Package net.shibboleth.idp.plugin.authn.webauthn.admin.impl

Class RequireStrongFreshAuthnAccessPredicate

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.idp.plugin.authn.webauthn.admin.impl.RequireStrongFreshAuthnAccessPredicate

All Implemented Interfaces:

Predicate<ProfileRequestContext>, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

public class RequireStrongFreshAuthnAccessPredicate
extends AbstractIdentifiableInitializableComponent
implements Predicate<ProfileRequestContext>

Access control predicate, used within a WebAuthn registration flow, to check if a user with existing WebAuthn/FIDO2 credentials has performed a fresh, strong, authentication. A fresh and strong authentication is signalled by a flag in the WebAuthnGuardContext context. The flag is likely set inside the MFA flow logic by the deployer indicating the expected level of authentication was performed.

Since:

1.1.0

Field Summary

Fields

Modifier and Type	Field	Description
private WebAuthnCredentialRepository	credentialRepository	The credential repository.
private final org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,SubjectContext>	subjectContextLookupStrategy	Strategy function to lookup SubjectContext.
private Function<ProfileRequestContext,WebAuthnGuardContext>	webAuthnGuardContextLookupStrategy	Lookup strategy to locate the WebAuthnGuardContext.

Constructor Summary

Constructors

Constructor	Description
RequireStrongFreshAuthnAccessPredicate()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doInitialize()
void	setCredentialRepository(WebAuthnCredentialRepository repository)	Set the credential repository used to store WebAuthn credentials.
void	setSubjectContextLookupStrategy(Function<ProfileRequestContext,SubjectContext> strategy)	Set the lookup strategy to use to locate the SubjectContext.
void	setWebAuthnGuardContextLookupStrategy(Function<ProfileRequestContext,WebAuthnGuardContext> strategy)	Set the lookup strategy to use to locate the WebAuthnGuardContext.
boolean	test(ProfileRequestContext profileRequestContext)

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Methods inherited from interface java.util.function.Predicate

and, negate, or

Field Details

log

@Nonnull
@NotEmpty
private final org.slf4j.Logger log

Class logger.

webAuthnGuardContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,WebAuthnGuardContext> webAuthnGuardContextLookupStrategy

Lookup strategy to locate the WebAuthnGuardContext.

subjectContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,SubjectContext> subjectContextLookupStrategy

Strategy function to lookup SubjectContext.

credentialRepository

@NonnullAfterInit
private WebAuthnCredentialRepository credentialRepository

The credential repository.

Constructor Details

RequireStrongFreshAuthnAccessPredicate

public RequireStrongFreshAuthnAccessPredicate()

Constructor.

Method Details

setWebAuthnGuardContextLookupStrategy

public void setWebAuthnGuardContextLookupStrategy(Function<ProfileRequestContext,WebAuthnGuardContext> strategy)

Set the lookup strategy to use to locate the WebAuthnGuardContext.

Parameters:

strategy - lookup function to use

setSubjectContextLookupStrategy

public void setSubjectContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,SubjectContext> strategy)

Set the lookup strategy to use to locate the SubjectContext.

Parameters:

strategy - lookup function to use

setCredentialRepository

public void setCredentialRepository(@Nonnull
 WebAuthnCredentialRepository repository)

Set the credential repository used to store WebAuthn credentials.

Parameters:

repository - The repository to set.

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractIdentifiedInitializableComponent

Throws:

ComponentInitializationException

test

public boolean test(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

test in interface Predicate<ProfileRequestContext>