WifiEnterpriseConfig

EXTRA_WAPI_AS_CERTIFICATE_DATA

static val EXTRA_WAPI_AS_CERTIFICATE_DATA: String

Intent extra: data for WAPI AS certificates

Value: "android.net.wifi.extra.WAPI_AS_CERTIFICATE_DATA"

EXTRA_WAPI_AS_CERTIFICATE_NAME

static val EXTRA_WAPI_AS_CERTIFICATE_NAME: String

Intent extra: name for WAPI AS certificates

Value: "android.net.wifi.extra.WAPI_AS_CERTIFICATE_NAME"

EXTRA_WAPI_USER_CERTIFICATE_DATA

static val EXTRA_WAPI_USER_CERTIFICATE_DATA: String

Intent extra: data for WAPI USER certificates

Value: "android.net.wifi.extra.WAPI_USER_CERTIFICATE_DATA"

EXTRA_WAPI_USER_CERTIFICATE_NAME

static val EXTRA_WAPI_USER_CERTIFICATE_NAME: String

Intent extra: name for WAPI USER certificates

Value: "android.net.wifi.extra.WAPI_USER_CERTIFICATE_NAME"

TLS_V1_0

static val TLS_V1_0: Int

Constant definition for TLS v1.0 which is used in setMinimumTlsVersion(int)

Value: 0

TLS_V1_1

static val TLS_V1_1: Int

Constant definition for TLS v1.1 which is used in setMinimumTlsVersion(int)

Value: 1

TLS_V1_2

static val TLS_V1_2: Int

Constant definition for TLS v1.2 which is used in setMinimumTlsVersion(int)

Value: 2

TLS_V1_3

static val TLS_V1_3: Int

Constant definition for TLS v1.3 which is used in setMinimumTlsVersion(int)

Value: 3

WAPI_AS_CERTIFICATE

static val WAPI_AS_CERTIFICATE: String

Key prefix for WAPI AS certificates.

Value: "WAPIAS_"

WAPI_USER_CERTIFICATE

static val WAPI_USER_CERTIFICATE: String

Key prefix for WAPI user certificates.

Value: "WAPIUSR_"

WifiEnterpriseConfig

WifiEnterpriseConfig()

WifiEnterpriseConfig

WifiEnterpriseConfig(source: WifiEnterpriseConfig!)

Copy constructor. This copies over all the fields verbatim (does not ignore masked password fields).

describeContents

open fun describeContents(): Int

enableTrustOnFirstUse

open fun enableTrustOnFirstUse(enable: Boolean): Unit

Enable Trust On First Use. Trust On First Use (TOFU) simplifies manual or partial configurations of TLS-based EAP networks. TOFU operates by installing the Root CA cert which is received from the server during an initial connection to a new network. Such installation is gated by user approval. Use only when it is not possible to configure the Root CA cert for the server.
Note: If a Root CA cert is already configured, this option is ignored, e.g. if setCaCertificate(java.security.cert.X509Certificate), or setCaCertificates(java.security.cert.X509Certificate[]) is called.

getAltSubjectMatch

open fun getAltSubjectMatch(): String!

Get alternate subject match

getAnonymousIdentity

open fun getAnonymousIdentity(): String!

Get the anonymous identity

getCaCertificate

open fun getCaCertificate(): X509Certificate?

Get CA certificate. If multiple CA certificates are configured previously, return the first one.

getCaCertificates

open fun getCaCertificates(): Array<X509Certificate!>?

Get CA certificates.

getClientCertificate

open fun getClientCertificate(): X509Certificate!

Get client certificate

getClientCertificateChain

open fun getClientCertificateChain(): Array<X509Certificate!>?

Get the complete client certificate chain in the same order as it was last supplied.

If the chain was last supplied by a call to setClientKeyEntry(java.security.PrivateKey,java.security.cert.X509Certificate) with a non-null * certificate instance, a single-element array containing the certificate will be * returned. If setClientKeyEntryWithCertificateChain(java.security.PrivateKey,java.security.cert.X509Certificate[]) was last called with a non-empty array, this array will be returned in the same order as it was supplied. Otherwise, null will be returned.

getClientKeyPairAlias

open fun getClientKeyPairAlias(): String?

Get KeyChain alias to use for client authentication.

getClientPrivateKey

open fun getClientPrivateKey(): PrivateKey?

