parse(new String[] { "-a", "-b" });
+
+
+    try
+    {
+      p.reset();
+      p.parse(new String[] { "-c" });
+      fail("Expected an exception when providing c but not d or e");
+    }
+    catch (final ArgumentException ex)
+    {
+      // This was expected.
+    }
+
+    try
+    {
+      p.reset();
+      p.parse(new String[] { "-d" });
+      fail("Expected an exception when providing d but not c or e");
+    }
+    catch (final ArgumentException ex)
+    {
+      // This was expected.
+    }
+
+    try
+    {
+      p.reset();
+      p.parse(new String[] { "-e" });
+      fail("Expected an exception when providing e but not c or d");
+    }
+    catch (final ArgumentException ex)
+    {
+      // This was expected.
+    }
+
+    try
+    {
+      p.reset();
+      p.parse(new String[] { "-c", "-d" });
+      fail("Expected an exception when providing c and d but not e");
+    }
+    catch (final ArgumentException ex)
+    {
+      // This was expected.
+    }
+
+    try
+    {
+      p.reset();
+      p.parse(new String[] { "-c", "-e" });
+      fail("Expected an exception when providing c and e but not d");
+    }
+    catch (final ArgumentException ex)
+    {
+      // This was expected.
+    }
+
+    try
+    {
+      p.reset();
+      p.parse(new String[] { "-d", "-e" });
+      fail("Expected an exception when providing d and e but not c");
+    }
+    catch (final ArgumentException ex)
+    {
+      // This was expected.
+    }
+
+    p.reset();
+    p.parse(new String[] { "-c", "-d", "-e" });
   }
 
 

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1576] trunk/docs/specs

[<di...@us...>]

Revision: 1576
          http://sourceforge.net/p/ldap-sdk/code/1576
Author:   dirmgr
Date:     2022-11-07 15:25:49 +0000 (Mon, 07 Nov 2022)
Log Message:
-----------
Add draft-schmaus-kitten-sasl-ht-09

Updated the set of LDAP-related specifications to include the latest
version of draft-schmaus-kitten-sasl-ht.

Modified Paths:
--------------
    trunk/docs/specs/internet-drafts.html

Added Paths:
-----------
    trunk/docs/specs/draft-schmaus-kitten-sasl-ht-09.txt

Removed Paths:
-------------
    trunk/docs/specs/draft-schmaus-kitten-sasl-ht-08.txt

Deleted: trunk/docs/specs/draft-schmaus-kitten-sasl-ht-08.txt
===================================================================
--- trunk/docs/specs/draft-schmaus-kitten-sasl-ht-08.txt	2022-10-26 22:14:15 UTC (rev 1575)
+++ trunk/docs/specs/draft-schmaus-kitten-sasl-ht-08.txt	2022-11-07 15:25:49 UTC (rev 1576)
@@ -1,616 +0,0 @@
-
-
-
-
-Common Authentication Technology Next Generation              F. Schmaus
-Internet-Draft                                                  C. Egger
-Intended status: Experimental                      FAU Erlangen-Nürnberg
-Expires: 13 April 2023                                   10 October 2022
-
-
-                    The Hashed Token SASL Mechanism
-                    draft-schmaus-kitten-sasl-ht-08
-
-Abstract
-
-      This I-D is developed at
-      https://github.com/Flowdalic/xeps/tree/master/draft-schmaus-
-      kitten-sasl-ht (https://github.com/Flowdalic/xeps/tree/master/
-      draft-schmaus-kitten-sasl-ht)
-
-   This document specifies the family of Hashed Token SASL mechanisms
-   which enable a proof-of-possession-based authentication scheme and
-   are meant to be used for quick re-authentication of a previous
-   session.  The Hashed Token SASL mechanism's authentication sequence
-   consists of only one round-trip.  The usage of short-lived,
-   exclusively ephemeral hashed tokens is achieving the single round-
-   trip property.  The SASL mechanism specified herin further provides
-   hash agility, mutual authentication and is secured by channel
-   binding.
-
-Status of This Memo
-
-   This Internet-Draft is submitted in full conformance with the
-   provisions of BCP 78 and BCP 79.
-
-   Internet-Drafts are working documents of the Internet Engineering
-   Task Force (IETF).  Note that other groups may also distribute
-   working documents as Internet-Drafts.  The list of current Internet-
-   Drafts is at https://datatracker.ietf.org/drafts/current/.
-
-   Internet-Drafts are draft documents valid for a maximum of six months
-   and may be updated, replaced, or obsoleted by other documents at any
-   time.  It is inappropriate to use Internet-Drafts as reference
-   material or to cite them other than as "work in progress."
-
-   This Internet-Draft will expire on 13 April 2023.
-
-Copyright Notice
-
-   Copyright (c) 2022 IETF Trust and the persons identified as the
-   document authors.  All rights reserved.
-
-
-
-
-Schmaus & Egger           Expires 13 April 2023                 [Page 1]
-
-Internet-Draft       The Hashed Token SASL Mechanism        October 2022
-
-
-   This document is subject to BCP 78 and the IETF Trust's Legal
-   Provisions Relating to IETF Documents (https://trustee.ietf.org/
-   license-info) in effect on the date of publication of this document.
-   Please review these documents carefully, as they describe your rights
-   and restrictions with respect to this document.
-
-Table of Contents
-
-   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
-     1.1.  Conventions and Terminology . . . . . . . . . . . . . . .   3
-     1.2.  Applicability . . . . . . . . . . . . . . . . . . . . . .   3
-   2.  The HT Family of Mechanisms . . . . . . . . . . . . . . . . .   4
-   3.  The HT Authentication Exchange  . . . . . . . . . . . . . . .   5
-     3.1.  Initiator First Message . . . . . . . . . . . . . . . . .   5
-     3.2.  Initiator Authentication  . . . . . . . . . . . . . . . .   6
-     3.3.  Final Responder Message . . . . . . . . . . . . . . . . .   6
-   4.  Compliance with SASL Mechanism Requirements . . . . . . . . .   7
-   5.  Requirements for the Application-Protocol Extension . . . . .   7
-   6.  Security Considerations . . . . . . . . . . . . . . . . . . .   7
-   7.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   8
-   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   8
-     8.1.  Normative References  . . . . . . . . . . . . . . . . . .   8
-     8.2.  Informative References  . . . . . . . . . . . . . . . . .  10
-   Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . .  11
-   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  11
-
-1.  Introduction
-
-   This specification describes the family of Hashed Token (HT) Simple
-   Authentication and Security Layer (SASL) [RFC4422] mechanisms, which
-   enable a proof-of-possession-based authentication scheme.  The HT
-   mechanism is designed to be used with short-lived, exclusively
-   ephemeral tokens, called SASL-HT tokens, and allow for quick, one
-   round-trip, re-authentication of a previous session.
-
-   Further properties of the HT mechanism are 1) hash agility, 2) mutual
-   authentication, and 3) being secured by channel binding.
-
-   Clients are supposed to request SASL-HT tokens from the server after
-   being authenticated using a "strong" SASL mechanism like SCRAM
-   [RFC5802].  Hence a typical sequence of actions using HT may look
-   like the following:
-
-
-
-
-
-
-
-
-
-Schmaus & Egger           Expires 13 April 2023                 [Page 2]
-
-Internet-Draft       The Hashed Token SASL Mechanism        October 2022
-
-
-   A) Client authenticates using a strong mechanism (e.g., SCRAM)
-   B) Client requests secret SASL-HT token
-   C) Service returns SASL-HT token
-      <normal client-server interaction here>
-   D) Connection between client and server gets interrupted,
-      for example because of a WiFi ↔ GSM switch
-   E) Client resumes the previous session using HT and token from C)
-   F) Service revokes the successfully used SASL-HT token
-      [goto B]
-
-   The HT mechanism requires an accompanying, application protocol
-   specific, extension, which allows clients to requests a new SASL-HT
-   token (see Section 5 (Section 5)).  One example for such an
-   application protocol specific extension based on HT is [XEP-0397].
-   This XMPP [RFC6120] extension protocol allows, amongst other things,
-   B) and C),
-
-   Since the SASL-HT token is not salted, and only one hash iteration is
-   used, the HT mechanism is not suitable to protect long-lived shared
-   secrets (e.g. "passwords").  You may want to look at [RFC5802] for
-   that.
-
-1.1.  Conventions and Terminology
-
-   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
-   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
-   "OPTIONAL" in this document are to be interpreted as described in
-   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
-   capitals, as shown here.  These words may also appear in this
-   document in lower case as plain English words, absent their normative
-   meanings.
-
-1.2.  Applicability
-
-   Because this mechanism transports information that should not be
-   controlled by an attacker, the HT mechanism *MUST* only be used over
-   channels protected by Transport Layer Security (TLS, see [RFC5246]),
-   or over similar integrity-protected and authenticated channels.
-   Also, the application protcol specific extension which requests a new
-   SASL-HT token *SHOULD* only be used over similarly protected
-   channels.
-
-   Also, when TLS is used, the client *MUST* successfully validate the
-   server's certificate ([RFC5280], [RFC6125]).
-
-   The family of HT mechanisms is not applicable for proxy
-   authentication since they can not carry an authorization identity
-   string (authzid).
-
-
-
-Schmaus & Egger           Expires 13 April 2023                 [Page 3]
-
-Internet-Draft       The Hashed Token SASL Mechanism        October 2022
-
-
-2.  The HT Family of Mechanisms
-
-   Each mechanism in this family differs by choice of the hash algorithm
-   and the choice of the channel binding [RFC5929] type.
-
-   An HT mechanism name is a string beginning with "HT-" followed by the
-   capitalised name of the used hash, followed by "-", and suffixed by
-   one of 'ENDP' and 'UNIQ'.
-
-   Hence each HT mechanism has a name of the following form:
-
-   HT-<hash-alg>-<cb-type>
-
-   Where <hash-alg> is the capitalised "Hash Name String" of the IANA
-   "Named Information Hash Algorithm Registry" [iana-hash-alg] as
-   specified in [RFC6920], and <cb-type> is one of 'ENDP', 'UNIQ', or
-   'EXPR' denoting the channel binding type.  In the case of 'ENDP', the
-   tls-server-end-point channel binding type is used.  In the case of
-   'UNIQ', the tls-unique channel binding type is used.  In the case of
-   'EXPR', the tls-exporter [RFC9266] channel binding type is used.
-   Valid channel binding types are defined in the IANA "Channel-Binding
-   Types" registry [iana-cbt] as specified in [RFC5056].
-
-                    +=========+======================+
-                    | cb-type | Channel Binding Type |
-                    +=========+======================+
-                    | ENDP    | tls-server-end-point |
-                    +---------+----------------------+
-                    | UNIQ    | tls-unique           |
-                    +---------+----------------------+
-                    | EXPR    | tls-exporter         |
-                    +---------+----------------------+
-
-                      Table 1: Mapping of cb-type to
-                          Channel Binding Types
-
-   The following table lists some examples of HT SASL mechanisms
-   registered by this document.
-
-
-
-
-
-
-
-
-
-
-
-
-
-Schmaus & Egger           Expires 13 April 2023                 [Page 4]
-
-Internet-Draft       The Hashed Token SASL Mechanism        October 2022
-
-
-      +==================+===================+======================+
-      | Mechanism Name   | HT Hash Algorithm | Channel-binding      |
-      |                  |                   | unique prefix        |
-      +==================+===================+======================+
-      | HT-SHA-512-ENDP  | SHA-512           | tls-server-end-point |
-      +------------------+-------------------+----------------------+
-      | HT-SHA-512-UNIQ  | SHA-512           | tls-unique           |
-      +------------------+-------------------+----------------------+
-      | HT-SHA3-512-ENDP | SHA3-512          | tls-server-end-point |
-      +------------------+-------------------+----------------------+
-      | HT-SHA-256-UNIQ  | SHA-256           | tls-unique           |
-      +------------------+-------------------+----------------------+
-
-                  Table 2: Examples of HT SASL mechanisms
-
-3.  The HT Authentication Exchange
-
-   The mechanism consists of a simple exchange of precisely two messages
-   between the initiator and responder.
-
-   The following syntax specifications use the Augmented Backus-Naur
-   form (ABNF) notation as specified in [RFC5234].
-
-3.1.  Initiator First Message
-
-   The HT mechanism starts with the initiator-msg, send by the initiator
-   to the responder.  The following lists the ABNF grammar for the
-   initiator-msg:
-
-   initiator-msg = authcid NUL initiator-hashed-token
-   authcid = 1*SAFE ; MUST accept up to 255 octets
-   initiator-hashed-token = 1*OCTET
-
-   NUL    = %0x00 ; The null octet
-   SAFE   = UTF1 / UTF2 / UTF3 / UTF4
-            ;; any UTF-8 encoded Unicode character except NUL
-
-   UTF1   = %x01-7F ;; except NUL
-   UTF2   = %xC2-DF UTF0
-   UTF3   = %xE0 %xA0-BF UTF0 / %xE1-EC 2(UTF0) /
-            %xED %x80-9F UTF0 / %xEE-EF 2(UTF0)
-   UTF4   = %xF0 %x90-BF 2(UTF0) / %xF1-F3 3(UTF0) /
-            %xF4 %x80-8F 2(UTF0)
-   UTF0   = %x80-BF
-
-   The initiator first message starts with the authentication identity
-   (authcid, see[RFC4422]) as UTF-8 [RFC3629] encoded string.  It is
-   followed by initiator-hashed-token separated by as single null octet.
-
-
-
-Schmaus & Egger           Expires 13 April 2023                 [Page 5]
-
-Internet-Draft       The Hashed Token SASL Mechanism        October 2022
-
-
-   The value of the initiator-hashed-token is defined as follows:
-
-   initiator-hashed-token := HMAC(token, "Initiator" || cb-data)
-
-   HMAC() is the function defined in [RFC2104] with H being the selected
-   HT hash algorithm, 'cb-data' represents the data provided by the
-   selected channel binding type, and 'token' are the UTF-8 encoded
-   octets of the SASL-HT token string which acts as a shared secret
-   between initiator and responder.
-
-   The initiator-msg *MAY* be included in TLS 1.3 0-RTT early data, as
-   specified in [RFC8446].  If this is the case, then the initiating
-   entity *MUST NOT* include any further application protocol payload in
-   the early data besides the HT initiator-msg and potential required
-   framing of the SASL profile.  The responder *MUST* abort the SASL
-   authentication if the early data contains additional application
-   protocol payload.
-
-      SASL-HT hence allows exploiting TLS 1.3 early data for "0.5 Round
-      Trip Time (RTT)" resumption of the application protocol's session.
-      Using TLS early data requires extra care when implementing: The
-      early data should only contain the SASL-HT payload, i.e., the
-      initiator-msg, and not an application protocol specific payload.
-      The reason for this is that the early data could be replayed, and
-      thus needs to carry an idempotent operation.  On the other hand,
-      if the responding entity can verify the early data, then it can
-      send additional application protocol payload together with the
-      "resumption successful" response to the initiating entity.
-
-3.2.  Initiator Authentication
-
-   Upon receiving the initiator-msg, the responder calculates itself the
-   value of initiator-hashed-token and compares it with the received
-   value found in the initiator-msg.  If both values are equal, then the
-   initiator has been successfully authenticated.  Otherwise, if both
-   values are not equal, then authentication *MUST* fail.
-
-   If the responder was able to authenticate the initiator, then the
-   used token *MUST* be revoked immediately.
-
-3.3.  Final Responder Message
-
-   After the initiator was authenticated the responder continues the
-   SASL authentication by sending the responder-msg to the initiator.
-
-   The ABNF for responder-msg is:
-
-   responder-msg = 1*OCTET
-
-
-
-Schmaus & Egger           Expires 13 April 2023                 [Page 6]
-
-Internet-Draft       The Hashed Token SASL Mechanism        October 2022
-
-
-   The responder-msg value is defined as follows:
-
-   responder-msg := HMAC(token, "Responder" || cb-data)
-
-   The initiating entity *MUST* verify the responder-msg to achieve
-   mutual authentication.
-
-4.  Compliance with SASL Mechanism Requirements
-
-   This section describes compliance with SASL mechanism requirements
-   specified in Section 5 of [RFC4422].
-
-   1.  "HT-SHA-256-ENDP", "HT-SHA-256-UNIQ", "HT-SHA-3-512-ENDP" and
-       "HT-SHA-3-512-UNIQ".
-
-   2.  Definition of server-challenges and client-responses: a) HT is a
-       client-first mechanism. b) HT does send additional data with
-       success (the responder-msg).
-
-   3.  HT is not capable of transferring authorization identities from
-       the client to the server.
-
-   4.  HT does not offer any security layers (HT offers channel binding
-       instead).
-
-   5.  HT does not protect the authorization identity.
-
-5.  Requirements for the Application-Protocol Extension
-
-   It is *REQUIRED* that the application-protocol specific extension
-   provides a mechanism to request a SASL-HT token in form of a Unicode
-   string.  The returned token *MUST* have been newly generated by a
-   cryptographically secure random number generator and MUST contain at
-   least 128 bit of entropy.
-
-   It is *RECOMMENDED* that the protocol allows the requestor to signal
-   the name of the SASL mechanism which he intends to use with the
-   token.  If a token is used with a different mechanism than the one
-   which was signalled upon requesting the token, then the
-   authentication *MUST* fail.  This allows pinning the token to a SASL
-   mechanism, which increases the security because it makes it
-   impossible for an attacker to downgrade the SASL mechanism.
-
-6.  Security Considerations
-
-   To be secure, the HT mechanism *MUST* be used over a TLS channel that
-   has had the session hash extension [RFC7627] negotiated, or session
-   resumption *MUST NOT* have been used.
-
-
-
-Schmaus & Egger           Expires 13 April 2023                 [Page 7]
-
-Internet-Draft       The Hashed Token SASL Mechanism        October 2022
-
-
-   It is *RECOMMENDED* that implementations periodically require a full
-   authentication using a strong SASL mechanism which does not use the
-   SASL-HT token.
-
-   It is of vital importance that the SASL-HT token is generated by a
-   cryptographically secure random generator.  See [RFC4086] for more
-   information about Randomness Requirements for Security.
-
-7.  IANA Considerations
-
-   IANA is requested to add the following family of SASL mechanisms to
-   the SASL Mechanism registry established by [RFC4422]:
-
-      To: ia...@ia...
-
-      Subject: Registration of a new SASL family HT
-
-      SASL mechanism name (or prefix for the family): HT-*
-
-      Security considerations: Section 6 of draft-schmaus-kitten-sasl-ht
-
-      Published specification (optional, recommended): draft-schmaus-
-      kitten-sasl-ht-XX (TODO)
-
-      Person & email address to contact for further information: IETF
-      SASL WG ki...@ie... (mailto:ki...@ie...)
-
-      Intended usage: COMMON
-
-      Owner/Change controller: IESG ie...@ie... (mailto:ie...@ie...)
-
-      Note: Members of this family MUST be explicitly registered using
-      the "IETF Review" [RFC5226] registration procedure.  Reviews MUST
-      be requested on the Kitten WG mailing list ki...@ie...
-      (mailto:ki...@ie...) (or a successor designated by the
-      responsible Security AD).
-
-8.  References
-
-8.1.  Normative References
-
-   [RFC2104]  Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
-              Hashing for Message Authentication", RFC 2104,
-              DOI 10.17487/RFC2104, February 1997,
-              <https://www.rfc-editor.org/info/rfc2104>.
-
-
-
-
-
-
-Schmaus & Egger           Expires 13 April 2023                 [Page 8]
-
-Internet-Draft       The Hashed Token SASL Mechanism        October 2022
-
-
-   [RFC3629]  Yergeau, F., "UTF-8, a transformation format of ISO
-              10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November
-              2003, <https://www.rfc-editor.org/info/rfc3629>.
-
-   [RFC4086]  Eastlake 3rd, D., Schiller, J., and S. Crocker,
-              "Randomness Requirements for Security", BCP 106, RFC 4086,
-              DOI 10.17487/RFC4086, June 2005,
-              <https://www.rfc-editor.org/info/rfc4086>.
-
-   [RFC4422]  Melnikov, A., Ed. and K. Zeilenga, Ed., "Simple
-              Authentication and Security Layer (SASL)", RFC 4422,
-              DOI 10.17487/RFC4422, June 2006,
-              <https://www.rfc-editor.org/info/rfc4422>.
-
-   [RFC5056]  Williams, N., "On the Use of Channel Bindings to Secure
-              Channels", RFC 5056, DOI 10.17487/RFC5056, November 2007,
-              <https://www.rfc-editor.org/info/rfc5056>.
-
-   [RFC5234]  Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax
-              Specifications: ABNF", STD 68, RFC 5234,
-              DOI 10.17487/RFC5234, January 2008,
-              <https://www.rfc-editor.org/info/rfc5234>.
-
-   [RFC5246]  Dierks, T. and E. Rescorla, "The Transport Layer Security
-              (TLS) Protocol Version 1.2", RFC 5246,
-              DOI 10.17487/RFC5246, August 2008,
-              <https://www.rfc-editor.org/info/rfc5246>.
-
-   [RFC5280]  Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
-              Housley, R., and W. Polk, "Internet X.509 Public Key
-              Infrastructure Certificate and Certificate Revocation List
-              (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
-              <https://www.rfc-editor.org/info/rfc5280>.
-
-   [RFC5929]  Altman, J., Williams, N., and L. Zhu, "Channel Bindings
-              for TLS", RFC 5929, DOI 10.17487/RFC5929, July 2010,
-              <https://www.rfc-editor.org/info/rfc5929>.
-
-   [RFC6125]  Saint-Andre, P. and J. Hodges, "Representation and
-              Verification of Domain-Based Application Service Identity
-              within Internet Public Key Infrastructure Using X.509
-              (PKIX) Certificates in the Context of Transport Layer
-              Security (TLS)", RFC 6125, DOI 10.17487/RFC6125, March
-              2011, <https://www.rfc-editor.org/info/rfc6125>.
-
-
-
-
-
-
-
-Schmaus & Egger           Expires 13 April 2023                 [Page 9]
-
-Internet-Draft       The Hashed Token SASL Mechanism        October 2022
-
-
-   [RFC6920]  Farrell, S., Kutscher, D., Dannewitz, C., Ohlman, B.,
-              Keranen, A., and P. Hallam-Baker, "Naming Things with
-              Hashes", RFC 6920, DOI 10.17487/RFC6920, April 2013,
-              <https://www.rfc-editor.org/info/rfc6920>.
-
-   [RFC7627]  Bhargavan, K., Ed., Delignat-Lavaud, A., Pironti, A.,
-              Langley, A., and M. Ray, "Transport Layer Security (TLS)
-              Session Hash and Extended Master Secret Extension",
-              RFC 7627, DOI 10.17487/RFC7627, September 2015,
-              <https://www.rfc-editor.org/info/rfc7627>.
-
-   [RFC8446]  Rescorla, E., "The Transport Layer Security (TLS) Protocol
-              Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
-              <https://www.rfc-editor.org/info/rfc8446>.
-
-   [RFC9266]  Whited, S., "Channel Bindings for TLS 1.3", RFC 9266,
-              DOI 10.17487/RFC9266, July 2022,
-              <https://www.rfc-editor.org/info/rfc9266>.
-
-   [iana-hash-alg]
-              Williams, N., "IANA Named Information Hash Algorithm
-              Registry", 2010, <https://www.iana.org/assignments/named-
-              information/named-information.xhtml#hash-alg>.
-
-   [iana-cbt] Williams, N., "IANA Channel-Binding Types", 2010,
-              <https://www.iana.org/assignments/channel-binding-types/
-              channel-binding-types.xhtml>.
-
-   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
-              Requirement Levels", BCP 14, RFC 2119,
-              DOI 10.17487/RFC2119, March 1997,
-              <https://www.rfc-editor.org/info/rfc2119>.
-
-   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
-              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
-              May 2017, <https://www.rfc-editor.org/info/rfc8174>.
-
-8.2.  Informative References
-
-   [RFC5226]  Narten, T. and H. Alvestrand, "Guidelines for Writing an
-              IANA Considerations Section in RFCs", RFC 5226,
-              DOI 10.17487/RFC5226, May 2008,
-              <https://www.rfc-editor.org/info/rfc5226>.
-
-
-
-
-
-
-
-
-Schmaus & Egger           Expires 13 April 2023                [Page 10]
-
-Internet-Draft       The Hashed Token SASL Mechanism        October 2022
-
-
-   [RFC5802]  Newman, C., Menon-Sen, A., Melnikov, A., and N. Williams,
-              "Salted Challenge Response Authentication Mechanism
-              (SCRAM) SASL and GSS-API Mechanisms", RFC 5802,
-              DOI 10.17487/RFC5802, July 2010,
-              <https://www.rfc-editor.org/info/rfc5802>.
-
-   [RFC6120]  Saint-Andre, P., "Extensible Messaging and Presence
-              Protocol (XMPP): Core", RFC 6120, DOI 10.17487/RFC6120,
-              March 2011, <https://www.rfc-editor.org/info/rfc6120>.
-
-   [XEP-0397] Schmaus, F., "XEP-0397: Instant Stream Resumption", 3
-              November 2018,
-              <https://xmpp.org/extensions/xep-0397.html>.
-
-Acknowledgments
-
-   This document benefited from discussions on the KITTEN WG mailing
-   list.  The authors would like to especially thank Thijs Alkemade, Sam
-   Whited and Alexey Melnikov for their comments on this topic.
-   Furthermore, we would like to thank Alexander Wuerstlein, who came up
-   with the idea to pin the token to a SASL mechanism for increased
-   security.
-
-Authors' Addresses
-
-   Florian Schmaus
-   FAU Erlangen-Nürnberg
-   Email: fl...@cs...
-
-
-   Christoph Egger
-   FAU Erlangen-Nürnberg
-   Email: eg...@cs...
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Schmaus & Egger           Expires 13 April 2023                [Page 11]

