[java-idp-plugin-webauthn] 04/11: JWEBAUTHN-27 - Add basic authenticator policy
Phil Smart
philip.smart at jisc.ac.uk
Fri Oct 18 17:13:29 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=00146193edee9f327caa661911c99307505e17ee
commit 00146193edee9f327caa661911c99307505e17ee
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Oct 4 09:46:43 2024 +0100
JWEBAUTHN-27 - Add basic authenticator policy
- Change name from 'assessor' to 'inspector'
https://shibboleth.atlassian.net/browse/JWEBAUTHN-27
---
...ava => AuthenticatorCapabilitiesInspector.java} | 8 ++---
.../webauthn/admin/policy/AuthenticatorPolicy.java | 7 ++--
.../webauthn/storage/CredentialRegistration.java | 2 +-
.../impl/AttachAuthenticatorCapabilities.java | 24 ++++++-------
...bstractAuthenticatorCapabilitiesInspector.java} | 28 +++++++--------
...hainingAuthenticatorCapabilitiesInspector.java} | 41 +++++++++++-----------
...=> SecondFactorOnlyAuthenticatorInspector.java} | 8 ++---
.../webauthn-registration-beans.xml | 20 +++++------
.../authn/webauthn/conf/authn/webauthn.properties | 20 +++++------
9 files changed, 80 insertions(+), 78 deletions(-)
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/AuthenticatorCapabilitiesAssessor.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/AuthenticatorCapabilitiesInspector.java
similarity index 75%
rename from webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/AuthenticatorCapabilitiesAssessor.java
rename to webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/AuthenticatorCapabilitiesInspector.java
index 170c80e..b1b1350 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/AuthenticatorCapabilitiesAssessor.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/AuthenticatorCapabilitiesInspector.java
@@ -28,13 +28,13 @@ import net.shibboleth.shared.annotation.constraint.Unmodifiable;
import net.shibboleth.shared.component.IdentifiedComponent;
/**
- * An API for assessing the capabilities of an authenticator and describing that in a Map. The authenticator is
+ * An API for inspecting the capabilities of an authenticator and describing that in a Map. The authenticator is
* identified by its AAGUID.
*/
-public interface AuthenticatorCapabilitiesAssessor extends IdentifiedComponent {
+public interface AuthenticatorCapabilitiesInspector extends IdentifiedComponent {
/**
- * Assess the capabilities of this authenticator and return any capabilities/properties/labels/tags appropriate.
+ * Inspect the capabilities of this authenticator and return any capabilities/properties/labels/tags appropriate.
*
* @param aaguid the authenticator attestation GUID.
* @param prc the profile request context
@@ -42,6 +42,6 @@ public interface AuthenticatorCapabilitiesAssessor extends IdentifiedComponent {
* @return a map of capabilities/properties/labels/tags relating to the authenticator, could be empty.
*/
@Nonnull @NotLive @Unmodifiable
- Map<String, String> assess(@Nullable final AAGUID aaguid, @Nullable final ProfileRequestContext prc);
+ Map<String, String> inspect(@Nullable final AAGUID aaguid, @Nullable final ProfileRequestContext prc);
}
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/AuthenticatorPolicy.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/AuthenticatorPolicy.java
index 0aa05de..b26c10b 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/AuthenticatorPolicy.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/AuthenticatorPolicy.java
@@ -55,13 +55,14 @@ public interface AuthenticatorPolicy extends IdentifiedComponent{
}
/**
- * Execute the policy. Return true if allowed, false otherwise.
+ * Execute the policy. Return {@link AuthenticatorPolicyOutcome#ALLOW} if allowed,
+ * {@link AuthenticatorPolicyOutcome#REJECT} if rejected, and {@link AuthenticatorPolicyOutcome#IGNORE} otherwise.
*
* @param aaguid the authenticator attestation GUID.
