[java-idp-plugin-webauthn] 02/02: JWEBAUTHN-26 - Allow metadata to be attached to registrations retroactively

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=c1744df7d1c586a7f03617c09986a95250c461b3

commit c1744df7d1c586a7f03617c09986a95250c461b3
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Sep 9 13:42:01 2024 +0100

    JWEBAUTHN-26 - Allow metadata to be attached to registrations
    retroactively
    
     - Add AAGUID to the credential storage record
    
    https://shibboleth.atlassian.net/browse/JWEBAUTHN-26
---
 .../logic/IsAdminUsernameCollectionEnabled.java    |  2 +-
 .../webauthn/storage/CredentialRegistration.java   | 37 ++++++++++++++++++++--
 .../admin/impl/StorePublicKeyCredential.java       |  4 ++-
 3 files changed, 39 insertions(+), 4 deletions(-)

diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsAdminUsernameCollectionEnabled.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsAdminUsernameCollectionEnabled.java
index 88e6281..7dbeed5 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsAdminUsernameCollectionEnabled.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/logic/IsAdminUsernameCollectionEnabled.java
@@ -35,7 +35,7 @@ public class IsAdminUsernameCollectionEnabled extends AbstractIdentifiableInitia
                     implements Predicate<ProfileRequestContext>  {
     
     /** Class logger. */
-    @Nonnull private final Logger log = LoggerFactory.getLogger(IsDiscoverableCredentialRequired.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(IsAdminUsernameCollectionEnabled.class);
     
     /** The predicate that determines if username collection is required.*/
     private Predicate<ProfileRequestContext> usernameCollectionRequiredPredicate;
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/CredentialRegistration.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/CredentialRegistration.java
index c30698d..94bbc5b 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/CredentialRegistration.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/CredentialRegistration.java
@@ -75,6 +75,9 @@ public final class CredentialRegistration {
 
     /** Optional attestation metadata about the authenticator. Will be an empty set if not used. */
     @Nonnull @Unmodifiable @NonnullElements private final Set<MetadataBLOBPayloadEntry> attestationMetadata;
+    
+    /** The AAGUID of the authenticator.*/
+    @Nullable private final byte[] aaguid;
 
     /** Was the user verified during registration. */
     private final boolean userVerified;
@@ -94,6 +97,7 @@ public final class CredentialRegistration {
         this.discoverable = builder.discoverable;
         this.attestationMetadata = builder.attestationMetadata;
         this.userVerified = builder.userVerified;
+        this.aaguid = builder.aaguid;
 
     }
 
@@ -191,6 +195,17 @@ public final class CredentialRegistration {
         
     }
     
+    /**
+     * Get the AAGUID of the authenticator that created this credential. This is optional, for example if attestation
+     * is not requested.
+     * 
+     * @return the aaguid
+     */
+    @JsonGetter("aaguid")
+    @Nullable public byte[] getAaguid() {
+        return aaguid;
+    }
+    
     /**
      * Get the credential ID as a base64URL encoded string.
      * 
@@ -303,6 +318,7 @@ public final class CredentialRegistration {
                 // The credential here is the new one
                 .withCredential(newRegisteredCred)
                 .withAttestationMetadata(attestationMetadata)
+                .withAaguid(aaguid)
                 .withCredentialNickname(credentialNickname)
                 .withDiscoverable(discoverable)
                 .withUserVerified(userVerified).build();
@@ -360,7 +376,7 @@ public final class CredentialRegistration {
         @Nonnull public IBuildStage withCredential(@Nonnull final RegisteredCredential credential);
     }
 
-    /** Builder stage.*/
+    /** Optional builder stage.*/
     public interface IBuildStage {
         /**
          * Set an optional nickname of the credential.
@@ -394,6 +410,14 @@ public final class CredentialRegistration {
          * @return the next builder stage
          */
         @Nonnull public IBuildStage withUserVerified(boolean userVerified);
+        
+        /**
+         * Set the AAGUID of the authenticator that created this credential.
+         * 
+         * @param aaguid the AAGUID of the authenticator
+         * @return the next builder stage
+         */
+        @Nonnull public IBuildStage withAaguid(byte[] aaguid);
 
         /**
          * Build this credential registration.
@@ -421,7 +445,9 @@ public final class CredentialRegistration {
         /** Attestation metadata.*/
         @Nonnull private Set<MetadataBLOBPayloadEntry> attestationMetadata;
         /** has the user been verified.*/
-        private boolean userVerified;
+        private boolean userVerified;        
+        /** The AAGUID of the authenticator.*/
+        @Nullable private byte[] aaguid;
 
         /** Constructor.*/
         @SuppressWarnings("null")
@@ -499,6 +525,13 @@ public final class CredentialRegistration {
         @Nonnull public CredentialRegistration build() {
             return new CredentialRegistration(this);
         }
+
+        @Override
+        @JsonProperty("aaguid")
+        public IBuildStage withAaguid(final byte[] authenticatorGuid) {
+            aaguid = authenticatorGuid;
+            return this;
+        }
     }
 
 }
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/StorePublicKeyCredential.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/StorePublicKeyCredential.java
index 39be089..cfcfbb6 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/StorePublicKeyCredential.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/StorePublicKeyCredential.java
@@ -130,12 +130,14 @@ public class StorePublicKeyCredential extends AbstractWebAuthnAuditingAction<Web
             final Instant now = Instant.now();
             assert now != null;
             final  Optional<Boolean> isDiscoverable = registrationResult.isDiscoverable();
-            
+            final ByteArray aaguid = registrationResult.getAaguid();
+                        
             final CredentialRegistration registration = CredentialRegistration.builder()
                     .withUserIdentity(user)
                     .withTransports(registrationResult.getKeyId().getTransports().orElse(new TreeSet<>()))
                     .withRegistrationTime(now)
                     .withCredential(credential)
+                    .withAaguid(aaguid != null ? aaguid.getBytes() : null)
                     .withAttestationMetadata(getAttestationMetadata(registrationResult.getAaguid()))
                     .withCredentialNickname(context.getCredentialNickname())
                     .withDiscoverable(isDiscoverable)

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.