[java-idp-plugin-webauthn] branch main updated: Cleanup isSecondFactor check
Phil Smart
philip.smart at jisc.ac.uk
Fri Jan 19 10:19:18 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=d46d013d31d43e64da2c9cadd72179af7b23036a
The following commit(s) were added to refs/heads/main by this push:
new d46d013 Cleanup isSecondFactor check
d46d013 is described below
commit d46d013d31d43e64da2c9cadd72179af7b23036a
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Jan 19 10:19:15 2024 +0000
Cleanup isSecondFactor check
- Still no actual logic for it
---
.../webauthn/context/logic/IsSecondFactor.java | 48 ++++++++++++++++++++--
.../META-INF/net.shibboleth.idp/postconfig.xml | 2 +-
.../authn/WebAuthn/webauthn-abstract-beans.xml | 6 +--
.../idp/flows/authn/WebAuthn/webauthn-beans.xml | 9 ++--
.../authn/webauthn/conf/authn/webauthn.properties | 4 +-
5 files changed, 57 insertions(+), 12 deletions(-)
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsSecondFactor.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsSecondFactor.java
index b680f82..a030d1d 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsSecondFactor.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsSecondFactor.java
@@ -23,26 +23,66 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.shared.component.AbstractInitializableComponent;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A predicate that determines if the authentication flow is being used as a second factor of authentication, and not
* a first (and possibly only) factor. Returns true if second factor use, or false if passwordless/first factor.
*/
-public class IsSecondFactor implements Predicate<ProfileRequestContext> {
+public class IsSecondFactor extends AbstractInitializableComponent implements Predicate<ProfileRequestContext> {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(IsSecondFactor.class);
+
+ /** If true, assume we are operating as a second factor irrespective of the conventional logic.*/
+ @Nonnull private Predicate<ProfileRequestContext> secondFactorOverride;
+
+ /** Constructor.*/
+ public IsSecondFactor() {
+ secondFactorOverride = PredicateSupport.alwaysFalse();
+ }
+
+ /**
+ * Set an override predicate that determines if a second factory authentication flow should be assumed. Ignoring the
+ * conventional logic of this predicate.
+ *
+ * @param override the override predicate
+ */
+ public void setSecondFactorOverride(@Nonnull final Predicate<ProfileRequestContext> override) {
+ checkSetterPreconditions();
+ secondFactorOverride = Constraint.isNotNull(override, "SecondFactorOverride can not be null");
+ }
+
+ /**
+ * Set an override flag that determines if a second factory authentication flow should be assumed. Ignoring the
+ * conventional logic of this predicate.
+ *
+ * @param flag the flag to set
+ */
+ public void setSecondFactorOverride(final boolean flag) {
+ checkSetterPreconditions();
+ secondFactorOverride = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
@Override
public boolean test(@Nullable final ProfileRequestContext input) {
+ checkComponentActive();
if (input == null) {
- log.trace("Profile context was null, can not determine if discoverable credentials are required");
+ log.trace("Profile context was null, assuming first factor");
return false;
}
+
+ if (secondFactorOverride.test(input)){
+ log.trace("Second factor authentication flow forced by configuration");
+ return true;
+ }
+
final AuthenticationContext authnContext = input.getSubcontext(AuthenticationContext.class);
if (authnContext == null) {
- log.trace("Authentication context was null, can not determine if discoverable credentials are required");
+ log.trace("Authentication context was null, assuming first factor");
return false;
}
@@ -52,7 +92,7 @@ public class IsSecondFactor implements Predicate<ProfileRequestContext> {
log.debug("Request contained a previous factor, assuming second factor");
return true;
}
- log.debug("Request did not contain a previous factor");
+ log.debug("Request did not contain a previous factor, assuming first factor");
return false;
}
}
diff --git a/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index afe940f..c91210e 100644
--- a/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -85,7 +85,7 @@
