Package net.shibboleth.idp.plugin.authn.webauthn.impl

Class AbstractWebAuthnAction<T>

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction<T>
Type Parameters:
T - the WebAuthn context type
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
Direct Known Subclasses:
AbstractWebAuthnAuditingAction, AddAttestationConveyancePreference, AddAuthenticatorAttachmentRequirement, AddDisplayName, AddResidentKeyRequirement, AddUserId, AddUserName, AddUserVerificationRequirement, CheckCredentialPolicy, CheckRegistrationPolicy, CreatePublicKeyCredentialCreationOptions, CreatePublicKeyCredentialRequestOptions, EnsureAllowedCredentialsIsEmpty, ExtractPublicKeyCredentialAssertionFromFormRequest, ExtractPublicKeyCredentialAttestationFromFormRequest, ExtractUsernameSearchFromFormRequest, GenerateServerChallenge, InitializeAdminSubjectCanonicalizationContext, InitializeSubjectCanonicalizationContext, LookupCredentialsForUser, LookupRegisteredCredentials, LookupRegisteredCredentialsFromUserHandle, UpdateAdminContextWithC14nPrincipal, UpdateWebAuthnContextWithC14nPrincipal, ValidateAuthenticatorAttestationResponse
public class AbstractWebAuthnAction<T> extends AbstractProfileAction

A base class for WebAuthn actions. Makes available the WebAuthn client, credential repository, and metadata service

In addition to the work performed by AbstractProfileAction, this action also looks up and makes available a WebAuthn context.

WebAuthn implementations should override the doExecute(ProfileRequestContext, T) method.

Event:
EventIds.INVALID_PROFILE_CTX
Precondition:
ProfileRequestContext.getSubcontext(ProfileRequestContext.class) != null

  • Field Details

    • log

      @Nonnull @NotEmpty private final org.slf4j.Logger log
      Class logger.

    • webauthnContextLookupStrategy

      @Nonnull private Function<ProfileRequestContext,T> webauthnContextLookupStrategy
      Lookup strategy to locate the WebAuthn context.

    • webauthnContext

      @NonnullBeforeExec private T webauthnContext
      The WebAuthn Context.

    • webAuthnClient

      @NonnullAfterInit private WebAuthnAuthenticationClient webAuthnClient
      The WebAuthn client to use.

    • credentialRepository

      @Nullable private WebAuthnCredentialRepository credentialRepository
      The credential repository to store valid credentials in.

    • fidoMetadataService

      @Nullable private com.yubico.fido.metadata.FidoMetadataService fidoMetadataService
      Optional FIDO metadata service resolver.

    • aaguidService

      @Nullable private PasskeyAaguidMetadataService aaguidService
      Supplementary description and icon information for passkey providers not in the MDS feed (mostly software providers). Enhances the UI.

  • Constructor Details

    • AbstractWebAuthnAction

      protected AbstractWebAuthnAction(@Nonnull Function<ProfileRequestContext,T> defaultStrategy)
      Constructor.
      Parameters:
      defaultStrategy - the default WebAuthn context lookup strategy to use

  • Method Details

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractInitializableComponent
      Throws:
      ComponentInitializationException

    • setWebAuthnClient

      public void setWebAuthnClient(@Nonnull WebAuthnAuthenticationClient client)
      Set the WebAuthn client used to handle registration and authentication ceremonies.
      Parameters:
      client - The WebAuthn client to set.

    • getWebAuthnClient

      @NonnullAfterInit protected WebAuthnAuthenticationClient getWebAuthnClient()
      Get the WebAuthn client used to handle registration and authentication ceremonies.
      Returns:
      the WebAuthn client.

    • setAaguidService

      public void setAaguidService(@Nullable PasskeyAaguidMetadataService service)
      Set the supplementary description service which contains descriptions and icons for passkey providers not in the MDS feed.
      Parameters:
      service - The AAGUID service to set.

    • getAaguidService

      @Nullable public PasskeyAaguidMetadataService getAaguidService()
      Get the supplementary description service which contains descriptions and icons for passkey providers not in the MDS feed.
      Returns:
      the AAGUID service.

    • setFidoMetadataService

      public void setFidoMetadataService(@Nullable com.yubico.fido.metadata.FidoMetadataService service)
      Set the FIDO Alliance metadata service resolver to use as the attestation trust source.
      Parameters:
      service - The FIDO metadata service to set.

    • getFidoMetadataService

      @Nullable protected com.yubico.fido.metadata.FidoMetadataService getFidoMetadataService()
      Get the FIDO Alliance metadata service resolver to use as the attestation trust source.
      Returns:
      the FIDO metadata service.

    • setCredentialRepository

      public void setCredentialRepository(@Nonnull WebAuthnCredentialRepository repository)
      Set the credential repository used to store WebAuthn credentials.
      Parameters:
      repository - The respository to set.

    • getCredentialRepository

      @Nullable protected WebAuthnCredentialRepository getCredentialRepository()
      Get the credential repository used to store WebAuthn credentials.
      Returns:
      the credential repository.

    • setWebAuthnContextLookupStrategy

      public void setWebAuthnContextLookupStrategy(@Nonnull Function<ProfileRequestContext,T> strategy)
      Set the WebAuthn context lookup strategy to use.
      Parameters:
      strategy - lookup strategy

    • doPreExecute

      protected final boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doPreExecute in class AbstractConditionalProfileAction

    • doExecute

      protected final void doExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Delegates to doExecute(ProfileRequestContext, Object). Implementations can not override this method.
      Overrides:
      doExecute in class AbstractProfileAction
      Parameters:
      profileRequestContext - the current IdP profile request context

    • doPreExecute

      protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull T context)
      Performs this authentication action's pre-execute step. Default implementation just returns true.
      Parameters:
      profileRequestContext - the current IdP profile request context
      context - the WebAuthn context
      Returns:
      true iff execution should continue

    • doExecute

      protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull T context)
      Performs this WebAuthn authentication action using the supplied WebAuthn context. Implementations should override this method.
      Parameters:
      profileRequestContext - the current IdP profile request context
      context - the WebAuthn context

    • getAuthenticatorMetadata

      @Nonnull @NotLive @NonnullElements protected Set<com.yubico.fido.metadata.MetadataBLOBPayloadEntry> getAuthenticatorMetadata(com.yubico.webauthn.data.ByteArray authenticatorId)
      Find FIDO2 MDS metadata for the authenticator.
      Parameters:
      authenticatorId - the authenticator attestation GUID
      Returns:
      the attestation metadata relating to the authenticator attestation GUID

    • getAaguidMetadata

      @Nullable protected AaguidEntry getAaguidMetadata(@Nullable com.yubico.fido.metadata.AAGUID aaguid)
      Get basic authenticator/provider information from the AAGUID. Contains providers not in the FIDO2 MDS feed, for example, software authenticators.
      Parameters:
      aaguid - the authenticator attestation GUID
      Returns:
      the aaguid metadata, or null if not found.

    • enhancedCredentialRecord

      @NotLive @Unmodifiable @Nonnull protected Collection<EnhancedCredentialRecord> enhancedCredentialRecord(Collection<CredentialRecord> credentials)
      Create EnhancedCredentialRecords from the given CredentialRecords and add any appropriate metadata to each record.
      Parameters:
      credentials - the credentials to convert to EnhancedCredentialRecords.
      Returns:
      a collection of enhanced credential records