Package net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl

Class AuthenticatorCapabilitiesPolicyRule

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl.AbstractAuthenticatorPolicyRule

net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl.AuthenticatorCapabilitiesPolicyRule

All Implemented Interfaces:

AuthenticatorPolicy, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

public class AuthenticatorCapabilitiesPolicyRule
extends AbstractAuthenticatorPolicyRule

An authenticator policy that inspects metadata to determine if the authenticator should be allowed or rejected.

Nested Class Summary

Nested classes/interfaces inherited from interface net.shibboleth.idp.plugin.authn.webauthn.admin.policy.AuthenticatorPolicy

AuthenticatorPolicy.AuthenticatorPolicyOutcome

Field Summary

Fields

Modifier and Type	Field	Description
private Predicate<Set<com.yubico.fido.metadata.MetadataBLOBPayloadEntry>>	authenticatorCapabilityAcceptor	A customizable predicate that determines if this authenticators capabilities should be accepted or rejected.
private final org.slf4j.Logger	log	Class logger.

Constructor Summary

Constructors

Constructor	Description
AuthenticatorCapabilitiesPolicyRule()	Constructor.

Method Summary

Modifier and Type	Method	Description
AuthenticatorPolicy.AuthenticatorPolicyOutcome	doAccept(com.yubico.fido.metadata.AAGUID aaguid, ProfileRequestContext prc)	Execute the policy.
void	setAuthenticatorCapabilityAcceptor(Predicate<Set<com.yubico.fido.metadata.MetadataBLOBPayloadEntry>> predicate)	Set the predicate that determines if this authenticators capabilities should be accepted or rejected.

Methods inherited from class net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl.AbstractAuthenticatorPolicyRule

evaluate, getFidoMetadataService, setActivationCondition, setActivationConditionStrategy, setFidoMetadataService

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

authenticatorCapabilityAcceptor

@Nonnull
private Predicate<Set<com.yubico.fido.metadata.MetadataBLOBPayloadEntry>> authenticatorCapabilityAcceptor

A customizable predicate that determines if this authenticators capabilities should be accepted or rejected. Defaults to ALLOW.

Constructor Details

AuthenticatorCapabilitiesPolicyRule

public AuthenticatorCapabilitiesPolicyRule()

Constructor.

Method Details

setAuthenticatorCapabilityAcceptor

public void setAuthenticatorCapabilityAcceptor(@Nonnull
 Predicate<Set<com.yubico.fido.metadata.MetadataBLOBPayloadEntry>> predicate)

Set the predicate that determines if this authenticators capabilities should be accepted or rejected.

Parameters:

predicate - the predicate which determines if this authenticator, based on its metadata, should be accepted.

doAccept

public AuthenticatorPolicy.AuthenticatorPolicyOutcome doAccept(@Nonnull
 com.yubico.fido.metadata.AAGUID aaguid,
 @Nullable
 ProfileRequestContext prc)

Execute the policy. Return true if allowed, false otherwise. Implementations should override this method.

Specified by:

doAccept in class AbstractAuthenticatorPolicyRule

Parameters:

aaguid - the authenticator attestation GUID.

prc - the profile request context

Returns:

true if the policy allows the authenticator, false otherwise.