Package net.shibboleth.idp.plugin.authn.webauthn.context

Class WebAuthnGuardContext

java.lang.Object

org.opensaml.messaging.context.BaseContext

net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnGuardContext

All Implemented Interfaces:

Iterable<BaseContext>

public class WebAuthnGuardContext
extends BaseContext

A context to hold signals about the type of authentication performed. For example, is the authentication performed sufficient for accessing the WebAuthn credential registration flow.

Use of this context is optional and determined by the deployer.

Since:

1.1.0

Nested Class Summary

Nested classes/interfaces inherited from class org.opensaml.messaging.context.BaseContext

BaseContext.ContextSetNoRemoveIteratorDecorator, BaseContext.DeprecatedContextClassNameLookAside

Field Summary

Fields

Modifier and Type	Field	Description
private boolean	stronglyAuthenticated	A flag that can be set to indicate the user just (fresh) performed some kind of 'strong' authentication.

Constructor Summary

Constructors

Constructor	Description
WebAuthnGuardContext()

Method Summary

Modifier and Type	Method	Description
boolean	isStronglyAuthenticated()	Did the user performed some kind of 'strong' authentication? (as determined by the flow)
WebAuthnGuardContext	setStronglyAuthenticated(boolean flag)	Set a flag to indicate the user performed some kind of 'strong' authentication.

Methods inherited from class org.opensaml.messaging.context.BaseContext

addSubcontext, addSubcontext, clearSubcontexts, containsSubcontext, createSubcontext, ensureSubcontext, ensureSubcontext, getParent, getSubcontext, getSubcontext, getSubcontext, getSubcontext, iterator, removeFromParent, removeSubcontext, removeSubcontext, setParent

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface java.lang.Iterable

forEach, spliterator

Field Details

stronglyAuthenticated

private boolean stronglyAuthenticated

A flag that can be set to indicate the user just (fresh) performed some kind of 'strong' authentication. This can be used in conjunction with an access control policy to determine if the user should be granted access to the registration page if other conditions are met e.g. if the user has FIDO2 credentials and the flag is not set, deny access.

This is not intended to replace AuthenticationContextClasses, but can be used in certain cases where the flow might legally change behaviour from one authentication to the next e.g. allow password login for the first registration, but require something stronger thereafter (and use this as a flag to indicate that).

Constructor Details

WebAuthnGuardContext

public WebAuthnGuardContext()

Method Details

setStronglyAuthenticated

@Nonnull
public WebAuthnGuardContext setStronglyAuthenticated(boolean flag)

Set a flag to indicate the user performed some kind of 'strong' authentication.

Parameters:

flag - The flag to set.

Returns:

this context

isStronglyAuthenticated

public boolean isStronglyAuthenticated()

Did the user performed some kind of 'strong' authentication? (as determined by the flow)

Returns:

true iff the user performed some kind of strong authentication, false otherwise.