authenticationFor method

({SigningAlgoType? algorithm, AtChops chops}) authenticationFor(String? enrollmentId)

The AtChops and the PKAM signing algorithm enrollmentId authenticates with — the one place either half of an APKAM keypair is resolved.

Typed material wins wherever this keyfile holds it for enrollmentId. The flat apkamPublicKey/apkamPrivateKey answer only when it holds none, and that is a fallback to where the keypair actually lives rather than a default: four shipping shapes file no typed authentication material at all — a keyfile written before the typed section existed, an rsa2048 first onboard, an OTP enrollment, and an onboard handed its keys by the caller.

Which way round matters on a retrofitted keyfile, the one shape that holds both: the flat fields keep the capped legacy enrollment's RSA credentials while the typed section carries the live enrollment's. Reading the flat fields for an enrollment that has typed material of its own signs the PKAM challenge as the wrong principal, and the atServer checks that signature against the named enrollment's record — so the misresolution surfaces as an authentication failure with nothing pointing at its cause.

A null algorithm means the caller leaves signingAlgoType at at_lookup's default, which is what the flat fields' RSA keypair needs. A null enrollmentId asks for the flat fields directly, as does any id with no typed material of its own, EnrollmentConstants.primaryEnrollmentId included; callers reach here with enrollmentToAuthenticateAs's answer. Throws AtKeyNotFoundException when enrollmentId holds typed authentication material under an algorithm this build cannot sign with. Falling back to the flat fields there would authenticate as whoever owns them, and at_lookup's default is rsa2048, so the wrong key would be signed by the wrong routine. A keyfile written by a newer client is the way this happens. authenticationAlgorithmFor raises it, so a caller wanting only the algorithm is refused on the same terms as one wanting the signer.

Implementation

// ignore: deprecated_member_use
({AtChops chops, SigningAlgoType? algorithm}) authenticationFor(
    String? enrollmentId) {
  final algorithm = authenticationAlgorithmFor(enrollmentId);
  if (algorithm == null) {
    return (chops: _toAtChops(), algorithm: null);
  }
  return (chops: _toAtChopsForEnrollment(enrollmentId!),
      algorithm: algorithm);
}