Package net.shibboleth.idp.plugin.authn.webauthn.impl

Class CheckUserHandleExistsIfNoAllowCredentials

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction<WebAuthnAuthenticationContext>

net.shibboleth.idp.plugin.authn.webauthn.impl.CheckUserHandleExistsIfNoAllowCredentials

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class CheckUserHandleExistsIfNoAllowCredentials
extends AbstractWebAuthnAction<WebAuthnAuthenticationContext>

An action which checks if the userHandle is returned in the assertion response if the set of allowedCredentials in the request was empty. If they are empty, the userHandle must be returned, if they are not empty the userHandle may be returned in the response.

This generally protects against bad behaviour from authenticators for the rest of the flow.

Since:

1.1.0

Event:

{EventIds#INVALID_PROFILE_CTX}, {AuthnEventIds#INVALID_CREDENTIALS}

Precondition:

ProfileRequestContext.getSubcontext(WebAuthnRegistrationContext.class) != null

Postcondition:

a non-proceed event occurs if the userHandle was not present when the set of allowed credentials is empty.

Field Summary

Fields

Modifier and Type	Field	Description
private com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs>	assertion	The stashed assertion from the context.
private final org.slf4j.Logger	log	Class logger.
private com.yubico.webauthn.data.PublicKeyCredentialRequestOptions	requestOptions	The stashed request options from the context.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	CheckUserHandleExistsIfNoAllowCredentials()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext, WebAuthnAuthenticationContext context)	Performs this WebAuthn authentication action using the supplied WebAuthn context.
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, WebAuthnAuthenticationContext context)	Performs this authentication action's pre-execute step.

Methods inherited from class net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction

doExecute, doInitialize, doPreExecute, enhancedCredentialRecord, getAaguidMetadata, getAaguidService, getAuthenticatorMetadata, getCredentialRepository, getFidoMetadataService, getWebAuthnClient, setAaguidService, setCredentialRepository, setFidoMetadataService, setWebAuthnClient, setWebAuthnContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

assertion

private com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> assertion

The stashed assertion from the context.

requestOptions

private com.yubico.webauthn.data.PublicKeyCredentialRequestOptions requestOptions

The stashed request options from the context.

Constructor Details

CheckUserHandleExistsIfNoAllowCredentials

protected CheckUserHandleExistsIfNoAllowCredentials()

Constructor.

Method Details

doPreExecute

protected boolean doPreExecute(ProfileRequestContext profileRequestContext,
 WebAuthnAuthenticationContext context)

Performs this authentication action's pre-execute step. Default implementation just returns true.

Overrides:

doPreExecute in class AbstractWebAuthnAction<WebAuthnAuthenticationContext>

Parameters:

profileRequestContext - the current IdP profile request context

context - the WebAuthn context

Returns:

true iff execution should continue

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 WebAuthnAuthenticationContext context)

Description copied from class: AbstractWebAuthnAction

Performs this WebAuthn authentication action using the supplied WebAuthn context. Implementations should override this method.

Overrides:

doExecute in class AbstractWebAuthnAction<WebAuthnAuthenticationContext>

Parameters:

profileRequestContext - the current IdP profile request context

context - the WebAuthn context