Package net.shibboleth.idp.plugin.authn.webauthn.admin.impl

Class CheckRegistrationPolicy

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction<WebAuthnRegistrationContext>

net.shibboleth.idp.plugin.authn.webauthn.admin.impl.CheckRegistrationPolicy

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class CheckRegistrationPolicy
extends AbstractWebAuthnAction<WebAuthnRegistrationContext>

A registration policy engine action that checks with the configured policy if the authenticator can be used to register credentials with the IdP.

Event:

{WebAuthnRegistrationEventIds#INVALID_REGISTRATION_CTX}

Precondition:

ProfileRequestContext.getSubcontext(WebAuthnRegistrationContext.class) != null

Postcondition:

the authenticator is allowed to register a credential, or an error event is triggered

Field Summary

Fields

Modifier and Type	Field	Description
private com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAttestationResponse,com.yubico.webauthn.data.ClientRegistrationExtensionOutputs>	attestation	The stashed attestation response.
private AuthenticatorPolicy	authenticatorPolicy	The authenticator policy to check.
private final org.slf4j.Logger	log	Class logger.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	CheckRegistrationPolicy()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext, WebAuthnRegistrationContext context)	Performs this WebAuthn authentication action using the supplied WebAuthn context.
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, WebAuthnRegistrationContext context)	Performs this authentication action's pre-execute step.
void	setAuthenticatorPolicy(AuthenticatorPolicy policy)	Set the policy to verify that the authenticator is authorized before the credential is stored.

Methods inherited from class net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction

doExecute, doInitialize, doPreExecute, enhancedCredentialRecord, getAaguidMetadata, getAaguidService, getAuthenticatorMetadata, getCredentialRepository, getFidoMetadataService, getWebAuthnClient, setAaguidService, setCredentialRepository, setFidoMetadataService, setWebAuthnClient, setWebAuthnContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

attestation

@NonnullBeforeExec
private com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAttestationResponse,com.yubico.webauthn.data.ClientRegistrationExtensionOutputs> attestation

The stashed attestation response.

authenticatorPolicy

@Nullable
private AuthenticatorPolicy authenticatorPolicy

The authenticator policy to check.

Constructor Details

CheckRegistrationPolicy

protected CheckRegistrationPolicy()

Constructor.

Method Details

setAuthenticatorPolicy

public void setAuthenticatorPolicy(@Nullable
 AuthenticatorPolicy policy)

Set the policy to verify that the authenticator is authorized before the credential is stored.

Parameters:

policy - The authenticator policy to set.

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 WebAuthnRegistrationContext context)

Performs this authentication action's pre-execute step. Default implementation just returns true.

Overrides:

doPreExecute in class AbstractWebAuthnAction<WebAuthnRegistrationContext>

Parameters:

profileRequestContext - the current IdP profile request context

context - the WebAuthn context

Returns:

true iff execution should continue

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 WebAuthnRegistrationContext context)

Description copied from class: AbstractWebAuthnAction

Performs this WebAuthn authentication action using the supplied WebAuthn context. Implementations should override this method.

Overrides:

doExecute in class AbstractWebAuthnAction<WebAuthnRegistrationContext>

Parameters:

profileRequestContext - the current IdP profile request context

context - the WebAuthn context