* @param prc the profile request context
*
- * @return true if the authenticator was accepted, false if the authenticator was rejected, ignore if the
- * policy is to be ignored (e.g. the policy is not active)
+ * @return the authenticator policy outcome: ALLOW if allowed, REJECT if rejected, and IGNORE if the
+ * policy is to be ignored (e.g. the policy is not active)
*/
AuthenticatorPolicyOutcome accept(@Nonnull final AAGUID aaguid, @Nullable final ProfileRequestContext prc);
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/CredentialRegistration.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/CredentialRegistration.java
index 829bf16..912c45c 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/CredentialRegistration.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/CredentialRegistration.java
@@ -84,7 +84,7 @@ public final class CredentialRegistration {
/**
* Capabilities of the authenticator as determined by the registration process and any configured authenticator
- * assessors (not necessarily just from FIDO metadata).
+ * inspectors (not necessarily just from FIDO metadata).
*/
@Nonnull private final Map<String,String> authenticatorCapabilities;
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AttachAuthenticatorCapabilities.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AttachAuthenticatorCapabilities.java
index c2816c7..89da113 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AttachAuthenticatorCapabilities.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AttachAuthenticatorCapabilities.java
@@ -33,7 +33,7 @@ import com.yubico.webauthn.data.ClientRegistrationExtensionOutputs;
import com.yubico.webauthn.data.PublicKeyCredential;
import net.shibboleth.idp.plugin.authn.webauthn.admin.WebAuthnRegistrationEventIds;
-import net.shibboleth.idp.plugin.authn.webauthn.admin.policy.AuthenticatorCapabilitiesAssessor;
+import net.shibboleth.idp.plugin.authn.webauthn.admin.policy.AuthenticatorCapabilitiesInspector;
import net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnRegistrationContext;
import net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
@@ -52,8 +52,8 @@ public class AttachAuthenticatorCapabilities extends AbstractWebAuthnAction<WebA
@NonnullBeforeExec
private PublicKeyCredential<AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs> attestation;
- /** The assessor that checks the capabilities of the authenticator.*/
- @Nullable private AuthenticatorCapabilitiesAssessor authenticatorAssessor;
+ /** The inspector that checks the capabilities of the authenticator.*/
+ @Nullable private AuthenticatorCapabilitiesInspector authenticatorInspector;
/**
* Constructor.
@@ -63,13 +63,13 @@ public class AttachAuthenticatorCapabilities extends AbstractWebAuthnAction<WebA
}
/**
- * Set the assessor that checks the capabilities of the authenticator.
+ * Set the inspector that checks the capabilities of the authenticator.
*
- * @param assessor the authenticator assessor to set.
+ * @param inspector the authenticator inspector to set.
*/
- public void setAuthenticatorAssessor(@Nullable final AuthenticatorCapabilitiesAssessor assessor) {
+ public void setAuthenticatorInspector(@Nullable final AuthenticatorCapabilitiesInspector inspector) {
checkSetterPreconditions();
- authenticatorAssessor = assessor;
+ authenticatorInspector = inspector;
}
/** {@inheritDoc} */
@@ -96,10 +96,10 @@ public class AttachAuthenticatorCapabilities extends AbstractWebAuthnAction<WebA
log.trace("{} Attaching authenticator capabilities", getLogPrefix());
- final AuthenticatorCapabilitiesAssessor localAssessor = authenticatorAssessor;
- if (localAssessor == null) {
- // If no assessor, there is nothing to do
- log.trace("{} No authenticator assessor to apply", getLogPrefix());
+ final AuthenticatorCapabilitiesInspector localInspector = authenticatorInspector;
+ if (localInspector == null) {
+ // If no inspector, there is nothing to do
+ log.trace("{} No authenticator inspector to apply", getLogPrefix());
return;
}
@@ -115,7 +115,7 @@ public class AttachAuthenticatorCapabilities extends AbstractWebAuthnAction<WebA
final ByteArray aaguid = attestedCredData.get().getAaguid();
final AAGUID authenticatorAttestationGUID = new AAGUID(aaguid);
final Map<String, String> capabilities =
- localAssessor.assess(authenticatorAttestationGUID, profileRequestContext);
+ localInspector.inspect(authenticatorAttestationGUID, profileRequestContext);
context.setAuthenticatorCapabilities(capabilities);
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/AbstractAuthenticatorCapabilitiesAssessor.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/AbstractAuthenticatorCapabilitiesInspector.java
similarity index 75%
rename from webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/AbstractAuthenticatorCapabilitiesAssessor.java
rename to webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/AbstractAuthenticatorCapabilitiesInspector.java
index d6e9bce..27c2627 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/AbstractAuthenticatorCapabilitiesAssessor.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/AbstractAuthenticatorCapabilitiesInspector.java
@@ -26,38 +26,38 @@ import org.slf4j.Logger;
import com.yubico.fido.metadata.AAGUID;
import com.yubico.fido.metadata.FidoMetadataService;
-import net.shibboleth.idp.plugin.authn.webauthn.admin.policy.AuthenticatorCapabilitiesAssessor;
+import net.shibboleth.idp.plugin.authn.webauthn.admin.policy.AuthenticatorCapabilitiesInspector;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
- * A base class for {@link AuthenticatorCapabilitiesAssessor authenticator assessors}. Can be enabled and disabled
+ * A base class for {@link AuthenticatorCapabilitiesInspector authenticator inspectors}. Can be enabled and disabled
* by the activiation condition.
