[java-idp-plugin-webauthn] branch main updated: Javadoc and minor code cleanup
Phil Smart
philip.smart at jisc.ac.uk
Fri Jun 21 14:07:49 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=767dccbf5794600f1430938005ea519ef14abeaf
The following commit(s) were added to refs/heads/main by this push:
new 767dccb Javadoc and minor code cleanup
767dccb is described below
commit 767dccbf5794600f1430938005ea519ef14abeaf
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Jun 21 15:07:44 2024 +0100
Javadoc and minor code cleanup
---
.../admin/CredentialCreationOptionsParameters.java | 38 +++++-----
.../authn/webauthn/admin/RegistrationResult.java | 1 -
.../authn/webauthn/authn/AssertionResult.java | 88 ++++++++++++++++++----
.../webauthn/authn/BaseOptionsParameters.java | 2 +-
.../authn/CredentialRequestOptionsParameters.java | 6 +-
.../client/WebAuthnAuthenticationClient.java | 2 +-
.../WebAuthnAuthenticationClientFactory.java | 4 +-
.../webauthn/context/BaseWebAuthnContext.java | 20 ++---
.../context/WebAuthnAuthenticationContext.java | 8 +-
.../context/WebAuthnManagementContext.java | 20 ++---
.../context/WebAuthnRegistrationContext.java | 29 +++----
.../logic/IsDiscoverableCredentialRequired.java | 4 +-
...stractAttributeContextUserIdentityStrategy.java | 11 ++-
.../AttributeContextByteArrayLookupStrategy.java | 2 +-
.../RegistrationErrorMessageLookupFunction.java | 2 +-
.../navigate/UsernameLookupFromSubjectContext.java | 2 +
.../impl/AddAttestationConveyancePreference.java | 3 +-
.../AddAuthenticatorAttachmentRequirement.java | 2 +-
.../CreatePublicKeyCredentialCreationOptions.java | 1 -
.../webauthn/admin/impl/RandomUserIdGenerator.java | 2 +
.../webauthn-registration-beans.xml | 2 +-
21 files changed, 162 insertions(+), 87 deletions(-)
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/CredentialCreationOptionsParameters.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/CredentialCreationOptionsParameters.java
index 4cbcaaf..b84b9de 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/CredentialCreationOptionsParameters.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/CredentialCreationOptionsParameters.java
@@ -19,6 +19,8 @@ import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.annotation.concurrent.Immutable;
+import javax.annotation.concurrent.ThreadSafe;
import com.yubico.webauthn.data.AttestationConveyancePreference;
import com.yubico.webauthn.data.AuthenticatorAttachment;
@@ -34,6 +36,8 @@ import net.shibboleth.shared.logic.Constraint;
/**
* A class to hold the parameters required to build a PublicKeyCredentialRequestOptions.
*/
+ at ThreadSafe
+ at Immutable
public class CredentialCreationOptionsParameters extends BaseOptionsParameters {
/**
@@ -146,7 +150,7 @@ public class CredentialCreationOptionsParameters extends BaseOptionsParameters {
*
* @return the user's display name.
*/
- @Nonnull public String getDisplayName() {
+ @Nonnull public final String getDisplayName() {
return displayName;
}
@@ -155,7 +159,7 @@ public class CredentialCreationOptionsParameters extends BaseOptionsParameters {
*
* @return is credential properties extension enabled
*/
- public boolean isEnableCredProperties() {
+ public final boolean isEnableCredProperties() {
return enableCredProperties;
}
@@ -164,7 +168,7 @@ public class CredentialCreationOptionsParameters extends BaseOptionsParameters {
*
* @return the attestation conveyance preference.
