[java-idp-plugin-webauthn] branch main updated: Allowing wiring of the challenge generation strategy

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=b727484361719f5d1c6a597ca59a4cdddb46250e

The following commit(s) were added to refs/heads/main by this push:
     new b727484  Allowing wiring of the challenge generation strategy
b727484 is described below

commit b727484361719f5d1c6a597ca59a4cdddb46250e
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Aug 13 11:45:10 2024 +0100

    Allowing wiring of the challenge generation strategy
    
     - Also improve the default generator.
---
 .../webauthn/impl/GenerateServerChallenge.java     | 40 +++++++++++++++-------
 .../webauthn-registration-beans.xml                |  3 +-
 .../idp/flows/authn/WebAuthn/webauthn-beans.xml    |  3 +-
 3 files changed, 31 insertions(+), 15 deletions(-)

diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/GenerateServerChallenge.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/GenerateServerChallenge.java
index 01bfefe..f585172 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/GenerateServerChallenge.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/GenerateServerChallenge.java
@@ -29,7 +29,6 @@ import org.slf4j.Logger;
 
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.plugin.authn.webauthn.context.BaseWebAuthnContext;
-import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
 
@@ -63,16 +62,18 @@ public class GenerateServerChallenge extends AbstractWebAuthnAction<BaseWebAuthn
      * @param strategy the strategy
      */
     public void setChallengeGeneratorStrategy(
-            @Nonnull final Function<ProfileRequestContext,byte[]> strategy) {
+            @Nullable final Function<ProfileRequestContext,byte[]> strategy) {
         checkSetterPreconditions();
-        challengeGeneratorStrategy =
-                Constraint.isNotNull(strategy, "Challenge Generator cannot be null");
+        if (strategy != null) {
+            challengeGeneratorStrategy = strategy;
+        }
     }
 
     /** {@inheritDoc} */
     @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final BaseWebAuthnContext context) {
-                  
+        
+        log.trace("{} Attempting challenge generation", getLogPrefix());
         final byte[] challenge = challengeGeneratorStrategy.apply(profileRequestContext);
         if (challenge == null) {
             log.trace("{} Generated challenge was null",getLogPrefix());
@@ -91,18 +92,31 @@ public class GenerateServerChallenge extends AbstractWebAuthnAction<BaseWebAuthn
         
         /** Class logger. */
         @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultChallengeGenerator.class);
+        
+        /** Random number generator. */
+        @Nullable private final SecureRandom randomGenerator;
 
-        /** {@inheritDoc} */
-        @Override
-        @Nullable public byte[] apply(@Nullable final ProfileRequestContext input) {           
+        /** Constructor.*/
+        public DefaultChallengeGenerator() {
             try {
-                final byte[] bytes = new byte[32];
-                SecureRandom.getInstanceStrong().nextBytes(bytes);
-                return bytes;
+                randomGenerator = SecureRandom.getInstance("SHA1PRNG");
             } catch (final NoSuchAlgorithmException e) {
-                log.error("Unable to generate challenge", e);
+                throw new RuntimeException("SHA1PRNG is required to be supported by the JVM but is not", e);
+            }
+        }
+        
+        /** {@inheritDoc} */
+        @Override
+        @Nullable public byte[] apply(@Nullable final ProfileRequestContext input) {    
+            if (randomGenerator == null) {
+                log.error("Unable to generate challenge, random number generator is null");
                 return null;
-            }            
+            }
+            final SecureRandom randomGeneratorLocal = randomGenerator;
+            assert randomGeneratorLocal != null;
+            final byte[] bytes = new byte[32];
+            randomGeneratorLocal.nextBytes(bytes);
+            return bytes;           
         }      
     }
     
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
index 90973b0..a2e6e03 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
@@ -83,7 +83,8 @@
 
     <bean id="GenerateServerChallenge" parent="AbstractWebAuthnBaseAction" scope="prototype"
         class="net.shibboleth.idp.plugin.authn.webauthn.impl.GenerateServerChallenge"
-        p:webAuthnContextLookupStrategy-ref="shibboleth.ChildLookup.WebAuthnRegistrationContext" />
+        p:webAuthnContextLookupStrategy-ref="shibboleth.ChildLookup.WebAuthnRegistrationContext" 
+        p:challengeGeneratorStrategy="#{getObject('shibboleth.authn.webauthn.ChallengeGeneratorStrategy')}"/>
 
     <bean id="AddUserId" parent="AbstractWebAuthnRegistrationAction" scope="prototype"
         class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.AddUserId"
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
index e0840ae..1ca58dd 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
@@ -103,7 +103,8 @@
 
     <bean id="GenerateServerChallenge" scope="prototype" parent="AbstractWebAuthnBaseAction"
         class="net.shibboleth.idp.plugin.authn.webauthn.impl.GenerateServerChallenge"
-        p:webAuthnContextLookupStrategy-ref="shibboleth.ChildLookup.WebAuthnAuthenticationContextFromAuthenticationContext" />
+        p:webAuthnContextLookupStrategy-ref="shibboleth.ChildLookup.WebAuthnAuthenticationContextFromAuthenticationContext" 
+        p:challengeGeneratorStrategy="#{getObject('shibboleth.authn.webauthn.ChallengeGeneratorStrategy')}"/>
 
     <bean id="CreatePublicKeyCredentialRequestOptions" scope="prototype" parent="AbstractWebAuthnAuthenticationAction"
         class="net.shibboleth.idp.plugin.authn.webauthn.impl.CreatePublicKeyCredentialRequestOptions"/>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.