public interface AuthenticationInfoOrBuilder
extends com.google.protobuf.MessageOrBuilder
Modifier and Type | Method and Description |
---|---|
Credentials |
getCredentials()
The information sent to prove the identity of the principal.
|
CredentialsOrBuilder |
getCredentialsOrBuilder()
The information sent to prove the identity of the principal.
|
String |
getErrorMessage()
A short, human-readable description of the reason authentication failed.
|
com.google.protobuf.ByteString |
getErrorMessageBytes()
A short, human-readable description of the reason authentication failed.
|
AuthenticationInfo.Exposure |
getExposure()
We divide operations into "internal" and "customer" operations.
|
int |
getExposureValue()
We divide operations into "internal" and "customer" operations.
|
Principal |
getOriginalPrincipal()
In the case where the original actor provides credentials to prove
their own identity and their right to assume the identity of a different
principal, THIS field captures the original actor, while `principal`
captures the assumed principal.
|
PrincipalOrBuilder |
getOriginalPrincipalOrBuilder()
In the case where the original actor provides credentials to prove
their own identity and their right to assume the identity of a different
principal, THIS field captures the original actor, while `principal`
captures the assumed principal.
|
Principal |
getPrincipal()
The identity that authorization decisions are checked against
when processing the request; usually a user or service account.
|
PrincipalOrBuilder |
getPrincipalOrBuilder()
The identity that authorization decisions are checked against
when processing the request; usually a user or service account.
|
AuthenticationInfo.Result |
getResult()
SUCCESS if the service accepted the principal's credentials, FAILURE
otherwise.
|
int |
getResultValue()
SUCCESS if the service accepted the principal's credentials, FAILURE
otherwise.
|
boolean |
hasCredentials()
The information sent to prove the identity of the principal.
|
boolean |
hasOriginalPrincipal()
In the case where the original actor provides credentials to prove
their own identity and their right to assume the identity of a different
principal, THIS field captures the original actor, while `principal`
captures the assumed principal.
|
boolean |
hasPrincipal()
The identity that authorization decisions are checked against
when processing the request; usually a user or service account.
|
findInitializationErrors, getAllFields, getDefaultInstanceForType, getDescriptorForType, getField, getInitializationErrorString, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, getUnknownFields, hasField, hasOneof
int getExposureValue()
We divide operations into "internal" and "customer" operations. All "customer" operations are those which must be requested by a Confluent customer's user or service account. On the other hand, "internal" operations are those requested by systems or employees of Confluent through special internal endpoints. If you're not sure, ask @audit-logs-eng-team in #audit-logs-eng. Downstream, we will scrub audit log events of "internal" authentication info before forwarding to customers. This includes removal of credentials info, and replacement of the employee principal with a generic "Confluent" principal. Down internal streams, we will hide all but the `confluent_user` or `confluent_service_account` details of "customer" principals from employees, unless privileged and working an incident.
.auditlog.v2.AuthenticationInfo.Exposure exposure = 1 [(.confluent.protobuf.field_meta) = { ... }
AuthenticationInfo.Exposure getExposure()
We divide operations into "internal" and "customer" operations. All "customer" operations are those which must be requested by a Confluent customer's user or service account. On the other hand, "internal" operations are those requested by systems or employees of Confluent through special internal endpoints. If you're not sure, ask @audit-logs-eng-team in #audit-logs-eng. Downstream, we will scrub audit log events of "internal" authentication info before forwarding to customers. This includes removal of credentials info, and replacement of the employee principal with a generic "Confluent" principal. Down internal streams, we will hide all but the `confluent_user` or `confluent_service_account` details of "customer" principals from employees, unless privileged and working an incident.
.auditlog.v2.AuthenticationInfo.Exposure exposure = 1 [(.confluent.protobuf.field_meta) = { ... }
boolean hasPrincipal()
The identity that authorization decisions are checked against when processing the request; usually a user or service account. The service MUST NOT fill in this field without first validating credentials and ensuring the credentials can be used to assume the identity of the principal. (If this field is present, `result` must be `SUCCESS`.) In the case where the original actor provides credentials to prove their own identity and their right to assume the identity of a different principal, THIS field captures the assumed principal, while `original_principal` captures the identity of the original actor.