*
* <p>Returns a map of authenticator capabilities or properties.</p>
*/
-public abstract class AbstractAuthenticatorCapabilitiesAssessor extends AbstractIdentifiableInitializableComponent
- implements AuthenticatorCapabilitiesAssessor {
+public abstract class AbstractAuthenticatorCapabilitiesInspector extends AbstractIdentifiableInitializableComponent
+ implements AuthenticatorCapabilitiesInspector {
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractAuthenticatorCapabilitiesAssessor.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractAuthenticatorCapabilitiesInspector.class);
/** FIDO metadata service resolver.*/
@Nullable private FidoMetadataService fidoMetadataService;
- /** Does this assessor apply? Default is true. */
+ /** Does this inspector apply? Default is true. */
@Nonnull private BiPredicate<AAGUID, ProfileRequestContext> activationCondition;
/** Constructor.*/
- protected AbstractAuthenticatorCapabilitiesAssessor() {
+ protected AbstractAuthenticatorCapabilitiesInspector() {
//default is always true
activationCondition = (prc,claims) -> true;
}
/**
- * Set an activation condition for this assessor.
+ * Set an activation condition for this inspector.
*
* @param condition condition to set
*/
@@ -67,7 +67,7 @@ public abstract class AbstractAuthenticatorCapabilitiesAssessor extends Abstract
}
/**
- * Set an activation condition for this assessor.
+ * Set an activation condition for this inspector.
*
* @param flag the flag to set
*/
@@ -97,17 +97,17 @@ public abstract class AbstractAuthenticatorCapabilitiesAssessor extends Abstract
/** {@inheritDoc} */
@Override
- public Map<String, String> assess(@Nullable final AAGUID aaguid, @Nullable final ProfileRequestContext prc) {
+ public Map<String, String> inspect(@Nullable final AAGUID aaguid, @Nullable final ProfileRequestContext prc) {
if (!activationCondition.test(aaguid, prc)) {
//not active for this request
- log.trace("AuthenticatorCapabilitiesAssessor '{}' not active for this request", getId());
+ log.trace("AuthenticatorCapabilitiesInspector '{}' not active for this request", getId());
return CollectionSupport.emptyMap();
}
- return doAssess(aaguid, prc);
+ return doInspect(aaguid, prc);
}
/**
- * Execute the assessor. Implementations should override this method.
+ * Execute the inspector. Implementations should override this method.
*
* @param aaguid the authenticator attestation GUID.
* @param prc the profile request context
@@ -115,7 +115,7 @@ public abstract class AbstractAuthenticatorCapabilitiesAssessor extends Abstract
* @return a map of capabilities.