Added: trunk/docs/specs/draft-schmaus-kitten-sasl-ht-09.txt
===================================================================
--- trunk/docs/specs/draft-schmaus-kitten-sasl-ht-09.txt	                        (rev 0)
+++ trunk/docs/specs/draft-schmaus-kitten-sasl-ht-09.txt	2022-11-07 15:25:49 UTC (rev 1576)
@@ -0,0 +1,616 @@
+
+
+
+
+Common Authentication Technology Next Generation              F. Schmaus
+Internet-Draft                                                  C. Egger
+Intended status: Experimental                      FAU Erlangen-Nürnberg
+Expires: 11 May 2023                                     7 November 2022
+
+
+                    The Hashed Token SASL Mechanism
+                    draft-schmaus-kitten-sasl-ht-09
+
+Abstract
+
+   This document specifies the family of Hashed Token SASL mechanisms
+   which enable a proof-of-possession-based authentication scheme and
+   are meant to be used for quick re-authentication of a previous
+   session.  The Hashed Token SASL mechanism's authentication sequence
+   consists of only one round-trip.  The usage of short-lived,
+   exclusively ephemeral hashed tokens is achieving the single round-
+   trip property.  The SASL mechanism specified herin further provides
+   hash agility, mutual authentication and support for channel binding.
+
+About This Document
+
+   This note is to be removed before publishing as an RFC.
+
+   Status information for this document may be found at
+   https://datatracker.ietf.org/doc/draft-schmaus-kitten-sasl-ht/.
+
+   Source for this draft and an issue tracker can be found at
+   https://github.com/flowdalic/xeps/tree/master/draft-schmaus-kitten-
+   sasl-ht.
+
+Status of This Memo
+
+   This Internet-Draft is submitted in full conformance with the
+   provisions of BCP 78 and BCP 79.
+
+   Internet-Drafts are working documents of the Internet Engineering
+   Task Force (IETF).  Note that other groups may also distribute
+   working documents as Internet-Drafts.  The list of current Internet-
+   Drafts is at https://datatracker.ietf.org/drafts/current/.
+
+   Internet-Drafts are draft documents valid for a maximum of six months
+   and may be updated, replaced, or obsoleted by other documents at any
+   time.  It is inappropriate to use Internet-Drafts as reference
+   material or to cite them other than as "work in progress."
+
+   This Internet-Draft will expire on 11 May 2023.
+
+
+
+
+Schmaus & Egger            Expires 11 May 2023                  [Page 1]
+
+Internet-Draft       The Hashed Token SASL Mechanism       November 2022
+
+
+Copyright Notice
+
+   Copyright (c) 2022 IETF Trust and the persons identified as the
+   document authors.  All rights reserved.
+
+   This document is subject to BCP 78 and the IETF Trust's Legal
+   Provisions Relating to IETF Documents (https://trustee.ietf.org/
+   license-info) in effect on the date of publication of this document.
+   Please review these documents carefully, as they describe your rights
+   and restrictions with respect to this document.
+
+Table of Contents
+
+   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
+     1.1.  Conventions and Terminology . . . . . . . . . . . . . . .   3
+     1.2.  Applicability . . . . . . . . . . . . . . . . . . . . . .   3
+   2.  The HT Family of Mechanisms . . . . . . . . . . . . . . . . .   4
+   3.  The HT Authentication Exchange  . . . . . . . . . . . . . . .   5
+     3.1.  Initiator First Message . . . . . . . . . . . . . . . . .   5
+     3.2.  Initiator Authentication  . . . . . . . . . . . . . . . .   6
+     3.3.  Final Responder Message . . . . . . . . . . . . . . . . .   6
+   4.  Compliance with SASL Mechanism Requirements . . . . . . . . .   7
+   5.  Requirements for the Application-Protocol Extension . . . . .   7
+   6.  Security Considerations . . . . . . . . . . . . . . . . . . .   8
+   7.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   8
+   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   9
+     8.1.  Normative References  . . . . . . . . . . . . . . . . . .   9
+     8.2.  Informative References  . . . . . . . . . . . . . . . . .  10
+   Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . .  11
+   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  11
+
+1.  Introduction
+
+   This specification describes the family of Hashed Token (HT) Simple
+   Authentication and Security Layer (SASL) [RFC4422] mechanisms, which
+   enable a proof-of-possession-based authentication scheme.  The HT
+   mechanism is designed to be used with short-lived, exclusively
+   ephemeral tokens, called SASL-HT tokens, and allow for quick, one
+   round-trip, re-authentication of a previous session.
+
+   Further properties of the HT mechanism are 1) hash agility, 2) mutual
+   authentication, and 3) support for channel binding.
+
+   Clients are supposed to request SASL-HT tokens from the server after
+   being authenticated using a "strong" SASL mechanism like SCRAM
+   [RFC5802].  Hence a typical sequence of actions using HT may look
+   like the following:
+
+
+
+
+Schmaus & Egger            Expires 11 May 2023                  [Page 2]
+
+Internet-Draft       The Hashed Token SASL Mechanism       November 2022
+
+
+   A) Client authenticates using a strong mechanism (e.g., SCRAM)
+   B) Client requests secret SASL-HT token
+   C) Service returns SASL-HT token
+      <normal client-server interaction here>
+   D) Connection between client and server gets interrupted,
+      for example because of a WiFi ↔ GSM switch
+   E) Client resumes the previous session using HT and token from C)
+   F) Service revokes the successfully used SASL-HT token
+      [goto B]
+
+   The HT mechanism requires an accompanying, application protocol
+   specific, extension, which allows clients to requests a new SASL-HT
+   token (see Section 5 (Section 5)).  One example for such an
+   application protocol specific extension based on HT is [XEP-0397].
+   This XMPP [RFC6120] extension protocol allows, amongst other things,
+   B) and C),
+
+   Since the SASL-HT token is not salted, and only one hash iteration is
+   used, the HT mechanism is not suitable to protect long-lived shared
+   secrets (e.g. "passwords").  You may want to look at [RFC5802] for
+   that.
+
+1.1.  Conventions and Terminology
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
+   "OPTIONAL" in this document are to be interpreted as described in
+   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
+   capitals, as shown here.  These words may also appear in this
+   document in lower case as plain English words, absent their normative
+   meanings.
+
+1.2.  Applicability
+
+   Because this mechanism transports information that should not be
+   controlled by an attacker, the HT mechanism *MUST* only be used over
+   channels protected by Transport Layer Security (TLS, see [RFC8446]),
+   or over similar integrity-protected and authenticated channels.
+   Also, the application protcol specific extension which requests a new
+   SASL-HT token *SHOULD* only be used over similarly protected
+   channels.
+
+   Also, when TLS is used, the client *MUST* successfully validate the
+   server's certificate ([RFC5280], [RFC6125]).
+
+   The family of HT mechanisms is not applicable for proxy
+   authentication since they can not carry an authorization identity
+   string (authzid).
+
+
+
+Schmaus & Egger            Expires 11 May 2023                  [Page 3]
+
+Internet-Draft       The Hashed Token SASL Mechanism       November 2022
+
+
+2.  The HT Family of Mechanisms
+
+   Each mechanism in this family differs by choice of the hash algorithm
+   and the choice of the channel binding [RFC5929] type.
+
+   An HT mechanism name is a string beginning with "HT-" followed by the
+   capitalised name of the used hash, followed by "-", and suffixed by
+   one of 'ENDP', 'UNIQ', 'EXPR' or 'NONE'.
+
+   Hence each HT mechanism has a name of the following form:
+
+   HT-<hash-alg>-<cb-type>
+
+   Where <hash-alg> is the capitalised "Hash Name String" of the IANA
+   "Named Information Hash Algorithm Registry" [iana-hash-alg] as
+   specified in [RFC6920], and <cb-type> is one of 'ENDP', 'UNIQ',
+   'EXPR' or 'NONE' denoting the channel binding type.  In the case of
+   'ENDP', the tls-server-end-point channel binding type is used.  In
+   the case of 'UNIQ', the tls-unique channel binding type is used.  In
+   the case of 'EXPR', the tls-exporter [RFC9266] channel binding type
+   is used.  Valid channel binding types are defined in the IANA
+   "Channel-Binding Types" registry [iana-cbt] as specified in
+   [RFC5056].
+
+   In the special case of 'NONE', no channel binding is to be used (cb-
+   data is to be an empty string).
+
+                    +=========+======================+
+                    | cb-type | Channel Binding Type |
+                    +=========+======================+
+                    | ENDP    | tls-server-end-point |
+                    +---------+----------------------+
+                    | UNIQ    | tls-unique           |
+                    +---------+----------------------+
+                    | EXPR    | tls-exporter         |
+                    +---------+----------------------+
+
+                      Table 1: Mapping of cb-type to
+                          Channel Binding Types
+
+   The following table lists some examples of HT SASL mechanisms
+   registered by this document.
+
+
+
+
+
+
+
+
+
+Schmaus & Egger            Expires 11 May 2023                  [Page 4]
+
+Internet-Draft       The Hashed Token SASL Mechanism       November 2022
+
+
+      +==================+===================+======================+
+      | Mechanism Name   | HT Hash Algorithm | Channel-binding      |
+      |                  |                   | unique prefix        |
+      +==================+===================+======================+
+      | HT-SHA-512-ENDP  | SHA-512           | tls-server-end-point |
+      +------------------+-------------------+----------------------+
+      | HT-SHA-512-UNIQ  | SHA-512           | tls-unique           |
+      +------------------+-------------------+----------------------+
+      | HT-SHA3-512-ENDP | SHA3-512          | tls-server-end-point |
+      +------------------+-------------------+----------------------+
+      | HT-SHA-256-UNIQ  | SHA-256           | tls-unique           |
+      +------------------+-------------------+----------------------+
+      | HT-SHA-256-NONE  | SHA-256           | N/A                  |
+      +------------------+-------------------+----------------------+
+
+                  Table 2: Examples of HT SASL mechanisms
+
+3.  The HT Authentication Exchange
+
+   The mechanism consists of a simple exchange of precisely two messages
+   between the initiator and responder.
+
+   The following syntax specifications use the Augmented Backus-Naur
+   form (ABNF) notation as specified in [RFC5234].
+
+3.1.  Initiator First Message
+
+   The HT mechanism starts with the initiator-msg, send by the initiator
+   to the responder.  The following lists the ABNF grammar for the
+   initiator-msg:
+
+   initiator-msg = authcid NUL initiator-hashed-token
+   authcid = 1*SAFE ; MUST accept up to 255 octets
+   initiator-hashed-token = 1*OCTET
+
+   NUL    = %0x00 ; The null octet
+   SAFE   = UTF1 / UTF2 / UTF3 / UTF4
+            ;; any UTF-8 encoded Unicode character except NUL
+
+   UTF1   = %x01-7F ;; except NUL
+   UTF2   = %xC2-DF UTF0
+   UTF3   = %xE0 %xA0-BF UTF0 / %xE1-EC 2(UTF0) /
+            %xED %x80-9F UTF0 / %xEE-EF 2(UTF0)
+   UTF4   = %xF0 %x90-BF 2(UTF0) / %xF1-F3 3(UTF0) /
+            %xF4 %x80-8F 2(UTF0)
+   UTF0   = %x80-BF
+
+
+
+
+
+Schmaus & Egger            Expires 11 May 2023                  [Page 5]
+
+Internet-Draft       The Hashed Token SASL Mechanism       November 2022
+
+
+   The initiator first message starts with the authentication identity
+   (authcid, see[RFC4422]) as UTF-8 [RFC3629] encoded string.  It is
+   followed by initiator-hashed-token separated by as single null octet.
+
+   The value of the initiator-hashed-token is defined as follows:
+
+   initiator-hashed-token := HMAC(token, "Initiator" || cb-data)
+
+   HMAC() is the function defined in [RFC2104] with H being the selected
+   HT hash algorithm, 'cb-data' represents the data provided by the
+   selected channel binding type, and 'token' are the UTF-8 encoded
+   octets of the SASL-HT token string which acts as a shared secret
+   between initiator and responder.
+
+   The initiator-msg *MAY* be included in TLS 1.3 0-RTT early data, as
+   specified in [RFC8446].  If this is the case, then the initiating
+   entity *MUST NOT* include any further application protocol payload in
+   the early data besides the HT initiator-msg and potential required
+   framing of the SASL profile.  The responder *MUST* abort the SASL
+   authentication if the early data contains additional application
+   protocol payload.
+
+      SASL-HT hence allows exploiting TLS 1.3 early data for "0.5 Round
+      Trip Time (RTT)" resumption of the application protocol's session.
+      Using TLS early data requires extra care when implementing: The
+      early data should only contain the SASL-HT payload, i.e., the
+      initiator-msg, and not an application protocol specific payload.
+      The reason for this is that the early data could be replayed, and
+      thus needs to carry an idempotent operation.  On the other hand,
+      if the responding entity can verify the early data, then it can
+      send additional application protocol payload together with the
+      "resumption successful" response to the initiating entity.
+
+3.2.  Initiator Authentication
+
+   Upon receiving the initiator-msg, the responder calculates itself the
+   value of initiator-hashed-token and compares it with the received
+   value found in the initiator-msg.  If both values are equal, then the
+   initiator has been successfully authenticated.  Otherwise, if both
+   values are not equal, then authentication *MUST* fail.
+
+3.3.  Final Responder Message
+
+   After the initiator was authenticated the responder continues the
+   SASL authentication by sending the responder-msg to the initiator.
+
+   The ABNF for responder-msg is:
+
+
+
+
+Schmaus & Egger            Expires 11 May 2023                  [Page 6]
+
+Internet-Draft       The Hashed Token SASL Mechanism       November 2022
+
+
+   responder-msg = 1*OCTET
+
+   The responder-msg value is defined as follows:
+
+   responder-msg := HMAC(token, "Responder" || cb-data)
+
+   The initiating entity *MUST* verify the responder-msg to achieve
+   mutual authentication.
+
+4.  Compliance with SASL Mechanism Requirements
+
+   This section describes compliance with SASL mechanism requirements
+   specified in Section 5 of [RFC4422].
+
+   1.  "HT-SHA-256-ENDP", "HT-SHA-256-UNIQ", "HT-SHA-3-512-ENDP" and
+       "HT-SHA-3-512-UNIQ".
+
+   2.  Definition of server-challenges and client-responses: a) HT is a
+       client-first mechanism. b) HT does send additional data with
+       success (the responder-msg).
+
+   3.  HT is not capable of transferring authorization identities from
+       the client to the server.
+
+   4.  HT does not offer any security layers (HT offers channel binding
+       instead).
+
+   5.  HT does not protect the authorization identity.
+
+5.  Requirements for the Application-Protocol Extension
+
+   It is *REQUIRED* that the application-protocol specific extension
+   provides a mechanism to request a SASL-HT token in form of a Unicode
+   string.  The returned token *MUST* have been newly generated by a
+   cryptographically secure random number generator and MUST contain at
+   least 128 bit of entropy.
+
+   It is *RECOMMENDED* that the protocol allows the requestor to signal
+   the name of the SASL mechanism which he intends to use with the
+   token.  If a token is used with a different mechanism than the one
+   which was signalled upon requesting the token, then the
+   authentication *MUST* fail.  This allows pinning the token to a SASL
+   mechanism, which increases the security because it makes it
+   impossible for an attacker to downgrade the SASL mechanism.
+
+   It is *RECOMMENDED* that the protocol defines a way for a client to
+   request rotation or revocation of a token.
+
+
+
+
+Schmaus & Egger            Expires 11 May 2023                  [Page 7]
+
+Internet-Draft       The Hashed Token SASL Mechanism       November 2022
+
+
+6.  Security Considerations
+
+   To be secure, the HT mechanism *MUST* be used over a TLS channel that
+   has had the session hash extension [RFC7627] negotiated, or session
+   resumption *MUST NOT* have been used.
+
+   It is *RECOMMENDED* that implementations periodically require a full
+   authentication using a strong SASL mechanism which does not use the
+   SASL-HT token.
+
+   It is of vital importance that the SASL-HT token is generated by a
+   cryptographically secure random generator.  See [RFC4086] for more
+   information about Randomness Requirements for Security.  In addition,
+   comparison of the client's HMAC with the server's calculated HMAC
+   *SHOULD* be performed using constant-time comparison functions, to
+   protect against timing attacks.
+
+   The tokens used with HT mechanisms *SHOULD* have a limited lifetime,
+   e.g. based on usage count or time elapsed since issuance.
+
+   Due to the additional security properties afforded by channel
+   binding, it is *RECOMMENDED* that clients use HT mechanisms
+   supporting channel binding in environments that can support it.
+
+7.  IANA Considerations
+
+   IANA is requested to add the following family of SASL mechanisms to
+   the SASL Mechanism registry established by [RFC4422]:
+
+      To: ia...@ia...
+
+      Subject: Registration of a new SASL family HT
+
+      SASL mechanism name (or prefix for the family): HT-*
+
+      Security considerations: Section 6 of draft-schmaus-kitten-sasl-ht
+
+      Published specification (optional, recommended): draft-schmaus-
+      kitten-sasl-ht-XX (TODO)
+
+      Person & email address to contact for further information: IETF
+      SASL WG ki...@ie... (mailto:ki...@ie...)
+
+      Intended usage: COMMON
+
+      Owner/Change controller: IESG ie...@ie... (mailto:ie...@ie...)
+
+
+
+
+
+Schmaus & Egger            Expires 11 May 2023                  [Page 8]
+
+Internet-Draft       The Hashed Token SASL Mechanism       November 2022
+
+
+      Note: Members of this family MUST be explicitly registered using
+      the "IETF Review" [RFC8126] registration procedure.  Reviews MUST
+      be requested on the Kitten WG mailing list ki...@ie...
+      (mailto:ki...@ie...) (or a successor designated by the
+      responsible Security AD).
+
+8.  References
+
+8.1.  Normative References
+
+   [RFC2104]  Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
+              Hashing for Message Authentication", RFC 2104,
+              DOI 10.17487/RFC2104, February 1997,
+              <https://www.rfc-editor.org/info/rfc2104>.
+
+   [RFC3629]  Yergeau, F., "UTF-8, a transformation format of ISO
+              10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November
+              2003, <https://www.rfc-editor.org/info/rfc3629>.
+
+   [RFC4086]  Eastlake 3rd, D., Schiller, J., and S. Crocker,
+              "Randomness Requirements for Security", BCP 106, RFC 4086,
+              DOI 10.17487/RFC4086, June 2005,
+              <https://www.rfc-editor.org/info/rfc4086>.
+
+   [RFC4422]  Melnikov, A., Ed. and K. Zeilenga, Ed., "Simple
+              Authentication and Security Layer (SASL)", RFC 4422,
+              DOI 10.17487/RFC4422, June 2006,
+              <https://www.rfc-editor.org/info/rfc4422>.
+
+   [RFC5056]  Williams, N., "On the Use of Channel Bindings to Secure
+              Channels", RFC 5056, DOI 10.17487/RFC5056, November 2007,
+              <https://www.rfc-editor.org/info/rfc5056>.
+
+   [RFC5234]  Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax
+              Specifications: ABNF", STD 68, RFC 5234,
+              DOI 10.17487/RFC5234, January 2008,
+              <https://www.rfc-editor.org/info/rfc5234>.
+
+   [RFC5280]  Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
+              Housley, R., and W. Polk, "Internet X.509 Public Key
+              Infrastructure Certificate and Certificate Revocation List
+              (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
+              <https://www.rfc-editor.org/info/rfc5280>.
+
+   [RFC5929]  Altman, J., Williams, N., and L. Zhu, "Channel Bindings
+              for TLS", RFC 5929, DOI 10.17487/RFC5929, July 2010,
+              <https://www.rfc-editor.org/info/rfc5929>.
+
+
+
+
+Schmaus & Egger            Expires 11 May 2023                  [Page 9]
+
+Internet-Draft       The Hashed Token SASL Mechanism       November 2022
+
+
+   [RFC6125]  Saint-Andre, P. and J. Hodges, "Representation and
+              Verification of Domain-Based Application Service Identity
+              within Internet Public Key Infrastructure Using X.509
+              (PKIX) Certificates in the Context of Transport Layer
+              Security (TLS)", RFC 6125, DOI 10.17487/RFC6125, March
+              2011, <https://www.rfc-editor.org/info/rfc6125>.
+
+   [RFC6920]  Farrell, S., Kutscher, D., Dannewitz, C., Ohlman, B.,
+              Keranen, A., and P. Hallam-Baker, "Naming Things with
+              Hashes", RFC 6920, DOI 10.17487/RFC6920, April 2013,
+              <https://www.rfc-editor.org/info/rfc6920>.
+
+   [RFC7627]  Bhargavan, K., Ed., Delignat-Lavaud, A., Pironti, A.,
+              Langley, A., and M. Ray, "Transport Layer Security (TLS)
+              Session Hash and Extended Master Secret Extension",
+              RFC 7627, DOI 10.17487/RFC7627, September 2015,
+              <https://www.rfc-editor.org/info/rfc7627>.
+
+   [RFC8446]  Rescorla, E., "The Transport Layer Security (TLS) Protocol
+              Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
+              <https://www.rfc-editor.org/info/rfc8446>.
+
+   [RFC9266]  Whited, S., "Channel Bindings for TLS 1.3", RFC 9266,
+              DOI 10.17487/RFC9266, July 2022,
+              <https://www.rfc-editor.org/info/rfc9266>.
+
+   [iana-hash-alg]
+              Williams, N., "IANA Named Information Hash Algorithm
+              Registry", 2010, <https://www.iana.org/assignments/named-
+              information/named-information.xhtml#hash-alg>.
+
+   [iana-cbt] Williams, N., "IANA Channel-Binding Types", 2010,
+              <https://www.iana.org/assignments/channel-binding-types/
+              channel-binding-types.xhtml>.
+
+   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
+              Requirement Levels", BCP 14, RFC 2119,
+              DOI 10.17487/RFC2119, March 1997,
+              <https://www.rfc-editor.org/info/rfc2119>.
+
+   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
+              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
+              May 2017, <https://www.rfc-editor.org/info/rfc8174>.
+
+8.2.  Informative References
+
+
+
+
+
+
+Schmaus & Egger            Expires 11 May 2023                 [Page 10]
+
+Internet-Draft       The Hashed Token SASL Mechanism       November 2022
+
+
+   [RFC5802]  Newman, C., Menon-Sen, A., Melnikov, A., and N. Williams,
+              "Salted Challenge Response Authentication Mechanism
+              (SCRAM) SASL and GSS-API Mechanisms", RFC 5802,
+              DOI 10.17487/RFC5802, July 2010,
+              <https://www.rfc-editor.org/info/rfc5802>.
+
+   [RFC6120]  Saint-Andre, P., "Extensible Messaging and Presence
+              Protocol (XMPP): Core", RFC 6120, DOI 10.17487/RFC6120,
+              March 2011, <https://www.rfc-editor.org/info/rfc6120>.
+
+   [RFC8126]  Cotton, M., Leiba, B., and T. Narten, "Guidelines for
+              Writing an IANA Considerations Section in RFCs", BCP 26,
+              RFC 8126, DOI 10.17487/RFC8126, June 2017,
+              <https://www.rfc-editor.org/info/rfc8126>.
+
+   [XEP-0397] Schmaus, F., "XEP-0397: Instant Stream Resumption", 3
+              November 2018,
+              <https://xmpp.org/extensions/xep-0397.html>.
+
+Acknowledgments
+
+   This document benefited from discussions on the KITTEN WG mailing
+   list.  The authors would like to especially thank Thijs Alkemade, Sam
+   Whited and Alexey Melnikov for their comments on this topic.
+   Furthermore, we would like to thank Alexander Wuerstlein, who came up
+   with the idea to pin the token to a SASL mechanism for increased
+   security.  And last but not least, thanks to Matthew Wild for working
+   on the -NONE variant of SASL-HT.
+
+Authors' Addresses
+
+   Florian Schmaus
+   FAU Erlangen-Nürnberg
+   Email: fl...@cs...
+
+
+   Christoph Egger
+   FAU Erlangen-Nürnberg
+   Email: eg...@cs...
+
+
+
+
+
+
+
+
+
+
+
+
+Schmaus & Egger            Expires 11 May 2023                 [Page 11]

