[java-idp-plugin-webauthn] branch main updated: Make base64 encoding consistent for logging
Phil Smart
philip.smart at jisc.ac.uk
Thu Nov 28 11:54:32 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=c75081ce6a1830937bcb5d0e4f1ff6955f5d5967
The following commit(s) were added to refs/heads/main by this push:
new c75081c Make base64 encoding consistent for logging
c75081c is described below
commit c75081ce6a1830937bcb5d0e4f1ff6955f5d5967
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Nov 28 11:54:30 2024 +0000
Make base64 encoding consistent for logging
- Further base64Url cleanup
---
.../idp/plugin/authn/webauthn/storage/CredentialRecord.java | 10 ++++++++++
.../authn/webauthn/admin/impl/DeletePublicKeyCredential.java | 2 +-
.../authn/webauthn/admin/impl/LabelCredentialRecords.java | 2 +-
.../idp/plugin/authn/webauthn/impl/CheckCredentialPolicy.java | 6 +++---
.../webauthn/policy/impl/ChainingCredentialPolicyRule.java | 8 ++++----
.../policy/impl/SecondFactorOnlyCredentialPolicyRule.java | 10 +++++++---
6 files changed, 26 insertions(+), 12 deletions(-)
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/CredentialRecord.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/CredentialRecord.java
index 0f61bc5..300f0ba 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/CredentialRecord.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/CredentialRecord.java
@@ -213,6 +213,16 @@ public final class CredentialRecord {
return credential.getCredentialId().getBase64Url();
}
+ /**
+ * Get the credential ID as a base64 encoded string.
+ *
+ * @return the credential ID base64URL encoded
+ */
+ @JsonIgnore
+ public String getCredentialIdBase64() {
+ return credential.getCredentialId().getBase64();
+ }
+
/**
* Get the credential ID as a Hex encoded string.
*
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/DeletePublicKeyCredential.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/DeletePublicKeyCredential.java
index 9f6ddec..e60a8e5 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/DeletePublicKeyCredential.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/DeletePublicKeyCredential.java
@@ -99,7 +99,7 @@ public class DeletePublicKeyCredential extends AbstractWebAuthnAuditingAction<We
}
} else {
final boolean removed = repository.removeRegistrationByUsername(username, credential.get());
- log.debug("{} Credential '{}' {} removed", getLogPrefix(), credential.get().getCredentialIdBase64Url(),
+ log.debug("{} Credential '{}' {} removed", getLogPrefix(), credential.get().getCredentialIdBase64(),
removed ? "was" : "was not");
if(removed) {
auditSuccess(profileRequestContext, "credential-removed");
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/LabelCredentialRecords.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/LabelCredentialRecords.java
index 5aa8c9b..5a9c6bc 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/LabelCredentialRecords.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/LabelCredentialRecords.java
@@ -104,7 +104,7 @@ public class LabelCredentialRecords extends AbstractAuthenticationAction {
final List<String> labels = labeller.apply(credential, profileRequestContext);
if (labels != null) {
log.trace("{} Added labels '{}' for credential '{}'",
- getLogPrefix(), labels, credential.getCredentialRecord().getCredentialIdBase64Url());
+ getLogPrefix(), labels, credential.getCredentialRecord().getCredentialIdBase64());
credential.setLabels(labels);
}
}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/CheckCredentialPolicy.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/CheckCredentialPolicy.java
index fc89925..a7e4803 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/CheckCredentialPolicy.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/CheckCredentialPolicy.java
@@ -160,18 +160,18 @@ public class CheckCredentialPolicy extends AbstractWebAuthnAction<WebAuthnAuthen
if (outcome == CredentialPolicyOutcome.REJECT) {
log.warn("{} CredentialPolicy '{}' has rejected credential '{}'", getLogPrefix(), localPolicy.getId(),
- credential.get().getCredentialRecord().getCredentialIdBase64Url());
+ credential.get().getCredentialRecord().getCredentialIdBase64());
authnContext.ensureSubcontext(AuthenticationErrorContext.class).getClassifiedErrors().add(