*/
- public AttestationConveyancePreference getAttestationConveyancePreference() {
+ public final AttestationConveyancePreference getAttestationConveyancePreference() {
return attestationConveyancePreference;
}
@@ -356,27 +360,27 @@ public class CredentialCreationOptionsParameters extends BaseOptionsParameters {
@Override
public IChallengeStage withUserVerificationRequirement(
- @Nonnull final UserVerificationRequirement userVerificationRequirement) {
- this.userVerificationRequirement = userVerificationRequirement;
+ @Nonnull final UserVerificationRequirement uvRequirement) {
+ userVerificationRequirement = uvRequirement;
return this;
}
@Override
- public IExcludeCredentialsStage withChallenge(@Nonnull final byte[] challenge) {
- this.challenge = challenge;
+ public IExcludeCredentialsStage withChallenge(@Nonnull final byte[] challengeIn) {
+ challenge = challengeIn;
return this;
}
@Override
public IUsernameStage withExcludeCredentials(
- @Nonnull final Set<PublicKeyCredentialDescriptor> excludeCredentials) {
- this.excludeCredentials = excludeCredentials;
+ @Nonnull final Set<PublicKeyCredentialDescriptor> exclude) {
+ excludeCredentials = exclude;
return this;
}
@Override
- public IDisplayNameStage withUsername(@Nonnull final String username) {
- this.username = username;
+ public IDisplayNameStage withUsername(@Nonnull final String uname) {
+ username = uname;
return this;
}
@@ -388,14 +392,14 @@ public class CredentialCreationOptionsParameters extends BaseOptionsParameters {
@Override
public IUserHandleStage withResidentKeyRequirement(
- @Nonnull final ResidentKeyRequirement residentKeyRequirement) {
- this.residentKeyRequirement = residentKeyRequirement;
+ @Nonnull final ResidentKeyRequirement residentKeyReq) {
+ residentKeyRequirement = residentKeyReq;
return this;
}
@Override
- public IAttestationConveyancePreferenceStage withUserId(@Nonnull final byte[] userId) {
- this.userId = userId;
+ public IAttestationConveyancePreferenceStage withUserId(@Nonnull final byte[] id) {
+ userId = id;
return this;
}
@@ -415,8 +419,8 @@ public class CredentialCreationOptionsParameters extends BaseOptionsParameters {
@Override
public IBuildStage withAuthenticatorAttachment(
- @Nullable final AuthenticatorAttachment authenticatorAttachment) {
- this.authenticatorAttachment = authenticatorAttachment;
+ @Nullable final AuthenticatorAttachment attachment) {
+ authenticatorAttachment = attachment;
return this;
}
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/RegistrationResult.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/RegistrationResult.java
index e2dcfb0..229db10 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/RegistrationResult.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/RegistrationResult.java
@@ -37,7 +37,6 @@ import net.shibboleth.idp.plugin.authn.webauthn.client.WebAuthnAuthenticationCli
*/
@ThreadSafe
@Immutable
-//TODO JavaDoc etc. once finalised
//TODO credential is just held here, it comes from the original response. In which case this class is mostly convient to
// access fields inside the credential.
public class RegistrationResult {
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/AssertionResult.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/AssertionResult.java
index 64137ed..b743e82 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/AssertionResult.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/AssertionResult.java
@@ -23,9 +23,8 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
* The result of calling {@link WebAuthnAuthenticationClient#validateAuthenticatorAssertionResponse(String, byte[],
* com.yubico.webauthn.data.PublicKeyCredentialRequestOptions, com.yubico.webauthn.data.PublicKeyCredential)}
*
- * <p>Note, this is similar to Yubico's AssertionResult but, importantly, can be instantiated publicly.</p>
+ * <p>Note, an instantiatable version of Yuico's AssertionResult.</p>
*/
-//TODO javadoc etc. when finalised
public class AssertionResult {
/** Is this assertion valid?*/
@@ -40,7 +39,12 @@ public class AssertionResult {
/** The user.id.*/
private final byte[] userId;
-
+ /**
+ *
+ * Constructor.
+ *
+ * @param builder the builder used to create an instance of this class
+ */
private AssertionResult(final Builder builder) {
this.success = builder.success;
this.username = builder.username;
@@ -49,7 +53,9 @@ public class AssertionResult {
}
/**
- * @return Returns the success.
+ * Is this assertion valid?
+ *
+ * @return true if verified, false otherwise.