Modified: trunk/docs/specs/internet-drafts.html
===================================================================
--- trunk/docs/specs/internet-drafts.html	2022-10-26 22:14:15 UTC (rev 1575)
+++ trunk/docs/specs/internet-drafts.html	2022-11-07 15:25:49 UTC (rev 1576)
@@ -672,9 +672,9 @@
   </li>
 
   <li>
-    <a href="draft-schmaus-kitten-sasl-ht-08.txt">draft-schmaus-kitten-sasl-ht-08</a>: The Hashed Token SASL Mechanism
+    <a href="draft-schmaus-kitten-sasl-ht-09.txt">draft-schmaus-kitten-sasl-ht-09</a>: The Hashed Token SASL Mechanism
     <br>
-    Expiration Date: April 13, 2023
+    Expiration Date: May 11, 2023
     <br><br>
   </li>
 

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1575] trunk

[<di...@us...>]

Revision: 1575
          http://sourceforge.net/p/ldap-sdk/code/1575
Author:   dirmgr
Date:     2022-10-26 22:14:15 +0000 (Wed, 26 Oct 2022)
Log Message:
-----------
Fix a bug in SearchResultEntry.equals

Fixed a bug in the SearchResultEntry.equals method that could
prevent a SearchResultEntry object (which is a subclass of Entry)
from being considered equal to an Entry that is not a
SearchResultEntry.

Modified Paths:
--------------
    trunk/docs/release-notes.html
    trunk/src/com/unboundid/ldap/sdk/SearchResultEntry.java
    trunk/tests/unit/src/com/unboundid/ldap/sdk/SearchResultEntryTestCase.java

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2022-10-20 21:55:30 UTC (rev 1574)
+++ trunk/docs/release-notes.html	2022-10-26 22:14:15 UTC (rev 1575)
@@ -14,6 +14,13 @@
 
               <ul>
                 <li>
+                  Fixed a bug in the SearchResultEntry.equals method that could prevent a
+                  SearchResultEntry object (which is a subclass of Entry) from being considered
+                  equal to an Entry that is not a SearchResultEntry.
+                  <br><br>
+                </li>
+
+                <li>
                   Fixed an issue with the Entry.applyModifications method in which it could fail
                   with a NOT_ALLOWED_ON_RDN result if the provided entry was missing one or more
                   attribute values used in its RDN.

Modified: trunk/src/com/unboundid/ldap/sdk/SearchResultEntry.java
===================================================================
--- trunk/src/com/unboundid/ldap/sdk/SearchResultEntry.java	2022-10-20 21:55:30 UTC (rev 1574)
+++ trunk/src/com/unboundid/ldap/sdk/SearchResultEntry.java	2022-10-26 22:14:15 UTC (rev 1575)
@@ -392,14 +392,8 @@
   @Override()
   public int hashCode()
   {
-    int hashCode = super.hashCode();
-
-    for (final Control c : controls)
-    {
-      hashCode += c.hashCode();
-    }
-
-    return hashCode;
+    // We need this method to satisfy checkstyle.
+    return super.hashCode();
   }
 
 
@@ -424,7 +418,9 @@
 
     if (! (o instanceof SearchResultEntry))
     {
-      return false;
+      // When comparing a SearchResultEntry with an entry that isn't a
+      // SearchResultEntry, we'll only rely on the base entry comparison.
+      return true;
     }
 
     final SearchResultEntry e = (SearchResultEntry) o;

Modified: trunk/tests/unit/src/com/unboundid/ldap/sdk/SearchResultEntryTestCase.java
===================================================================
--- trunk/tests/unit/src/com/unboundid/ldap/sdk/SearchResultEntryTestCase.java	2022-10-20 21:55:30 UTC (rev 1574)
+++ trunk/tests/unit/src/com/unboundid/ldap/sdk/SearchResultEntryTestCase.java	2022-10-26 22:14:15 UTC (rev 1575)
@@ -739,8 +739,7 @@
 
 
   /**
-   * Tests the {@code equals} method with an object that isn't a search result
-   * entry.
+   * Tests the {@code equals} method with an object that isn't an entry.
    */
   @Test()
   public void testEqualsNotEntry()
@@ -761,10 +760,41 @@
 
     SearchResultEntry e = new SearchResultEntry(dn, attributes, controls);
 
+    final String nonEntry = "foo";
+    assertFalse(e.hashCode() == nonEntry.hashCode());
+    assertFalse(nonEntry.equals(e));
+    assertFalse(e.equals(nonEntry));
+  }
+
+
+
+  /**
+   * Tests the {@code equals} method with an object that is an equivalent entry
+   * that is not a search result entry.
+   */
+  @Test()
+  public void testEqualsEquivalentEntry()
+  {
+    String dn = "dc=example,dc=com";
+
+    Attribute[] attributes =
+    {
+      new Attribute("objectClass", "top", "domain"),
+      new Attribute("dc", "example"),
+    };
+
+    Control[] controls =
+    {
+      new Control("1.2.3.4"),
+      new Control("1.2.3.5", true, null)
+    };
+
+    SearchResultEntry e = new SearchResultEntry(dn, attributes, controls);
+
     Entry e2 = new Entry(dn, attributes);
-    assertFalse(e.hashCode() == e2.hashCode());
+    assertEquals(e.hashCode(), e2.hashCode());
+    assertTrue(e.equals(e2));
     assertTrue(e2.equals(e));
-    assertFalse(e.equals(e2));
   }
 
 
@@ -774,7 +804,7 @@
    * result entry.
    */
   @Test()
-  public void testEqualsEquivalentEntry()
+  public void testEqualsEquivalentSearchResultEntry()
   {
     String dn = "dc=example,dc=com";
 
@@ -825,7 +855,7 @@
 
     SearchResultEntry e2 = new SearchResultEntry(dn, attributes,
                            new Control[0]);
-    assertFalse(e.hashCode() == e2.hashCode());
+    assertEquals(e.hashCode(), e2.hashCode());
     assertFalse(e.equals(e2));
     assertFalse(e2.equals(e));
   }
@@ -864,7 +894,7 @@
     };
 
     SearchResultEntry e2 = new SearchResultEntry(dn, attributes, controls2);
-    assertFalse(e.hashCode() == e2.hashCode());
+    assertEquals(e.hashCode(), e2.hashCode());
     assertFalse(e.equals(e2));
     assertFalse(e2.equals(e));
   }

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1574] trunk

[<di...@us...>]

Revision: 1574
          http://sourceforge.net/p/ldap-sdk/code/1574
Author:   dirmgr
Date:     2022-10-20 21:55:30 +0000 (Thu, 20 Oct 2022)
Log Message:
-----------
Allow getting JSON fields case insensitively

Added JSONObject methods for retrieving fields by name using
case-insensitive matching.  By default, JSON field names are treated
in a case-sensitive manner, but new methods allow them to be
retrieved in a case-insensitive manner.  Because a JSON object may
have multiple fields with names differing only by case, there are a
few options for handling the possibility of conflicts, including
returning only the first match found and ignoring subsequent
matches, throwing an exception if multiple matches are found, or
returning a map containing all matching name-value pairs.

