Package net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl

Class ChainingAuthenticatorPolicyRule

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl.AbstractAuthenticatorPolicyRule

net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl.ChainingAuthenticatorPolicyRule

All Implemented Interfaces:

AuthenticatorPolicy, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

public class ChainingAuthenticatorPolicyRule
extends AbstractAuthenticatorPolicyRule

A AuthenticatorPolicy implementation that verifies an authenticator is acceptable based on a chain of configured rules.

Verification ends if any of the chained rules signals the authenticator should be rejected.

Nested Class Summary

Nested classes/interfaces inherited from interface net.shibboleth.idp.plugin.authn.webauthn.admin.policy.AuthenticatorPolicy

AuthenticatorPolicy.AuthenticatorPolicyOutcome

Field Summary

Fields

Modifier and Type	Field	Description
private List<AuthenticatorPolicy>	authenticatorPolicyChain	An ordered chain of authenticator policies.
private final org.slf4j.Logger	log	Class logger.

Constructor Summary

Constructors

Constructor	Description
ChainingAuthenticatorPolicyRule()

Method Summary

Modifier and Type	Method	Description
protected AuthenticatorPolicy.AuthenticatorPolicyOutcome	doAccept(com.yubico.fido.metadata.AAGUID aaguid, ProfileRequestContext prc)	Execute the policy.
protected void	doInitialize()
void	setAuthenticatorPolicyChain(List<AuthenticatorPolicy> chain)	Set the chain of policies that should be applied to the authenticator.

Methods inherited from class net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl.AbstractAuthenticatorPolicyRule

evaluate, getFidoMetadataService, setActivationCondition, setActivationConditionStrategy, setFidoMetadataService

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

authenticatorPolicyChain

private List<AuthenticatorPolicy> authenticatorPolicyChain

An ordered chain of authenticator policies.

Constructor Details

ChainingAuthenticatorPolicyRule

public ChainingAuthenticatorPolicyRule()

Method Details

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractIdentifiedInitializableComponent

Throws:

ComponentInitializationException

setAuthenticatorPolicyChain

public void setAuthenticatorPolicyChain(@Nullable
 List<AuthenticatorPolicy> chain)

Set the chain of policies that should be applied to the authenticator. Every policy must allow the authenticator to be accepted.

Parameters:

chain - The authenticator policy chain to set.

doAccept

protected AuthenticatorPolicy.AuthenticatorPolicyOutcome doAccept(@Nonnull
 com.yubico.fido.metadata.AAGUID aaguid,
 @Nonnull
 ProfileRequestContext prc)

Execute the policy. Return true if allowed, false otherwise. Implementations should override this method.

Specified by:

doAccept in class AbstractAuthenticatorPolicyRule

Parameters:

aaguid - the authenticator attestation GUID.

prc - the profile request context

Returns:

true if the policy allows the authenticator, false otherwise.