*/
public final boolean isSuccess() {
return success;
@@ -57,7 +63,9 @@ public class AssertionResult {
/**
- * @return Returns the username.
+ * Get the username of the authenticated user.
+ *
+ * @return the username.
*/
@Nonnull public final String getUsername() {
return username;
@@ -65,13 +73,17 @@ public class AssertionResult {
/**
- * @return Returns the signatureCounterValid.
+ * Is the signature counter valid?
+ *
+ * @return true if valid, false otherwise.
*/
public final boolean isSignatureCounterValid() {
return signatureCounterValid;
}
/**
+ * Get the user.id of the authenticated user.
+ *
* @return Returns the userId.
*/
@Nonnull public byte[] getUserId() {
@@ -79,44 +91,94 @@ public class AssertionResult {
}
-
+ /**
+ * Builder.
+ *
+ * @return the next stage
+ */
public static ISuccessStage builder() {
return new Builder();
}
-
+ /**
+ * Builder stage.
+ */
public interface ISuccessStage {
+ /**
+ * Set if this assertion was verified.
+ *
+ * @param success true if the assertion was verified, false otherwise.
+ *
+ * @return the next stage
+ */
public IUsernameStage withSuccess(boolean success);
}
-
+ /**
+ * Builder stage.
+ */
public interface IUsernameStage {
+ /**
+ * Set the user.name of the authenticated user.
+ *
+ * @param username the user.name
+ * @return the next stage
+ */
public ISignatureCounterValidStage withUsername(String username);
}
-
+ /**
+ * Builder stage.
+ */
public interface ISignatureCounterValidStage {
+ /**
+ * Set if the signature counter is valid.
+ *
+ * @param signatureCounterValid true if valid, false otherwise.
+ * @return the next stage
+ */
public IUserIdStage withSignatureCounterValid(boolean signatureCounterValid);
}
-
+ /**
+ * Builder stage.
+ */
public interface IUserIdStage {
+ /**
+ * Set the user.id
+ * @param userId the user.id
+ * @return the next stage
+ */
public IBuildStage withUserId(byte[] userId);
}
-
+ /**
+ * Builder stage.
+ */
public interface IBuildStage {
+ /** Build the result.*/
public AssertionResult build();
}
-
+ /**
+ * The {@link AssertionResult} builder.
+ */
public static final class Builder
implements ISuccessStage, IUsernameStage, ISignatureCounterValidStage, IUserIdStage, IBuildStage {
+
+ /** Is this assertion valid?*/
private boolean success;
+
+ /** The username of the user this result corresponds to.*/
private String username;
+
+ /** Is the signature count valid?*/
private boolean signatureCounterValid;
+
+ /** The user.id.*/
private byte[] userId;
+ /** Constructor.*/
private Builder() {
}
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/BaseOptionsParameters.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/BaseOptionsParameters.java
index c356396..d1afa10 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/BaseOptionsParameters.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/BaseOptionsParameters.java
@@ -21,7 +21,7 @@ import com.yubico.webauthn.data.UserVerificationRequirement;
import net.shibboleth.shared.logic.Constraint;
/**
- * Abstract options parameters class. Common to credential create or get options.
+ * Abstract options parameters class. Common to WebAuthn credential 'create' or 'get' options.
*/
public abstract class BaseOptionsParameters {
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/CredentialRequestOptionsParameters.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/CredentialRequestOptionsParameters.java
index de1ce79..fbb9d5b 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/CredentialRequestOptionsParameters.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/CredentialRequestOptionsParameters.java
@@ -28,13 +28,13 @@ import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
/**
- * A class to hold the parameters required to build a PublicKeyCredentialRequestOptions.
+ * The parameters required to build a PublicKeyCredentialRequestOptions.
*/
public class CredentialRequestOptionsParameters extends BaseOptionsParameters {
/**
- * Credentials that have already been registered with the IdP. The authenticator should use these to avoid creating
- * duplicate credentials during registration.
+ * Credentials that have already been registered with the credential repository. The authenticator should use
+ * the IDs of these to avoid creating duplicate credentials during registration.