Modified Paths:
--------------
    trunk/docs/release-notes.html
    trunk/messages/unboundid-ldapsdk-json.properties
    trunk/src/com/unboundid/util/json/JSONObject.java
    trunk/tests/unit/src/com/unboundid/util/json/JSONObjectTestCase.java

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2022-10-19 19:00:36 UTC (rev 1573)
+++ trunk/docs/release-notes.html	2022-10-20 21:55:30 UTC (rev 1574)
@@ -21,6 +21,18 @@
                 </li>
 
                 <li>
+                  Added JSONObject methods for retrieving fields by name using case-insensitive
+                  matching.  By default, JSON field names are treated in a case-sensitive manner,
+                  but new methods allow them to be retrieved in a case-insensitive manner.
+                  Because a JSON object may have multiple fields with names differing only by
+                  case, there are a few options for handling the possibility of conflicts,
+                  including returning only the first match found and ignoring subsequent matches,
+                  throwing an exception if multiple matches are found, or returning a map
+                  containing all matching name-value pairs.
+                  <br><br>
+                </li>
+
+                <li>
                   Updated the set of LDAP-related specifications to include the latest version of
                   draft-schmaus-kitten-sasl-ht.
                   <br><br>

Modified: trunk/messages/unboundid-ldapsdk-json.properties
===================================================================
--- trunk/messages/unboundid-ldapsdk-json.properties	2022-10-19 19:00:36 UTC (rev 1573)
+++ trunk/messages/unboundid-ldapsdk-json.properties	2022-10-20 21:55:30 UTC (rev 1574)
@@ -114,6 +114,9 @@
   ''{0}'' cannot be parsed as a JSON object because it contains an array \
   with unexpected token ''{1}'' at position {2,number,0} when a comma or \
   closing square bracket was expected.
+ERR_OBJECT_MULTIPLE_FIELDS_WITH_CASE_INSENSITIVE_NAME=The JSON object has \
+  multiple fields with name ''{0}'' when treating field names in a \
+  case-insensitive manner.
 ERR_LDAP_SPEC_ERROR_PROCESSING_FIELD=Unable to parse the JSON object as an \
   LDAP connection details specification because an error was encountered \
   while attempting to process the value of field ''{0}'':  {1}

Modified: trunk/src/com/unboundid/util/json/JSONObject.java
===================================================================
--- trunk/src/com/unboundid/util/json/JSONObject.java	2022-10-19 19:00:36 UTC (rev 1573)
+++ trunk/src/com/unboundid/util/json/JSONObject.java	2022-10-20 21:55:30 UTC (rev 1574)
@@ -929,6 +929,103 @@
 
 
   /**
+   * Retrieves the value for the specified field, treating the field name as
+   * case-insensitive.  If the object has multiple fields with different
+   * capitalizations of the specified name, then only the first one found will
+   * be returned and any subsequent fields will be ignored.
+   *
+   * @param  name  The name of the field for which to retrieve the value.  It
+   *               will be treated in a case-insensitive manner.
+   *
+   * @return  The value for the specified field, or {@code null} if the
+   *          requested field is not present in the JSON object.
+   */
+  @Nullable()
+  public JSONValue getFieldIgnoreCaseIgnoreConflict(@NotNull final String name)
+  {
+    final String lowerName = StaticUtils.toLowerCase(name);
+    for (final Map.Entry<String,JSONValue> e : fields.entrySet())
+    {
+      if (lowerName.equals(StaticUtils.toLowerCase(e.getKey())))
+      {
+        return e.getValue();
+      }
+    }
+
+    return null;
+  }
+
+
+
+  /**
+   * Retrieves the value for the specified field, treating the field name as
+   * case-insensitive.  If the object has multiple fields with different
+   * capitalizations of the first name, then an exception will be thrown.
+   *
+   * @param  name  The name of the field for which to retrieve the value.  It
+   *               will be treated in a case-insensitive manner.
+   *
+   * @return  The value for the specified field, or {@code null} if the
+   *          requested field is not present in the JSON object.
+   *
+   * @throws  JSONException  If the object has multiple fields with different
+   *                         capitalizations of the provided name.
+   */
+  @Nullable()
+  public JSONValue getFieldIgnoreCaseThrowOnConflict(@NotNull final String name)
+         throws JSONException
+  {
+    JSONValue fieldValue = null;
+    final String lowerName = StaticUtils.toLowerCase(name);
+    for (final Map.Entry<String,JSONValue> e : fields.entrySet())
+    {
+      if (lowerName.equals(StaticUtils.toLowerCase(e.getKey())))
+      {
+        if (fieldValue != null)
+        {
+          throw new JSONException(
+               ERR_OBJECT_MULTIPLE_FIELDS_WITH_CASE_INSENSITIVE_NAME.get(name));
+        }
+
+        fieldValue = e.getValue();
+      }
+    }
+
+    return fieldValue;
+  }
+
+
+
+  /**
+   * Retrieves a map of all fields with the specified name, treating the name as
+   * case-insensitive.
+   *
+   * @param  name  The name of the field for which to retrieve the values.  It
+   *               will be treated in a case-insensitive manner.
+   *
+   * @return  A map of all fields with the specified name, or an empty map if
+   *          there are no fields with the specified name.
+   */
+  @NotNull()
+  public Map<String,JSONValue> getFieldsIgnoreCase(@NotNull final String name)
+  {
+    final Map<String,JSONValue> matchingFields = new LinkedHashMap<>();
+    final String lowerName = StaticUtils.toLowerCase(name);
+    for (final Map.Entry<String,JSONValue> e : fields.entrySet())
+    {
+      final String fieldName = e.getKey();
+      if (lowerName.equals(StaticUtils.toLowerCase(fieldName)))
+      {
+        matchingFields.put(fieldName, e.getValue());
+      }
+    }
+
+    return Collections.unmodifiableMap(matchingFields);
+  }
+
+
+
+  /**
    * Retrieves the value of the specified field as a string.
    *
    * @param  name  The name of the field for which to retrieve the string value.

Modified: trunk/tests/unit/src/com/unboundid/util/json/JSONObjectTestCase.java
===================================================================
--- trunk/tests/unit/src/com/unboundid/util/json/JSONObjectTestCase.java	2022-10-19 19:00:36 UTC (rev 1573)
+++ trunk/tests/unit/src/com/unboundid/util/json/JSONObjectTestCase.java	2022-10-20 21:55:30 UTC (rev 1574)
@@ -47,6 +47,7 @@
 import org.testng.annotations.Test;
 
 import com.unboundid.ldap.sdk.LDAPSDKTestCase;
+import com.unboundid.util.StaticUtils;
 
 
 
@@ -1513,4 +1514,139 @@
       },
     };
   }
+
+
+
+  /**
+   * Tests the behavior when trying to retrieve JSON fields when treating the
+   * field name in a case-insensitive manner.
+   *
+   * @throws  Exception  If an unexpected problem occurs.
+   */
+  @Test()
+  public void testGetFieldIgnoreCase()
+         throws Exception
+  {
+    final JSONObject o = new JSONObject(
+         new JSONField("fieldName", "fieldValue"),
+         new JSONField("FieldName", "FieldValue"),
+         new JSONField("fieldname", "fieldvalue"),
+         new JSONField("FIELDNAME", "FIELDVALUE"),
+         new JSONField("anotherName", "anotherValue"));
+
+    // Test with the getField method, which uses case-sensitive matching.
+    assertEquals(o.getField("fieldName"), new JSONString("fieldValue"));
+    assertEquals(o.getField("FieldName"), new JSONString("FieldValue"));
+    assertEquals(o.getField("fieldname"), new JSONString("fieldvalue"));
+    assertEquals(o.getField("FIELDNAME"), new JSONString("FIELDVALUE"));
+    assertNull(o.getField("FiElDnAmE"));
+    assertEquals(o.getField("anotherName"), new JSONString("anotherValue"));
+    assertNull(o.getField("AnotherName"));
+    assertNull(o.getField("missingName"));
+
+
+    // Test with the getFieldIgnoreCaseIgnoreConflict method, which returns the
+    // first field found.
+    assertEquals(o.getFieldIgnoreCaseIgnoreConflict("fieldName"),
+         new JSONString("fieldValue"));
+    assertEquals(o.getFieldIgnoreCaseIgnoreConflict("FieldName"),
+         new JSONString("fieldValue"));
+    assertEquals(o.getFieldIgnoreCaseIgnoreConflict("fieldname"),
+         new JSONString("fieldValue"));
+    assertEquals(o.getFieldIgnoreCaseIgnoreConflict("FIELDNAME"),
+         new JSONString("fieldValue"));
+    assertEquals(o.getFieldIgnoreCaseIgnoreConflict("FiElDnAmE"),
+         new JSONString("fieldValue"));
+    assertEquals(o.getFieldIgnoreCaseIgnoreConflict("anotherName"),
+         new JSONString("anotherValue"));
+    assertEquals(o.getFieldIgnoreCaseIgnoreConflict("AnotherName"),
+         new JSONString("anotherValue"));
+    assertNull(o.getFieldIgnoreCaseIgnoreConflict("missingName"));
+
+
+    // Test with the getFieldIgnoreCaseThrowOnConflict method, which will return
+    // a field only if there are no conflicts.
+    try
+    {
+      o.getFieldIgnoreCaseThrowOnConflict("fieldName");
+      fail("Expected an exception for a fieldName conflict");
+    }
+    catch (final JSONException e)
+    {
+      // This was expected.
+    }
+
+    try
+    {
+      o.getFieldIgnoreCaseThrowOnConflict("FieldName");
+      fail("Expected an exception for a fieldName conflict");
+    }
+    catch (final JSONException e)
+    {
+      // This was expected.
+    }
+
+    assertEquals(o.getFieldIgnoreCaseThrowOnConflict("anotherName"),
+         new JSONString("anotherValue"));
+    assertEquals(o.getFieldIgnoreCaseThrowOnConflict("AnotherName"),
+         new JSONString("anotherValue"));
+    assertEquals(o.getFieldIgnoreCaseThrowOnConflict("anothername"),
+         new JSONString("anotherValue"));
+    assertEquals(o.getFieldIgnoreCaseThrowOnConflict("ANOTHERNAME"),
+         new JSONString("anotherValue"));
+    assertEquals(o.getFieldIgnoreCaseThrowOnConflict("aNoThErNaMe"),
+         new JSONString("anotherValue"));
+
+    assertNull(o.getFieldIgnoreCaseThrowOnConflict("missingName"));
+
+
+    // Tests with the getFieldsIgnoreCase method, which returns a map of
+    // matching field names and values.
+    assertEquals(o.getFieldsIgnoreCase("fieldName"),
+         StaticUtils.mapOf(
+              "fieldName", new JSONString("fieldValue"),
+              "FieldName", new JSONString("FieldValue"),
+              "fieldname", new JSONString("fieldvalue"),
+              "FIELDNAME", new JSONString("FIELDVALUE")));
+    assertEquals(o.getFieldsIgnoreCase("FieldName"),
+         StaticUtils.mapOf(
+              "fieldName", new JSONString("fieldValue"),
+              "FieldName", new JSONString("FieldValue"),
+              "fieldname", new JSONString("fieldvalue"),
+              "FIELDNAME", new JSONString("FIELDVALUE")));
+    assertEquals(o.getFieldsIgnoreCase("fieldname"),
+         StaticUtils.mapOf(
+              "fieldName", new JSONString("fieldValue"),
+              "FieldName", new JSONString("FieldValue"),
+              "fieldname", new JSONString("fieldvalue"),
+              "FIELDNAME", new JSONString("FIELDVALUE")));
+    assertEquals(o.getFieldsIgnoreCase("FIELDNAME"),
+         StaticUtils.mapOf(
+              "fieldName", new JSONString("fieldValue"),
+              "FieldName", new JSONString("FieldValue"),
+              "fieldname", new JSONString("fieldvalue"),
+              "FIELDNAME", new JSONString("FIELDVALUE")));
+    assertEquals(o.getFieldsIgnoreCase("FiElDnAmE"),
+         StaticUtils.mapOf(
+              "fieldName", new JSONString("fieldValue"),
+              "FieldName", new JSONString("FieldValue"),
+              "fieldname", new JSONString("fieldvalue"),
+              "FIELDNAME", new JSONString("FIELDVALUE")));
+
+    assertEquals(o.getFieldsIgnoreCase("anotherName"),
+         StaticUtils.mapOf(
+              "anotherName", new JSONString("anotherValue")));
+    assertEquals(o.getFieldsIgnoreCase("AnotherName"),
+         StaticUtils.mapOf(
+              "anotherName", new JSONString("anotherValue")));
+    assertEquals(o.getFieldsIgnoreCase("anothername"),
+         StaticUtils.mapOf(
+              "anotherName", new JSONString("anotherValue")));
+    assertEquals(o.getFieldsIgnoreCase("ANOTHERNAME"),
+         StaticUtils.mapOf(
+              "anotherName", new JSONString("anotherValue")));
+
+    assertEquals(o.getFieldsIgnoreCase("missingName"),
+         Collections.emptyMap());
+  }
 }

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1573] trunk

[<di...@us...>]

Revision: 1573
          http://sourceforge.net/p/ldap-sdk/code/1573
Author:   dirmgr
Date:     2022-10-19 19:00:36 +0000 (Wed, 19 Oct 2022)
Log Message:
-----------
Fix an issue with Entry.applyModifications

Fixed an issue with the Entry.applyModifications method in which it
could fail with a NOT_ALLOWED_ON_RDN result if the provided entry was
missing one or more attribute values used in its RDN.

Modified Paths:
--------------
    trunk/docs/release-notes.html
    trunk/src/com/unboundid/ldap/sdk/Entry.java
    trunk/tests/unit/src/com/unboundid/ldap/sdk/EntryTestCase.java

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2022-10-11 14:18:43 UTC (rev 1572)
+++ trunk/docs/release-notes.html	2022-10-19 19:00:36 UTC (rev 1573)
@@ -14,6 +14,13 @@
 
               <ul>
                 <li>
+                  Fixed an issue with the Entry.applyModifications method in which it could fail
+                  with a NOT_ALLOWED_ON_RDN result if the provided entry was missing one or more
+                  attribute values used in its RDN.
+                  <br><br>
+                </li>
+
+                <li>
                   Updated the set of LDAP-related specifications to include the latest version of
                   draft-schmaus-kitten-sasl-ht.
                   <br><br>

Modified: trunk/src/com/unboundid/ldap/sdk/Entry.java
===================================================================
--- trunk/src/com/unboundid/ldap/sdk/Entry.java	2022-10-11 14:18:43 UTC (rev 1572)
+++ trunk/src/com/unboundid/ldap/sdk/Entry.java	2022-10-19 19:00:36 UTC (rev 1573)
@@ -2587,12 +2587,15 @@
       {
         if (! e.hasAttributeValue(rdnAttrs[i], rdnValues[i]))
         {
-          errors.add(ERR_ENTRY_APPLY_MODS_TARGETS_RDN.get(entry.getDN()));
-          if (resultCode == null)
+          if (entry.hasAttributeValue(rdnAttrs[i], rdnValues[i]))
           {
-            resultCode = ResultCode.NOT_ALLOWED_ON_RDN;
+            errors.add(ERR_ENTRY_APPLY_MODS_TARGETS_RDN.get(entry.getDN()));
+            if (resultCode == null)
+            {
+              resultCode = ResultCode.NOT_ALLOWED_ON_RDN;
+            }
+            break;
           }
-          break;
         }
       }
     }

Modified: trunk/tests/unit/src/com/unboundid/ldap/sdk/EntryTestCase.java
===================================================================
--- trunk/tests/unit/src/com/unboundid/ldap/sdk/EntryTestCase.java	2022-10-11 14:18:43 UTC (rev 1572)
+++ trunk/tests/unit/src/com/unboundid/ldap/sdk/EntryTestCase.java	2022-10-19 19:00:36 UTC (rev 1573)
@@ -3664,6 +3664,35 @@
 
 
   /**
+   * Tests the {@code applyModifications} method with an entry that has an RDN
+   * attribute value that isn't present in the entry.
+   *
+   * @throws  Exception  If an unexpected problem occurs.
+   */
+  @Test()
+  public void testApplyModificationsEntryMissingAttributeValueUsedInRDN()
+         throws Exception
+  {
+    Entry source = new Entry(
+         "dn: cn=test,dc=example,dc=com",
+         "objectClass: top",
+         "objectClass: untypedObject",
+         "objectClass: extensibleObject");
+
+    assertEquals(
+         Entry.applyModifications(source, true,
+              new Modification(ModificationType.REPLACE, "foo", "bar")),
+         new Entry(
+              "dn: cn=test,dc=example,dc=com",
+              "objectClass: top",
+              "objectClass: untypedObject",
+              "objectClass: extensibleObject",
+              "foo: bar"));
+  }
+
+
+
+  /**
    * Tests the {@code matchesBaseAndScope} method with a string representation
    * of the target DN.
    *

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1572] trunk/docs

[<di...@us...>]

Revision: 1572
          http://sourceforge.net/p/ldap-sdk/code/1572
Author:   dirmgr
Date:     2022-10-11 14:18:43 +0000 (Tue, 11 Oct 2022)
Log Message:
-----------
Add draft-schmaus-kitten-sasl-ht-08

Updated the set of LDAP-related specifications to include the latest
version of draft-schmaus-kitten-sasl-ht.