Get the client private key as supplied in setClientKeyEntryWithCertificateChain, or null if unset.

getDecoratedIdentityPrefix

open fun getDecoratedIdentityPrefix(): String?

Get the decorated identity prefix.

getDomainSuffixMatch

open fun getDomainSuffixMatch(): String!

Get the domain_suffix_match value. See setDomSuffixMatch.

getEapMethod

open fun getEapMethod(): Int

Get the eap method.

getIdentity

open fun getIdentity(): String!

Get the identity

getMinimumTlsVersion

open fun getMinimumTlsVersion(): Int

Get the minimum TLS version for TLS-based EAP methods.

getPassword

open fun getPassword(): String!

Get the password. Returns locally set password value. For networks fetched from framework, returns "*".

getPhase2Method

open fun getPhase2Method(): Int

Get the phase 2 authentication method.

getPlmn

open fun getPlmn(): String!

Get plmn (Public Land Mobile Network) for Passpoint credential; see (java.lang.String) for more information

getRealm

open fun getRealm(): String!

Get realm for Passpoint credential; see setRealm(java.lang.String) for more information

getSubjectMatch

open fun getSubjectMatch(): String!

Deprecated: in favor of altSubjectMatch

Get subject match (deprecated)

hasCaCertificate

open fun hasCaCertificate(): Boolean

Indicates whether or not this enterprise config has a CA certificate configured.

isAuthenticationSimBased

open fun isAuthenticationSimBased(): Boolean

Utility method to determine whether the configuration's authentication method is SIM-based.

isEapMethodServerCertUsed

open fun isEapMethodServerCertUsed(): Boolean

Determines whether an Enterprise configuration's EAP method requires a Root CA certification to validate the authentication server i.e. PEAP, TLS, UNAUTH_TLS, or TTLS.

isServerCertValidationEnabled

open fun isServerCertValidationEnabled(): Boolean

Determines whether an Enterprise configuration enables server certificate validation.

The caller can determine, along with isEapMethodServerCertUsed(), if an Enterprise configuration enables server certificate validation, which is a mandatory requirement for networks that use TLS based EAP methods. A configuration that does not enable server certificate validation will be ignored and will not be considered for network selection. A network suggestion with such a configuration will cause an IllegalArgumentException to be thrown when suggested. Server validation is achieved by the following: - Either certificate or CA path is configured. - Either alternative subject match or domain suffix match is set.

isTrustOnFirstUseEnabled

open fun isTrustOnFirstUseEnabled(): Boolean

Indicates whether or not Trust On First Use (TOFU) is enabled.

setAltSubjectMatch

open fun setAltSubjectMatch(altSubjectMatch: String!): Unit

Set alternate subject match. This is the substring to be matched against the alternate subject of the authentication server certificate. Note: If no alternate subject is set for an Enterprise configuration, either by not calling this API, or by calling it with null, or not setting domain suffix match using the setDomainSuffixMatch(java.lang.String), then the server certificate validation is incomplete - which means that the connection is not secure.

setAnonymousIdentity

open fun setAnonymousIdentity(anonymousIdentity: String!): Unit

Set anonymous identity. This is used as the unencrypted identity with certain EAP types

setCaCertificate

open fun setCaCertificate(cert: X509Certificate?): Unit

Specify a X.509 certificate that identifies the server.

A default name is automatically assigned to the certificate and used with this configuration. The framework takes care of installing the certificate when the config is saved and removing the certificate when the config is removed. Note: If no certificate is set for an Enterprise configuration, either by not calling this API (or the setCaCertificates(java.security.cert.X509Certificate[]), or by calling it with null, then the server certificate validation is skipped - which means that the connection is not secure.

setCaCertificates

open fun setCaCertificates(certs: Array<X509Certificate!>?): Unit

Specify a list of X.509 certificates that identifies the server. The validation passes if the CA of server certificate matches one of the given certificates.

Default names are automatically assigned to the certificates and used with this configuration. The framework takes care of installing the certificates when the config is saved and removing the certificates when the config is removed. Note: If no certificates are set for an Enterprise configuration, either by not calling this API (or the setCaCertificate(java.security.cert.X509Certificate), or by calling it with null, then the server certificate validation is skipped - which means that the connection is not secure.

setClientKeyEntry

open fun setClientKeyEntry(
    privateKey: PrivateKey!, 
    clientCertificate: X509Certificate!
): Unit

Specify a private key and client certificate for client authorization.

