SimpleSecretProto (in authenticator.proto) and SimpleSecretHolderProto (below) share the notion of a "label", which identifies a particular secret without (hopefully) revealing the secret. Note that a SimpleSecretLabel only disambiguates between secrets used to get access to some particular object. Two different secrets that apply to two different objects could have the same label. For example, in the common sharing model, each object has no more than one "auth key". Therefore, the label for an auth key simply has type = AUTH_KEY with no additional information. In theory, we could add some sort of resource ID to SimpleSecretLabel to make it more explicit. However, in practice, this is never really needed. A SimpleSecret for one object is never used to authorize a request on some other object, so there is no ambiguity. Also, since SimpleSecrets must obviously be unguessable, there is no risk that a SimpleSecret intended for one object will accidentally grant access to another.

Attributes

• capabilityId (type: integer(), default: nil) - DEPRECATED (3-Oct-2011) This field should be deleted when code stops using CAP_TOKEN labels. Used when type = CAP_TOKEN. When a CAP_TOKEN label appears in a SimpleSecretHolder Principal, |capability_id| must be filled in to identify one of the capabilities on the ACL. When a CAP_TOKEN label appears in a SimpleSecret Authenticator, it is NOT necessary to fill in |capability_id| -- ACL Service will find the ID by searching all capabilities on the ACL for one associated with the token given by the SimpleSecret's secret data. If |capability_id| is specified, though, then the Authenticator will only be accepted if it actually matches that particular token ID.
• genericLabel (type: String.t, default: nil) - Used when type = GENERIC_SECRET
• inviteId (type: String.t, default: nil) - Used when type == INVITE.
• type (type: String.t, default: nil) - This is optional because required enums cannot be extended.