KMIPServer Class
Properties Methods Events Configuration Settings Errors
The KMIPServer class provides server-side functionality for Key Management Interoperability Protocol (KMIP).
Syntax
class secureblackbox.KMIPServer
Remarks
The Key Management Interoperability Protocol (KMIP) is an OASIS standard for communication between different key management servers and clients.
Property List
The following is the full list of the properties of the class with short descriptions. Click on the links for further details.
| active | Indicates if the KMIP server is active and listening to incoming connections. |
| ca_cert_bytes | Returns raw certificate data in DER format. |
| ca_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| cert_request_bytes | Provides access to raw certificate request data in DER format. |
| cert_request_curve | Specifies the elliptic curve of the EC public key. |
| cert_request_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| cert_request_hash_algorithm | Specifies the hash algorithm to be used in the operations on the certificate request (such as signing). |
| cert_request_key_algorithm | Specifies the public key algorithm of this certificate request. |
| cert_request_key_bits | Returns the length of the public key. |
| cert_request_key_usage | Indicates the purposes of the key contained in the certificate request, in the form of an OR'ed flag set. |
| cert_request_key_valid | Returns True if the certificate's key is cryptographically valid, and False otherwise. |
| cert_request_private_key_bytes | Contains the certificate's private key. |
| cert_request_public_key_bytes | Contains the public key incorporated in the request, in DER format. |
| cert_request_sig_algorithm | Indicates the algorithm that was used by the requestor to sign this certificate request. |
| cert_request_subject | The common name of the certificate holder, typically an individual's name, a URL, an e-mail address, or a company name. |
| cert_request_subject_rdn | A collection of information, in the form of [OID, Value] pairs, uniquely identifying the certificate holder (subject). |
| cert_request_valid | Indicates whether or not the signature on the request is valid and matches the public key contained in the request. |
| cert_storage_count | The number of records in the CertStorage arrays. |
| cert_storage_bytes | Returns raw certificate data in DER format. |
| cert_storage_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| encoder_type | Specifies the KMIP encoder type. |
| external_crypto_custom_params | Custom parameters to be passed to the signing service (uninterpreted). |
| external_crypto_data | Additional data to be included in the async state and mirrored back by the requestor. |
| external_crypto_external_hash_calculation | Specifies whether the message hash is to be calculated at the external endpoint. |
| external_crypto_hash_algorithm | Specifies the request's signature hash algorithm. |
| external_crypto_key_id | The ID of the pre-shared key used for DC request authentication. |
| external_crypto_key_secret | The pre-shared key used for DC request authentication. |
| external_crypto_method | Specifies the asynchronous signing method. |
| external_crypto_mode | Specifies the external cryptography mode. |
| external_crypto_public_key_algorithm | Provide public key algorithm here if the certificate is not available on the pre-signing stage. |
| generated_cert_bytes | Returns raw certificate data in DER format. |
| generated_cert_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| port | A port to listen for connections on. |
| socket_incoming_speed_limit | The maximum number of bytes to read from the socket, per second. |
| socket_local_address | The local network interface to bind the socket to. |
| socket_local_port | The local port number to bind the socket to. |
| socket_outgoing_speed_limit | The maximum number of bytes to write to the socket, per second. |
| socket_timeout | The maximum period of waiting, in milliseconds, after which the socket operation is considered unsuccessful. |
| socket_use_i_pv6 | Enables or disables IP protocol version 6. |
| storage_file_name | A path to the KMIP object database. |
| tls_auto_validate_certificates | Specifies whether server-side TLS certificates should be validated automatically using internal validation rules. |
| tls_base_configuration | Selects the base configuration for the TLS settings. |
| tls_ciphersuites | A list of ciphersuites separated with commas or semicolons. |
| tlsec_curves | Defines the elliptic curves to enable. |
| tls_force_resume_if_destination_changes | Whether to force TLS session resumption when the destination address changes. |
| tls_pre_shared_identity | Defines the identity used when the PSK (Pre-Shared Key) key-exchange mechanism is negotiated. |
| tls_pre_shared_key | Contains the pre-shared for the PSK (Pre-Shared Key) key-exchange mechanism, encoded with base16. |
| tls_pre_shared_key_ciphersuite | Defines the ciphersuite used for PSK (Pre-Shared Key) negotiation. |
| tls_renegotiation_attack_prevention_mode | Selects renegotiation attack prevention mechanism. |
| tls_revocation_check | Specifies the kind(s) of revocation check to perform. |
| tlsssl_options | Various SSL (TLS) protocol options, set of cssloExpectShutdownMessage 0x001 Wait for the close-notify message when shutting down the connection cssloOpenSSLDTLSWorkaround 0x002 (DEPRECATED) Use a DTLS version workaround when talking to very old OpenSSL versions cssloDisableKexLengthAlignment 0x004 Do not align the client-side PMS by the RSA modulus size. |
