Package net.shibboleth.idp.plugin.authn.webauthn.policy.impl

Class AbstractCredentialPolicyRule

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.idp.plugin.authn.webauthn.policy.impl.AbstractCredentialPolicyRule

All Implemented Interfaces:

CredentialPolicy, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

Direct Known Subclasses:

ChainingCredentialPolicyRule, FunctionalCredentialPolicyRule, SecondFactorOnlyCredentialPolicyRule

@ThreadSafeAfterInit
public abstract class AbstractCredentialPolicyRule
extends AbstractIdentifiableInitializableComponent
implements CredentialPolicy

A base class for credential policies. Ensures the credential is not null before it is passed to the policy rule implementation. Can be enabled and disabled using the activiation condition.

Returns CredentialPolicy.CredentialPolicyOutcome.ACCEPT if the credential is accepted, returns CredentialPolicy.CredentialPolicyOutcome.REJECT if the credential is rejected, returns CredentialPolicy.CredentialPolicyOutcome.IGNORE if the rule is to be ignored.

Nested Class Summary

Nested classes/interfaces inherited from interface net.shibboleth.idp.plugin.authn.webauthn.policy.CredentialPolicy

CredentialPolicy.CredentialPolicyOutcome

Field Summary

Fields

Modifier and Type	Field	Description
private BiPredicate<EnhancedCredentialRecord,ProfileRequestContext>	activationCondition	Does this policy rule apply? Default is true.
private com.yubico.fido.metadata.FidoMetadataService	fidoMetadataService	FIDO metadata service resolver.
private final org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,WebAuthnAuthenticationContext>	webauthnContextLookupStrategy	Lookup strategy to locate the WebAuthn context.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	AbstractCredentialPolicyRule()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected abstract CredentialPolicy.CredentialPolicyOutcome	doEvaluate(EnhancedCredentialRecord credential, ProfileRequestContext prc, WebAuthnAuthenticationContext webAuthnContext)	Execute the policy.
CredentialPolicy.CredentialPolicyOutcome	evaluate(EnhancedCredentialRecord credential, ProfileRequestContext prc)	Execute the policy.
protected com.yubico.fido.metadata.FidoMetadataService	getFidoMetadataService()	Get the metadata service to use.
void	setActivationCondition(boolean flag)	Set an activation condition for this policy rule.
void	setActivationConditionStrategy(BiPredicate<EnhancedCredentialRecord,ProfileRequestContext> condition)	Set an activation condition for this policy rule.
void	setFidoMetadataService(com.yubico.fido.metadata.FidoMetadataService trustSource)	Set the FIDO metadata source.
void	setWebAuthnContextLookupStrategy(Function<ProfileRequestContext,WebAuthnAuthenticationContext> strategy)	Set the WebAuthn context lookup strategy to use.

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

fidoMetadataService

@Nullable
private com.yubico.fido.metadata.FidoMetadataService fidoMetadataService

FIDO metadata service resolver.

activationCondition

@Nonnull
private BiPredicate<EnhancedCredentialRecord,ProfileRequestContext> activationCondition

Does this policy rule apply? Default is true.

webauthnContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,WebAuthnAuthenticationContext> webauthnContextLookupStrategy

Lookup strategy to locate the WebAuthn context.

Constructor Details

AbstractCredentialPolicyRule

protected AbstractCredentialPolicyRule()

Constructor.

Method Details

setWebAuthnContextLookupStrategy

public void setWebAuthnContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,WebAuthnAuthenticationContext> strategy)

Set the WebAuthn context lookup strategy to use.

Parameters:

strategy - lookup strategy

setActivationConditionStrategy

public void setActivationConditionStrategy(@Nonnull
 BiPredicate<EnhancedCredentialRecord,ProfileRequestContext> condition)

Set an activation condition for this policy rule.

Parameters:

condition - condition to set

setActivationCondition

public void setActivationCondition(boolean flag)

Set an activation condition for this policy rule.

Parameters:

flag - the flag to set

setFidoMetadataService

public void setFidoMetadataService(@Nullable
 com.yubico.fido.metadata.FidoMetadataService trustSource)

Set the FIDO metadata source.

Parameters:

trustSource - the attestation trust source.

getFidoMetadataService

@Nullable
protected com.yubico.fido.metadata.FidoMetadataService getFidoMetadataService()

Get the metadata service to use.

Returns:

the metadata service.

evaluate

public CredentialPolicy.CredentialPolicyOutcome evaluate(@Nonnull
 EnhancedCredentialRecord credential,
 @Nonnull
 ProfileRequestContext prc)

Execute the policy.

Tests the policy is active, extracts and presents the WebAuthnAuthenticationContext context from the ProfileRequestContext for convenience.

Specified by:

evaluate in interface CredentialPolicy

Parameters:

credential - the credential to accept or reject.

prc - the profile request context

Returns:

CredentialPolicy.CredentialPolicyOutcome.ACCEPT if allowed, CredentialPolicy.CredentialPolicyOutcome.REJECT if rejected, and CredentialPolicy.CredentialPolicyOutcome.IGNORE otherwise.

doEvaluate

protected abstract CredentialPolicy.CredentialPolicyOutcome doEvaluate(@Nonnull
 EnhancedCredentialRecord credential,
 @Nonnull
 ProfileRequestContext prc,
 @Nonnull
 WebAuthnAuthenticationContext webAuthnContext)

Execute the policy. Implementations should override this method.

Parameters:

credential - the credential to check the policy rules for

prc - the profile request context

webAuthnContext - the WebAuthn authentication context

Returns:

the credential policy outcome