Package net.shibboleth.idp.plugin.authn.webauthn.client

Interface WebAuthnAuthenticationClient

All Known Implementing Classes:

YubicoWebAuthnAuthenticationClient

@ThreadSafe
public interface WebAuthnAuthenticationClient

A client that manages WebAuthn authentication and registration ceremonies.

Uses the Yubico library data model. Clients will need to be adapted to and support this model, if required providing translations between their internal representation and the Yubico types.

Implementations must be thread-safe

Method Summary

Modifier and Type	Method	Description
com.yubico.webauthn.data.PublicKeyCredentialRequestOptions	createAuthenticationRequest(CredentialRequestOptionsParameters requestParams)	Create a PublicKeyCredentialRequestOptions for the WebAuthn 'get' call to generate an authentication assertion.
com.yubico.webauthn.data.PublicKeyCredentialCreationOptions	createRegistrationRequest(CredentialCreationOptionsParameters creationOptions)	Create a PublicKeyCredentialCreationOptions for the WebAuthn 'create' call to generate a new registration attestation.
AssertionResult	validateAuthenticatorAssertionResponse(String username, byte[] userId, com.yubico.webauthn.data.PublicKeyCredentialRequestOptions publicKeyCredentialRequestOptions, com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> publicKeyCredentialAssertionResponse)	Validate the PublicKeyCredential authenticator assertion response from an authentication request.
RegistrationResult	validateAuthenticatorAttestationResponse(com.yubico.webauthn.data.PublicKeyCredentialCreationOptions publicKeyCredentialCreationOptions, com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAttestationResponse,com.yubico.webauthn.data.ClientRegistrationExtensionOutputs> publicKeyCredentialAttestationResponse)	Validate the PublicKeyCredential authenticator attestation response from a registration request.

Method Details

createAuthenticationRequest

@Nonnull
com.yubico.webauthn.data.PublicKeyCredentialRequestOptions createAuthenticationRequest(@Nonnull
 CredentialRequestOptionsParameters requestParams)
                                                                                throws WebAuthnAuthenticationClientException

Create a PublicKeyCredentialRequestOptions for the WebAuthn 'get' call to generate an authentication assertion.

Parameters:

requestParams - the options that should be present in the authentication request.

Returns:

a PublicKeyCredentialRequestOptions object to supply to the WebAuthn 'get' call

Throws:

WebAuthnAuthenticationClientException - if there is an error generating the authentication request

createRegistrationRequest

@Nonnull
com.yubico.webauthn.data.PublicKeyCredentialCreationOptions createRegistrationRequest(@Nonnull
 CredentialCreationOptionsParameters creationOptions)
                                                                               throws WebAuthnAuthenticationClientException

Create a PublicKeyCredentialCreationOptions for the WebAuthn 'create' call to generate a new registration attestation.

Parameters:

creationOptions - the options that should be present in the registration request.

Returns:

a PublicKeyCredentialCreationOptions object to supply the WebAuthn 'create' call

Throws:

WebAuthnAuthenticationClientException - if there is an error generating the creation request

validateAuthenticatorAssertionResponse

@Nonnull
AssertionResult validateAuthenticatorAssertionResponse(@Nullable
 String username,
 @Nullable
 byte[] userId,
 @Nonnull
 com.yubico.webauthn.data.PublicKeyCredentialRequestOptions publicKeyCredentialRequestOptions,
 @Nonnull
 com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> publicKeyCredentialAssertionResponse)
                                                throws AssertionFailureException

Validate the PublicKeyCredential authenticator assertion response from an authentication request.

Parameters:

username - the username of the users account on the IdP. Should map one-to-one with the user.id.

userId - the user.id of the users account on the IdP. Should match the userHandle in the assertion response

publicKeyCredentialRequestOptions - the options used when generating an assertion for authentication.

publicKeyCredentialAssertionResponse - the assertion response.

Returns:

an assertion result iff the assertion was valid.

Throws:

AssertionFailureException - if the assertion is not valid

validateAuthenticatorAttestationResponse

@Nonnull
RegistrationResult validateAuthenticatorAttestationResponse(@Nonnull
 com.yubico.webauthn.data.PublicKeyCredentialCreationOptions publicKeyCredentialCreationOptions,
 @Nonnull
 com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAttestationResponse,com.yubico.webauthn.data.ClientRegistrationExtensionOutputs> publicKeyCredentialAttestationResponse)
                                                     throws RegistrationFailureException

Validate the PublicKeyCredential authenticator attestation response from a registration request.

Parameters:

publicKeyCredentialCreationOptions - the options used when requesting a new public key credential

publicKeyCredentialAttestationResponse - the response to the client's request to create a public key credential

Returns:

a registration result iff the registration was valid

Throws:

RegistrationFailureException - if the registration is invalid.