*/
@Nonnull @NonnullElements private final List<PublicKeyCredentialDescriptor> allowCredentials;
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/WebAuthnAuthenticationClient.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/WebAuthnAuthenticationClient.java
index 8ebfd86..436598b 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/WebAuthnAuthenticationClient.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/WebAuthnAuthenticationClient.java
@@ -47,7 +47,7 @@ public interface WebAuthnAuthenticationClient {
throws WebAuthnAuthenticationClientException;
/**
- * Create a PublicKeyCredentialCreationOptions for the WebAuthn 'create' call to generate a registration
+ * Create a PublicKeyCredentialCreationOptions for the WebAuthn 'create' call to generate a new registration
* attestation.
*
* @param creationOptions the options that should be present in the registration request.
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/WebAuthnAuthenticationClientFactory.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/WebAuthnAuthenticationClientFactory.java
index 55a8d3f..d8a0bd5 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/WebAuthnAuthenticationClientFactory.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/WebAuthnAuthenticationClientFactory.java
@@ -13,9 +13,9 @@ public interface WebAuthnAuthenticationClientFactory {
/**
* Create an {@link WebAuthnAuthenticationClient} instance.
*
- * @return the client, never {@code nul}.
+ * @return the client, never {@code null}.
*
- * @throws WebAuthnAuthenticationClientException if there is an errtor creating the client.
+ * @throws WebAuthnAuthenticationClientException if there is an error creating the client.
*/
@Nonnull WebAuthnAuthenticationClient createInstance() throws WebAuthnAuthenticationClientException;
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/BaseWebAuthnContext.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/BaseWebAuthnContext.java
index f75779e..6581494 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/BaseWebAuthnContext.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/BaseWebAuthnContext.java
@@ -60,7 +60,7 @@ public class BaseWebAuthnContext extends BaseContext {
@Nullable private UserVerificationRequirement userVerificationRequirement;
/**
- * Are credentials available to use for WebAuthn authentication.
+ * Does the user have existing, registered, credentials available to use for authentication.
*
* @return true iff existing credentials are available, false otherwise.
*/
@@ -69,7 +69,7 @@ public class BaseWebAuthnContext extends BaseContext {
}
/**
- * Gets the username (user.name in WebAuthn parlance).
+ * Gets the username (WebAuthn user.name).
*
* @return the user.name
*/
@@ -78,7 +78,7 @@ public class BaseWebAuthnContext extends BaseContext {
}
/**
- * Sets the username (user.name in WebAuthn parlance). Must not be empty or {@code null}.
+ * Sets the username (WebAuthn user.name). Must not be empty or {@code null}.
*
* @param name the user.name
*
@@ -90,7 +90,7 @@ public class BaseWebAuthnContext extends BaseContext {
}
/**
- * Set the credentials that have already been registered with the IdP.
+ * Set user's credentials that have already been registered with the credential repository.
*
* @param credentials the set of credentials
*
@@ -103,7 +103,7 @@ public class BaseWebAuthnContext extends BaseContext {
}
/**
- * Get the credentials that have already been registered with the IdP.
+ * Get the user's credentials that have already been registered with the credential repository.
*
* @return the existing credentials.
*/
@@ -125,9 +125,9 @@ public class BaseWebAuthnContext extends BaseContext {
}
/**
- * Set the server challenge which forms part of the information the client authenticator needs to sign.
+ * Set the server challenge that forms part of the information the client authenticator needs to sign.
*
- * @param challenge the challenge, must not be empty and must be a minimum 16 bytes long.
+ * @param challenge the challenge, must not be empty and must be at minimum 16 bytes.
*
* @return this context.
*/
@@ -140,7 +140,7 @@ public class BaseWebAuthnContext extends BaseContext {
/**
- * Set the user.id used to map public key credentials to user accounts. Maximum 64 bytes.
+ * Set the user.id used to map public key credentials to the user's account. Maximum 64 bytes.
*
* @param id The user.id to set.
*
@@ -154,8 +154,8 @@ public class BaseWebAuthnContext extends BaseContext {
}
/**
- * Get the user.id used to map public key credentials to user accounts. Sent to the authenticator during credential
- * creation. Referred to as the userHandle in responses from the authenticator during authentication.