A default name is automatically assigned to the key entry and used with this configuration. The framework takes care of installing the key entry when the config is saved and removing the key entry when the config is removed.

setClientKeyEntryWithCertificateChain

open fun setClientKeyEntryWithCertificateChain(
    privateKey: PrivateKey!, 
    clientCertificateChain: Array<X509Certificate!>!
): Unit

Specify a private key and client certificate chain for client authorization.

A default name is automatically assigned to the key entry and used with this configuration. The framework takes care of installing the key entry when the config is saved and removing the key entry when the config is removed.

setClientKeyPairAlias

open fun setClientKeyPairAlias(alias: String): Unit

Specify a key pair via KeyChain alias for client authentication. The alias should refer to a key pair in KeyChain that is allowed for WiFi authentication.

setDecoratedIdentityPrefix

open fun setDecoratedIdentityPrefix(decoratedIdentityPrefix: String?): Unit

Set a prefix for a decorated identity as per RFC 7542. This prefix must contain a list of realms (could be a list of 1) delimited by a '!' character. e.g. homerealm.example.org! or proxyrealm.example.net!homerealm.example.org! A prefix of "homerealm.example.org!" will generate a decorated identity that looks like: homerealm.example.org!user@otherrealm.example.net Calling with a null parameter will clear the decorated prefix. Note: Caller must verify that the device supports this feature by calling WifiManager#isDecoratedIdentitySupported()

setDomainSuffixMatch

open fun setDomainSuffixMatch(domain: String!): Unit

Set the domain_suffix_match directive on wpa_supplicant. This is the parameter to use for Hotspot 2.0 defined matching of AAA server certs per WFA HS2.0 spec, section 7.3.3.2, second paragraph.

From wpa_supplicant documentation:

Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for the AAAserver certificate in SubjectAltName dNSName element(s). If a matching dNSName is found, this constraint is met.

Suffix match here means that the host/domain name is compared one label at a time starting from the top-level domain and all the labels in domain_suffix_match shall be included in the certificate. The certificate may include additional sub-level labels in addition to the required labels.

More than one match string can be provided by using semicolons to separate the strings (e.g., example.org;example.com). When multiple strings are specified, a match with any one of the values is considered a sufficient match for the certificate, i.e., the conditions are ORed ogether.

For example, domain_suffix_match=example.com would match test.example.com but would not match test-example.com. Note: If no domain suffix is set for an Enterprise configuration, either by not calling this API, or by calling it with null, or not setting alternate subject match using the setAltSubjectMatch(java.lang.String), then the server certificate validation is incomplete - which means that the connection is not secure.

setEapMethod

open fun setEapMethod(eapMethod: Int): Unit

Set the EAP authentication method.

setIdentity

open fun setIdentity(identity: String!): Unit

Set the identity

setMinimumTlsVersion

open fun setMinimumTlsVersion(tlsVersion: Int): Unit

Set the minimum TLS version for TLS-based EAP methods. WifiManager#isTlsMinimumVersionSupported() indicates whether or not a minimum TLS version can be set. If not supported, the minimum TLS version is always TLS v1.0.

WifiManager#isTlsV13Supported() indicates whether or not TLS v1.3 is supported. If requested minimum is not supported, it will default to the maximum supported version.

setPassword

open fun setPassword(password: String!): Unit

Set the password.

setPhase2Method

open fun setPhase2Method(phase2Method: Int): Unit

Set Phase 2 authentication method. Sets the inner authentication method to be used in phase 2 after setting up a secure channel

setPlmn

open fun setPlmn(plmn: String!): Unit

Set plmn (Public Land Mobile Network) of the provider of Passpoint credential

setRealm

open fun setRealm(realm: String!): Unit

Set realm for Passpoint credential; realm identifies a set of networks where your Passpoint credential can be used

setSubjectMatch

open fun setSubjectMatch(subjectMatch: String!): Unit

Deprecated: in favor of altSubjectMatch

Set subject match (deprecated). This is the substring to be matched against the subject of the authentication server certificate.

toString

open fun toString(): String

writeToParcel

open fun writeToParcel(
    dest: Parcel, 
    flags: Int
): Unit

CREATOR

static val CREATOR: Parcelable.Creator<WifiEnterpriseConfig!>