All Classes and Interfaces
Class
Description
A entry in the Passkeys AAGUID JSON file.
A base class for functions that retrieve a single attribute value from the
attribute context.A base class for
authenticator policies.A base class for
credential policies.A base class for WebAuthn actions.
An abstract audit extractor function to extract values directly from various WebAuthn contexts.
A base class for actions that include audit logging support.
A base class for WebAuthn actions that extract a username for subsequent use.
An abstract audit extractor function to extract values directly from the WebAuthn management context.
An abstract audit extractor function to extract values directly from the WebAuthn registration context.
Add an attestation conveyance preference to the
context.Add an authenticator attachment requirement to the
context.An action to generate or lookup a user.displayName.
An action that sets onto the context if nickname collection is required.
Add a ResidentKey requirement to the
context.An action to generate or lookup a user.id (stored by an authenticator as the userHandle).
An action to generate or lookup a WebAuthn user.name.
Add a UserVerification requirement to the
context.An action that removes a public key credential from the credential repository based on the credential ID
found in the management context.
A credential lookup function that returns the credentials belonging to the user that has been searched for in the
management interface.
An access control predicate that should implement comparison logic to allow access only to authenticated users who
initiated the WebAuthn registration/authentication process.
Default comparison predicate which just compares the equality of the input strings.
A basic authenticator policy that rejects all authenticators not in the allowed list.
Exception that is throw if an authentication assertion is not valid.
The
AssertionResult builder.Builder stage.
Builder stage.
Builder stage.
Builder stage.
Builder stage.
Builder stage.
An
AbstractAttributeContextUserIdentityStrategy that pulls out an StringAttributeValue from the
attribute context and represents it as a UTF-8 encoded byte array.An
AbstractAttributeContextUserIdentityStrategy that pulls out an StringAttributeValue from the
attribute context.An authenticator policy that inspects metadata to determine if the authenticator should be allowed
or rejected.
An authenticator capability acceptor that only allows authenticators that support user verification.
An API for applying policy checks to an authenticator.
Representation of the three outcomes of an AuthenticatorPolicy.
A helper class for various FIDO2 Authenticator functions.
Abstract options parameters class.
A base class that pulls out the
WebAuthnAuthenticationContext for consumers to use.The base WebAuthn context for both registration and authentication ceremonies.
A cache facade that handles the consistent conversion between
CredentialRecords and cache entries.An implementation of a
CacheService that handles the consistent conversion between
CredentialRecords and username cache entries using the supplied strategies.A builder to safely construct this object.
A builder stage.
A builder stage.
A
AuthenticatorPolicy implementation that verifies an authenticator is acceptable based on a chain of
configured rules.A credential labeller that labels credentials based on a chain of other labellers.
A
CredentialPolicy implementation that verifies an authentication credential is acceptable based on a
chain of configured rules.A policy engine action that checks with the configured policy if the credential, used to sign the assertion can
be used to authenticate.
A registration policy engine action that checks with the configured policy if the authenticator can be used to
register credentials with the IdP.
An action which checks if the userHandle is returned in the assertion response if the set of allowedCredentials
in the request was empty.
Action to create a PublicKeyCredentialCreationOptions from the parameters in the WebAuthn context using the available
client.Action to create CreatePublicKeyCredentialRequestOptions from the parameters in the WebAuthn context using the
supplied
client.A class to hold the parameters required to build a PublicKeyCredentialRequestOptions.
Builder class.
Stage interface.
Stage interface.
Stage interface.
Stage interface.
Stage interface.
Stage interface.
Stage interface.
Stage interface.
Stage interface.
An API for applying policy checks to an authentication credential.
Representation of the three outcomes of an CredentialPolicy.
A credential record used to hold a registered credential.
Builder.
Optional builder stage.
Builder stage.
Builder stage.
Builder stage.
Builder stage.
Builder stage.
Serialize the set of CredentialRecords to a JSON string.
An unchecked exception that is throw when there is an unrecoverable error occurs handling requests to the
credential repository.
The parameters required to build a PublicKeyCredentialRequestOptions.
Builder class.
Stage interface.
Build the options.
Stage interface.
Stage interface.
A strategy to locate the userHandle first from an assertion response and then, if that does not exist, from the
userId in the WebAuthn authentication context.
An action that removes a credential registration from the credential repository.
A no-op implementation of a
CacheService.An ephemeral wrapper class that holds a
CredentialRecord and any associated metadata.An action that blanks any existing registered credentials in the WebAuthn authentication context.