WebAuthnAuthenticationEventIds.CREDENTIAL_POLICY_REJECTION);
ActionSupport.buildEvent(profileRequestContext, WebAuthnAuthenticationEventIds.CREDENTIAL_POLICY_REJECTION);
return;
} else if (outcome == CredentialPolicyOutcome.IGNORE) {
log.trace("{} CredentialPolicy '{}' was not active for credential '{}', accepting", getLogPrefix(),
- localPolicy.getId(), credential.get().getCredentialRecord().getCredentialIdBase64Url());
+ localPolicy.getId(), credential.get().getCredentialRecord().getCredentialIdBase64());
return;
}
log.debug("{} CredentialPolicy '{}' accepted credential '{}'", getLogPrefix(), localPolicy.getId(),
- credential.get().getCredentialRecord().getCredentialIdBase64Url());
+ credential.get().getCredentialRecord().getCredentialIdBase64());
}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/policy/impl/ChainingCredentialPolicyRule.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/policy/impl/ChainingCredentialPolicyRule.java
index 9de34c8..4c291d3 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/policy/impl/ChainingCredentialPolicyRule.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/policy/impl/ChainingCredentialPolicyRule.java
@@ -77,24 +77,24 @@ public class ChainingCredentialPolicyRule extends AbstractCredentialPolicyRule {
for (final CredentialPolicy policy : credentialPolicyChain) {
if (log.isTraceEnabled()) {
log.trace("Trying CredentialPolicy rule '{}' for credential '{}'", policy.getId(),
- credentialRecord.getCredentialIdBase64Url());
+ credentialRecord.getCredentialIdBase64());
}
final CredentialPolicyOutcome outcome = policy.evaluate(credential, prc);
if (outcome == CredentialPolicyOutcome.REJECT) {
if (log.isDebugEnabled()) {
log.debug("CredentialPolicy rule '{}' rejected credential '{}'", policy.getId(),
- credentialRecord.getCredentialIdBase64Url());
+ credentialRecord.getCredentialIdBase64());
}
return CredentialPolicyOutcome.REJECT;
} else if (outcome == CredentialPolicyOutcome.IGNORE){
if (log.isDebugEnabled()) {
log.debug("CredentialPolicy rule '{}' was ignored for credential '{}'", policy.getId(),
- credentialRecord.getCredentialIdBase64Url());
+ credentialRecord.getCredentialIdBase64());
}
} else {
if (log.isTraceEnabled()) {
log.trace("CredentialPolicy rule '{}' accepted credential '{}'", policy.getId(),
- credentialRecord.getCredentialIdBase64Url());
+ credentialRecord.getCredentialIdBase64());
}
}
}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/policy/impl/SecondFactorOnlyCredentialPolicyRule.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/policy/impl/SecondFactorOnlyCredentialPolicyRule.java
index 226f7a3..538f715 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/policy/impl/SecondFactorOnlyCredentialPolicyRule.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/policy/impl/SecondFactorOnlyCredentialPolicyRule.java
@@ -27,7 +27,6 @@ import com.yubico.webauthn.data.ByteArray;
import net.shibboleth.idp.plugin.authn.webauthn.authn.AuthenticatorSupport;
import net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnAuthenticationContext;
-import net.shibboleth.idp.plugin.authn.webauthn.impl.WebAuthnSupport;
import net.shibboleth.idp.plugin.authn.webauthn.policy.CredentialPolicy;
import net.shibboleth.idp.plugin.authn.webauthn.storage.EnhancedCredentialRecord;
import net.shibboleth.shared.annotation.constraint.NotLive;
@@ -88,11 +87,16 @@ public class SecondFactorOnlyCredentialPolicyRule extends AbstractCredentialPoli
if (log.isTraceEnabled()) {
log.trace("Rejected credential '{}', authentication is sole-factor and authenticator '{}' that "
+ "created the credential should only be used as a second factor",
- credential.getCredentialRecord().getCredentialIdBase64Url(),
- WebAuthnSupport.toBase64UrlOrUnknown(credential.getCredentialRecord().getAaguid()));
+ credential.getCredentialRecord().getCredentialIdBase64(),
+ aaguidToCheck.asGuidString());
}
return CredentialPolicyOutcome.REJECT;
}
+ if (log.isTraceEnabled()) {
+ log.trace("Accepting credential '{}' from authenticator '{}'",
+ credential.getCredentialRecord().getCredentialIdBase64(),
+ aaguidToCheck.asGuidString());
+ }
return CredentialPolicyOutcome.ACCEPT;
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list