<!-- Singleton clients and repositories -->
<!-- TODO configure these with getbeans and properties -->
- <bean id="shibboleth.authn.webauthn.DefaultWebauthnAuthenticationClientFactory" scope="singleton"
+ <bean id="shibboleth.authn.webauthn.DefaultWebAuthnAuthenticationClientFactory" scope="singleton"
class="net.shibboleth.idp.plugin.authn.webauthn.client.impl.YubicoWebauthnClientFactory"
p:relyingPartyId="%{idp.authn.webauthn.relyingPartyId}"
p:relyingPartyName="%{idp.authn.webauthn.relyingPartyName}"
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-abstract-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-abstract-beans.xml
index 9d7be7d..943a0d6 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-abstract-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-abstract-beans.xml
@@ -11,14 +11,14 @@
<!-- Parent beans -->
<bean id="AbstractWebAuthnAuthenticationAction" scope="prototype" abstract="true"
- p:webAuthnClient="#{getObject('shibboleth.authn.webauthn.DefaultWebauthnAuthenticationClientFactory')}"/>
+ p:webAuthnClient="#{getObject('shibboleth.authn.webauthn.DefaultWebAuthnAuthenticationClientFactory')}"/>
<bean id="AbstractWebAuthnRegistrationAction" scope="prototype" abstract="true"
- p:webAuthnClient="#{getObject('shibboleth.authn.webauthn.DefaultWebauthnAuthenticationClientFactory')}"
+ p:webAuthnClient="#{getObject('shibboleth.authn.webauthn.DefaultWebAuthnAuthenticationClientFactory')}"
p:credentialRepository="#{getObject('shibboleth.authn.webauthn.DefaultCredentialRepository')}"/>
<bean id="AbstractWebAuthnBaseAction" scope="prototype" abstract="true"
- p:webAuthnClient="#{getObject('shibboleth.authn.webauthn.DefaultWebauthnAuthenticationClientFactory')}"
+ p:webAuthnClient="#{getObject('shibboleth.authn.webauthn.DefaultWebAuthnAuthenticationClientFactory')}"
p:credentialRepository="#{getObject('shibboleth.authn.webauthn.DefaultCredentialRepository')}"/>
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
index 8b8ff30..52cedc5 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
@@ -21,7 +21,9 @@
</bean>
<bean id="IsSecondFactor" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.webauthn.context.logic.IsSecondFactor" />
+ class="net.shibboleth.idp.plugin.authn.webauthn.context.logic.IsSecondFactor"
+ p:secondFactorOverride="#{getObject('shibboleth.authn.webauthn.SecondFactorOverride') != null ?
+ getObject('shibboleth.authn.webauthn.SecondFactorOverride') : %{idp.authn.webauthn.forceSecondFactorFlow:false}}"/>
<bean id="IsDiscoverableCredentialRequired" scope="prototype"
class="net.shibboleth.idp.plugin.authn.webauthn.context.logic.IsDiscoverableCredentialRequired" />
@@ -38,11 +40,12 @@
p:webAuthnBaseContextLookupStrategy-ref="shibboleth.ChildLookup.WebAuthnAuthenticationContextFromAuthenticationContext"
p:userVerificationRequirement="required" />
- <bean id="AddUserVerificationNotRequired" parent="AbstractWebAuthnAuthenticationAction"
+ <bean id="AddUserVerificationNotRequired" parent="AbstractWebAuthnBaseAction"
class="net.shibboleth.idp.plugin.authn.webauthn.impl.AddUserVerificationRequirement" scope="prototype"
+ p:webAuthnBaseContextLookupStrategy-ref="shibboleth.ChildLookup.WebAuthnAuthenticationContextFromAuthenticationContext"
p:userVerificationRequirement="discouraged" />
- <bean id="LookupRegisteredCredentials" parent="AbstractWebAuthnRegistrationAction"
+ <bean id="LookupRegisteredCredentials" parent="AbstractWebAuthnBaseAction"
class="net.shibboleth.idp.plugin.authn.webauthn.impl.LookupRegisteredCredentials"
p:webAuthnBaseContextLookupStrategy-ref="shibboleth.ChildLookup.WebAuthnAuthenticationContextFromAuthenticationContext" />
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
index 5892659..2e629de 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
@@ -14,4 +14,6 @@ idp.authn.webauthn.allowOriginSubdomain = false
### The authenticatorAttachment requirement. One-of 'any', 'cross-platform', or 'platform'.
# idp.authn.webauthn.registration.authenticatorAttachment = any
### Require User Verification
-# idp.authn.webauthn.registration.userVerification = discouraged
\ No newline at end of file
+# idp.authn.webauthn.registration.userVerification = discouraged
+
+idp.authn.webauthn.forceSecondFactorFlow = false
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list