[java-idp-plugin-webauthn] branch main updated: JWEBAUTHN-55 - Trigger for notification when a webauthn credential is added/removed from an account
Phil Smart
philip.smart at jisc.ac.uk
Fri May 16 13:26:36 UTC 2025
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=d20659d7f3d679a6c4dd708b0ecc34bdf00ca66d
The following commit(s) were added to refs/heads/main by this push:
new d20659d JWEBAUTHN-55 - Trigger for notification when a webauthn credential is added/removed from an account
d20659d is described below
commit d20659d7f3d679a6c4dd708b0ecc34bdf00ca66d
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri May 16 14:26:34 2025 +0100
JWEBAUTHN-55 - Trigger for notification when a webauthn credential is
added/removed from an account
- Add BiConsumer hooks to the success and failure audit event.
https://shibboleth.atlassian.net/browse/JWEBAUTHN-55
---
.../audit/impl/AbstractWebAuthnAuditingAction.java | 46 +++++++++++++++++++++-
.../webauthn-registration-beans.xml | 12 ++++--
2 files changed, 53 insertions(+), 5 deletions(-)
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/audit/impl/AbstractWebAuthnAuditingAction.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/audit/impl/AbstractWebAuthnAuditingAction.java
index 3b8572e..fbf20c4 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/audit/impl/AbstractWebAuthnAuditingAction.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/audit/impl/AbstractWebAuthnAuditingAction.java
@@ -15,6 +15,7 @@
package net.shibboleth.idp.plugin.authn.webauthn.audit.impl;
import java.util.Map;
+import java.util.function.BiConsumer;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -55,6 +56,12 @@ public abstract class AbstractWebAuthnAuditingAction<T> extends AbstractWebAuthn
/** The Spring RequestContext to operate on. */
@Nullable private RequestContext requestContext;
+ /** A hook to be executed during a success audit even.*/
+ @Nonnull private BiConsumer<ProfileRequestContext, String> onSuccessAuditHook;
+
+ /** A hook to be executed during a failure audit even.*/
+ @Nonnull private BiConsumer<ProfileRequestContext, String> onFailureAuditHook;
+
/**
*
* Constructor.
@@ -66,6 +73,9 @@ public abstract class AbstractWebAuthnAuditingAction<T> extends AbstractWebAuthn
auditContextCreationStrategy =
new ChildContextLookup<>(AuditContext.class, true).compose(
new ChildContextLookup<>(AuthenticationContext.class));
+ // By default the hooks do nothing
+ onSuccessAuditHook = (prc, event) -> {};
+ onFailureAuditHook = (prc, event) -> {};
}
/**
@@ -110,6 +120,34 @@ public abstract class AbstractWebAuthnAuditingAction<T> extends AbstractWebAuthn
return auditContextCreationStrategy.apply(profileRequestContext);
}
+ /**
+ * Set a hook to run on a failure audit event.
+ *
+ * @param hook the hook to set.
+ *
+ * @since 1.3.0
+ */
+ public void setOnFailureAuditHook(@Nullable final BiConsumer<ProfileRequestContext, String> hook) {
+ checkSetterPreconditions();
+ if (hook != null) {
+ onFailureAuditHook = hook;
+ }
+ }
+
+ /**
+ * Set a hook to run on a success audit event.
+ *
+ * @param hook the hook to set.
+ *
+ * @since 1.3.0
+ */
+ public void setOnSuccessAuditHook(@Nullable final BiConsumer<ProfileRequestContext, String> hook) {
+ checkSetterPreconditions();
+ if (hook != null) {
+ onSuccessAuditHook = hook;
+ }
+ }
+
/** {@inheritDoc} */
@Override
protected Event doExecute(@Nonnull final RequestContext springRequestContext,
@@ -120,24 +158,28 @@ public abstract class AbstractWebAuthnAuditingAction<T> extends AbstractWebAuthn
}
/**
- * Audit a successful operation. This will automatically add a 'success' field to the audit context.
+ * Audit a successful operation. This will automatically add a 'success' field to the audit context. The
+ * {@link #onSuccessAuditHook} is run before audit logging.
*
* @param profileRequestContext the profile request context
* @param action a descriptive string of the action that was performed. Can be {@code null} if not used.
*/
protected void auditSuccess(@Nonnull final ProfileRequestContext profileRequestContext,
@Nullable final String action) {
+ onSuccessAuditHook.accept(profileRequestContext, action);
doAudit(profileRequestContext, true, action);
}
/**
- * Audit a failed operation. This will automatically add a 'failure' field to the audit context.