Modified Paths:
--------------
    trunk/docs/release-notes.html
    trunk/docs/specs/internet-drafts.html

Added Paths:
-----------
    trunk/docs/specs/draft-schmaus-kitten-sasl-ht-08.txt

Removed Paths:
-------------
    trunk/docs/specs/draft-schmaus-kitten-sasl-ht-04.txt

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2022-09-02 17:17:58 UTC (rev 1571)
+++ trunk/docs/release-notes.html	2022-10-11 14:18:43 UTC (rev 1572)
@@ -6,6 +6,24 @@
 
               <h2>Release Notes</h2>
 
+              <h3>Version 6.0.7</h3>
+
+              <p>
+                The following changes were made between the 6.0.6 and 6.0.7 releases:
+              </p>
+
+              <ul>
+                <li>
+                  Updated the set of LDAP-related specifications to include the latest version of
+                  draft-schmaus-kitten-sasl-ht.
+                  <br><br>
+                </li>
+              </ul>
+
+              <p></p>
+
+
+
               <h3>Version 6.0.6</h3>
 
               <p>

Deleted: trunk/docs/specs/draft-schmaus-kitten-sasl-ht-04.txt
===================================================================
--- trunk/docs/specs/draft-schmaus-kitten-sasl-ht-04.txt	2022-09-02 17:17:58 UTC (rev 1571)
+++ trunk/docs/specs/draft-schmaus-kitten-sasl-ht-04.txt	2022-10-11 14:18:43 UTC (rev 1572)
@@ -1,616 +0,0 @@
-
-
-
-
-Common Authentication Technology Next Generation              F. Schmaus
-Internet-Draft                                                  C. Egger
-Intended status: Experimental           University of Erlangen-Nuremberg
-Expires: November 8, 2018                                    May 7, 2018
-
-
-                    The Hashed Token SASL Mechanism
-                    draft-schmaus-kitten-sasl-ht-04
-
-Abstract
-
-   This document specifies the family of Hashed Token SASL mechanisms,
-   which are meant to be used for quick re-authentication of a previous
-   session.  The Hashed Token SASL mechanism's authentication sequence
-   consists of only one round-trip.  This is achieved by the usage of
-   short-lived, exclusively ephemeral hashed tokens.  It further
-   provides hash agility, mutual authentication and is secured by
-   channel binding.
-
-Status of This Memo
-
-   This Internet-Draft is submitted in full conformance with the
-   provisions of BCP 78 and BCP 79.
-
-   Internet-Drafts are working documents of the Internet Engineering
-   Task Force (IETF).  Note that other groups may also distribute
-   working documents as Internet-Drafts.  The list of current Internet-
-   Drafts is at https://datatracker.ietf.org/drafts/current/.
-
-   Internet-Drafts are draft documents valid for a maximum of six months
-   and may be updated, replaced, or obsoleted by other documents at any
-   time.  It is inappropriate to use Internet-Drafts as reference
-   material or to cite them other than as "work in progress."
-
-   This Internet-Draft will expire on November 8, 2018.
-
-Copyright Notice
-
-   Copyright (c) 2018 IETF Trust and the persons identified as the
-   document authors.  All rights reserved.
-
-   This document is subject to BCP 78 and the IETF Trust's Legal
-   Provisions Relating to IETF Documents
-   (https://trustee.ietf.org/license-info) in effect on the date of
-   publication of this document.  Please review these documents
-   carefully, as they describe your rights and restrictions with respect
-   to this document.  Code Components extracted from this document must
-   include Simplified BSD License text as described in Section 4.e of
-
-
-
-Schmaus & Egger         Expires November 8, 2018                [Page 1]
-
-Internet-Draft                                                  May 2018
-
-
-   the Trust Legal Provisions and are provided without warranty as
-   described in the Simplified BSD License.
-
-Table of Contents
-
-   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
-     1.1.  Conventions and Terminology . . . . . . . . . . . . . . .   3
-     1.2.  Applicability . . . . . . . . . . . . . . . . . . . . . .   3
-   2.  The HT Family of Mechanisms . . . . . . . . . . . . . . . . .   3
-   3.  The HT Authentication Exchange  . . . . . . . . . . . . . . .   4
-     3.1.  Initiator First Message . . . . . . . . . . . . . . . . .   4
-     3.2.  Initiator Authentication  . . . . . . . . . . . . . . . .   6
-     3.3.  Final Responder Message . . . . . . . . . . . . . . . . .   6
-   4.  Compliance with SASL Mechanism Requirements . . . . . . . . .   6
-   5.  Requirements for the Application-Protocol Extension . . . . .   7
-   6.  Security Considerations . . . . . . . . . . . . . . . . . . .   7
-   7.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   7
-   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   8
-     8.1.  Normative References  . . . . . . . . . . . . . . . . . .   8
-     8.2.  Informative References  . . . . . . . . . . . . . . . . .  10
-   Appendix A.  Acknowledgments  . . . . . . . . . . . . . . . . . .  10
-   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  10
-
-1.  Introduction
-
-   This specification describes the the family of Hashed Token (HT)
-   Simple Authentication and Security Layer (SASL) [RFC4422] mechanisms.
-   The HT mechanism is designed to be used with short-lived, exclusively
-   ephemeral tokens, called SASL-HT tokens, and allow for quick, one
-   round-trip, re-authentication of a previous session.
-
-   Further properties of the HT mechanism are 1) hash agility, 2) mutual
-   authentication, and 3) being secured by channel binding.
-
-   Clients are supposed to request SASL-HT tokens from the server after
-   being authenticated using a "strong" SASL mechanism like SCRAM
-   [RFC5802].  Hence a typical sequence of actions using HT may look
-   like the following:
-
-      A) Client authenticates using a strong mechanism (e.g., SCRAM)
-      B) Client requests secret SASL-HT token
-      C) Service returns SASL-HT token
-         <normal client-server interaction here>
-      D) Connection between client and server gets interrupted,
-         for example because of a WiFi <-> GSM switch
-      E) Client resumes previous session using HT and token from C)
-      F) Service revokes the sucessfully used SASL-HT token
-         [goto B]
-
-
-
-Schmaus & Egger         Expires November 8, 2018                [Page 2]
-
-Internet-Draft                                                  May 2018
-
-
-   The HT mechanism requires an accompanying, application protocol
-   specific, extension, which allows clients to requests a new SASL-HT
-   token (see Section 5).  One example for such an application protocol
-   specific extension based on HT is [XEP-0397].  This XMPP [RFC6120]
-   extension protocol allows, amoungst other things, B) and C),
-
-   Since the SASL-HT token is not salted, and only one hash iteration is
-   used, the HT mechanism is not suitable to protect long-lived shared
-   secrets (e.g. "passwords").  You may want to look at [RFC5802] for
-   that.
-
-1.1.  Conventions and Terminology
-
-   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
-   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
-   "OPTIONAL" in this document are to be interpreted as described in BCP
-   14 [RFC2119] [RFC8174] when, and only when, they appear in all
-   capitals, as shown here.
-
-1.2.  Applicability
-
-   Because this mechanism transports information that should not be
-   controlled by an attacker, the HT mechanism MUST only be used over
-   channels protected by Transport Layer Security (TLS, see [RFC5246]),
-   or over similar integrity-protected and authenticated channels.  Also
-   the application protoocl specific extension which requests a new
-   SASL-HT token SHOULD only be used over similar protected channels.
-
-   In addition, when TLS is used, the client MUST successfully validate
-   the server's certificate ([RFC5280], [RFC6125]).
-
-   The family of HT mechanisms is not applicable for proxy
-   authentication, since they can not carry a authorization identity
-   string (authzid).
-
-2.  The HT Family of Mechanisms
-
-   Each mechanism in this family differs by the choice of the hash
-   algorithm and the choice of the channel binding [RFC5929] type.
-
-   A HT mechanism name is a string beginning with "HT-" followed by the
-   capitalized name of the used hash, followed by "-", and suffixed by
-   one of 'ENDP' and 'UNIQ'.
-
-   Hence each HT mechanism has a name of the following form:
-
-                          HT-<hash-alg>-<cb-type>
-
-
-
-
-Schmaus & Egger         Expires November 8, 2018                [Page 3]
-
-Internet-Draft                                                  May 2018
-
-
-   Where <hash-alg> is the capitalized "Hash Name String" of the IANA
-   "Named Information Hash Algorithm Registry" [iana-hash-alg] as
-   specified in [RFC6920], and <cb-type> is one of 'ENDP' or 'UNIQ'
-   denoting the channel binding type.  In case of 'ENDP', the tls-
-   server-end-point channel binding type is used.  In case of 'UNIQ',
-   the tls-unique channel binding type is used.  Valid channel binding
-   types are defined in the IANA "Channel-Binding Types" registry
-   [iana-cbt] as specified in [RFC5056].
-
-                      +------+----------------------+
-                      | CBT  | Channel Binding Type |
-                      +------+----------------------+
-                      | ENDP | tls-server-end-point |
-                      | UNIQ |      tls-unique      |
-                      +------+----------------------+
-
-                    Mapping of CBT to Channel Bindings
-
-   The following table lists the HT SASL mechanisms registered by this
-   document.
-
-   +------------------+------------------+-----------------------------+
-   |  Mechanism Name  |     HT Hash      |    Channel-binding unique   |
-   |                  |    Algorithm     |            prefix           |
-   +------------------+------------------+-----------------------------+
-   | HT-SHA-512-ENDP  |     SHA-512      |     tls-server-end-point    |
-   | HT-SHA-512-UNIQ  |     SHA-512      |          tls-unique         |
-   | HT-SHA3-512-ENDP |     SHA3-512     |     tls-server-end-point    |
-   | HT-SHA-256-UNIQ  |     SHA-256      |          tls-unique         |
-   +------------------+------------------+-----------------------------+
-
-                        Defined HT SASL mechanisms
-
-3.  The HT Authentication Exchange
-
-   The mechanism consists of a simple exchange of exactly two messages
-   between the initiator and responder.
-
-   The following syntax specifications use the Augmented Backus-Naur
-   form (ABNF) notation as specified in [RFC5234].
-
-3.1.  Initiator First Message
-
-   The HT mechanism starts with the initiator-msg, send by the initiator
-   to the responder.  The follwing lists the ABNF grammar for the
-   initiator-msg:
-
-
-
-
-
-Schmaus & Egger         Expires November 8, 2018                [Page 4]
-
-Internet-Draft                                                  May 2018
-
-
-        initiator-msg = authcid NUL initiator-hashed-token
-        authcid = 1*SAFE ; MUST accept up to 255 octets
-        initiator-hashed-token = 1*OCTET
-
-        NUL    = %0x00 ; The null octet
-        SAFE   = UTF1 / UTF2 / UTF3 / UTF4
-                 ;; any UTF-8 encoded Unicode character except NUL
-
-        UTF1   = %x01-7F ;; except NUL
-        UTF2   = %xC2-DF UTF0
-        UTF3   = %xE0 %xA0-BF UTF0 / %xE1-EC 2(UTF0) /
-                 %xED %x80-9F UTF0 / %xEE-EF 2(UTF0)
-        UTF4   = %xF0 %x90-BF 2(UTF0) / %xF1-F3 3(UTF0) /
-                 %xF4 %x80-8F 2(UTF0)
-        UTF0   = %x80-BF
-
-   The initiator first message starts with the authentication identity
-   (authcid, see[RFC4422]) as UTF-8 [RFC3629] encoded string.  It is
-   followed by initiator-hashed-token separated by as single null octet.
-
-   The value of the initiator-hashed-token is defined as follows:
-
-       initiator-hashed-token := HMAC(token, "Initiator" || cb-data)
-
-   HMAC() is the function defined in [RFC2104] with H being the selected
-   HT hash algorithm, 'cb-data' represents the data provided by the
-   selected channel binding type, and 'token' are the UTF-8 encoded
-   octets of the SASL-HT token string which acts as shared secret
-   between initiator and responder.
-
-   The initiator-msg MAY be included in TLS 1.3 0-RTT early data, as
-   specified in [I-D.ietf-tls-tls13].  If this is the case, then the
-   initiating entity MUST NOT include any further appliction protocol
-   payload in the early data besides the HT initiator-msg and potential
-   required framing of the SASL profile.  The responder MUST abort the
-   SASL authentication if the early data contains additional application
-   protocol payload.
-
-      TODO: It should be possible to exploit TLS 1.3 early data for
-      "0.5" RTT resumption of the application protocol's session.  That
-      is, on resumption the initiating entity MUST NOT send any
-      application protocol payload together with first flight data,
-      besides the HT initiator-msg.  But if the responding entity is
-      able to verify the TLS 1.3 early data, then it can send additional
-      application protocol payload right away together with the
-      "resumption successful" response to the initiating entity.
-
-
-
-
-
-Schmaus & Egger         Expires November 8, 2018                [Page 5]
-
-Internet-Draft                                                  May 2018
-
-
-      TODO: Add note why HMAC() is always involved, even if HMAC() is
-      usually not required when modern hash algorithms are used.
-
-3.2.  Initiator Authentication
-
-   Upon receiving the initiator-msg, the responder calculates itself the
-   value of initiator-hashed-token and compares it with the received
-   value found in the initiator-msg.  If both values are equal, then the
-   initiator has been successfully authenticated.  Otherwise, if both
-   values are not equal, then authentication MUST fail.
-
-   If the responder was able to authenticate the initiator, then the
-   used token MUST be revoked immediately.
-
-3.3.  Final Responder Message
-
-   After the initiator was authenticated the responder continues the
-   SASL authentication by sending the responder-msg to the initiator.
-
-   The ABNF for responder-msg is:
-
-                          responder-msg = 1*OCTET
-
-   The responder-msg value is defined as follows:
-
-           responder-msg := HMAC(token, "Responder" || cb-data)
-
-   The initiating entity MUST verify the responder-msg to achieve mutual
-   authentication.
-
-4.  Compliance with SASL Mechanism Requirements
-
-   This section describes compliance with SASL mechanism requirements
-   specified in Section 5 of [RFC4422].
-
-   1.  "HT-SHA-256-ENDP", "HT-SHA-256-UNIQ", "HT-SHA-3-512-ENDP" and
-       "HT-SHA-3-512-UNIQ".
-
-   2.  Definition of server-challenges and client-responses:
-
-       a  HT is a client-first mechanism.
-
-       b  HT does send additional data with success (the responder-msg).
-
-   3.  HT is not capable of transferring authorization identities from
-       the client to the server.
-
-
-
-
-
-Schmaus & Egger         Expires November 8, 2018                [Page 6]
-
-Internet-Draft                                                  May 2018
-
-
-   4.  HT does not offer any security layers (HT offers channel binding
-       instead).
-
-   5.  HT does not protect the authorization identity.
-
-5.  Requirements for the Application-Protocol Extension
-
-   It is REQUIRED that the application-protocol specific extension
-   provides a mechanism to request a SASL-HT token in form of a Unicode
-   string.  The returned token MUST have been newly generated by a
-   cryptographically secure random number generator and MUST contain at
-   least 128 bit of entropy.
-
-   It is RECOMMENDED that the the protocol allows the requestor to
-   signal the name of the SASL mechanism which he intends to use with
-   the token.  If a token is used with a different mechanism than the
-   one which was signalled upon requesting the token, then the
-   authentication MUST fail.  This allows to pin the token to a SASL
-   mechanism, which increases the security because it makes it
-   impossible for an attacker to downgrade the SASL mechanism.
-
-6.  Security Considerations
-
-   To be secure, the HT mechanism MUST be used over a TLS channel that
-   has had the session hash extension [RFC7627] negotiated, or session
-   resumption MUST NOT have been used.
-
-   It is RECOMMENDED that implementations peridically require a full
-   authentication using a strong SASL mechanism which does not use the
-   SASL-HT token.
-
-   It is of vital importance that the SASL-HT token is generated by a
-   cryptographically secure random generator.  See [RFC4086] for more
-   information about Randomness Requirements for Security.
-
-7.  IANA Considerations
-
-   IANA has added the following family of SASL mechanisms to the SASL
-   Mechanism registry established by [RFC4422]:
-
-
-
-
-
-
-
-
-
-
-
-
-Schmaus & Egger         Expires November 8, 2018                [Page 7]
-
-Internet-Draft                                                  May 2018
-
-
-      To: ia...@ia...
-      Subject: Registration of a new SASL family HT
-
-      SASL mechanism name (or prefix for the family): HT-*
-      Security considerations:
-        Section FIXME of draft-schmaus-kitten-sasl-ht
-      Published specification (optional, recommended):
-        draft-schmaus-kitten-sasl-ht-XX (TODO)
-      Person & email address to contact for further information:
-      IETF SASL WG <ki...@ie...>
-      Intended usage: COMMON
-      Owner/Change controller: IESG <ie...@ie...>
-      Note: Members of this family MUST be explicitly registered
-      using the "IETF Review" [@!RFC5226] registration procedure.
-      Reviews MUST be requested on the Kitten WG mailing list
-      <ki...@ie...> (or a successor designated by the responsible
-      Security AD).
-
-8.  References
-
-8.1.  Normative References
-
-   [I-D.ietf-tls-tls13]
-              Rescorla, E., "The Transport Layer Security (TLS) Protocol
-              Version 1.3", draft-ietf-tls-tls13-23 (work in progress),
-              January 2018.
-
-   [iana-cbt]
-              Williams, N., "IANA Channel-Binding Types", 2010,
-              <https://www.iana.org/assignments/channel-binding-types/
-              channel-binding-types.xhtml>.
-
-   [iana-hash-alg]
-              Williams, N., "IANA Named Information Hash Algorithm
-              Registry", 2010, <https://www.iana.org/assignments/named-
-              information/named-information.xhtml#hash-alg>.
-
-   [RFC2104]  Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
-              Hashing for Message Authentication", RFC 2104,
-              DOI 10.17487/RFC2104, February 1997,
-              <https://www.rfc-editor.org/info/rfc2104>.
-
-   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
-              Requirement Levels", BCP 14, RFC 2119,
-              DOI 10.17487/RFC2119, March 1997,
-              <https://www.rfc-editor.org/info/rfc2119>.
-
-
-
-
-
-Schmaus & Egger         Expires November 8, 2018                [Page 8]
-
-Internet-Draft                                                  May 2018
-
-
-   [RFC3629]  Yergeau, F., "UTF-8, a transformation format of ISO
-              10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November
-              2003, <https://www.rfc-editor.org/info/rfc3629>.
-
-   [RFC4086]  Eastlake 3rd, D., Schiller, J., and S. Crocker,
-              "Randomness Requirements for Security", BCP 106, RFC 4086,
-              DOI 10.17487/RFC4086, June 2005,
-              <https://www.rfc-editor.org/info/rfc4086>.
-
-   [RFC4422]  Melnikov, A., Ed. and K. Zeilenga, Ed., "Simple
-              Authentication and Security Layer (SASL)", RFC 4422,
-              DOI 10.17487/RFC4422, June 2006,
-              <https://www.rfc-editor.org/info/rfc4422>.
-
-   [RFC5056]  Williams, N., "On the Use of Channel Bindings to Secure
-              Channels", RFC 5056, DOI 10.17487/RFC5056, November 2007,
-              <https://www.rfc-editor.org/info/rfc5056>.
-
-   [RFC5234]  Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax
-              Specifications: ABNF", STD 68, RFC 5234,
-              DOI 10.17487/RFC5234, January 2008,
-              <https://www.rfc-editor.org/info/rfc5234>.
-
-   [RFC5246]  Dierks, T. and E. Rescorla, "The Transport Layer Security
-              (TLS) Protocol Version 1.2", RFC 5246,
-              DOI 10.17487/RFC5246, August 2008,
-              <https://www.rfc-editor.org/info/rfc5246>.
-
-   [RFC5280]  Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
-              Housley, R., and W. Polk, "Internet X.509 Public Key
-              Infrastructure Certificate and Certificate Revocation List
-              (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
-              <https://www.rfc-editor.org/info/rfc5280>.
-
-   [RFC5929]  Altman, J., Williams, N., and L. Zhu, "Channel Bindings
-              for TLS", RFC 5929, DOI 10.17487/RFC5929, July 2010,
-              <https://www.rfc-editor.org/info/rfc5929>.
-
-   [RFC6125]  Saint-Andre, P. and J. Hodges, "Representation and
-              Verification of Domain-Based Application Service Identity
-              within Internet Public Key Infrastructure Using X.509
-              (PKIX) Certificates in the Context of Transport Layer
-              Security (TLS)", RFC 6125, DOI 10.17487/RFC6125, March
-              2011, <https://www.rfc-editor.org/info/rfc6125>.
-
-
-
-
-
-
-
-Schmaus & Egger         Expires November 8, 2018                [Page 9]
-
-Internet-Draft                                                  May 2018
-
-
-   [RFC6920]  Farrell, S., Kutscher, D., Dannewitz, C., Ohlman, B.,
-              Keranen, A., and P. Hallam-Baker, "Naming Things with
-              Hashes", RFC 6920, DOI 10.17487/RFC6920, April 2013,
-              <https://www.rfc-editor.org/info/rfc6920>.
-
-   [RFC7627]  Bhargavan, K., Ed., Delignat-Lavaud, A., Pironti, A.,
-              Langley, A., and M. Ray, "Transport Layer Security (TLS)
-              Session Hash and Extended Master Secret Extension",
-              RFC 7627, DOI 10.17487/RFC7627, September 2015,
-              <https://www.rfc-editor.org/info/rfc7627>.
-
-   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
-              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
-              May 2017, <https://www.rfc-editor.org/info/rfc8174>.
-
-8.2.  Informative References
-
-   [RFC5802]  Newman, C., Menon-Sen, A., Melnikov, A., and N. Williams,
-              "Salted Challenge Response Authentication Mechanism
-              (SCRAM) SASL and GSS-API Mechanisms", RFC 5802,
-              DOI 10.17487/RFC5802, July 2010,
-              <https://www.rfc-editor.org/info/rfc5802>.
-
-   [RFC6120]  Saint-Andre, P., "Extensible Messaging and Presence
-              Protocol (XMPP): Core", RFC 6120, DOI 10.17487/RFC6120,
-              March 2011, <https://www.rfc-editor.org/info/rfc6120>.
-
-   [XEP-0397]
-              Schmaus, F., "XEP-0397: Instant Stream Resumption", 2018,
-              <https://xmpp.org/extensions/xep-0397.html>.
-
-Appendix A.  Acknowledgments
-
-   This document benefited from discussions on the KITTEN WG mailing
-   list.  The authors would like to specially thank Thijs Alkemade, Sam
-   Whited and Alexey Melnikov for their comments on this topic.
-   Furthermore we would like to thank Alexander Wuerstlein, who came up
-   with the idea to pin the token to a SASL mechanism for increased
-   security.
-
-Authors' Addresses
-
-   Florian Schmaus
-   University of Erlangen-Nuremberg
-
-   Email: sc...@cs...
-
-
-
-
-
-Schmaus & Egger         Expires November 8, 2018               [Page 10]
-
-Internet-Draft                                                  May 2018
-
-
-   Christoph Egger
-   University of Erlangen-Nuremberg
-
-   Email: eg...@cs...
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Schmaus & Egger         Expires November 8, 2018               [Page 11]

