Package net.shibboleth.idp.plugin.authn.webauthn.context.logic

Class IsSecondFactor

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.idp.plugin.authn.webauthn.context.logic.IsSecondFactor

All Implemented Interfaces:

Predicate<ProfileRequestContext>, Component, DestructableComponent, InitializableComponent

public class IsSecondFactor
extends AbstractInitializableComponent
implements Predicate<ProfileRequestContext>

A predicate that determines if the authentication flow is being used as a second factor of authentication, and not a first (and possibly only) factor. Returns true if second factor use, or false if passwordless or first factor.

Field Summary

Fields

Modifier and Type	Field	Description
private Set<String>	allowedPreviousFactors	Which previous factors are acceptable to allow a second factor only WebAuthn flow.
private Predicate<ProfileRequestContext>	enabled	Determines if 2FA support should be enabled (true) or disabled (false).
private final org.slf4j.Logger	log	Class logger.
private Predicate<ProfileRequestContext>	secondFactorOverride	If true, set isSecondFactor to true irrespective of the conventional logic.
private Function<ProfileRequestContext,String>	usernameLookupStrategy	Lookup strategy to find if a username has already been collected.

Constructor Summary

Constructors

Constructor	Description
IsSecondFactor()	Constructor.

Method Summary

Modifier and Type	Method	Description
void	setAllowedPreviousFactors(Collection<String> factors)	Set the allowable previous factors.
void	setEnabled(boolean flag)	Set a flag that determines if 2FA support should be enabled (true) or disabled (false).
void	setEnabled(Predicate<ProfileRequestContext> predicate)	Set a predicate that determines if 2FA support should be enabled (true) or disabled (false).
void	setSecondFactorOverride(boolean flag)	Set an override flag that determines if a second factory authentication flow should be assumed.
void	setSecondFactorOverride(Predicate<ProfileRequestContext> override)	Set an override predicate that determines if a second factory authentication flow should be assumed.
void	setUsernameLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the lookup strategy to check if a username has already been collected.
boolean	test(ProfileRequestContext input)

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface java.util.function.Predicate

and, negate, or

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

secondFactorOverride

@Nonnull
private Predicate<ProfileRequestContext> secondFactorOverride

If true, set isSecondFactor to true irrespective of the conventional logic.

enabled

@Nonnull
private Predicate<ProfileRequestContext> enabled

Determines if 2FA support should be enabled (true) or disabled (false). If enabled, the request is checked for 2FA suitability as normal.

usernameLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> usernameLookupStrategy

Lookup strategy to find if a username has already been collected.

allowedPreviousFactors

@Nonnull
@NonnullElements
private Set<String> allowedPreviousFactors

Which previous factors are acceptable to allow a second factor only WebAuthn flow.

Constructor Details

IsSecondFactor

public IsSecondFactor()

Constructor.

Method Details

setUsernameLookupStrategy

public void setUsernameLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set the lookup strategy to check if a username has already been collected.

Parameters:

strategy - lookup strategy

setEnabled

public void setEnabled(@Nonnull
 Predicate<ProfileRequestContext> predicate)

Set a predicate that determines if 2FA support should be enabled (true) or disabled (false). If enabled, the predicate is allowed to check 2FA suitability.

Parameters:

predicate - the predicate

setEnabled

public void setEnabled(boolean flag)

Set a flag that determines if 2FA support should be enabled (true) or disabled (false). If enabled, the predicate is allowed to check 2FA suitability.

Parameters:

flag - the flag to set

setSecondFactorOverride

public void setSecondFactorOverride(@Nonnull
 Predicate<ProfileRequestContext> override)

Set an override predicate that determines if a second factory authentication flow should be assumed. Ignoring the conventional logic of this predicate.

Parameters:

override - the override predicate

setSecondFactorOverride

public void setSecondFactorOverride(boolean flag)

Set an override flag that determines if a second factory authentication flow should be assumed. Ignoring the conventional logic of this predicate.

Parameters:

flag - the flag to set

setAllowedPreviousFactors

public void setAllowedPreviousFactors(@Nullable @NonnullElements
 Collection<String> factors)

Set the allowable previous factors.

Parameters:

factors - the factors to allow

test

public boolean test(@Nullable
 ProfileRequestContext input)

Specified by:

test in interface Predicate<ProfileRequestContext>