.auditlog.v2.Principal principal = 2;
Principal getPrincipal()
The identity that authorization decisions are checked against when processing the request; usually a user or service account. The service MUST NOT fill in this field without first validating credentials and ensuring the credentials can be used to assume the identity of the principal. (If this field is present, `result` must be `SUCCESS`.) In the case where the original actor provides credentials to prove their own identity and their right to assume the identity of a different principal, THIS field captures the assumed principal, while `original_principal` captures the identity of the original actor.
.auditlog.v2.Principal principal = 2;
PrincipalOrBuilder getPrincipalOrBuilder()
The identity that authorization decisions are checked against when processing the request; usually a user or service account. The service MUST NOT fill in this field without first validating credentials and ensuring the credentials can be used to assume the identity of the principal. (If this field is present, `result` must be `SUCCESS`.) In the case where the original actor provides credentials to prove their own identity and their right to assume the identity of a different principal, THIS field captures the assumed principal, while `original_principal` captures the identity of the original actor.
.auditlog.v2.Principal principal = 2;
boolean hasOriginalPrincipal()
In the case where the original actor provides credentials to prove their own identity and their right to assume the identity of a different principal, THIS field captures the original actor, while `principal` captures the assumed principal. Authorization decisions are based off the privileges attached to `principal`, not this `original_principal`. The service MUST NOT fill in this field unless the `principal` field is also present and has a different value.
.auditlog.v2.Principal original_principal = 3;
Principal getOriginalPrincipal()
In the case where the original actor provides credentials to prove their own identity and their right to assume the identity of a different principal, THIS field captures the original actor, while `principal` captures the assumed principal. Authorization decisions are based off the privileges attached to `principal`, not this `original_principal`. The service MUST NOT fill in this field unless the `principal` field is also present and has a different value.
.auditlog.v2.Principal original_principal = 3;
PrincipalOrBuilder getOriginalPrincipalOrBuilder()
In the case where the original actor provides credentials to prove their own identity and their right to assume the identity of a different principal, THIS field captures the original actor, while `principal` captures the assumed principal. Authorization decisions are based off the privileges attached to `principal`, not this `original_principal`. The service MUST NOT fill in this field unless the `principal` field is also present and has a different value.
.auditlog.v2.Principal original_principal = 3;
int getResultValue()
SUCCESS if the service accepted the principal's credentials, FAILURE otherwise. In case of FAILURE, an error_message should be provided.
.auditlog.v2.AuthenticationInfo.Result result = 4;
AuthenticationInfo.Result getResult()
SUCCESS if the service accepted the principal's credentials, FAILURE otherwise. In case of FAILURE, an error_message should be provided.
.auditlog.v2.AuthenticationInfo.Result result = 4;
String getErrorMessage()
A short, human-readable description of the reason authentication failed. Producers must not include details from the request itself. Consumers should not programmatically parse this field.
string error_message = 5;
com.google.protobuf.ByteString getErrorMessageBytes()
A short, human-readable description of the reason authentication failed. Producers must not include details from the request itself. Consumers should not programmatically parse this field.
string error_message = 5;
boolean hasCredentials()
The information sent to prove the identity of the principal. This may be present even when authentication fails. Authentication events include this field, but after a successful authentication attempt, later events (of a different type) on the same connection from the same authenticated principal may omit the credentials from their audit log entries, in which case they can be correlated back to the authentication event by means of the `connection_id` they share. Alternatively, services may include the connected client's credentials even for event types other than authentication events. Consumers should be prepared to handle either case.
.auditlog.v2.Credentials credentials = 6;
Credentials getCredentials()
The information sent to prove the identity of the principal. This may be present even when authentication fails. Authentication events include this field, but after a successful authentication attempt, later events (of a different type) on the same connection from the same authenticated principal may omit the credentials from their audit log entries, in which case they can be correlated back to the authentication event by means of the `connection_id` they share. Alternatively, services may include the connected client's credentials even for event types other than authentication events. Consumers should be prepared to handle either case.
.auditlog.v2.Credentials credentials = 6;
CredentialsOrBuilder getCredentialsOrBuilder()
The information sent to prove the identity of the principal. This may be present even when authentication fails. Authentication events include this field, but after a successful authentication attempt, later events (of a different type) on the same connection from the same authenticated principal may omit the credentials from their audit log entries, in which case they can be correlated back to the authentication event by means of the `connection_id` they share. Alternatively, services may include the connected client's credentials even for event types other than authentication events. Consumers should be prepared to handle either case.
.auditlog.v2.Credentials credentials = 6;