Package net.shibboleth.idp.plugin.authn.webauthn.admin.impl

Class AddUserId

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction<WebAuthnRegistrationContext>

net.shibboleth.idp.plugin.authn.webauthn.admin.impl.AddUserId

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class AddUserId
extends AbstractWebAuthnAction<WebAuthnRegistrationContext>

An action to generate or lookup a user.id (stored by an authenticator as the userHandle). This is used by the IdP to map a public key credential to a users session map of public keys, and by the authenticator to map the IdP's ID (RelyingParty ID) and the userHandle to a public key credential source (which contains the private key).

Used during the registration process, added to PublicKeyCredentialCreationOptions.

The user.id could contain some form of state if required, but must not contain retrievable PII.

The same user should have the same user.id. That is, a single user can have more than one registered credential.

Event:

WebAuthnRegistrationEventIds.INVALID_REGISTRATION

Precondition:

ProfileRequestContext.getSubcontext(WebAuthnRegistrationContext.class) != null

Postcondition:

a user ID is added to the registration context

Field Summary

Fields

Modifier and Type	Field	Description
private final org.slf4j.Logger	log	Class logger.
private WebAuthnCredentialRepository	repository	The credential repository to use.
private Function<ProfileRequestContext,byte[]>	userIdGeneratorStrategy	Strategy used to generate the user.id.
private String	username	The stashed username.

Constructor Summary

Constructors

Constructor	Description
AddUserId()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext, WebAuthnRegistrationContext context)	Performs this WebAuthn authentication action using the supplied WebAuthn context.
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, WebAuthnRegistrationContext context)	Performs this authentication action's pre-execute step.
void	setUserIdGeneratorStrategy(Function<ProfileRequestContext,byte[]> strategy)	Set the strategy used to generate the user.id.

Methods inherited from class net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction

doExecute, doPreExecute, enhancedCredentialRecord, getAaguidMetadata, getAaguidService, getAuthenticatorMetadata, getCredentialRepository, getFidoMetadataService, getWebAuthnClient, setAaguidService, setCredentialRepository, setFidoMetadataService, setWebAuthnClient, setWebAuthnContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

userIdGeneratorStrategy

@NonnullAfterInit
private Function<ProfileRequestContext,byte[]> userIdGeneratorStrategy

Strategy used to generate the user.id.

username

@NonnullBeforeExec
private String username

The stashed username.

repository

@NonnullAfterInit
private WebAuthnCredentialRepository repository

The credential repository to use.

Constructor Details

AddUserId

public AddUserId()

Constructor.

Method Details

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractWebAuthnAction<WebAuthnRegistrationContext>

Throws:

ComponentInitializationException

setUserIdGeneratorStrategy

public void setUserIdGeneratorStrategy(@Nonnull
 Function<ProfileRequestContext,byte[]> strategy)

Set the strategy used to generate the user.id.

Parameters:

strategy - the strategy

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 WebAuthnRegistrationContext context)

Performs this authentication action's pre-execute step. Default implementation just returns true.

Overrides:

doPreExecute in class AbstractWebAuthnAction<WebAuthnRegistrationContext>

Parameters:

profileRequestContext - the current IdP profile request context

context - the WebAuthn context

Returns:

true iff execution should continue

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 WebAuthnRegistrationContext context)

Performs this WebAuthn authentication action using the supplied WebAuthn context. Implementations should override this method.

Overrides:

doExecute in class AbstractWebAuthnAction<WebAuthnRegistrationContext>

Parameters:

profileRequestContext - the current IdP profile request context

context - the WebAuthn context