+ * Audit a failed operation. This will automatically add a 'failure' field to the audit context. The
+ * {@link #onFailureAuditHook} is run before audit logging.
*
* @param profileRequestContext the profile request context
* @param action a descriptive string of the action that was performed. Can be {@code null} if not used.
*/
protected void auditFailure(@Nonnull final ProfileRequestContext profileRequestContext,
@Nullable final String action) {
+ onFailureAuditHook.accept(profileRequestContext, action);
doAudit(profileRequestContext, false, action);
}
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
index 3a39e08..4567546 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
@@ -208,13 +208,17 @@
class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.UpdateCredentialNickname"
p:populateAuditContextAction="#{%{idp.authn.webauthn.registration.audit.enabled:false} ? getObject('RegistrationOperationPopulateAuditContext') : null}"
p:writeAuditLogAction="#{%{idp.authn.webauthn.registration.audit.enabled:false} ? getObject('WriteAdminAuditLog') : null}"
- p:auditContextCreationStrategy-ref="AdminAuditContextLookup"/>
+ p:auditContextCreationStrategy-ref="AdminAuditContextLookup"
+ p:onSuccessAuditHook="#{getObject('shibboleth.authn.WebAuthn.audit.UpdateCredentialNicknameAuditSuccessHook') ?: getObject('shibboleth.authn.WebAuthn.audit.UpdateCredentialNicknameAuditSuccessHook')}"
+ p:onFailureAuditHook="#{getObject('shibboleth.authn.WebAuthn.audit.UpdateCredentialNicknameAuditFailureHook') ?: getObject('shibboleth.authn.WebAuthn.audit.UpdateCredentialNicknameAuditFailureHook')}"/>
<bean id="DeletePublicKeyCredential" parent="AbstractWebAuthnRegistrationAction" scope="prototype"
class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.DeletePublicKeyCredential"
p:populateAuditContextAction="#{%{idp.authn.webauthn.registration.audit.enabled:false} ? getObject('RegistrationOperationPopulateAuditContext') : null}"
p:writeAuditLogAction="#{%{idp.authn.webauthn.registration.audit.enabled:false} ? getObject('WriteAdminAuditLog') : null}"
- p:auditContextCreationStrategy-ref="AdminAuditContextLookup" />
+ p:auditContextCreationStrategy-ref="AdminAuditContextLookup"
+ p:onSuccessAuditHook="#{getObject('shibboleth.authn.WebAuthn.audit.DeleteKeyAuditSuccessHook') ?: getObject('shibboleth.authn.WebAuthn.audit.DeleteKeyAuditSuccessHook')}"
+ p:onFailureAuditHook="#{getObject('shibboleth.authn.WebAuthn.audit.DeleteKeyAuditFailureHook') ?: getObject('shibboleth.authn.WebAuthn.audit.DeleteKeyAuditFailureHook')}"/>
<bean id="CheckRegistrationPolicy" parent="AbstractWebAuthnRegistrationAction" scope="prototype"
class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.CheckRegistrationPolicy"
@@ -233,7 +237,9 @@
p:credentialRepository="#{getObject('shibboleth.authn.WebAuthn.CredentialRepository') ?: getObject('shibboleth.authn.WebAuthn.DefaultCredentialRepository')}"
p:populateAuditContextAction="#{%{idp.authn.webauthn.registration.audit.enabled:false} ? getObject('RegistrationOperationPopulateAuditContext') : null}"
p:writeAuditLogAction="#{%{idp.authn.webauthn.registration.audit.enabled:false} ? getObject('WriteAdminAuditLog') : null}"
- p:auditContextCreationStrategy-ref="AdminAuditContextLookup" />
+ p:auditContextCreationStrategy-ref="AdminAuditContextLookup"
+ p:onSuccessAuditHook="#{getObject('shibboleth.authn.WebAuthn.audit.AddKeyAuditSuccessHook') ?: getObject('shibboleth.authn.WebAuthn.audit.AddKeyAuditSuccessHook')}"
+ p:onFailureAuditHook="#{getObject('shibboleth.authn.WebAuthn.audit.AddKeyAuditFailureHook') ?: getObject('shibboleth.authn.WebAuthn.audit.AddKeyAuditFailureHook')}"/>
<bean id="InlineEnrolmentRedirectFunction" class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.InlineEnrolmentRedirectFunction"/>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list