Package net.shibboleth.idp.plugin.authn.webauthn.impl

Class CheckCredentialPolicy

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction<WebAuthnAuthenticationContext>

net.shibboleth.idp.plugin.authn.webauthn.impl.CheckCredentialPolicy

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class CheckCredentialPolicy
extends AbstractWebAuthnAction<WebAuthnAuthenticationContext>

A policy engine action that checks with the configured policy if the credential, used to sign the assertion can be used to authenticate. If it is rejected by the policy, a WebAuthnAuthenticationEventIds.CREDENTIAL_POLICY_REJECTION is returned. Similarly, if a credential can not be found to evaluate the policy returns an WebAuthnAuthenticationEventIds.CREDENTIAL_POLICY_REJECTION.

Event:

{EventIds#INVALID_PROFILE_CTX}, {WebAuthnAuthenticationEventIds#CREDENTIAL_POLICY_REJECTION}

Precondition:

ProfileRequestContext.getSubcontext(WebAuthnRegistrationContext.class) != null

Postcondition:

the credential is allowed to be used for authentication, or an error event is triggered

Field Summary

Fields

Modifier and Type	Field	Description
private com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs>	assertion	The stashed assertion response.
private AuthenticationContext	authnContext	The stashed authentication context.
private CredentialPolicy	credentialPolicy	The credential policy to check.
private final org.slf4j.Logger	log	Class logger.
private WebAuthnCredentialRepository	repository	The credential repository to use.
private Function<ProfileRequestContext,byte[]>	userHandleLookupStrategy	Get the userHandle to help find the credential used to sign the assertion.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	CheckCredentialPolicy()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext, WebAuthnAuthenticationContext context)	Performs this WebAuthn authentication action using the supplied WebAuthn context.
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, WebAuthnAuthenticationContext context)	Performs this authentication action's pre-execute step.
void	setCredentialPolicy(CredentialPolicy policy)	Set the policy to verify that the credential can be used for authentication.
void	setUserHandleLookupStrategy(Function<ProfileRequestContext,byte[]> strategy)	Set the strategy to locate the userHandle of the user that holds the credential used to sign the assertion.

Methods inherited from class net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction

doExecute, doPreExecute, enhancedCredentialRecord, getAaguidMetadata, getAaguidService, getAuthenticatorMetadata, getCredentialRepository, getFidoMetadataService, getWebAuthnClient, setAaguidService, setCredentialRepository, setFidoMetadataService, setWebAuthnClient, setWebAuthnContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

assertion

@NonnullBeforeExec
private com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> assertion

The stashed assertion response.

userHandleLookupStrategy

@Nonnull
private Function<ProfileRequestContext,byte[]> userHandleLookupStrategy

Get the userHandle to help find the credential used to sign the assertion.

credentialPolicy

@Nullable
private CredentialPolicy credentialPolicy

The credential policy to check.

repository

@NonnullAfterInit
private WebAuthnCredentialRepository repository

The credential repository to use.

authnContext

@NonnullBeforeExec
private AuthenticationContext authnContext

The stashed authentication context.

Constructor Details

CheckCredentialPolicy

protected CheckCredentialPolicy()

Constructor.

Method Details

setCredentialPolicy

public void setCredentialPolicy(@Nullable
 CredentialPolicy policy)

Set the policy to verify that the credential can be used for authentication.

Parameters:

policy - The authenticator policy to set.

setUserHandleLookupStrategy

public void setUserHandleLookupStrategy(Function<ProfileRequestContext,byte[]> strategy)

Set the strategy to locate the userHandle of the user that holds the credential used to sign the assertion.

Parameters:

strategy - The user handle lookup strategy to set.

Since:

1.1.0

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractWebAuthnAction<WebAuthnAuthenticationContext>

Throws:

ComponentInitializationException

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 WebAuthnAuthenticationContext context)

Performs this authentication action's pre-execute step. Default implementation just returns true.

Overrides:

doPreExecute in class AbstractWebAuthnAction<WebAuthnAuthenticationContext>

Parameters:

profileRequestContext - the current IdP profile request context

context - the WebAuthn context

Returns:

true iff execution should continue

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 WebAuthnAuthenticationContext context)

Description copied from class: AbstractWebAuthnAction

Performs this WebAuthn authentication action using the supplied WebAuthn context. Implementations should override this method.

Overrides:

doExecute in class AbstractWebAuthnAction<WebAuthnAuthenticationContext>

Parameters:

profileRequestContext - the current IdP profile request context

context - the WebAuthn context