← Back to plugin index

AES256 Encryption Ticket Encoder
Description
Encodes the ticket and encrypts the contents with a password.

The key-value pairs are first encoded as described in KeyMultiValue, the expiry timestamp is added and then encrypted using a password based encryption scheme with salt. The resulting ticket value is the base-64 representation of the ciphertext.

Type name
AES256EncryptionTicketEncoder
Class
com.airlock.iam.core.misc.util.ticket.codec.AES256EncryptionTicketEncoder
May be used by
Ticket String Provider Start User Representation Step Encoded User Data Header Cookie Ticket Identity Propagator SSO Ticket Identity Propagator OAuth 2.0 SSO Ticket Resource Encoded User Data Response Header
Properties
Password (password)
Description
Specifies the password used to encrypt the ticket.
Attributes
String
Mandatory
Sensitive
Length >= 4
Require Authenticated Encryption (requireAuthenticatedEncryption)
Description
By default, password based encryption now uses the GCM mode for authenticated encryption. If this flag is disabled, the legacy CBC mode is used. This mode does not provide authenticity and is only provided for backward compatibility for cases where the ticket is decrypted in an external system.

If possible this flag should be enabled.

Attributes
Boolean
Optional
Default value
true
YAML Template (with default values) 

type: AES256EncryptionTicketEncoder
id: AES256EncryptionTicketEncoder-xxxxxx
displayName: 
comment: 
properties:
  password:
  requireAuthenticatedEncryption: true