A credential lookup function that returns the list of existing credentials from the
WebAuthnAuthenticationContext.A credential lookup function that returns the list of existing credentials from the
WebAuthnRegistrationContext.An action that extracts the credential ID for from the incoming HTTP request and uses a
BiConsumer
to set it back onto an appropriate context.An action that extracts the key nickname from the incoming HTTP request.
An action that extracts the PublicKeyCredential containing the authenticator assertion response from the
incoming HTTP request.
An action that extracts the PublicKeyCredential containing the authenticator attestation response from the incoming
HTTP request.
An action to populate a username into the
BaseWebAuthnContext.An action to populate a username into the
BaseWebAuthnContext.An action that extracts the username search value from the incoming HTTP request.
Spring factory bean for creating a
FidoMetadataService.A policy engine that filters the set of existing credentials held in the context based on the policy.
A
AuthenticatorPolicy that evaluates a BiFunction to determine if the authenticator that created
the credential registration should be accepted or rejected.A
CredentialPolicy that evaluates a BiFunction to determine if a credential should be accepted or
rejected.A context class that provides access to the
ProfileRequestContext and FidoMetadataService from
BiFunctions that implement registration or authentication rules.An action to generate an appropriate server challenge for use in either the PublicKeyCredentialCreationOptions or the
PublicKeyCredentialRequestOptions.
Default challenge generator that generates a 32 byte randomized challenge of sufficient entropy.
A
CredentialRepository adaptor for the Shibboleth StorageService.An action that creates a new
SubjectCanonicalizationContext out of the search username in the admin context,
ready for the c14n flows to canonicalize.An action that creates a new
SubjectCanonicalizationContext out of the username in the base context,
ready for the c14n flows to canonicalize.A context that holds information about a resumable SSO flow.
A function that generates a redirect URL to return the user to a resource relative to the server root.
A predicate that determines if username collection is required as a first step to the registration process.
A predicate that determines if the authentication ceremony requires a discoverable credential (ResidentKey)
supplied by the authenticator, or if we have a username to determine which credentials to use from the IdP.
A predicate that lookups into the context to find if the authentication flow is passwordless.
A predicate that determines if the authentication flow is being used as a second factor of authentication, and not
a first (and possibly only) factor.
A predicate that lookups into the context to find if the authentication flow is acting as a second factor.
A predicate that determines if a username already exists in the authentication context.
A predicate that lookups into the context to find if the authentication flow is usernameless.
Use the labelling function to add labels to each
EnhancedCredentialRecord found in the context.An action that lookups registered credentials for a username contained in the WebAuthn management
context and sets them back onto the context.
An action that lookups existing registered credentials based on the username contained in the WebAuthn context
and sets them back onto the context.
An action that lookups existing registered credentials from the userHandle supplied in the authenticators assertion
response and sets them back onto the context.
A
BiConsumer that sets the credential ID to remove onto the WebAuthn management context.Access control implementation based on a
List of predicates over a ProfileRequestContext.A spring factory bean for create a
PasskeyAaguidMetadataService.A service that looks up icons and descriptions about passkey providers (authenticators) from a map.
A credential labeller function that labels credentials as 'Passkey' if they are discoverable.
Populate the
InlineEnrolmentContext from the HTTP referer header in the
HTTP request iff the registration query parameter contains 'inline'.An action to create (or lookup) the
WebAuthnAuthenticationContext and populate
with the username found from the username lookup strategy.An action to create (or lookup) the
WebAuthnManagementContext and set the admin principal name from the
lookup strategy.An action to create (or lookup) the
WebAuthnRegistrationContext and populate with the username found from
the lookup strategy.A query strategy that loads all known credentials from the datasource based on the storage context label.
A query strategy that uses the specialised query functionality of the
WebAuthnJDBCQueryAccelerator to
load credentials from the datasource with the given credentialId.A query strategy that uses the specialised query functionality of the
WebAuthnJDBCQueryAccelerator to
load credentials from the datasource with the given userHandle.A user.id generator that generates a random 64 byte user.id.
A cache loading strategy that loads all known credentials from the datasource.
A
BiConsumer that sets the credential ID to remove onto the WebAuthn registration context.A
BiConsumer that sets the credential ID to modify onto the WebAuthn registration context.A function that examines the state of a request and produces an appropriate message for WebAuthn flow views.
Exception that is throw if a public key credential registration (attestation) is not valid.
A function that examines the state of a request and produces an appropriate message for WebAuthn flow views.
Builder.
Builder stage.
Builder stage.
Builder stage.
Builder stage.