*/
@Nonnull
- protected abstract Map<String, String> doAssess(@Nullable AAGUID aaguid, @Nullable ProfileRequestContext prc);
+ protected abstract Map<String, String> doInspect(@Nullable AAGUID aaguid, @Nullable ProfileRequestContext prc);
}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/ChainingAuthenticatorCapabilitiesAssessor.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/ChainingAuthenticatorCapabilitiesInspector.java
similarity index 55%
rename from webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/ChainingAuthenticatorCapabilitiesAssessor.java
rename to webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/ChainingAuthenticatorCapabilitiesInspector.java
index b7734ec..e5269df 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/ChainingAuthenticatorCapabilitiesAssessor.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/ChainingAuthenticatorCapabilitiesInspector.java
@@ -26,62 +26,63 @@ import org.slf4j.Logger;
import com.yubico.fido.metadata.AAGUID;
-import net.shibboleth.idp.plugin.authn.webauthn.admin.policy.AuthenticatorCapabilitiesAssessor;
+import net.shibboleth.idp.plugin.authn.webauthn.admin.policy.AuthenticatorCapabilitiesInspector;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
- * A {@link AbstractAuthenticatorCapabilitiesAssessor} implementation that is based on a chain of
- * configured assessors. The outcomes from each are aggregated together (last entry for a given key will win).
+ * A {@link AbstractAuthenticatorCapabilitiesInspector} implementation that is based on a chain of
+ * configured inspectors. The outcomes from each are aggregated together (the last entry for a given key will overwrite
+ * the previous entry).
*/
-public class ChainingAuthenticatorCapabilitiesAssessor extends AbstractAuthenticatorCapabilitiesAssessor {
+public class ChainingAuthenticatorCapabilitiesInspector extends AbstractAuthenticatorCapabilitiesInspector {
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(ChainingAuthenticatorCapabilitiesAssessor.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ChainingAuthenticatorCapabilitiesInspector.class);
- /** An ordered chain of authenticator assessors.*/
- private List<AuthenticatorCapabilitiesAssessor> authenticatorAssessorChain;
+ /** An ordered chain of authenticator inspectors.*/
+ private List<AuthenticatorCapabilitiesInspector> authenticatorInspectorChain;
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
- if (authenticatorAssessorChain == null) {
- throw new ComponentInitializationException("List of authenticator assessors can not be null");
+ if (authenticatorInspectorChain == null) {
+ throw new ComponentInitializationException("List of authenticator inspectors can not be null");
}
}
/**
- * Set the chain of assessors that should be used to evaluate the authenticator.
+ * Set the chain of inspectors that should be used to evaluate the authenticator.
*
- * @param chain The authenticator policy chain to set.
+ * @param chain The authenticator inspector chain to set.
*/
- public void setAuthenticatorAssessorChain(@Nullable final List<AuthenticatorCapabilitiesAssessor> chain) {
+ public void setAuthenticatorInspectorChain(@Nullable final List<AuthenticatorCapabilitiesInspector> chain) {
checkSetterPreconditions();
if (chain != null) {
- authenticatorAssessorChain = chain;
+ authenticatorInspectorChain = chain;
} else {
- authenticatorAssessorChain = CollectionSupport.emptyList();
+ authenticatorInspectorChain = CollectionSupport.emptyList();
}
}
/** {@inheritDoc} */
@Override
- protected Map<String,String> doAssess(@Nullable final AAGUID aaguid, @Nullable final ProfileRequestContext prc) {
+ protected Map<String,String> doInspect(@Nullable final AAGUID aaguid, @Nullable final ProfileRequestContext prc) {
final Map<String, String> allOutcomes = new HashMap<>();
- for (final AuthenticatorCapabilitiesAssessor assessor : authenticatorAssessorChain) {
+ for (final AuthenticatorCapabilitiesInspector inspector : authenticatorInspectorChain) {
if (log.isTraceEnabled()) {
- log.trace("Trying AuthenticatorCapabilitiesAssessor '{}' for authenticator '{}'", assessor.getId(),
+ log.trace("Trying AuthenticatorCapabilitiesInspector '{}' for authenticator '{}'", inspector.getId(),
aaguid != null ? aaguid.asGuidString() : "unknown");
}
- final Map<String,String> outcome = assessor.assess(aaguid, prc);
- log.trace("AuthenticatorCapabilitiesAssessor '{}' produced result '{}'", assessor.getId(), outcome);
+ final Map<String,String> outcome = inspector.inspect(aaguid, prc);
+ log.trace("AuthenticatorCapabilitiesInspector '{}' produced result '{}'", inspector.getId(), outcome);
allOutcomes.putAll(outcome);
}
- log.trace("All AuthenticatorCapabilitiesAssessors produced result '{}'", allOutcomes);
+ log.trace("All AuthenticatorCapabilitiesInspector produced result '{}'", allOutcomes);
return CollectionSupport.copyToMap(allOutcomes);
}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/SecondFactorOnlyAuthenticatorAssessor.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/SecondFactorOnlyAuthenticatorInspector.java
similarity index 91%
rename from webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/SecondFactorOnlyAuthenticatorAssessor.java
rename to webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/SecondFactorOnlyAuthenticatorInspector.java
index ae9733d..610a749 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/SecondFactorOnlyAuthenticatorAssessor.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/policy/impl/SecondFactorOnlyAuthenticatorInspector.java
@@ -37,19 +37,19 @@ import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Tag credentials created by authenticators that should only be used for second-factor authentication.
