Package net.shibboleth.idp.plugin.authn.webauthn.client.impl

Class YubicoWebAuthnAuthenticationClient

java.lang.Object

net.shibboleth.idp.plugin.authn.webauthn.client.impl.YubicoWebAuthnAuthenticationClient

All Implemented Interfaces:

WebAuthnAuthenticationClient

@ThreadSafe
public class YubicoWebAuthnAuthenticationClient
extends Object
implements WebAuthnAuthenticationClient

Yubico implementation of a WebAuthnAuthenticationClient.

Thread-safe, only a single instance is required.

Field Summary

Fields

Modifier and Type	Field	Description
private final org.slf4j.Logger	log	Class logger.
private final List<com.yubico.webauthn.data.PublicKeyCredentialParameters>	preferredPublickeyParams	List of acceptable public key algorithms.
private final com.yubico.webauthn.RelyingParty	rp	Information pertaining to the relying party.

Constructor Summary

Constructors

Constructor	Description
YubicoWebAuthnAuthenticationClient(com.yubico.webauthn.RelyingParty relyingParty, List<com.yubico.webauthn.data.PublicKeyCredentialParameters> publickeyParams)	Package-private Constructor.

Method Summary

Modifier and Type	Method	Description
com.yubico.webauthn.data.PublicKeyCredentialRequestOptions	createAuthenticationRequest(CredentialRequestOptionsParameters requestParams)	Create a PublicKeyCredentialRequestOptions for the WebAuthn 'get' call to generate an authentication assertion.
com.yubico.webauthn.data.PublicKeyCredentialCreationOptions	createRegistrationRequest(CredentialCreationOptionsParameters creationOptions)	Create a PublicKeyCredentialCreationOptions for the WebAuthn 'create' call to generate a new registration attestation.
AssertionResult	validateAuthenticatorAssertionResponse(String username, byte[] userId, com.yubico.webauthn.data.PublicKeyCredentialRequestOptions publicKeyCredentialRequestOptions, com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> authenticatorAssertionResponse)	Validate the PublicKeyCredential authenticator assertion response from an authentication request.
RegistrationResult	validateAuthenticatorAttestationResponse(com.yubico.webauthn.data.PublicKeyCredentialCreationOptions publicKeyCredentialCreationOptions, com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAttestationResponse,com.yubico.webauthn.data.ClientRegistrationExtensionOutputs> authenticatorAttestationResponse)	Validate the PublicKeyCredential authenticator attestation response from a registration request.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

rp

@Nonnull
private final com.yubico.webauthn.RelyingParty rp

Information pertaining to the relying party.

preferredPublickeyParams

@Nonnull
@NonnullElements
@NotLive
private final List<com.yubico.webauthn.data.PublicKeyCredentialParameters> preferredPublickeyParams

List of acceptable public key algorithms.

Constructor Details

YubicoWebAuthnAuthenticationClient

YubicoWebAuthnAuthenticationClient(@Nonnull
 com.yubico.webauthn.RelyingParty relyingParty,
 @Nonnull @NonnullElements @NotLive
 List<com.yubico.webauthn.data.PublicKeyCredentialParameters> publickeyParams)

Package-private Constructor.

Should only be instantiated by the YubicoWebauthnClientFactory.

Parameters:

relyingParty - information pertaining to the relying party.

publickeyParams - list of preferred public key credential parameters to send to the authenticator during registration.

Method Details

createAuthenticationRequest

public com.yubico.webauthn.data.PublicKeyCredentialRequestOptions createAuthenticationRequest(@Nonnull
 CredentialRequestOptionsParameters requestParams)
                                                                                       throws WebAuthnAuthenticationClientException

Description copied from interface: WebAuthnAuthenticationClient

Create a PublicKeyCredentialRequestOptions for the WebAuthn 'get' call to generate an authentication assertion.

Specified by:

createAuthenticationRequest in interface WebAuthnAuthenticationClient

Parameters:

requestParams - the options that should be present in the authentication request.

Returns:

a PublicKeyCredentialRequestOptions object to supply to the WebAuthn 'get' call

Throws:

WebAuthnAuthenticationClientException - if there is an error generating the authentication request

createRegistrationRequest

public com.yubico.webauthn.data.PublicKeyCredentialCreationOptions createRegistrationRequest(@Nonnull
 CredentialCreationOptionsParameters creationOptions)
                                                                                      throws WebAuthnAuthenticationClientException

Create a PublicKeyCredentialCreationOptions for the WebAuthn 'create' call to generate a new registration attestation.

Specified by:

createRegistrationRequest in interface WebAuthnAuthenticationClient

Parameters:

creationOptions - the options that should be present in the registration request.

Returns:

a PublicKeyCredentialCreationOptions object to supply the WebAuthn 'create' call

Throws:

WebAuthnAuthenticationClientException - if there is an error generating the creation request

validateAuthenticatorAssertionResponse

public AssertionResult validateAuthenticatorAssertionResponse(@Nullable
 String username,
 @Nullable
 byte[] userId,
 @Nonnull
 com.yubico.webauthn.data.PublicKeyCredentialRequestOptions publicKeyCredentialRequestOptions,
 @Nonnull
 com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> authenticatorAssertionResponse)
                                                       throws AssertionFailureException

Description copied from interface: WebAuthnAuthenticationClient

Validate the PublicKeyCredential authenticator assertion response from an authentication request.

Specified by:

validateAuthenticatorAssertionResponse in interface WebAuthnAuthenticationClient

Parameters:

username - the username of the users account on the IdP. Should map one-to-one with the user.id.

userId - the user.id of the users account on the IdP. Should match the userHandle in the assertion response

publicKeyCredentialRequestOptions - the options used when generating an assertion for authentication.

authenticatorAssertionResponse - the assertion response.

Returns:

an assertion result iff the assertion was valid.

Throws:

AssertionFailureException - if the assertion is not valid

validateAuthenticatorAttestationResponse

public RegistrationResult validateAuthenticatorAttestationResponse(@Nonnull
 com.yubico.webauthn.data.PublicKeyCredentialCreationOptions publicKeyCredentialCreationOptions,
 @Nonnull
 com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAttestationResponse,com.yubico.webauthn.data.ClientRegistrationExtensionOutputs> authenticatorAttestationResponse)
                                                            throws RegistrationFailureException

Validate the PublicKeyCredential authenticator attestation response from a registration request.

Specified by:

validateAuthenticatorAttestationResponse in interface WebAuthnAuthenticationClient

Parameters:

publicKeyCredentialCreationOptions - the options used when requesting a new public key credential

authenticatorAttestationResponse - the response to the client's request to create a public key credential

Returns:

a registration result iff the registration was valid

Throws:

RegistrationFailureException - if the registration is invalid.