| tlstls_mode | Specifies the TLS mode to use. |
| tls_use_extended_master_secret | Enables Extended Master Secret Extension, as defined in RFC 7627. |
| tls_use_session_resumption | Enables or disables TLS session resumption capability. |
| tls_versions | Th SSL/TLS versions to enable by default. |
| user_count | The number of records in the User arrays. |
| user_associated_data | Contains the user's Associated Data when SSH AEAD (Authenticated Encryption with Associated Data) algorithm is used. |
| user_base_path | Base path for this user in the server's file system. |
| user_cert | Contains the user's certificate. |
| user_data | Contains uninterpreted user-defined data that should be associated with the user account, such as comments or custom settings. |
| user_handle | Allows to get or set a 'handle', a unique identifier of the underlying property object. |
| user_hash_algorithm | Specifies the hash algorithm used to generate TOTP (Time-based One-Time Passwords) passwords for this user. |
| user_incoming_speed_limit | Specifies the incoming speed limit for this user. |
| user_otp_algorithm | The algorithm used to generate one-time passwords (OTP) for this user, either HOTP (Hash-based OTP) or TOTP (Time-based OTP). |
| user_otp_value | The user's time interval (TOTP) or Counter (HOTP). |
| user_outgoing_speed_limit | Specifies the outgoing speed limit for this user. |
| user_password | The user's authentication password. |
| user_password_len | Specifies the length of the user's OTP password. |
| user_shared_secret | Contains the user's secret key, which is essentially a shared secret between the client and server. |
| user_ssh_key | Contains the user's SSH key. |
| user_username | The registered name (login) of the user. |
Method List
The following is the full list of the methods of the class with short descriptions. Click on the links for further details.
| config | Sets or retrieves a configuration setting. |
| get_client_cert | Populates the per-connection certificate object. |
| get_client_cert_request | Populates the per-connection certificate request object. |
| set_client_cert | Commits the per-connection certificate object to the connection context. |
| start | Start the KMIP server. |
| stop | Stops the KMIP server. |
Event List
The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.
| on_after_generate_cert | Signifies completion of certificate generation. |
| on_after_generate_key | Signifies completion of key generation. |
| on_auth_attempt | Fires when a connected client makes an authentication attempt. |
| on_before_generate_cert | Fires when a certificate generation request is received. |
| on_before_generate_key | Fires when a key generation request is received. |
| on_destroy_action | Fires when an object destruction request is received. |
| on_error | Information about any errors that occur during KMIP operations. |
| on_external_sign | Handles remote or external signing initiated by the server protocol. |
| on_notification | This event notifies the application about an underlying control flow event. |
| on_request | Fires when a request is received from the client. |
Configuration Settings
The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.
| AuthBasic | Turns on/off the basic authentication. |
| AuthDigest | Turns on/off the digest authentication. |
| DualStack | Allows the use of ip4 and ip6 simultaneously. |
| MajorProtocolVersion | Major protocol version on the KMIP server. |
| MinorProtocolVersion | Minor protocol version on the KMIP server. |
| SSLMode | Whether to establish a TLS-secured connection. |
| UseChunkedTransfer | Whether to use chunked encoding of the data. |
| UseCompression | Whether to use GZip compression. |
| CheckKeyIntegrityBeforeUse | Enables or disable private key integrity check before use. |
| CookieCaching | Specifies whether a cookie cache should be used for HTTP(S) transports. |
| Cookies | Gets or sets local cookies for the class (supported for HTTPClient, RESTClient and SOAPClient only). |
| DefDeriveKeyIterations | Specifies the default key derivation algorithm iteration count. |
| EnableClientSideSSLFFDHE | Enables or disables finite field DHE key exchange support in TLS clients. |
| GlobalCookies | Gets or sets global cookies for all the HTTP transports. |
| HttpUserAgent | Specifies the user agent name to be used by all HTTP clients. |
| LogDestination | Specifies the debug log destination. |
| LogDetails | Specifies the debug log details to dump. |
| LogFile | Specifies the debug log filename. |
| LogFilters | Specifies the debug log filters. |
| LogFlushMode | Specifies the log flush mode. |
| LogLevel | Specifies the debug log level. |
| LogMaxEventCount | Specifies the maximum number of events to cache before further action is taken. |
| LogRotationMode | Specifies the log rotation mode. |
| MaxASN1BufferLength | Specifies the maximal allowed length for ASN.1 primitive tag data. |
| MaxASN1TreeDepth | Specifies the maximal depth for processed ASN.1 trees. |
| OCSPHashAlgorithm | Specifies the hash algorithm to be used to identify certificates in OCSP requests. |
| UseOwnDNSResolver | Specifies whether the client classes should use own DNS resolver. |
| UseSharedSystemStorages | Specifies whether the validation engine should use a global per-process copy of the system certificate stores. |
| UseSystemOAEPAndPSS | Enforces or disables the use of system-driven RSA OAEP and PSS computations. |
| UseSystemRandom | Enables or disables the use of the OS PRNG. |