*/
-public class SecondFactorOnlyAuthenticatorAssessor extends AbstractAuthenticatorCapabilitiesAssessor {
+public class SecondFactorOnlyAuthenticatorInspector extends AbstractAuthenticatorCapabilitiesInspector {
/** The name of the capability.*/
@Nonnull @NotEmpty public static final String CAPABILITY_NAME = "2faOnly";
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(SecondFactorOnlyAuthenticatorAssessor.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(SecondFactorOnlyAuthenticatorInspector.class);
/** A set of authenticators that should only be used for second factor authentication, based on their AAGUID.*/
@Nonnull @NotLive @Unmodifiable private Set<AAGUID> secondFactorOnlyAuthenticators;
/** Constructor.*/
- public SecondFactorOnlyAuthenticatorAssessor() {
+ public SecondFactorOnlyAuthenticatorInspector() {
secondFactorOnlyAuthenticators = CollectionSupport.emptySet();
}
@@ -75,7 +75,7 @@ public class SecondFactorOnlyAuthenticatorAssessor extends AbstractAuthenticator
/** {@inheritDoc} */
@Override
- public Map<String, String> doAssess(final AAGUID aaguid, final ProfileRequestContext prc) {
+ public Map<String, String> doInspect(final AAGUID aaguid, final ProfileRequestContext prc) {
final boolean secondFactorOnly = secondFactorOnlyAuthenticators.contains(aaguid);
final HashMap<String,String> capabilities = new HashMap<>();
capabilities.put(CAPABILITY_NAME, secondFactorOnly ? "true" : "false");
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
index a1558b1..3bf9db5 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
@@ -199,20 +199,20 @@
<bean id="AttachAuthenticatorCapabilities" parent="AbstractWebAuthnRegistrationAction" scope="prototype"
class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.AttachAuthenticatorCapabilities"
- p:authenticatorAssessor="#{getObject('%{idp.authn.webauthn.registration.authenticator.assessor:shibboleth.authn.webauthn.registration.ChainedAuthenticatorCapabilitiesAssessor}')}"
- p:activationCondition="%{idp.authn.webauthn.registration.authenticator.assessor.enabled:false}"/>
+ p:authenticatorInspector="#{getObject('%{idp.authn.webauthn.registration.authenticator.inspector:shibboleth.authn.webauthn.registration.ChainedAuthenticatorCapabilitiesInspector}')}"
+ p:activationCondition="%{idp.authn.webauthn.registration.authenticator.inspector.enabled:false}"/>
- <bean id="shibboleth.authn.webauthn.registration.ChainedAuthenticatorCapabilitiesAssessor" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl.ChainingAuthenticatorCapabilitiesAssessor"
- p:authenticatorAssessorChain="#{getObject('%{idp.authn.webauthn.registration.authenticator.assessor.chainedlist:shibboleth.authn.webauthn.registration.ChainedAuthenticatorAssessors}')}"/>
+ <bean id="shibboleth.authn.webauthn.registration.ChainedAuthenticatorCapabilitiesInspector" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl.ChainingAuthenticatorCapabilitiesInspector"
+ p:authenticatorInspectorChain="#{getObject('%{idp.authn.webauthn.registration.authenticator.inspector.chainedlist:shibboleth.authn.webauthn.registration.ChainedAuthenticatorInspectors}')}"/>
- <util:list id="shibboleth.authn.webauthn.registration.ChainedAuthenticatorAssessors">
+ <util:list id="shibboleth.authn.webauthn.registration.ChainedAuthenticatorInspectors">
- <bean id="shibboleth.authn.webauthn.registration.SecondFactorOnlyAssessor" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl.SecondFactorOnlyAuthenticatorAssessor"
