Package net.shibboleth.idp.plugin.authn.webauthn.admin.impl

Class AllowCurrentUserAccessPredicate

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.idp.plugin.authn.webauthn.admin.impl.AllowCurrentUserAccessPredicate

All Implemented Interfaces:

Predicate<ProfileRequestContext>, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

public class AllowCurrentUserAccessPredicate
extends AbstractIdentifiableInitializableComponent
implements Predicate<ProfileRequestContext>

An access control predicate that should implement comparison logic to allow access only to authenticated users who initiated the WebAuthn registration/authentication process. If the authenticated user is not the same as the user who started the registration/authentication process (as determined by the initial username collection step), access should be denied.

It is important to prevent users from changing their username between the registration and authentication flows. If this is allowed, it would create a loophole in the WebAuthn authentication process which could allow a user bypass. For instance, a user who starts the registration of a new WebAuthn credential, without any previous WebAuthn credentials, could then login with an inferior authentication mechanism as another user who should only be using WebAuthn (although the overall flow is the responsibility of the MFA flow logic).

More complicated comparison predicates might be needed if either the principal in the subject context and or the username in the registration context have been transformed into different forms but are still logically equivalent.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	AllowCurrentUserAccessPredicate.DefaultCurrentUserComparisonPredicate	Default comparison predicate which just compares the equality of the input strings.

Field Summary

Fields

Modifier and Type	Field	Description
private BiPredicate<ProfileRequestContext,Pair<String,String>>	comparisonPredicate	The predicate that performs the comparison.
private final org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,SubjectContext>	subjectContextLookupStrategy	Strategy function to lookup SubjectContext.
private Function<ProfileRequestContext,WebAuthnAuthenticationContext>	webauthnContextLookupStrategy	Lookup strategy to locate the WebAuthn authentication context.
private Function<ProfileRequestContext,WebAuthnRegistrationContext>	webauthnRegistrationContextLookupStrategy	Lookup strategy to locate the WebAuthn registration context.

Constructor Summary

Constructors

Constructor	Description
AllowCurrentUserAccessPredicate()	Constructor.

Method Summary

Modifier and Type	Method	Description
void	setComparisonPredicate(BiPredicate<ProfileRequestContext,Pair<String,String>> predicate)	Set the predicate that performs the comparison between the principal name from the subject context (as the first item in the pair) with the username in the registration context (as the second item in the pair).
void	setSubjectContextLookupStrategy(Function<ProfileRequestContext,SubjectContext> strategy)	Set the lookup strategy to use to locate the SubjectContext.
void	setWebauthnContextLookupStrategy(Function<ProfileRequestContext,WebAuthnAuthenticationContext> strategy)	Set the WebAuthn authentication context lookup strategy to use.
void	setWebauthnRegistrationContextLookupStrategy(Function<ProfileRequestContext,WebAuthnRegistrationContext> strategy)	Set the WebAuthn registration context lookup strategy to use.
boolean	test(ProfileRequestContext profileRequestContext)

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Methods inherited from interface java.util.function.Predicate

and, negate, or

Field Details

log

@Nonnull
@NotEmpty
private final org.slf4j.Logger log

Class logger.

webauthnRegistrationContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,WebAuthnRegistrationContext> webauthnRegistrationContextLookupStrategy

Lookup strategy to locate the WebAuthn registration context.

webauthnContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,WebAuthnAuthenticationContext> webauthnContextLookupStrategy

Lookup strategy to locate the WebAuthn authentication context.

subjectContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,SubjectContext> subjectContextLookupStrategy

Strategy function to lookup SubjectContext.

comparisonPredicate

@Nonnull
private BiPredicate<ProfileRequestContext,Pair<String,String>> comparisonPredicate

The predicate that performs the comparison.

Constructor Details

AllowCurrentUserAccessPredicate

public AllowCurrentUserAccessPredicate()

Constructor.

Method Details

setWebauthnContextLookupStrategy

public void setWebauthnContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,WebAuthnAuthenticationContext> strategy)

Set the WebAuthn authentication context lookup strategy to use.

Parameters:

strategy - lookup strategy

setSubjectContextLookupStrategy

public void setSubjectContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,SubjectContext> strategy)

Set the lookup strategy to use to locate the SubjectContext.

Parameters:

strategy - lookup function to use

setComparisonPredicate

public void setComparisonPredicate(@Nonnull
 BiPredicate<ProfileRequestContext,Pair<String,String>> predicate)

Set the predicate that performs the comparison between the principal name from the subject context (as the first item in the pair) with the username in the registration context (as the second item in the pair). The profile request context adds additional information if required.

Parameters:

predicate - The comparison predicate to set.

setWebauthnRegistrationContextLookupStrategy

public void setWebauthnRegistrationContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,WebAuthnRegistrationContext> strategy)

Set the WebAuthn registration context lookup strategy to use.

Parameters:

strategy - lookup strategy

test

public boolean test(ProfileRequestContext profileRequestContext)

Specified by:

test in interface Predicate<ProfileRequestContext>