Package net.shibboleth.idp.plugin.authn.webauthn.impl

Class LookupRegisteredCredentials

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction<BaseWebAuthnContext>
net.shibboleth.idp.plugin.authn.webauthn.impl.LookupRegisteredCredentials
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class LookupRegisteredCredentials extends AbstractWebAuthnAction<BaseWebAuthnContext>
An action that lookups existing registered credentials based on the username contained in the WebAuthn context and sets them back onto the context. Also sets the user.id from the userHandle associated with the username back onto the WebAuthn context.

If the username is not required and is not found in the context (e.g. failed c14n) the set of existing credentials will remain empty. If the username is required and is not found in the context an error event will be returned. If no credentials exist and the trigger event condition is set, an error event will be produced.

Event:
AuthnEventIds.INVALID_AUTHN_CTX
Postcondition:
BaseWebAuthnContext.setExistingCredentials() is either null if no existing credentials are found, or contains the credentials from the credential repository. BaseWebAuthnContext.getUserId() != null if the userHandle is found from the username.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • triggerEventOnNoCredentialsPredicate

      private Predicate<ProfileRequestContext> triggerEventOnNoCredentialsPredicate
      Should an non-proceed event be built if there are no credentials found?. Defaults to false.

    • noCredentialsEventId

      @Nonnull @NotEmpty private String noCredentialsEventId
      The EventID of the event to build if no credentials are found and triggerEventOnNoCredentialsPredicate evaluates to true.

    • repository

      @NonnullAfterInit private WebAuthnCredentialRepository repository
      The credential repository to use.

    • usernameRequiredPredicate

      @Nonnull private Predicate<ProfileRequestContext> usernameRequiredPredicate
      Is the username required? If not, just leave an empty set of existing credentials.

  • Constructor Details

    • LookupRegisteredCredentials

      public LookupRegisteredCredentials()
      Constructor.

  • Method Details

    • setUsernameRequired

      public void setUsernameRequired(boolean flag)
      Set a flag to determine if the username is required or not.
      Parameters:
      flag - is the username required?

    • setUsernameRequiredPredicate

      public void setUsernameRequiredPredicate(@Nonnull Predicate<ProfileRequestContext> predicate)
      Set a strategy to determine if the username is required or not.
      Parameters:
      predicate - the predicate to set.

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractWebAuthnAction<BaseWebAuthnContext>
      Throws:
      ComponentInitializationException

    • setTriggerEventOnNoCredentials

      public void setTriggerEventOnNoCredentials(boolean trigger)
      Set a flag which triggers a custom event to be built if no credentials are found.
      Parameters:
      trigger - the flag to set

    • setTriggerEventOnNoCredentialsPredicate

      public void setTriggerEventOnNoCredentialsPredicate(@Nonnull Predicate<ProfileRequestContext> predicate)
      Set a predicate which triggers a custom event to be built if no credentials are found.
      Parameters:
      predicate - the flag to set

    • setNoCredentialsEventId

      public void setNoCredentialsEventId(@Nonnull @NotEmpty String eventId)
      Set the EventID of the event to build if no credentials are found and triggerEventOnNoCredentials is set.
      Parameters:
      eventId - the eventId to build.

    • doExecute

      protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull BaseWebAuthnContext context)
      Performs this WebAuthn authentication action using the supplied WebAuthn context. Implementations should override this method.
      Overrides:
      doExecute in class AbstractWebAuthnAction<BaseWebAuthnContext>
      Parameters:
      profileRequestContext - the current IdP profile request context
      context - the WebAuthn context