Package net.shibboleth.idp.plugin.authn.webauthn.context

Class BaseWebAuthnContext

java.lang.Object
org.opensaml.messaging.context.BaseContext
net.shibboleth.idp.plugin.authn.webauthn.context.BaseWebAuthnContext
All Implemented Interfaces:
Iterable<BaseContext>
Direct Known Subclasses:
WebAuthnAuthenticationContext, WebAuthnRegistrationContext
public class BaseWebAuthnContext extends BaseContext
The base WebAuthn context for both registration and authentication ceremonies.

  • Field Details

    • username

      @Nullable private String username
      The internal IdP username of the user, used as a key to store credentials against. In the registration flow, this is likely the principal name of the authenticated user. In the passwordless flow, this is likely a c14n version of the username input by the user. In the usernameless flow, this will be set to the username key in the credential repository found from the credential presented during authentication.

      If null in the authentication ceremony and we can not determine the user.id (and hence public key) to use, the flow will require a discoverable credential.

    • rawUsername

      @Nullable private String rawUsername
      The raw username entered by the user in one of the username collection steps. Is not transformed or canonicalized in anyway.

    • existingCredentials

      @Nullable private Collection<EnhancedCredentialRecord> existingCredentials
      Credentials that have already been registered with the IdP. The authenticator should use these to avoid creating duplicate credentials during registration, or to tell the browser which credentials to use during authentication.

    • credentialsSet

      private boolean credentialsSet
      Have the existingCredentials been set.

    • serverChallenge

      @Nullable private byte[] serverChallenge
      The challenge sent to the authenticator in both registration and authentication ceremonies.

    • userId

      @Nullable private byte[] userId
      The user.id supplied to the authenticator during registration. Generated by the IdP. Returned in assertion responses as a userHandle.

    • userVerificationRequirement

      @Nullable private com.yubico.webauthn.data.UserVerificationRequirement userVerificationRequirement
      Does the authentication/registration require user verification?

  • Constructor Details

    • BaseWebAuthnContext

      public BaseWebAuthnContext()

  • Method Details

    • isWebAuthnAvailable

      public boolean isWebAuthnAvailable()
      Does the user have existing, registered, credentials available to use for authentication. Only returns false if the collection of existing credentials has been set and is empty. Otherwise we assume WebAuthn is available to prevent this being used as a signal to fallback to an inferior authentication method when we do not yet know if the user has any credentials.
      Returns:
      true iff existing credentials are available, false otherwise.

    • getUsername

      @Nullable public String getUsername()
      Gets the internal IdP username.
      Returns:
      the internal username

    • setUsername

      @Nonnull public BaseWebAuthnContext setUsername(@Nullable String name)
      Sets the internal IdP username.
      Parameters:
      name - the internal username
      Returns:
      this context

    • getRawUsername

      @Nullable public String getRawUsername()
      Gets the raw username entered by the user in one of the username collection steps.
      Returns:
      the raw username entered by the user

    • setRawUsername

      @Nonnull public BaseWebAuthnContext setRawUsername(@Nullable String name)
      Sets the raw username entered by the user in one of the username collection steps.
      Parameters:
      name - the raw username entered by the user
      Returns:
      this context

    • setExistingCredentials

      @Nonnull public BaseWebAuthnContext setExistingCredentials(@Nullable Collection<EnhancedCredentialRecord> credentials)
      Set the user's credentials that have already been registered with the credential repository.
      Parameters:
      credentials - the set of credentials
      Returns:
      this context

    • getExistingCredentials

      @Nonnull @Unmodifiable @NotLive public Collection<EnhancedCredentialRecord> getExistingCredentials()
      Get the user's credentials that have already been registered with the credential repository.
      Returns:
      the existing credentials.

    • getServerChallenge

      @Nullable public byte[] getServerChallenge()
      Get the server challenge sent to (or to send to) the authenticator.
      Returns:
      the server challenge.

    • setServerChallenge

      @Nonnull public BaseWebAuthnContext setServerChallenge(@Nonnull byte[] challenge)
      Set the server challenge that forms part of the information the client authenticator needs to sign.
      Parameters:
      challenge - the challenge, must not be empty and must be at minimum 16 bytes.
      Returns:
      this context.

    • setUserId

      @Nonnull public BaseWebAuthnContext setUserId(@Nonnull byte[] id)
      Set the WebAuthn user.id used to map public key credentials to the user's account. Maximum 64 bytes.
      Parameters:
      id - The user.id to set.
      Returns:
      this context

    • getUserId

      @Nullable public byte[] getUserId()
      Get the WebAuthn user.id used to map public key credentials to the user's account. Sent to the authenticator during credential creation. Referred to as the userHandle in responses from the authenticator during authentication.
      Returns:
      the user.id.

    • setUserVerificationRequirement

      @Nonnull public BaseWebAuthnContext setUserVerificationRequirement(@Nullable com.yubico.webauthn.data.UserVerificationRequirement requirement)
      Set the user verification requirement.
      Parameters:
      requirement - The user verification requirement to set.
      Returns:
      this context

    • getUserVerificationRequirement

      @Nullable public com.yubico.webauthn.data.UserVerificationRequirement getUserVerificationRequirement()
      Get the user verification requirement.
      Returns:
      the user verification requirement.