Added: trunk/docs/specs/draft-schmaus-kitten-sasl-ht-08.txt
===================================================================
--- trunk/docs/specs/draft-schmaus-kitten-sasl-ht-08.txt	                        (rev 0)
+++ trunk/docs/specs/draft-schmaus-kitten-sasl-ht-08.txt	2022-10-11 14:18:43 UTC (rev 1572)
@@ -0,0 +1,616 @@
+
+
+
+
+Common Authentication Technology Next Generation              F. Schmaus
+Internet-Draft                                                  C. Egger
+Intended status: Experimental                      FAU Erlangen-Nürnberg
+Expires: 13 April 2023                                   10 October 2022
+
+
+                    The Hashed Token SASL Mechanism
+                    draft-schmaus-kitten-sasl-ht-08
+
+Abstract
+
+      This I-D is developed at
+      https://github.com/Flowdalic/xeps/tree/master/draft-schmaus-
+      kitten-sasl-ht (https://github.com/Flowdalic/xeps/tree/master/
+      draft-schmaus-kitten-sasl-ht)
+
+   This document specifies the family of Hashed Token SASL mechanisms
+   which enable a proof-of-possession-based authentication scheme and
+   are meant to be used for quick re-authentication of a previous
+   session.  The Hashed Token SASL mechanism's authentication sequence
+   consists of only one round-trip.  The usage of short-lived,
+   exclusively ephemeral hashed tokens is achieving the single round-
+   trip property.  The SASL mechanism specified herin further provides
+   hash agility, mutual authentication and is secured by channel
+   binding.
+
+Status of This Memo
+
+   This Internet-Draft is submitted in full conformance with the
+   provisions of BCP 78 and BCP 79.
+
+   Internet-Drafts are working documents of the Internet Engineering
+   Task Force (IETF).  Note that other groups may also distribute
+   working documents as Internet-Drafts.  The list of current Internet-
+   Drafts is at https://datatracker.ietf.org/drafts/current/.
+
+   Internet-Drafts are draft documents valid for a maximum of six months
+   and may be updated, replaced, or obsoleted by other documents at any
+   time.  It is inappropriate to use Internet-Drafts as reference
+   material or to cite them other than as "work in progress."
+
+   This Internet-Draft will expire on 13 April 2023.
+
+Copyright Notice
+
+   Copyright (c) 2022 IETF Trust and the persons identified as the
+   document authors.  All rights reserved.
+
+
+
+
+Schmaus & Egger           Expires 13 April 2023                 [Page 1]
+
+Internet-Draft       The Hashed Token SASL Mechanism        October 2022
+
+
+   This document is subject to BCP 78 and the IETF Trust's Legal
+   Provisions Relating to IETF Documents (https://trustee.ietf.org/
+   license-info) in effect on the date of publication of this document.
+   Please review these documents carefully, as they describe your rights
+   and restrictions with respect to this document.
+
+Table of Contents
+
+   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
+     1.1.  Conventions and Terminology . . . . . . . . . . . . . . .   3
+     1.2.  Applicability . . . . . . . . . . . . . . . . . . . . . .   3
+   2.  The HT Family of Mechanisms . . . . . . . . . . . . . . . . .   4
+   3.  The HT Authentication Exchange  . . . . . . . . . . . . . . .   5
+     3.1.  Initiator First Message . . . . . . . . . . . . . . . . .   5
+     3.2.  Initiator Authentication  . . . . . . . . . . . . . . . .   6
+     3.3.  Final Responder Message . . . . . . . . . . . . . . . . .   6
+   4.  Compliance with SASL Mechanism Requirements . . . . . . . . .   7
+   5.  Requirements for the Application-Protocol Extension . . . . .   7
+   6.  Security Considerations . . . . . . . . . . . . . . . . . . .   7
+   7.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   8
+   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   8
+     8.1.  Normative References  . . . . . . . . . . . . . . . . . .   8
+     8.2.  Informative References  . . . . . . . . . . . . . . . . .  10
+   Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . .  11
+   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  11
+
+1.  Introduction
+
+   This specification describes the family of Hashed Token (HT) Simple
+   Authentication and Security Layer (SASL) [RFC4422] mechanisms, which
+   enable a proof-of-possession-based authentication scheme.  The HT
+   mechanism is designed to be used with short-lived, exclusively
+   ephemeral tokens, called SASL-HT tokens, and allow for quick, one
+   round-trip, re-authentication of a previous session.
+
+   Further properties of the HT mechanism are 1) hash agility, 2) mutual
+   authentication, and 3) being secured by channel binding.
+
+   Clients are supposed to request SASL-HT tokens from the server after
+   being authenticated using a "strong" SASL mechanism like SCRAM
+   [RFC5802].  Hence a typical sequence of actions using HT may look
+   like the following:
+
+
+
+
+
+
+
+
+
+Schmaus & Egger           Expires 13 April 2023                 [Page 2]
+
+Internet-Draft       The Hashed Token SASL Mechanism        October 2022
+
+
+   A) Client authenticates using a strong mechanism (e.g., SCRAM)
+   B) Client requests secret SASL-HT token
+   C) Service returns SASL-HT token
+      <normal client-server interaction here>
+   D) Connection between client and server gets interrupted,
+      for example because of a WiFi ↔ GSM switch
+   E) Client resumes the previous session using HT and token from C)
+   F) Service revokes the successfully used SASL-HT token
+      [goto B]
+
+   The HT mechanism requires an accompanying, application protocol
+   specific, extension, which allows clients to requests a new SASL-HT
+   token (see Section 5 (Section 5)).  One example for such an
+   application protocol specific extension based on HT is [XEP-0397].
+   This XMPP [RFC6120] extension protocol allows, amongst other things,
+   B) and C),
+
+   Since the SASL-HT token is not salted, and only one hash iteration is
+   used, the HT mechanism is not suitable to protect long-lived shared
+   secrets (e.g. "passwords").  You may want to look at [RFC5802] for
+   that.
+
+1.1.  Conventions and Terminology
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
+   "OPTIONAL" in this document are to be interpreted as described in
+   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
+   capitals, as shown here.  These words may also appear in this
+   document in lower case as plain English words, absent their normative
+   meanings.
+
+1.2.  Applicability
+
+   Because this mechanism transports information that should not be
+   controlled by an attacker, the HT mechanism *MUST* only be used over
+   channels protected by Transport Layer Security (TLS, see [RFC5246]),
+   or over similar integrity-protected and authenticated channels.
+   Also, the application protcol specific extension which requests a new
+   SASL-HT token *SHOULD* only be used over similarly protected
+   channels.
+
+   Also, when TLS is used, the client *MUST* successfully validate the
+   server's certificate ([RFC5280], [RFC6125]).
+
+   The family of HT mechanisms is not applicable for proxy
+   authentication since they can not carry an authorization identity
+   string (authzid).
+
+
+
+Schmaus & Egger           Expires 13 April 2023                 [Page 3]
+
+Internet-Draft       The Hashed Token SASL Mechanism        October 2022
+
+
+2.  The HT Family of Mechanisms
+
+   Each mechanism in this family differs by choice of the hash algorithm
+   and the choice of the channel binding [RFC5929] type.
+
+   An HT mechanism name is a string beginning with "HT-" followed by the
+   capitalised name of the used hash, followed by "-", and suffixed by
+   one of 'ENDP' and 'UNIQ'.
+
+   Hence each HT mechanism has a name of the following form:
+
+   HT-<hash-alg>-<cb-type>
+
+   Where <hash-alg> is the capitalised "Hash Name String" of the IANA
+   "Named Information Hash Algorithm Registry" [iana-hash-alg] as
+   specified in [RFC6920], and <cb-type> is one of 'ENDP', 'UNIQ', or
+   'EXPR' denoting the channel binding type.  In the case of 'ENDP', the
+   tls-server-end-point channel binding type is used.  In the case of
+   'UNIQ', the tls-unique channel binding type is used.  In the case of
+   'EXPR', the tls-exporter [RFC9266] channel binding type is used.
+   Valid channel binding types are defined in the IANA "Channel-Binding
+   Types" registry [iana-cbt] as specified in [RFC5056].
+
+                    +=========+======================+
+                    | cb-type | Channel Binding Type |
+                    +=========+======================+
+                    | ENDP    | tls-server-end-point |
+                    +---------+----------------------+
+                    | UNIQ    | tls-unique           |
+                    +---------+----------------------+
+                    | EXPR    | tls-exporter         |
+                    +---------+----------------------+
+
+                      Table 1: Mapping of cb-type to
+                          Channel Binding Types
+
+   The following table lists some examples of HT SASL mechanisms
+   registered by this document.
+
+
+
+
+
+
+
+
+
+
+
+
+
+Schmaus & Egger           Expires 13 April 2023                 [Page 4]
+
+Internet-Draft       The Hashed Token SASL Mechanism        October 2022
+
+
+      +==================+===================+======================+
+      | Mechanism Name   | HT Hash Algorithm | Channel-binding      |
+      |                  |                   | unique prefix        |
+      +==================+===================+======================+
+      | HT-SHA-512-ENDP  | SHA-512           | tls-server-end-point |
+      +------------------+-------------------+----------------------+
+      | HT-SHA-512-UNIQ  | SHA-512           | tls-unique           |
+      +------------------+-------------------+----------------------+
+      | HT-SHA3-512-ENDP | SHA3-512          | tls-server-end-point |
+      +------------------+-------------------+----------------------+
+      | HT-SHA-256-UNIQ  | SHA-256           | tls-unique           |
+      +------------------+-------------------+----------------------+
+
+                  Table 2: Examples of HT SASL mechanisms
+
+3.  The HT Authentication Exchange
+
+   The mechanism consists of a simple exchange of precisely two messages
+   between the initiator and responder.
+
+   The following syntax specifications use the Augmented Backus-Naur
+   form (ABNF) notation as specified in [RFC5234].
+
+3.1.  Initiator First Message
+
+   The HT mechanism starts with the initiator-msg, send by the initiator
+   to the responder.  The following lists the ABNF grammar for the
+   initiator-msg:
+
+   initiator-msg = authcid NUL initiator-hashed-token
+   authcid = 1*SAFE ; MUST accept up to 255 octets
+   initiator-hashed-token = 1*OCTET
+
+   NUL    = %0x00 ; The null octet
+   SAFE   = UTF1 / UTF2 / UTF3 / UTF4
+            ;; any UTF-8 encoded Unicode character except NUL
+
+   UTF1   = %x01-7F ;; except NUL
+   UTF2   = %xC2-DF UTF0
+   UTF3   = %xE0 %xA0-BF UTF0 / %xE1-EC 2(UTF0) /
+            %xED %x80-9F UTF0 / %xEE-EF 2(UTF0)
+   UTF4   = %xF0 %x90-BF 2(UTF0) / %xF1-F3 3(UTF0) /
+            %xF4 %x80-8F 2(UTF0)
+   UTF0   = %x80-BF
+
+   The initiator first message starts with the authentication identity
+   (authcid, see[RFC4422]) as UTF-8 [RFC3629] encoded string.  It is
+   followed by initiator-hashed-token separated by as single null octet.
+
+
+
+Schmaus & Egger           Expires 13 April 2023                 [Page 5]
+
+Internet-Draft       The Hashed Token SASL Mechanism        October 2022
+
+
+   The value of the initiator-hashed-token is defined as follows:
+
+   initiator-hashed-token := HMAC(token, "Initiator" || cb-data)
+
+   HMAC() is the function defined in [RFC2104] with H being the selected
+   HT hash algorithm, 'cb-data' represents the data provided by the
+   selected channel binding type, and 'token' are the UTF-8 encoded
+   octets of the SASL-HT token string which acts as a shared secret
+   between initiator and responder.
+
+   The initiator-msg *MAY* be included in TLS 1.3 0-RTT early data, as
+   specified in [RFC8446].  If this is the case, then the initiating
+   entity *MUST NOT* include any further application protocol payload in
+   the early data besides the HT initiator-msg and potential required
+   framing of the SASL profile.  The responder *MUST* abort the SASL
+   authentication if the early data contains additional application
+   protocol payload.
+
+      SASL-HT hence allows exploiting TLS 1.3 early data for "0.5 Round
+      Trip Time (RTT)" resumption of the application protocol's session.
+      Using TLS early data requires extra care when implementing: The
+      early data should only contain the SASL-HT payload, i.e., the
+      initiator-msg, and not an application protocol specific payload.
+      The reason for this is that the early data could be replayed, and
+      thus needs to carry an idempotent operation.  On the other hand,
+      if the responding entity can verify the early data, then it can
+      send additional application protocol payload together with the
+      "resumption successful" response to the initiating entity.
+
+3.2.  Initiator Authentication
+
+   Upon receiving the initiator-msg, the responder calculates itself the
+   value of initiator-hashed-token and compares it with the received
+   value found in the initiator-msg.  If both values are equal, then the
+   initiator has been successfully authenticated.  Otherwise, if both
+   values are not equal, then authentication *MUST* fail.
+
+   If the responder was able to authenticate the initiator, then the
+   used token *MUST* be revoked immediately.
+
+3.3.  Final Responder Message
+
+   After the initiator was authenticated the responder continues the
+   SASL authentication by sending the responder-msg to the initiator.
+
+   The ABNF for responder-msg is:
+
+   responder-msg = 1*OCTET
+
+
+
+Schmaus & Egger           Expires 13 April 2023                 [Page 6]
+
+Internet-Draft       The Hashed Token SASL Mechanism        October 2022
+
+
+   The responder-msg value is defined as follows:
+
+   responder-msg := HMAC(token, "Responder" || cb-data)
+
+   The initiating entity *MUST* verify the responder-msg to achieve
+   mutual authentication.
+
+4.  Compliance with SASL Mechanism Requirements
+
+   This section describes compliance with SASL mechanism requirements
+   specified in Section 5 of [RFC4422].
+
+   1.  "HT-SHA-256-ENDP", "HT-SHA-256-UNIQ", "HT-SHA-3-512-ENDP" and
+       "HT-SHA-3-512-UNIQ".
+
+   2.  Definition of server-challenges and client-responses: a) HT is a
+       client-first mechanism. b) HT does send additional data with
+       success (the responder-msg).
+
+   3.  HT is not capable of transferring authorization identities from
+       the client to the server.
+
+   4.  HT does not offer any security layers (HT offers channel binding
+       instead).
+
+   5.  HT does not protect the authorization identity.
+
+5.  Requirements for the Application-Protocol Extension
+
+   It is *REQUIRED* that the application-protocol specific extension
+   provides a mechanism to request a SASL-HT token in form of a Unicode
+   string.  The returned token *MUST* have been newly generated by a
+   cryptographically secure random number generator and MUST contain at
+   least 128 bit of entropy.
+
+   It is *RECOMMENDED* that the protocol allows the requestor to signal
+   the name of the SASL mechanism which he intends to use with the
+   token.  If a token is used with a different mechanism than the one
+   which was signalled upon requesting the token, then the
+   authentication *MUST* fail.  This allows pinning the token to a SASL
+   mechanism, which increases the security because it makes it
+   impossible for an attacker to downgrade the SASL mechanism.
+
+6.  Security Considerations
+
+   To be secure, the HT mechanism *MUST* be used over a TLS channel that
+   has had the session hash extension [RFC7627] negotiated, or session
+   resumption *MUST NOT* have been used.
+
+
+
+Schmaus & Egger           Expires 13 April 2023                 [Page 7]
+
+Internet-Draft       The Hashed Token SASL Mechanism        October 2022
+
+
+   It is *RECOMMENDED* that implementations periodically require a full
+   authentication using a strong SASL mechanism which does not use the
+   SASL-HT token.
+
+   It is of vital importance that the SASL-HT token is generated by a
+   cryptographically secure random generator.  See [RFC4086] for more
+   information about Randomness Requirements for Security.
+
+7.  IANA Considerations
+
+   IANA is requested to add the following family of SASL mechanisms to
+   the SASL Mechanism registry established by [RFC4422]:
+
+      To: ia...@ia...
+
+      Subject: Registration of a new SASL family HT
+
+      SASL mechanism name (or prefix for the family): HT-*
+
+      Security considerations: Section 6 of draft-schmaus-kitten-sasl-ht
+
+      Published specification (optional, recommended): draft-schmaus-
+      kitten-sasl-ht-XX (TODO)
+
+      Person & email address to contact for further information: IETF
+      SASL WG ki...@ie... (mailto:ki...@ie...)
+
+      Intended usage: COMMON
+
+      Owner/Change controller: IESG ie...@ie... (mailto:ie...@ie...)
+
+      Note: Members of this family MUST be explicitly registered using
+      the "IETF Review" [RFC5226] registration procedure.  Reviews MUST
+      be requested on the Kitten WG mailing list ki...@ie...
+      (mailto:ki...@ie...) (or a successor designated by the
+      responsible Security AD).
+
+8.  References
+
+8.1.  Normative References
+
+   [RFC2104]  Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
+              Hashing for Message Authentication", RFC 2104,
+              DOI 10.17487/RFC2104, February 1997,
+              <https://www.rfc-editor.org/info/rfc2104>.
+
+
+
+
+
+
+Schmaus & Egger           Expires 13 April 2023                 [Page 8]
+
+Internet-Draft       The Hashed Token SASL Mechanism        October 2022
+
+
+   [RFC3629]  Yergeau, F., "UTF-8, a transformation format of ISO
+              10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November
+              2003, <https://www.rfc-editor.org/info/rfc3629>.
+
+   [RFC4086]  Eastlake 3rd, D., Schiller, J., and S. Crocker,
+              "Randomness Requirements for Security", BCP 106, RFC 4086,
+              DOI 10.17487/RFC4086, June 2005,
+              <https://www.rfc-editor.org/info/rfc4086>.
+
+   [RFC4422]  Melnikov, A., Ed. and K. Zeilenga, Ed., "Simple
+              Authentication and Security Layer (SASL)", RFC 4422,
+              DOI 10.17487/RFC4422, June 2006,
+              <https://www.rfc-editor.org/info/rfc4422>.
+
+   [RFC5056]  Williams, N., "On the Use of Channel Bindings to Secure
+              Channels", RFC 5056, DOI 10.17487/RFC5056, November 2007,
+              <https://www.rfc-editor.org/info/rfc5056>.
+
+   [RFC5234]  Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax
+              Specifications: ABNF", STD 68, RFC 5234,
+              DOI 10.17487/RFC5234, January 2008,
+              <https://www.rfc-editor.org/info/rfc5234>.
+
+   [RFC5246]  Dierks, T. and E. Rescorla, "The Transport Layer Security
+              (TLS) Protocol Version 1.2", RFC 5246,
+              DOI 10.17487/RFC5246, August 2008,
+              <https://www.rfc-editor.org/info/rfc5246>.
+
+   [RFC5280]  Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
+              Housley, R., and W. Polk, "Internet X.509 Public Key
+              Infrastructure Certificate and Certificate Revocation List
+              (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
+              <https://www.rfc-editor.org/info/rfc5280>.
+
+   [RFC5929]  Altman, J., Williams, N., and L. Zhu, "Channel Bindings
+              for TLS", RFC 5929, DOI 10.17487/RFC5929, July 2010,
+              <https://www.rfc-editor.org/info/rfc5929>.
+
+   [RFC6125]  Saint-Andre, P. and J. Hodges, "Representation and
+              Verification of Domain-Based Application Service Identity
+              within Internet Public Key Infrastructure Using X.509
+              (PKIX) Certificates in the Context of Transport Layer
+              Security (TLS)", RFC 6125, DOI 10.17487/RFC6125, March
+              2011, <https://www.rfc-editor.org/info/rfc6125>.
+
+
+
+
+
+
+
+Schmaus & Egger           Expires 13 April 2023                 [Page 9]
+
+Internet-Draft       The Hashed Token SASL Mechanism        October 2022
+
+
+   [RFC6920]  Farrell, S., Kutscher, D., Dannewitz, C., Ohlman, B.,
+              Keranen, A., and P. Hallam-Baker, "Naming Things with
+              Hashes", RFC 6920, DOI 10.17487/RFC6920, April 2013,
+              <https://www.rfc-editor.org/info/rfc6920>.
+
+   [RFC7627]  Bhargavan, K., Ed., Delignat-Lavaud, A., Pironti, A.,
+              Langley, A., and M. Ray, "Transport Layer Security (TLS)
+              Session Hash and Extended Master Secret Extension",
+              RFC 7627, DOI 10.17487/RFC7627, September 2015,
+              <https://www.rfc-editor.org/info/rfc7627>.
+
+   [RFC8446]  Rescorla, E., "The Transport Layer Security (TLS) Protocol
+              Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
+              <https://www.rfc-editor.org/info/rfc8446>.
+
+   [RFC9266]  Whited, S., "Channel Bindings for TLS 1.3", RFC 9266,
+              DOI 10.17487/RFC9266, July 2022,
+              <https://www.rfc-editor.org/info/rfc9266>.
+
+   [iana-hash-alg]
+              Williams, N., "IANA Named Information Hash Algorithm
+              Registry", 2010, <https://www.iana.org/assignments/named-
+              information/named-information.xhtml#hash-alg>.
+
+   [iana-cbt] Williams, N., "IANA Channel-Binding Types", 2010,
+              <https://www.iana.org/assignments/channel-binding-types/
+              channel-binding-types.xhtml>.
+
+   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
+              Requirement Levels", BCP 14, RFC 2119,
+              DOI 10.17487/RFC2119, March 1997,
+              <https://www.rfc-editor.org/info/rfc2119>.
+
+   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
+              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
+              May 2017, <https://www.rfc-editor.org/info/rfc8174>.
+
+8.2.  Informative References
+
+   [RFC5226]  Narten, T. and H. Alvestrand, "Guidelines for Writing an
+              IANA Considerations Section in RFCs", RFC 5226,
+              DOI 10.17487/RFC5226, May 2008,
+              <https://www.rfc-editor.org/info/rfc5226>.
+
+
+
+
+
+
+
+
+Schmaus & Egger           Expires 13 April 2023                [Page 10]
+
+Internet-Draft       The Hashed Token SASL Mechanism        October 2022
+
+
+   [RFC5802]  Newman, C., Menon-Sen, A., Melnikov, A., and N. Williams,
+              "Salted Challenge Response Authentication Mechanism
+              (SCRAM) SASL and GSS-API Mechanisms", RFC 5802,
+              DOI 10.17487/RFC5802, July 2010,
+              <https://www.rfc-editor.org/info/rfc5802>.
+
+   [RFC6120]  Saint-Andre, P., "Extensible Messaging and Presence
+              Protocol (XMPP): Core", RFC 6120, DOI 10.17487/RFC6120,
+              March 2011, <https://www.rfc-editor.org/info/rfc6120>.
+
+   [XEP-0397] Schmaus, F., "XEP-0397: Instant Stream Resumption", 3
+              November 2018,
+              <https://xmpp.org/extensions/xep-0397.html>.
+
+Acknowledgments
+
+   This document benefited from discussions on the KITTEN WG mailing
+   list.  The authors would like to especially thank Thijs Alkemade, Sam
+   Whited and Alexey Melnikov for their comments on this topic.
+   Furthermore, we would like to thank Alexander Wuerstlein, who came up
+   with the idea to pin the token to a SASL mechanism for increased
+   security.
+
+Authors' Addresses
+
+   Florian Schmaus
+   FAU Erlangen-Nürnberg
+   Email: fl...@cs...
+
+
+   Christoph Egger
+   FAU Erlangen-Nürnberg
+   Email: eg...@cs...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Schmaus & Egger           Expires 13 April 2023                [Page 11]