- p:secondFactorOnlyAuthenticators="%{idp.authn.webauthn.registration.authenticator.assessor.secondFactorOnlyAuthenticators:null}"
- p:activationCondition="%{idp.authn.webauthn.registration.authenticator.assessor.secondFactorOnlyAssessor.enabled:true}"/>
+ <bean id="shibboleth.authn.webauthn.registration.SecondFactorOnlyInspector" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl.SecondFactorOnlyAuthenticatorInspector"
+ p:secondFactorOnlyAuthenticators="%{idp.authn.webauthn.registration.authenticator.inspector.secondFactorOnlyAuthenticators:null}"
+ p:activationCondition="%{idp.authn.webauthn.registration.authenticator.inspector.secondFactorOnlyInspector.enabled:true}"/>
</util:list>
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
index a2b515e..d08d8ed 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
@@ -97,16 +97,16 @@ idp.authn.webauthn.supportedPrincipals = \
# When the 'authenticator capabilities' policy is enabled, which policy bean should be applied
#idp.authn.webauthn.registration.authenticator.policy.authenticatorCapabilities = shibboleth.authn.webauthn.registration.authenticator.policy.AuthenticatorGetInfoUVCapable
-# Enable the authenticator assessor engine?
-#idp.authn.webauthn.registration.authenticator.assessor.enabled = false
-# Set the authenticator assessors to use, defaults to a chained set of assessors
-#idp.authn.webauthn.registration.authenticator.assessor = shibboleth.authn.webauthn.registration.ChainedAuthenticatorCapabilitiesAssessor
-# When using the chained assessors, give the name of the list of assessors
-#idp.authn.webauthn.registration.authenticator.assessor.chainedlist = shibboleth.authn.webauthn.registration.ChainedAuthenticatorAssessors
-# When using the default chained set of assessors, should we enable the 'second factor only' assessor
-#idp.authn.webauthn.registration.authenticator.assessor.secondFactorOnlyAssessor.enabled = true
-# When using the default chained set of assessors, give a comma seperated list of authenticators (by attestation GUIDs (AAGUID)) to tag as only allowed for second factor authentication
-#idp.authn.webauthn.registration.authenticator.assessor.secondFactorOnlyAuthenticators =
+# Enable the authenticator inspector engine?
+#idp.authn.webauthn.registration.authenticator.inspector.enabled = false
+# Set the authenticator inspectors to use, defaults to a chained set of inspectors
+#idp.authn.webauthn.registration.authenticator.inspector = shibboleth.authn.webauthn.registration.ChainedAuthenticatorCapabilitiesInspector
+# When using the chained inspectors, give the name of the list of inspectors
+#idp.authn.webauthn.registration.authenticator.inspector.chainedlist = shibboleth.authn.webauthn.registration.ChainedAuthenticatorInspectors
+# When using the default chained set of inspectors, should we enable the 'second factor only' inspector
+#idp.authn.webauthn.registration.authenticator.inspector.secondFactorOnlyInspector.enabled = true
+# When using the default chained set of inspectors, give a comma seperated list of authenticators (by attestation GUIDs (AAGUID)) to tag as only allowed for second factor authentication
+#idp.authn.webauthn.registration.authenticator.inspector.secondFactorOnlyAuthenticators =
# Allow inline self-enrolment
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list