Access control predicate, used within a WebAuthn registration flow, to check if a user with existing WebAuthn/FIDO2
credentials has performed a fresh, strong, authentication.
A credential labeller function that labels credentials as 'SecondFactor' if the authenticator that created the
credential should only be used as a second factor, and not sole factor of authentication.
A
CredentialPolicy that rejects credentials used in sole-factor mode if created by authenticators which
should only be used for second factor authentication.A consumer that sets the isPasswordless mode flag to the authentication context.
A consumer that sets the isSecondFactor mode flag to the authentication context.
A consumer that sets the isUsernameless mode flag to the authentication context.
A factory bean that decides which credential repository implementation to create based on the options set.
The type of JDBC accelerator.
An extraction strategy that converts the
ByteArray into a base64Url encoded string.An extraction strategy that converts the
CredentialRecord into a base64Url encoded string of the
credentialId inside the credential.An extraction strategy that converts the
CredentialRecord into a base64Url encoded string of the
userHandle inside the credential.An extraction strategy that converts the
CredentialRecord into a username inside the registration.An action that adds the public key credential in the registration context to the credential repository.
An extension of the
IdPStorageServiceCredentialRepository that utalizes specialised
lookup functions to improve the performance of userHandle and credentialId lookup operations.A WebAuthn management action that sets the principal name from the SubjectCanonicalizationContext back onto the
WebAuthn context as the search username.
An action that updates the nickname of a credential in the credential repository.
A WebAuthn action that sets the principal name from the SubjectCanonicalizationContext back onto the WebAuthn
context.
A strategy that takes the UsernamePrincipal from the authentication context iff there is only one.
Predicate to determine if the user is required to enter their username or not.
Extract a username from the HTTP request, returning
null if not found.Pull out a username from a WebAuthn Registration Context if it exists.
Pull out a username/principalName from the
SubjectContext.getPrincipalName() if it exists.Validate the public key registration attempt by delegating the created public key credential to the WebAuthn client.
An action that validates a WebAuthn authenticator assertion that results from a call to WebAuthn's 'get' credential
API.
A default cleanup hook that removes the
WebAuthnAuthenticationContext from the tree.Audit fields for WebAuthn.
A client that manages WebAuthn authentication and registration ceremonies.
An exception to signal an error condition during execution or creation of a Webauthn client.
Abstract factory for creating singleton
WebAuthnAuthenticationClient instances.Authentication context for processing WebAuthn authentication ceremonies.
Constants to use for
ProfileAction
EventContext results related to
WebAuthn authentication.A WebAuthn credential repository that extends the
CredentialRepository interface to support additional read
and write operations.Function that returns the base64 encoded credential identifier of the credential that has been removed.Encoder for
credentials that converts raw values into a format suitable for views.A function that examines the state of a request and produces an appropriate message for WebAuthn flow views.
Function that returns which mode of flow was run e.g.A context to hold signals about the type of authentication performed.
A marker interface for a JDBC query accelerator that improves the performance of lookup operations.
Implementation of a
WebAuthnJDBCQueryAccelerator and WebAuthnJDBCReadAllAccelerator that uses
specialized queries to lookup credentials by userHandle and credentialId.An accelerator for JDBC queries to improve the performance of lookup operations that search for non-indexed fields,
namely; userHandle and credentialId.
An accelerator for JDBC queries to improve the performance of lookup operations that read all records at once.
Storage record used by
WebAuthnJDBCAcceleratorImpl.A WebAuthn admin management context for the management admin flow.
IdP Module implementation for the WebAuthn login flow.Plugin description about the WebAuthn plugin.
Registration context for processing WebAuthn Registration Ceremonies.
A WebAuthn version of
AuthenticationErrorContext that holds information about WebAuthn registration events.Constants to use for
ProfileAction
EventContext results related to
WebAuthn registration.A WebAuthn version of
AuthenticationWarningContext that holds information about WebAuthn registration events.Function that returns which username that the admin user searched for.Helper methods for WebAuthn.
Function that returns the base64 encoded credential identifier of the credential that has been removed.Function that returns the base64 encoded credential identifier of the credential that has been removed.Function that returns the user.id from the BaseWebAuthnContext base64 encoded, if any.Principal based on the WebAuthn user.id base64 encoded.
Function that returns the internal username from the BaseWebAuthnContext, if any.Function that returns true if UserVerification was performed, false otherwise.Yubico implementation of a
WebAuthnAuthenticationClient.Spring factory bean for creating a
YubicoWebAuthnAuthenticationClient.