Package net.shibboleth.idp.plugin.authn.webauthn.impl

Class ValidateWebAuthnAssertion

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.authn.AbstractAuthenticationAction

net.shibboleth.idp.authn.AbstractValidationAction

net.shibboleth.idp.authn.impl.AbstractAuditingValidationAction

net.shibboleth.idp.plugin.authn.webauthn.impl.ValidateWebAuthnAssertion

All Implemented Interfaces:

PrincipalSupportingComponent, Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ValidateWebAuthnAssertion
extends AbstractAuditingValidationAction

An action that validates a WebAuthn authenticator assertion that results from a call to WebAuthn's 'get' credential API. If successful, populates the Subject with a UsernamePrincipal based on the username in the authentication context and a WebAuthnUserIdPrinicpal based on the user.id in the authentication context.

Event:

AuthnEventIds.INVALID_CREDENTIALS, AuthnEventIds.INVALID_AUTHN_CTX

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	ValidateWebAuthnAssertion.WebAuthnCleanupHook	A default cleanup hook that removes the WebAuthnAuthenticationContext from the tree.

Field Summary

Fields

Modifier and Type	Field	Description
private WebAuthnAuthenticationContext	context	The WebAuthn authentication context.
private WebAuthnCredentialRepository	credentialRepository	The credential repository to validate assertion responses against.
private final org.slf4j.Logger	log	Class logger.
private com.yubico.webauthn.data.PublicKeyCredentialRequestOptions	publicKeyCredentialRequestOptions	The options used to create the authentication request.
private Predicate<ProfileRequestContext>	updateLastUsedTime	Should we updated the last used time on successful validation?.
private Predicate<ProfileRequestContext>	updateSignatureCount	Should we update the signature count on the credential in the repository after successful validation? Defaults to true.
private WebAuthnAuthenticationClient	webAuthnClient	The WebAuthn client to use.
private final Function<ProfileRequestContext,WebAuthnAuthenticationContext>	webauthnContextLookupStrategy	Strategy used to locate or create the WebAuthnAuthenticationContext to populate.

Constructor Summary

Constructors

Constructor	Description
ValidateWebAuthnAssertion()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	buildAuthenticationResult(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
protected void	doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
protected Subject	populateSubject(Subject subject)
void	setCredentialRepository(WebAuthnCredentialRepository repository)	Set the credential repository used to store WebAuthn credentials.
void	setUpdateLastUsedTimePredicate(Predicate<ProfileRequestContext> predicate)	Set the predicate to determine if we should update the last used time on the credential in the repository after successful validation?
void	setUpdateSignatureCount(boolean flag)	Set the flag to determine if we should update the signature count on the credential in the repository after successful validation?
void	setUpdateSignatureCountPredicate(Predicate<ProfileRequestContext> predicate)	Set the predicate to determine if we should update the signature count on the credential in the repository after successful validation?
void	setWebAuthnClient(WebAuthnAuthenticationClient client)	Set the WebAuthn client used to handle validation of the authentication ceremony.
private void	updateLastUsedTime(String username, com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> assertion)	Update the last used time of the credential to Instant.now().
private void	updateSignatureCount(String username, com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> assertion)	Take the new signature count from the authenticator assertion response and update the stored credential with that value.

Methods inherited from class net.shibboleth.idp.authn.impl.AbstractAuditingValidationAction

doAudit, doExecute, getAuditContext, getAuditFields, recordFailure, recordSuccess, setAuditContextCreationStrategy, setPopulateAuditContextAction, setWriteAuditLogAction

Methods inherited from class net.shibboleth.idp.authn.AbstractValidationAction

addDefaultPrincipals, getClassifiedErrors, getCleanupHook, getMetricName, getRequesterLookupStrategy, getResponderLookupStrategy, getResultCachingPredicate, getSubject, getSupportedPrincipals, handleError, handleError, handleWarning, setAddDefaultPrincipals, setClassifiedMessages, setCleanupHook, setMetricName, setRequesterLookupStrategy, setResponderLookupStrategy, setResultCachingPredicate, setSupportedPrincipals

Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

doExecute, doPreExecute, setAuthenticationContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

webauthnContextLookupStrategy

@Nonnull
private final Function<ProfileRequestContext,WebAuthnAuthenticationContext> webauthnContextLookupStrategy

Strategy used to locate or create the WebAuthnAuthenticationContext to populate.

context

@NonnullBeforeExec
private WebAuthnAuthenticationContext context

The WebAuthn authentication context.

webAuthnClient

@NonnullAfterInit
private WebAuthnAuthenticationClient webAuthnClient

The WebAuthn client to use.

credentialRepository

@NonnullAfterInit
private WebAuthnCredentialRepository credentialRepository

The credential repository to validate assertion responses against.

publicKeyCredentialRequestOptions

@NonnullBeforeExec
private com.yubico.webauthn.data.PublicKeyCredentialRequestOptions publicKeyCredentialRequestOptions

The options used to create the authentication request.

updateSignatureCount

@Nonnull
private Predicate<ProfileRequestContext> updateSignatureCount

Should we update the signature count on the credential in the repository after successful validation? Defaults to true.

updateLastUsedTime

@Nonnull
private Predicate<ProfileRequestContext> updateLastUsedTime

Should we updated the last used time on successful validation?. Defaults to false.

Constructor Details

ValidateWebAuthnAssertion

public ValidateWebAuthnAssertion()

Constructor.

Method Details

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

setCredentialRepository

public void setCredentialRepository(@Nonnull
 WebAuthnCredentialRepository repository)

Set the credential repository used to store WebAuthn credentials.

Parameters:

repository - the repository to set.

setWebAuthnClient

public void setWebAuthnClient(@Nonnull
 WebAuthnAuthenticationClient client)

Set the WebAuthn client used to handle validation of the authentication ceremony.

Parameters:

client - the webauthnClient to set.

setUpdateSignatureCount

public void setUpdateSignatureCount(boolean flag)

Set the flag to determine if we should update the signature count on the credential in the repository after successful validation?

Parameters:

flag - the flag to set.

setUpdateSignatureCountPredicate

public void setUpdateSignatureCountPredicate(@Nonnull
 Predicate<ProfileRequestContext> predicate)

Set the predicate to determine if we should update the signature count on the credential in the repository after successful validation?

Parameters:

predicate - the predicate to set.

setUpdateLastUsedTimePredicate

public void setUpdateLastUsedTimePredicate(@Nonnull
 Predicate<ProfileRequestContext> predicate)

Set the predicate to determine if we should update the last used time on the credential in the repository after successful validation?

Parameters:

predicate - the predicate to set.

Since:

1.1.0

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Overrides:

doPreExecute in class AbstractValidationAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Overrides:

doExecute in class AbstractAuthenticationAction

updateLastUsedTime

private void updateLastUsedTime(@Nonnull
 String username,
 @Nonnull
 com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> assertion)
                         throws AssertionFailureException

Update the last used time of the credential to Instant.now(). Any failure just gets logged and normal processing continues.

Parameters:

username - the username of the user to update the last used time for

assertion - the assertion with the credential Id to update

Throws:

AssertionFailureException - on error updating the counter

updateSignatureCount

private void updateSignatureCount(@Nonnull
 String username,
 @Nonnull
 com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> assertion)
                           throws AssertionFailureException

Take the new signature count from the authenticator assertion response and update the stored credential with that value. It is assumed the assertion and signature counter is valid by the time this method is called.

Parameters:

username - the username of the user to update signature count for

assertion - the assertion with the credential Id to update, and the new signature count

Throws:

AssertionFailureException - on error updating the counter

buildAuthenticationResult

protected void buildAuthenticationResult(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Overrides:

buildAuthenticationResult in class AbstractValidationAction

populateSubject

protected Subject populateSubject(@Nonnull
 Subject subject)

Specified by:

populateSubject in class AbstractValidationAction