Modified: trunk/docs/specs/internet-drafts.html
===================================================================
--- trunk/docs/specs/internet-drafts.html	2022-09-02 17:17:58 UTC (rev 1571)
+++ trunk/docs/specs/internet-drafts.html	2022-10-11 14:18:43 UTC (rev 1572)
@@ -672,9 +672,9 @@
   </li>
 
   <li>
-    <a href="draft-schmaus-kitten-sasl-ht-04.txt">draft-schmaus-kitten-sasl-ht-04</a>: The Hashed Token SASL Mechanism
+    <a href="draft-schmaus-kitten-sasl-ht-08.txt">draft-schmaus-kitten-sasl-ht-08</a>: The Hashed Token SASL Mechanism
     <br>
-    Expiration Date: November 8, 2018
+    Expiration Date: April 13, 2023
     <br><br>
   </li>
 

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.

[ldap-sdk-commits] SF.net SVN: ldap-sdk:[1571] trunk

[<di...@us...>]

Revision: 1571
          http://sourceforge.net/p/ldap-sdk/code/1571
Author:   dirmgr
Date:     2022-09-02 17:17:58 +0000 (Fri, 02 Sep 2022)
Log Message:
-----------
Post-6.0.6 release updates

Updated the LDAP SDK version so that subsequent builds will have a
version number of 6.0.7.  Preserved a copy of the 6.0.6 public API
to ensure that we will maintain backward compatibility with it.
Fixed a couple of minor typos in the release notes.

Modified Paths:
--------------
    trunk/docs/release-notes.html
    trunk/tests/unit/src/com/unboundid/ldap/sdk/APITestCase.java
    trunk/version.properties

Added Paths:
-----------
    trunk/resource/public-api-6.0.6.txt

Modified: trunk/docs/release-notes.html
===================================================================
--- trunk/docs/release-notes.html	2022-09-02 17:11:52 UTC (rev 1570)
+++ trunk/docs/release-notes.html	2022-09-02 17:17:58 UTC (rev 1571)
@@ -54,7 +54,7 @@
 
                 <li>
                   Significantly improved the class-level Javadoc documentation for the SSLUtil
-                  class to provide a better overview of TLS protocol versions,  TLS cipher suites,
+                  class to provide a better overview of TLS protocol versions, TLS cipher suites,
                   key managers, trust managers, and certificate host name verification, and to
                   provide examples that better illustrate best practices for establishing secure
                   connections.  Also made Javadoc improvements in the LDAPConnection and
@@ -148,7 +148,7 @@
                   used and missing, and the most common filter sizes in terms of number of
                   components.  If the tool is invoked with the --doNotAnonymize option, then it
                   will also report on the target bind DNs with the most consecutive failed
-                  authetnication attempts, and on search filters that may potentially indicate
+                  authentication attempts, and on search filters that may potentially indicate
                   unsuccessful injection attempts based on suspicious content in an assertion
                   value (including parentheses, ampersands, pipes, quotes, or the words "select"
                   and "from").

