Package net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl

Class AbstractAuthenticatorPolicyRule

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl.AbstractAuthenticatorPolicyRule
All Implemented Interfaces:
AuthenticatorPolicy, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
Direct Known Subclasses:
AllowlistAuthenticatorPolicy, AuthenticatorCapabilitiesPolicyRule, ChainingAuthenticatorPolicyRule, FunctionalAuthenticatorPolicyRule
@ThreadSafeAfterInit public abstract class AbstractAuthenticatorPolicyRule extends AbstractIdentifiableInitializableComponent implements AuthenticatorPolicy
A base class for authenticator policies. Ensures the AAGUID is not null before it is passed to the policy rule implementation. Can be enabled and disabled by the activiation condition.

Returns AuthenticatorPolicy.AuthenticatorPolicyOutcome.ACCEPT if the authenticator is accepted, returns AuthenticatorPolicy.AuthenticatorPolicyOutcome.REJECT if the authenticator is rejected, returns AuthenticatorPolicy.AuthenticatorPolicyOutcome.IGNORE if the rule is to be ignored.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • fidoMetadataService

      @Nullable private com.yubico.fido.metadata.FidoMetadataService fidoMetadataService
      FIDO metadata service resolver.

    • activationCondition

      @Nonnull private BiPredicate<com.yubico.fido.metadata.AAGUID,ProfileRequestContext> activationCondition
      Does this policy rule apply? Default is true.

  • Constructor Details

    • AbstractAuthenticatorPolicyRule

      protected AbstractAuthenticatorPolicyRule()
      Constructor.

  • Method Details

    • setActivationConditionStrategy

      public void setActivationConditionStrategy(@Nonnull BiPredicate<com.yubico.fido.metadata.AAGUID,ProfileRequestContext> condition)
      Set an activation condition for this policy rule.
      Parameters:
      condition - condition to set

    • setActivationCondition

      public void setActivationCondition(boolean flag)
      Set an activation condition for this policy rule.
      Parameters:
      flag - the flag to set

    • setFidoMetadataService

      public void setFidoMetadataService(@Nullable com.yubico.fido.metadata.FidoMetadataService trustSource)
      Set the attestation trust source.
      Parameters:
      trustSource - the attestation trust source.

    • getFidoMetadataService

      @Nullable protected com.yubico.fido.metadata.FidoMetadataService getFidoMetadataService()
      Get the metadata service to use.
      Returns:
      the metadata service.

    • evaluate

      public AuthenticatorPolicy.AuthenticatorPolicyOutcome evaluate(@Nullable com.yubico.fido.metadata.AAGUID aaguid, @Nonnull ProfileRequestContext prc)
      Execute and evaluate the policy. Return AuthenticatorPolicy.AuthenticatorPolicyOutcome.ACCEPT if allowed, AuthenticatorPolicy.AuthenticatorPolicyOutcome.REJECT if rejected, and AuthenticatorPolicy.AuthenticatorPolicyOutcome.IGNORE otherwise.
      Specified by:
      evaluate in interface AuthenticatorPolicy
      Parameters:
      aaguid - the authenticator attestation GUID.
      prc - the profile request context
      Returns:
      the authenticator policy outcome: ACCEPT if allowed, REJECT if rejected, and IGNORE if the policy is to be ignored (e.g. the policy is not active)

    • doAccept

      protected abstract AuthenticatorPolicy.AuthenticatorPolicyOutcome doAccept(@Nonnull com.yubico.fido.metadata.AAGUID aaguid, @Nonnull ProfileRequestContext prc)
      Execute the policy. Return true if allowed, false otherwise. Implementations should override this method.
      Parameters:
      aaguid - the authenticator attestation GUID.
      prc - the profile request context
      Returns:
      true if the policy allows the authenticator, false otherwise.