+ * Get the user.id used to map public key credentials to the user's account. Sent to the authenticator during
+ * credential creation. Referred to as the userHandle in responses from the authenticator during authentication.
*
* @return the user.id.
*/
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnAuthenticationContext.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnAuthenticationContext.java
index 1788d4d..7994340 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnAuthenticationContext.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnAuthenticationContext.java
@@ -12,7 +12,7 @@ import com.yubico.webauthn.data.PublicKeyCredentialRequestOptions;
import net.shibboleth.shared.logic.Constraint;
-/** Authentication context for processing WebAuthn Authentication Ceremonies. */
+/** Authentication context for processing WebAuthn authentication ceremonies. */
@NotThreadSafe
public final class WebAuthnAuthenticationContext extends BaseWebAuthnContext {
@@ -33,7 +33,7 @@ public final class WebAuthnAuthenticationContext extends BaseWebAuthnContext {
private PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs>
publicKeyCredentialAssertionResponse;
- /** The public key credential request options for authentication.*/
+ /** The public key credential request options for generating an authentication assertion.*/
@Nullable private PublicKeyCredentialRequestOptions publicKeyCredentialRequestOptions;
/**
@@ -59,7 +59,7 @@ public final class WebAuthnAuthenticationContext extends BaseWebAuthnContext {
/**
- * Set the public key credential request options for authentication.
+ * Set the public key credential request options for generating an authentication assertion.
*
* @param options the request options to set.
*
@@ -72,7 +72,7 @@ public final class WebAuthnAuthenticationContext extends BaseWebAuthnContext {
}
/**
- * Get the public key credential request options.
+ * Get the public key credential request options for generating an authentication assertion.
*
* @return the public key credential request options.
*/
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnManagementContext.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnManagementContext.java
index db442f5..bf5a969 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnManagementContext.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnManagementContext.java
@@ -31,20 +31,20 @@ import net.shibboleth.shared.collection.CollectionSupport;
*/
public class WebAuthnManagementContext extends BaseContext {
- /** Canonical principal name of admin subject. */
+ /** Canonical principal name of the authenticated user, acting as an admin. */
@Nullable private String principalName;
/** The username of the user to find and manage credentials for. */
@Nullable private String searchUsername;
- /** The set of credentials registered for the given searchUsername.*/
+ /** The located set of credentials registered for the given searchUsername.*/
@Nullable @Unmodifiable @NotLive private Collection<CredentialRegistration> foundCredentials;
- /** The ID of the credential that is going to be removed.*/
+ /** The ID of a credential that is going to be removed.*/
@Nullable private byte[] credentialIdToRemove;
/**
- * Get the canonical principal name of the subject.
+ * Get the canonical principal name of the authenticated subject.
*
* @return the canonical principal name
*/
@@ -53,7 +53,7 @@ public class WebAuthnManagementContext extends BaseContext {
}
/**
- * Set the canonical principal name of the subject.
+ * Set the canonical principal name of the authenticated subject.
*
* @param name the canonical principal name
*
@@ -68,7 +68,7 @@ public class WebAuthnManagementContext extends BaseContext {
/**
* Get the username of the user to find and manage credentials for.
*
- * @return the username
+ * @return the username to search for
*/
@Nullable public String getSearchUsername() {
return searchUsername;
@@ -77,7 +77,7 @@ public class WebAuthnManagementContext extends BaseContext {
/**
* Set the username of the user to find and manage credentials for.
*
- * @param name the username
+ * @param name the username to search for
*
* @return this context
*/
@@ -88,7 +88,7 @@ public class WebAuthnManagementContext extends BaseContext {
}
/**
- * Set the credentials found to belong to the given search user.
+ * Set the credentials found to belong to the given searchUsername.
*
* @param credentials the set of credentials
*
@@ -105,7 +105,7 @@ public class WebAuthnManagementContext extends BaseContext {
}
/**
- * Get the credentials found to belong to the given search user.
