[java-idp-plugin-webauthn] branch main updated: Add UV flag to assertion result and log it

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=2b1564516d145045ba7765ab51034b287b075436

The following commit(s) were added to refs/heads/main by this push:
     new 2b15645  Add UV flag to assertion result and log it
2b15645 is described below

commit 2b1564516d145045ba7765ab51034b287b075436
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Sep 3 12:22:28 2024 +0100

    Add UV flag to assertion result and log it
---
 .../authn/webauthn/authn/AssertionResult.java      | 48 +++++++++++++++++++---
 .../impl/YubicoWebAuthnAuthenticationClient.java   |  1 +
 .../webauthn/impl/ValidateWebAuthnAssertion.java   |  3 +-
 3 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/AssertionResult.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/AssertionResult.java
index 8e27b22..bbf221d 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/AssertionResult.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/AssertionResult.java
@@ -33,6 +33,9 @@ public final class AssertionResult {
     /** The username of the user this result corresponds to.*/
     @Nonnull @NotEmpty private final String username;
     
+    /** Was the user verified by the authenticator during authentication? */
+    private final boolean userVerified;
+    
     /** Is the signature count valid?*/
     private final boolean signatureCounterValid;
     
@@ -50,6 +53,7 @@ public final class AssertionResult {
         this.username = builder.username;
         this.signatureCounterValid = builder.signatureCounterValid;
         this.userId = builder.userId;
+        this.userVerified = builder.userVerified;
     }
     
     /**
@@ -75,7 +79,7 @@ public final class AssertionResult {
     /**
      * Is the signature counter valid?
      * 
-     * @return  true if valid, false otherwise.
+     * @return true if valid, false otherwise.
      */
     public final boolean isSignatureCounterValid() {
         return signatureCounterValid;
@@ -84,11 +88,20 @@ public final class AssertionResult {
     /**
      * Get the user.id of the authenticated user.
      * 
-     * @return Returns the userId.
+     * @return the userId.
      */
     @Nonnull public byte[] getUserId() {
         return userId;
     }
+    
+    /**
+     * Was the user verified by the authenticator during authentication?
+     * 
+     * @return true if the user was verified, false otherwise.
+     */
+    public boolean isUserVerified() {
+        return userVerified;
+    }
 
 
     /**
@@ -150,7 +163,20 @@ public final class AssertionResult {
          * @param userId the user.id
          * @return the next stage
          */
-        public IBuildStage withUserId(byte[] userId);
+        public IUserVerifiedStage withUserId(byte[] userId);
+    }
+    
+    /**
+     * Builder stage.
+     */
+    public interface IUserVerifiedStage {
+        /**
+         * Set the userVerified flag
+         * 
+         * @param uv the user verified flag
+         * @return the next stage
+         */
+        public IBuildStage withUserId(boolean uv);
     }
 
     /**
@@ -169,7 +195,8 @@ public final class AssertionResult {
      * The {@link AssertionResult} builder.
      */
     public static final class Builder
-            implements ISuccessStage, IUsernameStage, ISignatureCounterValidStage, IUserIdStage, IBuildStage {
+            implements ISuccessStage, IUsernameStage, ISignatureCounterValidStage, IUserIdStage, IUserVerifiedStage,
+                IBuildStage {
         
         /** Is this assertion valid?*/
         private boolean success;
@@ -182,6 +209,9 @@ public final class AssertionResult {
         
         /** The user.id.*/
         private byte[] userId;
+        
+        /** Was the user verified by the authenticator during authentication? */
+        private boolean userVerified;
 
         /** Constructor.*/
         private Builder() {
@@ -206,15 +236,23 @@ public final class AssertionResult {
         }
 
         @Override
-        public IBuildStage withUserId(final byte[] id) {
+        public IUserVerifiedStage withUserId(final byte[] id) {
             userId = id;
             return this;
         }
+        
+        /** {@inheritDoc} */
+        @Override
+        public IBuildStage withUserId(final boolean uv) {
+            userVerified = uv;
+            return this;
+        }
 
         @Override
         public AssertionResult build() {
             return new AssertionResult(this);
         }
+       
     }
 
 }
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebAuthnAuthenticationClient.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebAuthnAuthenticationClient.java
index 650eb33..df5832d 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebAuthnAuthenticationClient.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebAuthnAuthenticationClient.java
@@ -188,6 +188,7 @@ public class YubicoWebAuthnAuthenticationClient implements WebAuthnAuthenticatio
                     .withUsername(result.getUsername())
                     .withSignatureCounterValid(result.isSignatureCounterValid())
                     .withUserId(result.getCredential().getUserHandle().getBytes())
+                    .withUserId(result.isUserVerified())
                     .build();
             assert assertionResult != null;
             return assertionResult;
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
index c8df92a..8bee559 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
@@ -202,7 +202,8 @@ public class ValidateWebAuthnAssertion extends AbstractAuditingValidationAction
                 updateSignatureCount(result.getUsername(), assertion);
             }
             
-            log.info("{} WebAuthn authentication succeeded for '{}'",getLogPrefix(),result.getUsername());
+            log.info("{} WebAuthn authentication succeeded for '{}', authenticator verified the user '{}'",getLogPrefix(),
+                    result.getUsername(), result.isUserVerified());
             // Add the username and user.id that matched the credential from the result back to the context. 
             // The result is authorative.
             context.setUsername(result.getUsername());

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.