Package net.shibboleth.idp.plugin.authn.webauthn.impl

Class LookupRegisteredCredentialsFromUserHandle

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction<WebAuthnAuthenticationContext>

net.shibboleth.idp.plugin.authn.webauthn.impl.LookupRegisteredCredentialsFromUserHandle

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class LookupRegisteredCredentialsFromUserHandle
extends AbstractWebAuthnAction<WebAuthnAuthenticationContext>

An action that lookups existing registered credentials from the userHandle supplied in the authenticators assertion response and sets them back onto the context. If no credentials exist and the trigger condition is set, an error event will be produced.

Also ensures the username found from the userHandle matches that in the authentication context if supplied.

Event:

AuthnEventIds.INVALID_AUTHN_CTX, AuthnEventIds.INVALID_CREDENTIALS

Postcondition:

BaseWebAuthnContext.setExistingCredentials() is either null if no existing credentials are found, or contains the credentials from the credential repository

Field Summary

Fields

Modifier and Type	Field	Description
private com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs>	assertion	The stashed assertion from the context.
private final org.slf4j.Logger	log	Class logger.
private String	noCredentialsEventId	The EventID of the event to build if no credentials are found and triggerEventOnNoCredentialsPredicate evaluates to true.
private WebAuthnCredentialRepository	repository	The credential repository to use.
private com.yubico.webauthn.data.PublicKeyCredentialRequestOptions	requestOptions	The stashed request options from the context.
private Predicate<ProfileRequestContext>	triggerEventOnNoCredentialsPredicate	Should an event be built if there are no credentials found?.

Constructor Summary

Constructors

Constructor	Description
LookupRegisteredCredentialsFromUserHandle()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext, WebAuthnAuthenticationContext context)	Performs this WebAuthn authentication action using the supplied WebAuthn context.
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, WebAuthnAuthenticationContext context)	Performs this authentication action's pre-execute step.
void	setNoCredentialsEventId(String eventId)	Set the EventID of the event to build if no credentials are found and triggerEventOnNoCredentials is set.
void	setTriggerEventOnNoCredentials(boolean trigger)	Set a flag which triggers a custom event to be built if no credentials are found.
void	setTriggerEventOnNoCredentialsPredicate(Predicate<ProfileRequestContext> predicate)	Set a predicate which triggers a custom event to be built if no credentials are found.

Methods inherited from class net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction

doExecute, doPreExecute, enhancedCredentialRecord, getAaguidMetadata, getAaguidService, getAuthenticatorMetadata, getCredentialRepository, getFidoMetadataService, getWebAuthnClient, setAaguidService, setCredentialRepository, setFidoMetadataService, setWebAuthnClient, setWebAuthnContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

triggerEventOnNoCredentialsPredicate

private Predicate<ProfileRequestContext> triggerEventOnNoCredentialsPredicate

Should an event be built if there are no credentials found?. Defaults to false.

noCredentialsEventId

@Nonnull
@NotEmpty
private String noCredentialsEventId

The EventID of the event to build if no credentials are found and triggerEventOnNoCredentialsPredicate evaluates to true.

repository

@NonnullAfterInit
private WebAuthnCredentialRepository repository

The credential repository to use.

assertion

private com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> assertion

The stashed assertion from the context.

requestOptions

private com.yubico.webauthn.data.PublicKeyCredentialRequestOptions requestOptions

The stashed request options from the context.

Constructor Details

LookupRegisteredCredentialsFromUserHandle

public LookupRegisteredCredentialsFromUserHandle()

Constructor.

Method Details

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractWebAuthnAction<WebAuthnAuthenticationContext>

Throws:

ComponentInitializationException

setTriggerEventOnNoCredentials

public void setTriggerEventOnNoCredentials(boolean trigger)

Set a flag which triggers a custom event to be built if no credentials are found.

Parameters:

trigger - the flag to set

setTriggerEventOnNoCredentialsPredicate

public void setTriggerEventOnNoCredentialsPredicate(@Nonnull
 Predicate<ProfileRequestContext> predicate)

Set a predicate which triggers a custom event to be built if no credentials are found.

Parameters:

predicate - the flag to set

setNoCredentialsEventId

public void setNoCredentialsEventId(@Nonnull @NotEmpty
 String eventId)

Set the EventID of the event to build if no credentials are found and triggerEventOnNoCredentials is set.

Parameters:

eventId - the eventId to build.

doPreExecute

protected boolean doPreExecute(ProfileRequestContext profileRequestContext,
 WebAuthnAuthenticationContext context)

Performs this authentication action's pre-execute step. Default implementation just returns true.

Overrides:

doPreExecute in class AbstractWebAuthnAction<WebAuthnAuthenticationContext>

Parameters:

profileRequestContext - the current IdP profile request context

context - the WebAuthn context

Returns:

true iff execution should continue

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 WebAuthnAuthenticationContext context)

Performs this WebAuthn authentication action using the supplied WebAuthn context. Implementations should override this method.

Overrides:

doExecute in class AbstractWebAuthnAction<WebAuthnAuthenticationContext>

Parameters:

profileRequestContext - the current IdP profile request context

context - the WebAuthn context