+ * Get the credentials found to belong to the given searchUsername.
*
* @return the credentials.
*/
@@ -132,7 +132,7 @@ public class WebAuthnManagementContext extends BaseContext {
/**
* Get the ID of the credential that is going to be removed.
*
- * @return Returns the credentialIdToRemove.
+ * @return the credential id to remove.
*/
@Nullable public byte[] getCredentialIdToRemove() {
return credentialIdToRemove;
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnRegistrationContext.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnRegistrationContext.java
index 129ec50..2b8bced 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnRegistrationContext.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnRegistrationContext.java
@@ -31,38 +31,41 @@ public final class WebAuthnRegistrationContext extends BaseWebAuthnContext {
@Nullable private PublicKeyCredential<AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs>
publicKeyCredentialAttestationResponse;
- /** The public key credential creation options for registration.*/
+ /** The public key credential creation options for creating a new credential.*/
@Nullable private PublicKeyCredentialCreationOptions publicKeyCredentialCreationOptions;
/**
- * The credential public key which is the result of a registration of a new key pair generated
- * by the authenticator.
+ * The credential public key which is the result of registration of a new key pair generated
+ * by an authenticator.
*/
@Nullable private RegistrationResult registrationResult;
/** A display friendly nickname for the credential that is to be registered.*/
@Nullable private String credentialNickname;
- /** The ID of the credential that is going to be removed.*/
+ /** The ID of a credential that is going to be removed.*/
@Nullable private byte[] credentialIdToRemove;
/** The requirement on registering a ResidentKey. Also know as a discoverable credential.*/
@Nullable private ResidentKeyRequirement residentKeyRequirement;
- /** The AuthenticatorAttachment requirement. {@code null} would represent either possibility.*/
+ /**
+ * The authenticator attachment requirement (cross-platform or platform). {@code null} would represent either
+ * possibility.
+ */
@Nullable private AuthenticatorAttachment authenticatorAttachmentRequirement;
- /** The attestation preference.*/
+ /** The attestation conveyance preference.*/
@Nullable private AttestationConveyancePreference attestationConveyancePreference;
/**
- * The user.displayName supplied to the authenticator during registration. A human-palatable name for the user
- * account, intended only for display.
+ * The user.displayName supplied to the authenticator during generation of a new credential. A human-palatable name
+ * for the user account, intended only for display.
*/
@Nullable private String displayName;
/**
- * Set the AuthenticatorAttachment requirement. {@code null} would represent either possibility.
+ * Set the authenticator attachment requirement. {@code null} would represent either possibility.
*
* @param requirement The authenticatorAttachmentRequirement to set.
*
@@ -76,7 +79,7 @@ public final class WebAuthnRegistrationContext extends BaseWebAuthnContext {
/**
*
- * Get the AuthenticatorAttachment requirement. {@code null} would represent either possibility.
+ * Get the authenticator attachment requirement. {@code null} would represent either possibility.
*
* @return the authenticator attachment requirement.
*/
@@ -133,7 +136,7 @@ public final class WebAuthnRegistrationContext extends BaseWebAuthnContext {
/**
* Set the registration result which is the result of registration of a new key pair generated
- * by the authenticator.
+ * by an authenticator.
*
* @param result the registration result to set.
*
@@ -197,7 +200,7 @@ public final class WebAuthnRegistrationContext extends BaseWebAuthnContext {
}
/**
- * Set the ResidentKey requirement. Also know as a discoverable credential.
+ * Set the ResidentKey requirement. A residenty key is also know as a discoverable credential.
*
* @param requirement The resident key requirement to set.
*
@@ -210,7 +213,7 @@ public final class WebAuthnRegistrationContext extends BaseWebAuthnContext {
}
/**
- * Get the ResidentKey requirement. Also know as a discoverable credential.
+ * Get the ResidentKey requirement. A residenty key is also know as a discoverable credential.
*
* @return the requirement.
