[java-idp-plugin-webauthn] branch main updated: Add AuthenticationFlowLookupStrategy

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=c9368dc9061e8b379a0c407af48266889809f10d

The following commit(s) were added to refs/heads/main by this push:
     new c9368dc  Add AuthenticationFlowLookupStrategy
c9368dc is described below

commit c9368dc9061e8b379a0c407af48266889809f10d
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon May 13 15:41:30 2024 +0100

    Add AuthenticationFlowLookupStrategy
    
            - This simply mimics the logic you can achieve using the MFA flow and
    is not configured by default. It might be useful for reference in the
    future.
---
 ...redentialsAuthenticationFlowLookupStrategy.java | 122 +++++++++++++++++++++
 1 file changed, 122 insertions(+)

diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/WebAuthnCredentialsAuthenticationFlowLookupStrategy.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/WebAuthnCredentialsAuthenticationFlowLookupStrategy.java
new file mode 100644
index 0000000..61aa861
--- /dev/null
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/WebAuthnCredentialsAuthenticationFlowLookupStrategy.java
@@ -0,0 +1,122 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.webauthn.admin.impl;
+
+import java.util.Set;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnRegistrationContext;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
+
+/**
+ * An authentication flow lookup strategy that returns {@link #webAuthnFlows} if a 
+ * {@link WebAuthnRegistrationContext} exists in the {@link ProfileRequestContext} and the user has existing WebAuthn 
+ * credentials. Otherwise the set of {@link #credentialUnavailableFlows} is returned.
+ */
+public class WebAuthnCredentialsAuthenticationFlowLookupStrategy extends AbstractIdentifiableInitializableComponent
+                implements Function<ProfileRequestContext,Set<String>>{
+    
+    /** Class logger. */
+    @Nonnull @NotEmpty 
+    private final Logger log = LoggerFactory.getLogger(WebAuthnCredentialsAuthenticationFlowLookupStrategy.class);
+    
+    /** The default ID of the WebAuthn flow.*/
+    private static final String DEFAULT_WEBAUTN_FLOW = "WebAuthn";
+    
+    /** 
+     * The set of WebAuthn flows to return if a user has registered WebAuthn credentials. 
+     * This is defaults to WebAuthn.
+     */
+    @Nonnull @NonnullElements @NotLive @Unmodifiable private Set<String> webAuthnFlows;
+    
+    /** The set of alternative flows to return if a user does not have any registered WebAuthn credentials. */
+    @Nonnull @NonnullElements @NotLive @Unmodifiable private Set<String> credentialUnavailableFlows;
+    
+    /** Lookup strategy to locate the webauthn registration context. */
+    @Nonnull 
+    private Function<ProfileRequestContext,WebAuthnRegistrationContext> webauthnRegistrationContextLookupStrategy;
+    
+    /** Constructor.*/
+    protected WebAuthnCredentialsAuthenticationFlowLookupStrategy() {
+        //prc -> WebAuthnContext
+        webauthnRegistrationContextLookupStrategy = new ChildContextLookup<>(WebAuthnRegistrationContext.class);
+        credentialUnavailableFlows = CollectionSupport.emptySet();
+        webAuthnFlows = CollectionSupport.setOf(DEFAULT_WEBAUTN_FLOW);
+    }
+    
+    /**
+     * Set the set of WebAuthn flows to return if a user has registered WebAuthn credentials. 
+     * 
+     * @param flows The webAuthnFlows to set.
+     */
+    public void setWebAuthnFlows(@Nullable @NonnullElements final Set<String> flows) {
+        checkSetterPreconditions();
+        if (flows != null) {
+            webAuthnFlows = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(flows));
+        }    
+    }
+    
+    /**
+     * Set the set of alternative flows to return if a user does not have any registered WebAuthn credentials.
+     * 
+     * @param flows The credentialUnavailableFlows to set.
+     */
+    public void setCredentialUnavailableFlows(@Nullable @NonnullElements final Set<String> flows) {
+        checkSetterPreconditions();
+        if (flows != null) {
+            credentialUnavailableFlows = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(flows));
+        }
+    }
+    
+    /**
+     * Set WebAuthn registration context lookup strategy to use.
+     * 
+     * @param strategy lookup strategy
+     */
+    public void setWebauthnRegistrationContextLookupStrategy(
+            @Nonnull final Function<ProfileRequestContext,WebAuthnRegistrationContext> strategy) {
+        checkSetterPreconditions();
+        webauthnRegistrationContextLookupStrategy = 
+                Constraint.isNotNull(strategy, "WebauthnContextLookuplookup strategy cannot be null");
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    public Set<String> apply(@Nullable final ProfileRequestContext input) {
+        checkComponentActive();
+        final WebAuthnRegistrationContext regContext = webauthnRegistrationContextLookupStrategy.apply(input);
+        
+        if (regContext != null && regContext.isWebAuthnAvailable()) {
+            return webAuthnFlows;
+        }
+        return credentialUnavailableFlows;
+    }
+
+}

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.