[java-idp-plugin-webauthn] branch main updated: Fix username lookup strategy for populating the registration context
Phil Smart
philip.smart at jisc.ac.uk
Mon Feb 19 17:12:20 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=c91d1484b3d51dff130bb6d3b3ae5374f35769a8
The following commit(s) were added to refs/heads/main by this push:
new c91d148 Fix username lookup strategy for populating the registration context
c91d148 is described below
commit c91d1484b3d51dff130bb6d3b3ae5374f35769a8
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Feb 19 17:12:17 2024 +0000
Fix username lookup strategy for populating the registration context
- Take principal name from the SubjectContext
---
.../UsernameLookupFromAuthenticationResult.java | 68 ----------------------
.../navigate/UsernameLookupFromSubjectContext.java | 54 +++++++++++++++++
.../webauthn-registration-beans.xml | 4 +-
3 files changed, 56 insertions(+), 70 deletions(-)
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromAuthenticationResult.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromAuthenticationResult.java
deleted file mode 100644
index d467687..0000000
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromAuthenticationResult.java
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.webauthn.context.navigate;
-
-import java.util.Set;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.authn.AuthenticationResult;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.idp.authn.principal.UsernamePrincipal;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Pull out a username from a the authentication result if it exists. Useful when operating inside a WebAuthn
- * registration flow.
- */
-public class UsernameLookupFromAuthenticationResult implements Function<ProfileRequestContext, String> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(UsernameLookupFromAuthenticationResult.class);
-
- /** {@inheritDoc} */
- @Override
- public String apply(@Nullable final ProfileRequestContext input) {
- if (input == null) {
- log.trace("Profile context was null, can not find existing username");
- return null;
- }
- final AuthenticationContext authnContext = input.getSubcontext(AuthenticationContext.class);
- if (authnContext == null) {
- log.debug("Authentication context was null, can not find existing username");
- return null;
- }
- final AuthenticationResult result = authnContext.getAuthenticationResult();
- if (result == null) {
- log.debug("Authentication result was null, can not find existing username");
- return null;
- }
-
- final Set<UsernamePrincipal> usernamePrincipals = result.getSubject().getPrincipals(UsernamePrincipal.class);
- if (usernamePrincipals != null && usernamePrincipals.size() == 1) {
- final String username = usernamePrincipals.iterator().next().getName();
- log.debug("Found existing username '{}' from authentication result", username);
- return username;
- }
- log.debug("Could not find existing username from authentication result");
- return null;
- }
-
-}
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromSubjectContext.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromSubjectContext.java
new file mode 100644
index 0000000..effb05b
--- /dev/null
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromSubjectContext.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.webauthn.context.navigate;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import net.shibboleth.idp.authn.context.SubjectContext;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
+/**
+ * Pull out a username from a the {@link SubjectContext#getPrincipalName()} if it exists.
+ * Useful when operating inside a WebAuthn registration flow.
+ */
+public class UsernameLookupFromSubjectContext implements Function<ProfileRequestContext, String> {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(UsernameLookupFromSubjectContext.class);
+
+ /** {@inheritDoc} */
+ @Override
+ public String apply(@Nullable final ProfileRequestContext input) {
+ if (input == null) {
+ log.trace("Profile context was null, can not find existing username");
+ return null;
+ }
+ final SubjectContext subjectContext = input.getSubcontext(SubjectContext.class);
+ if (subjectContext == null) {
+ log.debug("Subject context was null, can not find existing username");
+ return null;
+ }
+ final String username = subjectContext.getPrincipalName();
+ log.debug("Found existing username '{}' from subject", username);
+ return username;
+ }
+
+}
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
index 9e15dfa..eb55081 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
@@ -27,12 +27,12 @@
</property>
</bean>
- <!-- Important that this gets the username from the authn result, not the initial context that is created -->
+ <!-- Important that this gets the username from the subject context, not the initial context that is created -->
<bean id="PopulateWebAuthnRegistrationContext" scope="prototype"
class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.PopulateWebAuthnRegistrationContext">
<property name="usernameLookupStrategy">
<bean id="usernameFromAuthnResult" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.webauthn.context.navigate.UsernameLookupFromAuthenticationResult"/>
+ class="net.shibboleth.idp.plugin.authn.webauthn.context.navigate.UsernameLookupFromSubjectContext"/>
</property>
</bean>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list