Added: trunk/resource/public-api-6.0.6.txt
===================================================================
--- trunk/resource/public-api-6.0.6.txt	                        (rev 0)
+++ trunk/resource/public-api-6.0.6.txt	2022-09-02 17:17:58 UTC (rev 1571)
@@ -0,0 +1,16709 @@
+@Extensible class com.unboundid.ldap.listener.InMemoryExtendedOperationHandler constructor public com.unboundid.ldap.listener.InMemoryExtendedOperationHandler()
+@Extensible class com.unboundid.ldap.listener.InMemoryExtendedOperationHandler method public abstract com.unboundid.ldap.sdk.ExtendedResult processExtendedOperation(com.unboundid.ldap.listener.InMemoryRequestHandler,int,com.unboundid.ldap.sdk.ExtendedRequest)
+@Extensible class com.unboundid.ldap.listener.InMemoryExtendedOperationHandler method public abstract java.lang.String getExtendedOperationHandlerName()
+@Extensible class com.unboundid.ldap.listener.InMemoryExtendedOperationHandler method public abstract java.util.List<java.lang.String> getSupportedExtendedRequestOIDs()
+@Extensible class com.unboundid.ldap.listener.InMemoryExtendedOperationHandler method public java.lang.String toString()
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder constructor protected com.unboundid.ldap.listener.InMemoryPasswordEncoder(java.lang.String,com.unboundid.ldap.listener.PasswordEncoderOutputFormatter)
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method protected abstract boolean passwordMatches(byte[],byte[],com.unboundid.ldap.sdk.ReadOnlyEntry) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method protected abstract byte[] encodePassword(byte[],com.unboundid.ldap.sdk.ReadOnlyEntry,java.util.List<com.unboundid.ldap.sdk.Modification>) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method protected abstract byte[] extractClearPassword(byte[],com.unboundid.ldap.sdk.ReadOnlyEntry) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method protected abstract void ensurePreEncodedPasswordAppearsValid(byte[],com.unboundid.ldap.sdk.ReadOnlyEntry,java.util.List<com.unboundid.ldap.sdk.Modification>) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public abstract void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final boolean clearPasswordMatchesEncodedPassword(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.ReadOnlyEntry) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final boolean passwordStartsWithPrefix(com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final com.unboundid.asn1.ASN1OctetString encodePassword(com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.ReadOnlyEntry,java.util.List<com.unboundid.ldap.sdk.Modification>) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final com.unboundid.asn1.ASN1OctetString extractClearPasswordFromEncodedPassword(com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.ReadOnlyEntry) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final com.unboundid.ldap.listener.PasswordEncoderOutputFormatter getOutputFormatter()
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final java.lang.String getPrefix()
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final java.lang.String toString()
+@Extensible class com.unboundid.ldap.listener.InMemoryPasswordEncoder method public final void ensurePreEncodedPasswordAppearsValid(com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.ReadOnlyEntry,java.util.List<com.unboundid.ldap.sdk.Modification>) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.InMemorySASLBindHandler constructor public com.unboundid.ldap.listener.InMemorySASLBindHandler()
+@Extensible class com.unboundid.ldap.listener.InMemorySASLBindHandler method public abstract com.unboundid.ldap.sdk.BindResult processSASLBind(com.unboundid.ldap.listener.InMemoryRequestHandler,int,com.unboundid.ldap.sdk.DN,com.unboundid.asn1.ASN1OctetString,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.InMemorySASLBindHandler method public abstract java.lang.String getSASLMechanismName()
+@Extensible class com.unboundid.ldap.listener.InMemorySASLBindHandler method public java.lang.String toString()
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler constructor public com.unboundid.ldap.listener.LDAPListenerRequestHandler()
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.listener.LDAPListenerRequestHandler newInstance(com.unboundid.ldap.listener.LDAPListenerClientConnection) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processAddRequest(int,com.unboundid.ldap.protocol.AddRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processBindRequest(int,com.unboundid.ldap.protocol.BindRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processCompareRequest(int,com.unboundid.ldap.protocol.CompareRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processDeleteRequest(int,com.unboundid.ldap.protocol.DeleteRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processExtendedRequest(int,com.unboundid.ldap.protocol.ExtendedRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processModifyDNRequest(int,com.unboundid.ldap.protocol.ModifyDNRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processModifyRequest(int,com.unboundid.ldap.protocol.ModifyRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public abstract com.unboundid.ldap.protocol.LDAPMessage processSearchRequest(int,com.unboundid.ldap.protocol.SearchRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public void closeInstance()
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public void processAbandonRequest(int,com.unboundid.ldap.protocol.AbandonRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.LDAPListenerRequestHandler method public void processUnbindRequest(int,com.unboundid.ldap.protocol.UnbindRequestProtocolOp,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.listener.PasswordEncoderOutputFormatter constructor public com.unboundid.ldap.listener.PasswordEncoderOutputFormatter()
+@Extensible class com.unboundid.ldap.listener.PasswordEncoderOutputFormatter method public abstract byte[] format(byte[]) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.PasswordEncoderOutputFormatter method public abstract byte[] unFormat(byte[]) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.PasswordEncoderOutputFormatter method public abstract void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.listener.PasswordEncoderOutputFormatter method public final java.lang.String toString()
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor constructor public com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor()
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processAddRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedAddRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processAddResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedAddResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processCompareRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedCompareRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processCompareResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedCompareResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processDeleteRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedDeleteRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processDeleteResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedDeleteResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processExtendedRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedExtendedRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processExtendedResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedExtendedResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processIntermediateResponse(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedIntermediateResponse)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processModifyDNRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedModifyDNRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processModifyDNResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedModifyDNResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processModifyRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedModifyRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processModifyResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedModifyResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSASLBindRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSASLBindRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSASLBindResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSASLBindResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSearchEntry(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchEntry)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSearchReference(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchReference)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSearchRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSearchResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSearchResult)
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSimpleBindRequest(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSimpleBindRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.listener.interceptor.InMemoryOperationInterceptor method public void processSimpleBindResult(com.unboundid.ldap.listener.interceptor.InMemoryInterceptedSimpleBindResult)
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule constructor public com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule()
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule method public abstract com.unboundid.asn1.ASN1OctetString normalize(com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule method public abstract com.unboundid.asn1.ASN1OctetString normalizeSubstring(com.unboundid.asn1.ASN1OctetString,byte)
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule method public boolean matchesAnyValue(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString[])
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule method public boolean matchesSubstring(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString[],com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule method public boolean valuesMatch(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.matchingrules.AcceptAllSimpleMatchingRule method public int compareValues(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule constructor protected com.unboundid.ldap.matchingrules.MatchingRule()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule field public static final byte SUBSTRING_TYPE_SUBANY
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule field public static final byte SUBSTRING_TYPE_SUBFINAL
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule field public static final byte SUBSTRING_TYPE_SUBINITIAL
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract boolean matchesSubstring(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString[],com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract boolean valuesMatch(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract com.unboundid.asn1.ASN1OctetString normalize(com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract com.unboundid.asn1.ASN1OctetString normalizeSubstring(com.unboundid.asn1.ASN1OctetString,byte) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract int compareValues(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract java.lang.String getEqualityMatchingRuleName()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract java.lang.String getEqualityMatchingRuleOID()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract java.lang.String getOrderingMatchingRuleName()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract java.lang.String getOrderingMatchingRuleOID()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract java.lang.String getSubstringMatchingRuleName()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public abstract java.lang.String getSubstringMatchingRuleOID()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public boolean matchesAnyValue(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString[]) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public java.lang.String getEqualityMatchingRuleNameOrOID()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public java.lang.String getOrderingMatchingRuleNameOrOID()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public java.lang.String getSubstringMatchingRuleNameOrOID()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule getDefaultEqualityMatchingRule()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule getDefaultOrderingMatchingRule()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule getDefaultSubstringMatchingRule()
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectEqualityMatchingRule(java.lang.String)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectEqualityMatchingRule(java.lang.String,com.unboundid.ldap.sdk.schema.Schema)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectEqualityMatchingRule(java.lang.String,java.lang.String,com.unboundid.ldap.sdk.schema.Schema)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectMatchingRuleForSyntax(java.lang.String)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectOrderingMatchingRule(java.lang.String)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectOrderingMatchingRule(java.lang.String,com.unboundid.ldap.sdk.schema.Schema)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectOrderingMatchingRule(java.lang.String,java.lang.String,com.unboundid.ldap.sdk.schema.Schema)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectSubstringMatchingRule(java.lang.String)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectSubstringMatchingRule(java.lang.String,com.unboundid.ldap.sdk.schema.Schema)
+@Extensible class com.unboundid.ldap.matchingrules.MatchingRule method public static com.unboundid.ldap.matchingrules.MatchingRule selectSubstringMatchingRule(java.lang.String,java.lang.String,com.unboundid.ldap.sdk.schema.Schema)
+@Extensible class com.unboundid.ldap.matchingrules.SimpleMatchingRule constructor public com.unboundid.ldap.matchingrules.SimpleMatchingRule()
+@Extensible class com.unboundid.ldap.matchingrules.SimpleMatchingRule method public boolean matchesAnyValue(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString[]) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.SimpleMatchingRule method public boolean matchesSubstring(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString[],com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.SimpleMatchingRule method public boolean valuesMatch(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.matchingrules.SimpleMatchingRule method public int compareValues(com.unboundid.asn1.ASN1OctetString,com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.BindRequest constructor protected com.unboundid.ldap.sdk.BindRequest(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.BindRequest field protected static final com.unboundid.asn1.ASN1Integer VERSION_ELEMENT
+@Extensible class com.unboundid.ldap.sdk.BindRequest method protected abstract com.unboundid.ldap.sdk.BindResult process(com.unboundid.ldap.sdk.LDAPConnection,int) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.BindRequest method protected com.unboundid.ldap.sdk.LDAPResult process(com.unboundid.ldap.sdk.LDAPConnection,int) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public abstract com.unboundid.ldap.sdk.BindRequest duplicate()
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public abstract com.unboundid.ldap.sdk.BindRequest duplicate(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public abstract java.lang.String getBindType()
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public com.unboundid.ldap.sdk.BindRequest getRebindRequest(java.lang.String,int)
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public com.unboundid.ldap.sdk.LDAPRequest duplicate()
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public com.unboundid.ldap.sdk.LDAPRequest duplicate(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.BindRequest method public final com.unboundid.ldap.sdk.OperationType getOperationType()
+@Extensible class com.unboundid.ldap.sdk.BindResult constructor protected com.unboundid.ldap.sdk.BindResult(com.unboundid.ldap.sdk.BindResult)
+@Extensible class com.unboundid.ldap.sdk.BindResult constructor public com.unboundid.ldap.sdk.BindResult(com.unboundid.ldap.sdk.LDAPException)
+@Extensible class com.unboundid.ldap.sdk.BindResult constructor public com.unboundid.ldap.sdk.BindResult(com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.BindResult constructor public com.unboundid.ldap.sdk.BindResult(int,com.unboundid.ldap.sdk.ResultCode,java.lang.String,java.lang.String,java.lang.String[],com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.BindResult constructor public com.unboundid.ldap.sdk.BindResult(int,com.unboundid.ldap.sdk.ResultCode,java.lang.String,java.lang.String,java.lang.String[],com.unboundid.ldap.sdk.Control[],com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.sdk.BindResult method public com.unboundid.asn1.ASN1OctetString getServerSASLCredentials()
+@Extensible class com.unboundid.ldap.sdk.BindResult method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.Control constructor protected com.unboundid.ldap.sdk.Control()
+@Extensible class com.unboundid.ldap.sdk.Control constructor protected com.unboundid.ldap.sdk.Control(com.unboundid.ldap.sdk.Control)
+@Extensible class com.unboundid.ldap.sdk.Control constructor public com.unboundid.ldap.sdk.Control(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.Control constructor public com.unboundid.ldap.sdk.Control(java.lang.String,boolean)
+@Extensible class com.unboundid.ldap.sdk.Control constructor public com.unboundid.ldap.sdk.Control(java.lang.String,boolean,com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.sdk.Control method public com.unboundid.util.json.JSONObject toJSONControl()
+@Extensible class com.unboundid.ldap.sdk.Control method public final boolean equals(java.lang.Object)
+@Extensible class com.unboundid.ldap.sdk.Control method public final boolean hasValue()
+@Extensible class com.unboundid.ldap.sdk.Control method public final boolean isCritical()
+@Extensible class com.unboundid.ldap.sdk.Control method public final com.unboundid.asn1.ASN1OctetString getValue()
+@Extensible class com.unboundid.ldap.sdk.Control method public final com.unboundid.asn1.ASN1Sequence encode()
+@Extensible class com.unboundid.ldap.sdk.Control method public final int hashCode()
+@Extensible class com.unboundid.ldap.sdk.Control method public final java.lang.String getOID()
+@Extensible class com.unboundid.ldap.sdk.Control method public final void writeTo(com.unboundid.asn1.ASN1Buffer)
+@Extensible class com.unboundid.ldap.sdk.Control method public java.lang.String getControlName()
+@Extensible class com.unboundid.ldap.sdk.Control method public java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.Control method public static com.unboundid.asn1.ASN1Sequence encodeControls(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.Control method public static com.unboundid.ldap.sdk.Control decode(com.unboundid.asn1.ASN1Sequence) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.Control method public static com.unboundid.ldap.sdk.Control decode(java.lang.String,boolean,com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.Control method public static com.unboundid.ldap.sdk.Control decodeJSONControl(com.unboundid.util.json.JSONObject,boolean,boolean) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.Control method public static com.unboundid.ldap.sdk.Control readFrom(com.unboundid.asn1.ASN1StreamReader) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.Control method public static com.unboundid.ldap.sdk.Control[] decodeControls(com.unboundid.asn1.ASN1Sequence) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.Control method public static void deregisterDecodeableControl(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.Control method public static void registerDecodeableControl(java.lang.String,com.unboundid.ldap.sdk.DecodeableControl)
+@Extensible class com.unboundid.ldap.sdk.Control method public static void registerDecodeableControl(java.lang.String,java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.Control method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest constructor protected com.unboundid.ldap.sdk.ExtendedRequest(com.unboundid.ldap.sdk.ExtendedRequest)
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest constructor public com.unboundid.ldap.sdk.ExtendedRequest(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest constructor public com.unboundid.ldap.sdk.ExtendedRequest(java.lang.String,com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest constructor public com.unboundid.ldap.sdk.ExtendedRequest(java.lang.String,com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest constructor public com.unboundid.ldap.sdk.ExtendedRequest(java.lang.String,com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest field protected static final byte TYPE_EXTENDED_REQUEST_OID
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest field protected static final byte TYPE_EXTENDED_REQUEST_VALUE
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method protected com.unboundid.ldap.sdk.ExtendedResult process(com.unboundid.ldap.sdk.LDAPConnection,int) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method protected com.unboundid.ldap.sdk.LDAPResult process(com.unboundid.ldap.sdk.LDAPConnection,int) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public com.unboundid.asn1.ASN1Element encodeProtocolOp()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public com.unboundid.ldap.sdk.ExtendedRequest duplicate()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public com.unboundid.ldap.sdk.ExtendedRequest duplicate(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public com.unboundid.ldap.sdk.LDAPRequest duplicate()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public com.unboundid.ldap.sdk.LDAPRequest duplicate(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final boolean hasValue()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final byte getProtocolOpType()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final com.unboundid.asn1.ASN1OctetString getValue()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final com.unboundid.ldap.sdk.OperationType getOperationType()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final int getLastMessageID()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final java.lang.String getOID()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public final void writeTo(com.unboundid.asn1.ASN1Buffer)
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public java.lang.String getExtendedRequestName()
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public void toCode(java.util.List<java.lang.String>,java.lang.String,int,boolean)
+@Extensible class com.unboundid.ldap.sdk.ExtendedRequest method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult constructor protected com.unboundid.ldap.sdk.ExtendedResult(com.unboundid.ldap.sdk.ExtendedResult)
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult constructor public com.unboundid.ldap.sdk.ExtendedResult(com.unboundid.ldap.sdk.LDAPException)
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult constructor public com.unboundid.ldap.sdk.ExtendedResult(com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult constructor public com.unboundid.ldap.sdk.ExtendedResult(int,com.unboundid.ldap.sdk.ResultCode,java.lang.String,java.lang.String,java.lang.String[],java.lang.String,com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult method public final boolean hasValue()
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult method public final com.unboundid.asn1.ASN1OctetString getValue()
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult method public final java.lang.String getOID()
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult method public java.lang.String getExtendedResultName()
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult method public java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.ExtendedResult method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse constructor protected com.unboundid.ldap.sdk.IntermediateResponse(com.unboundid.ldap.sdk.IntermediateResponse)
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse constructor public com.unboundid.ldap.sdk.IntermediateResponse(int,java.lang.String,com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse constructor public com.unboundid.ldap.sdk.IntermediateResponse(int,java.lang.String,com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse constructor public com.unboundid.ldap.sdk.IntermediateResponse(java.lang.String,com.unboundid.asn1.ASN1OctetString)
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse constructor public com.unboundid.ldap.sdk.IntermediateResponse(java.lang.String,com.unboundid.asn1.ASN1OctetString,com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse field protected static final byte TYPE_INTERMEDIATE_RESPONSE_OID
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse field protected static final byte TYPE_INTERMEDIATE_RESPONSE_VALUE
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public final com.unboundid.asn1.ASN1OctetString getValue()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public final com.unboundid.ldap.sdk.Control getControl(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public final com.unboundid.ldap.sdk.Control[] getControls()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public final java.lang.String getOID()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public final java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public int getMessageID()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public java.lang.String getIntermediateResponseName()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public java.lang.String valueToString()
+@Extensible class com.unboundid.ldap.sdk.IntermediateResponse method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger constructor public com.unboundid.ldap.sdk.LDAPConnectionLogger()
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logAbandonRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,int,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logAddRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ReadOnlyAddRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logAddResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logBindRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.SASLBindRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logBindRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.SimpleBindRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logBindResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.BindResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logCompareRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ReadOnlyCompareRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logCompareResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logConnect(com.unboundid.ldap.sdk.LDAPConnectionInfo,java.lang.String,java.net.InetAddress,int)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logConnectFailure(com.unboundid.ldap.sdk.LDAPConnectionInfo,java.lang.String,int,com.unboundid.ldap.sdk.LDAPException)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logDeleteRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ReadOnlyDeleteRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logDeleteResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logDisconnect(com.unboundid.ldap.sdk.LDAPConnectionInfo,java.lang.String,int,com.unboundid.ldap.sdk.DisconnectType,java.lang.String,java.lang.Throwable)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logExtendedRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ExtendedRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logExtendedResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ExtendedResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logIntermediateResponse(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.IntermediateResponse)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logModifyDNRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ReadOnlyModifyDNRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logModifyDNResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logModifyRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ReadOnlyModifyRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logModifyResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logSearchEntry(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.SearchResultEntry)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logSearchReference(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.SearchResultReference)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logSearchRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.ReadOnlySearchRequest)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logSearchResult(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,com.unboundid.ldap.sdk.SearchResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionLogger method public void logUnbindRequest(com.unboundid.ldap.sdk.LDAPConnectionInfo,int,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck constructor public com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck()
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public final java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void ensureConnectionValidAfterAuthentication(com.unboundid.ldap.sdk.LDAPConnection,com.unboundid.ldap.sdk.BindResult) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void ensureConnectionValidAfterException(com.unboundid.ldap.sdk.LDAPConnection,com.unboundid.ldap.sdk.LDAPException) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void ensureConnectionValidForCheckout(com.unboundid.ldap.sdk.LDAPConnection) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void ensureConnectionValidForContinuedUse(com.unboundid.ldap.sdk.LDAPConnection) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void ensureConnectionValidForRelease(com.unboundid.ldap.sdk.LDAPConnection) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void ensureNewConnectionValid(com.unboundid.ldap.sdk.LDAPConnection) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void performPoolMaintenance(com.unboundid.ldap.sdk.AbstractConnectionPool)
+@Extensible class com.unboundid.ldap.sdk.LDAPConnectionPoolHealthCheck method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest constructor protected com.unboundid.ldap.sdk.LDAPRequest(com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public abstract com.unboundid.ldap.sdk.OperationType getOperationType()
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public abstract int getLastMessageID()
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public abstract void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final boolean followReferrals(com.unboundid.ldap.sdk.LDAPConnection)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final boolean hasControl()
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final boolean hasControl(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final com.unboundid.ldap.sdk.Control getControl(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final com.unboundid.ldap.sdk.Control[] getControls()
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final com.unboundid.ldap.sdk.IntermediateResponseListener getIntermediateResponseListener()
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final com.unboundid.ldap.sdk.ReferralConnector getReferralConnector(com.unboundid.ldap.sdk.LDAPConnection)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final java.util.List<com.unboundid.ldap.sdk.Control> getControlList()
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final long getResponseTimeoutMillis(com.unboundid.ldap.sdk.LDAPConnection)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final void setFollowReferrals(java.lang.Boolean)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final void setIntermediateResponseListener(com.unboundid.ldap.sdk.IntermediateResponseListener)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final void setReferralConnector(com.unboundid.ldap.sdk.ReferralConnector)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public final void setResponseTimeoutMillis(long)
+@Extensible class com.unboundid.ldap.sdk.LDAPRequest method public java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult constructor protected com.unboundid.ldap.sdk.LDAPResult(com.unboundid.ldap.sdk.LDAPResult)
+@Extensible class com.unboundid.ldap.sdk.LDAPResult constructor public com.unboundid.ldap.sdk.LDAPResult(int,com.unboundid.ldap.sdk.ResultCode)
+@Extensible class com.unboundid.ldap.sdk.LDAPResult constructor public com.unboundid.ldap.sdk.LDAPResult(int,com.unboundid.ldap.sdk.ResultCode,java.lang.String,java.lang.String,java.lang.String[],com.unboundid.ldap.sdk.Control[])
+@Extensible class com.unboundid.ldap.sdk.LDAPResult constructor public com.unboundid.ldap.sdk.LDAPResult(int,com.unboundid.ldap.sdk.ResultCode,java.lang.String,java.lang.String,java.util.List<java.lang.String>,java.util.List<com.unboundid.ldap.sdk.Control>)
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final boolean hasResponseControl()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final boolean hasResponseControl(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final com.unboundid.ldap.sdk.Control getResponseControl(java.lang.String)
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final com.unboundid.ldap.sdk.Control[] getResponseControls()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final com.unboundid.ldap.sdk.OperationType getOperationType()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final com.unboundid.ldap.sdk.ResultCode getResultCode()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final int getMessageID()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final java.lang.String getDiagnosticMessage()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final java.lang.String getMatchedDN()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public final java.lang.String[] getReferralURLs()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public java.lang.String getResultString()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.LDAPResult method public void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection constructor public com.unboundid.ldap.sdk.MockableLDAPConnection(com.unboundid.ldap.sdk.LDAPConnection)
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.BindResult bind(com.unboundid.ldap.sdk.BindRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.BindResult bind(java.lang.String,java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.CompareResult compare(com.unboundid.ldap.sdk.CompareRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.CompareResult compare(com.unboundid.ldap.sdk.ReadOnlyCompareRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.CompareResult compare(java.lang.String,java.lang.String,java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.ExtendedResult processExtendedOperation(com.unboundid.ldap.sdk.ExtendedRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.ExtendedResult processExtendedOperation(java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.ExtendedResult processExtendedOperation(java.lang.String,com.unboundid.asn1.ASN1OctetString) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult add(com.unboundid.ldap.sdk.AddRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult add(com.unboundid.ldap.sdk.Entry) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult add(com.unboundid.ldap.sdk.ReadOnlyAddRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult add(java.lang.String,com.unboundid.ldap.sdk.Attribute...) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult add(java.lang.String,java.util.Collection<com.unboundid.ldap.sdk.Attribute>) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult add(java.lang.String...) throws com.unboundid.ldif.LDIFException,com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult delete(com.unboundid.ldap.sdk.DeleteRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult delete(com.unboundid.ldap.sdk.ReadOnlyDeleteRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult delete(java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modify(com.unboundid.ldap.sdk.ModifyRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modify(com.unboundid.ldap.sdk.ReadOnlyModifyRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modify(java.lang.String,com.unboundid.ldap.sdk.Modification) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modify(java.lang.String,com.unboundid.ldap.sdk.Modification...) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modify(java.lang.String,java.util.List<com.unboundid.ldap.sdk.Modification>) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modify(java.lang.String...) throws com.unboundid.ldif.LDIFException,com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modifyDN(com.unboundid.ldap.sdk.ModifyDNRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modifyDN(com.unboundid.ldap.sdk.ReadOnlyModifyDNRequest) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modifyDN(java.lang.String,java.lang.String,boolean) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.LDAPResult modifyDN(java.lang.String,java.lang.String,boolean,java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.RootDSE getRootDSE() throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(com.unboundid.ldap.sdk.ReadOnlySearchRequest) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(com.unboundid.ldap.sdk.SearchRequest) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(com.unboundid.ldap.sdk.SearchResultListener,java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.DereferencePolicy,int,int,boolean,com.unboundid.ldap.sdk.Filter,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(com.unboundid.ldap.sdk.SearchResultListener,java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.DereferencePolicy,int,int,boolean,java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(com.unboundid.ldap.sdk.SearchResultListener,java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.Filter,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(com.unboundid.ldap.sdk.SearchResultListener,java.lang.String,com.unboundid.ldap.sdk.SearchScope,java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.DereferencePolicy,int,int,boolean,com.unboundid.ldap.sdk.Filter,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.DereferencePolicy,int,int,boolean,java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.Filter,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResult search(java.lang.String,com.unboundid.ldap.sdk.SearchScope,java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry getEntry(java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry getEntry(java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry searchForEntry(com.unboundid.ldap.sdk.ReadOnlySearchRequest) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry searchForEntry(com.unboundid.ldap.sdk.SearchRequest) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry searchForEntry(java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.DereferencePolicy,int,boolean,com.unboundid.ldap.sdk.Filter,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry searchForEntry(java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.DereferencePolicy,int,boolean,java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry searchForEntry(java.lang.String,com.unboundid.ldap.sdk.SearchScope,com.unboundid.ldap.sdk.Filter,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.SearchResultEntry searchForEntry(java.lang.String,com.unboundid.ldap.sdk.SearchScope,java.lang.String,java.lang.String...) throws com.unboundid.ldap.sdk.LDAPSearchException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.schema.Schema getSchema() throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public com.unboundid.ldap.sdk.schema.Schema getSchema(java.lang.String) throws com.unboundid.ldap.sdk.LDAPException
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public final com.unboundid.ldap.sdk.LDAPConnection getWrappedConnection()
+@Extensible class com.unboundid.ldap.sdk.MockableLDAPConnection method public void close()
+@Extensible class com.unboundid.ldap.sdk.NameResolver constructor protected com.unboundid.ldap.sdk.NameResolver()
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public abstract void toString(java.lang.StringBuilder)
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public final java.lang.String toString()
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public java.lang.String getCanonicalHostName(java.net.InetAddress)
+@Extensible class com.unboundid.ldap.sdk.NameResolver method public java.lang.String getHostN...
 
[truncated message content]