@@ -13,7 +13,7 @@ public class OMSecurityConstants {
1313
1414 /**
1515 * Change this boolean to enable/disable debug logging in SDK.
16- *
16+ * <p>
1717 * Cannot use {@link BuildConfig#DEBUG} in library project because of
1818 * https://issuetracker.google.com/issues/36967265
1919 * <p>
@@ -24,6 +24,7 @@ public class OMSecurityConstants {
2424 */
2525 public static boolean DEBUG = false ;
2626
27+ public static final String UTF_8 = "UTF-8" ;
2728 public static final char COLON = ':' ;
2829 public static final char EQUAL = '=' ;
2930 public static final char AMPERSAND = '&' ;
@@ -59,17 +60,38 @@ public class OMSecurityConstants {
5960
6061 /*TODO Documentation*/
6162 //TODO Add javadoc for every constant following the format specified for CLIENT_CERTIFICATE_HOST
63+
6264 /**
6365 * Holds constants specific to OMAuthenticationChallenge
6466 */
6567 public static class Challenge {
6668 public static final String USERNAME_KEY = "username_key" ;
69+ /**
70+ * The key against which the following is present or MUST be provided:
71+ * the password of the end user.
72+ * <p/>
73+ * The value is of type {@link String}.
74+ *
75+ * @deprecated This accepts or provides password as String which leads to security issues.
76+ * This field will be removed in a future release. This is maintained now just to have
77+ * backward compatibility. Instead of this field, use {@link #PASSWORD_KEY_2}.
78+ */
79+ @ Deprecated
6780 public static final String PASSWORD_KEY = "password_key" ;
81+
82+ /**
83+ * The key against which the following is present or MUST be provided:
84+ * the password of the end user.
85+ * <p/>
86+ * The value is of type char[].
87+ */
88+ public static final String PASSWORD_KEY_2 = "password_as_char_array_key" ;
89+
6890 public static final String IDENTITY_DOMAIN_KEY = "iddomain_key" ;
6991 public static final String OFFLINE_CREDENTIAL_KEY = "offline_credential_key" ;
70- public static final String IS_FORCE_AUTHENTICATION ="isForceAuthentication" ;
92+ public static final String IS_FORCE_AUTHENTICATION = "isForceAuthentication" ;
7193 /**
72- * The key against the following is present:
94+ * The key against which the following is present:
7395 * Exception thrown in the authentication attempt
7496 * <p/>
7597 * The value is of type {@link OMMobileSecurityException}.
@@ -78,7 +100,7 @@ public static class Challenge {
78100 public static final String MOBILE_SECURITY_EXCEPTION = "mobileSecurityException" ;
79101
80102 /**
81- * The key against the following is present:
103+ * The key against which the following is present:
82104 * the host name of the server requesting the certificate
83105 * <p/>
84106 * The value is of type {@link String}.
@@ -89,7 +111,7 @@ public static class Challenge {
89111 public static final String CLIENT_CERTIFICATE_HOST = "client_certificate_host_key" ;
90112
91113 /**
92- * The key against the following is present:
114+ * The key against which the following is present:
93115 * the port number of the server requesting the certificate
94116 * <p/>
95117 * The value is of type {@link Integer}.
@@ -100,7 +122,7 @@ public static class Challenge {
100122 public static final String CLIENT_CERTIFICATE_PORT = "client_certificate_port_key" ;
101123
102124 /**
103- * The key against the following is present:
125+ * The key against which the following is present:
104126 * the acceptable certificate issuers for the certificate matching the private key (can be null)
105127 * null implies any issuer will do.
106128 * <p/>
@@ -112,22 +134,22 @@ public static class Challenge {
112134 public static final String CLIENT_CERTIFICATE_ISSUERS_KEY = "client_certificate_issuer_names_key" ;
113135
114136 /**
115- * The key against the following is present:
137+ * The key against which the following is present:
116138 * the acceptable types of asymmetric keys (can be null) or in other words: the list of public key algorithm names
117- *
139+ * <p>
118140 * The value is of type {@link String}[].
119- *
141+ * <p>
120142 * <b>Note:</b> Client certificate authentication in embedded browser [Fed Auth, OAuth] is supported only from LOLLIPOP onwards.
121143 * Refer {@link oracle.idm.mobile.OMMobileSecurityService.AuthServerType} for more details.
122144 */
123145 public static final String CLIENT_CERTIFICATE_KEYTYPES_KEY = "client_certificate_keytypes_key" ;
124146
125147 /**
126- * The key against the following MUST BE provided by the developer:
148+ * The key against which the following MUST BE provided by the developer:
127149 * the alias for the client side of an SSL connection to authenticate it with the specified public key type and certificate issuers
128- *
150+ * <p>
129151 * The value MUST be of type {@link String}
130- *
152+ * <p>
131153 * <b>Note:</b> Client certificate authentication in embedded browser [Fed Auth, OAuth] is supported only from LOLLIPOP onwards.
132154 * Refer {@link oracle.idm.mobile.OMMobileSecurityService.AuthServerType} for more details.
133155 */
@@ -144,6 +166,15 @@ public static class Challenge {
144166 public static final String CLIENT_CERTIFICATE_STORAGE_PREFERENCE_KEY = "client_certificate_storage_pref_key" ;
145167 public static final String UNTRUSTED_SERVER_CERTIFICATE_AUTH_TYPE_KEY = "untrusted_certificate_authtype_key" ;
146168 public static final String UNTRUSTED_SERVER_CERTIFICATE_CHAIN_KEY = "untrusted_server_certificate_chain_key" ;
169+ /**
170+ * The key against which the following is present:
171+ * The URL of the server being accessed which resulted
172+ * in {@link javax.net.ssl.SSLHandshakeException}.
173+ * <p>
174+ * The value is of type {@link java.net.URL}.
175+ * <p>
176+ */
177+ public static final String UNTRUSTED_SERVER_URL_KEY = "untrusted_server_url_key" ;
147178 public static final String INVALID_REDIRECT_TYPE_KEY = "invalid_redirect_type_key" ;
148179
149180
@@ -170,6 +201,7 @@ public static class Challenge {
170201 public static final String EXPIRY_DATE = "expiresdate" ;
171202 public static final String EXPIRES_IN = "expires_in" ;
172203 public static final String IS_SECURE = "issecure" ;
204+
173205 /**
174206 * Constants to represent parameter keys used internally in SDK.
175207 *
@@ -179,6 +211,7 @@ public static class Param {
179211 public static final String OAUTH_REFRESH_TOKEN_VALUE = "ParamOAuthRefreshTokenValue" ;
180212 public static final String OAUTH_FRONT_CHANNEL_RESPONSE_JSON = "ParamFrontChannelResponseJSON" ;
181213 public static final String COLLECT_OFFLINE_CREDENTIAL = "collectOfflineCredential" ;
214+ public static final String CLEAR_PASSWORD = "clearPassword" ;
182215 //Begin: Fed Auth
183216 public static final String LOGIN_FAILURE_URL_HIT = "login_failure_url_hit" ;
184217 public static final String VISITED_URLS = "visited_urls" ;
@@ -244,4 +277,6 @@ public class Flags {
244277 public static final int CONNECTION_ALLOW_HTTPS_TO_HTTP_REDIRECT = 103 ;
245278 public static final int CONNECTION_ALLOW_HTTP_TO_HTTPS_REDIRECT = 104 ;
246279 }
280+
281+ public static final String OM_CREDENTIAL = "_Credential" ;
247282}
0 commit comments