*/
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsDiscoverableCredentialRequired.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsDiscoverableCredentialRequired.java
index f9c121a..7ac91fd 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsDiscoverableCredentialRequired.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsDiscoverableCredentialRequired.java
@@ -27,8 +27,8 @@ import net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnAuthenticationCo
import net.shibboleth.shared.primitive.LoggerFactory;
/**
- * A predicate that determines if the authentication ceremony requires a discoverable credential supplied by the
- * authenticator, or if we have a username to determine which credentials to use from the IdP.
+ * A predicate that determines if the authentication ceremony requires a discoverable credential (ResidentKey)
+ * supplied by the authenticator, or if we have a username to determine which credentials to use from the IdP.
*/
public class IsDiscoverableCredentialRequired implements Predicate<ProfileRequestContext> {
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/AbstractAttributeContextUserIdentityStrategy.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/AbstractAttributeContextUserIdentityStrategy.java
index 8d7b596..e8cbbe6 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/AbstractAttributeContextUserIdentityStrategy.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/AbstractAttributeContextUserIdentityStrategy.java
@@ -52,7 +52,7 @@ public abstract class AbstractAttributeContextUserIdentityStrategy<T> extends Ab
/** The attribute Id to extract the value from.*/
@Nullable @NotEmpty private String attributeId;
- /** Whether to look at filtered or unfiltered attributes. Default is true.*/
+ /** Whether to look at filtered or unfiltered attributes. Default is filtered.*/
private boolean useUnfilteredAttributes;
/** Constructor.*/
@@ -72,6 +72,7 @@ public abstract class AbstractAttributeContextUserIdentityStrategy<T> extends Ab
* @return whether to source the input attributes from the unfiltered set
*/
public boolean isUseUnfilteredAttributes() {
+ checkComponentActive();
return useUnfilteredAttributes;
}
@@ -83,6 +84,7 @@ public abstract class AbstractAttributeContextUserIdentityStrategy<T> extends Ab
* @param flag flag to set
*/
public void setUseUnfilteredAttributes(final boolean flag) {
+ checkSetterPreconditions();
useUnfilteredAttributes = flag;
}
@@ -97,11 +99,12 @@ public abstract class AbstractAttributeContextUserIdentityStrategy<T> extends Ab
}
/**
- * Get the attributeId.
+ * Get the attribute Id to extract the value from.
*
* @return the attributeId.
*/
@Nullable @NotEmpty protected String getAttributeId() {
+ checkComponentActive();
return attributeId;
}
@@ -120,8 +123,8 @@ public abstract class AbstractAttributeContextUserIdentityStrategy<T> extends Ab
}
/**
- * Get the attribute from the filtered set of attributes with the given attribute Id from the AttributeContext
- * (if it exists).
+ * Get the attribute from either the filtered or unfiltered set of attributes with the given attribute Id from the
+ * AttributeContext (if it exists).
*
* @param profileRequestContext the profile request context to locate the attribute context and the attribute from
*
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/AttributeContextByteArrayLookupStrategy.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/AttributeContextByteArrayLookupStrategy.java
index 8ac2971..2ab4a8b 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/AttributeContextByteArrayLookupStrategy.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/AttributeContextByteArrayLookupStrategy.java
@@ -30,7 +30,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An {@link AbstractAttributeContextUserIdentityStrategy} that pulls out an {@link StringAttributeValue} from the
* attribute context and represents it as a UTF-8 encoded byte array. Will return an empty array if the attribute can
- * not be found, or if there is more than one attribute value.
+ * not be found or if there is more than one attribute value.
*/
public class AttributeContextByteArrayLookupStrategy extends AbstractAttributeContextUserIdentityStrategy<byte[]> {
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/RegistrationErrorMessageLookupFunction.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/RegistrationErrorMessageLookupFunction.java
index e67a6d6..da78037 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/RegistrationErrorMessageLookupFunction.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/RegistrationErrorMessageLookupFunction.java
@@ -46,7 +46,7 @@ public class RegistrationErrorMessageLookupFunction extends ApplicationObjectSup
@Nonnull
private Function<ProfileRequestContext,WebAuthnRegistrationErrorContext> webauthnErrorContextLookupStrategy;
-
+ /** Constructor.*/
public RegistrationErrorMessageLookupFunction() {
webauthnErrorContextLookupStrategy = new ChildContextLookup<>(WebAuthnRegistrationErrorContext.class)
.compose(new ChildContextLookup<>(WebAuthnRegistrationContext.class));
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromSubjectContext.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromSubjectContext.java
index c2b1384..113ceab 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromSubjectContext.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromSubjectContext.java
@@ -18,6 +18,7 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
@@ -28,6 +29,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Pull out a username/principalName from the {@link SubjectContext#getPrincipalName()} if it exists.
*/
+ at ThreadSafe
public class UsernameLookupFromSubjectContext implements Function<ProfileRequestContext, String> {
/** Class logger. */
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAttestationConveyancePreference.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAttestationConveyancePreference.java
index 2e4a9c5..ce7085c 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAttestationConveyancePreference.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAttestationConveyancePreference.java
@@ -31,7 +31,8 @@ import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
- * Add an attestation preference to the {@link WebAuthnAuthenticationContext context}. The default preference is 'none'.
+ * Add an attestation conveyance preference to the {@link WebAuthnAuthenticationContext context}. The default
+ * preference is 'none'.
*
* @pre <pre>ProfileRequestContext.getSubcontext(WebAuthnRegistrationContext.class) != null</pre>
* @post <pre>WebAuthnRegistrationContext.getAttestationConveyancePreference() != null</pre>
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAuthenticatorAttachmentRequirement.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAuthenticatorAttachmentRequirement.java
index 25f1419..c3ad7a8 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAuthenticatorAttachmentRequirement.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddAuthenticatorAttachmentRequirement.java
@@ -32,7 +32,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Add an authenticator attachment requirement to the {@link WebAuthnRegistrationContext context}. Default is
- * {@code null} which translates to a requiremernt of 'any'.
+ * {@code null} which translates to a requirement of 'any'.
*
* @pre <pre>ProfileRequestContext.getSubcontext(WebAuthnRegistrationContext.class) != null</pre>
* @post <pre>WebAuthnRegistrationContext.getAuthenticatorAttachmentRequirement() != null</pre>
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/CreatePublicKeyCredentialCreationOptions.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/CreatePublicKeyCredentialCreationOptions.java
index 58e6a3e..8705f05 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/CreatePublicKeyCredentialCreationOptions.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/CreatePublicKeyCredentialCreationOptions.java
@@ -111,7 +111,6 @@ public class CreatePublicKeyCredentialCreationOptions extends AbstractWebAuthnRe
assert null != existingCredentialDescriptors;
- //TODO helper?
final CredentialCreationOptionsParameters creationOptions = CredentialCreationOptionsParameters.builder()
.withUserVerificationRequirement(uvRequirement)
.withChallenge(challenge)
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/RandomUserIdGenerator.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/RandomUserIdGenerator.java
index 54238b9..773ddfb 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/RandomUserIdGenerator.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/RandomUserIdGenerator.java
@@ -20,6 +20,7 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
@@ -29,6 +30,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A user.id generator that generates a random 64 byte user.id. Returns {@code null} iff one can not be generated.
*/
+ at ThreadSafe
public final class RandomUserIdGenerator implements Function<ProfileRequestContext, byte[]>{
/** Class logger. */
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
index 7465374..3ec5428 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
@@ -92,7 +92,7 @@
<bean id="shibboleth.authn.webauthn.SubjectDisplayNameLookupStrategy" lazy-init="true"
class="net.shibboleth.idp.plugin.authn.webauthn.context.navigate.UsernameLookupFromSubjectContext"/>
- <bean id="shibboleth.authn.webauthn.AttributeContextDisplayNameLookupStrategy" lazy-init="true"
+ <bean id="shibboleth.authn.webauthn.AttributeContextDisplayNameLookupStrategy" lazy-init="true" scope="singleton"
class="net.shibboleth.idp.plugin.authn.webauthn.context.navigate.AttributeContextStringLookupStrategy"
p:attributeId="%{idp.authn.webauthn.registration.displayname.attributeId:#{null}}"/>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list