Package net.shibboleth.idp.plugin.authn.webauthn.policy.impl

Class SecondFactorOnlyCredentialPolicyRule

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.idp.plugin.authn.webauthn.policy.impl.AbstractCredentialPolicyRule

net.shibboleth.idp.plugin.authn.webauthn.policy.impl.SecondFactorOnlyCredentialPolicyRule

All Implemented Interfaces:

CredentialPolicy, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

public class SecondFactorOnlyCredentialPolicyRule
extends AbstractCredentialPolicyRule

A CredentialPolicy that rejects credentials used in sole-factor mode if created by authenticators which should only be used for second factor authentication.

Nested Class Summary

Nested classes/interfaces inherited from interface net.shibboleth.idp.plugin.authn.webauthn.policy.CredentialPolicy

CredentialPolicy.CredentialPolicyOutcome

Field Summary

Fields

Modifier and Type	Field	Description
private final org.slf4j.Logger	log	Class logger.
private Set<com.yubico.fido.metadata.AAGUID>	secondFactorOnlyAuthenticators	A set of authenticators that should only be used for second factor authentication, based on their AAGUID.

Constructor Summary

Constructors

Constructor	Description
SecondFactorOnlyCredentialPolicyRule()	Constructor.

Method Summary

Modifier and Type	Method	Description
CredentialPolicy.CredentialPolicyOutcome	doEvaluate(EnhancedCredentialRecord credential, ProfileRequestContext prc, WebAuthnAuthenticationContext webAuthnContext)	Execute the policy.
void	setSecondFactorOnlyAuthenticators(Set<String> allowed)	Set the authenticators that should only be used for second factor authentication based on their AAGUID.

Methods inherited from class net.shibboleth.idp.plugin.authn.webauthn.policy.impl.AbstractCredentialPolicyRule

evaluate, getFidoMetadataService, setActivationCondition, setActivationConditionStrategy, setFidoMetadataService, setWebAuthnContextLookupStrategy

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

secondFactorOnlyAuthenticators

@Nonnull
@NotLive
@Unmodifiable
private Set<com.yubico.fido.metadata.AAGUID> secondFactorOnlyAuthenticators

A set of authenticators that should only be used for second factor authentication, based on their AAGUID.

Constructor Details

SecondFactorOnlyCredentialPolicyRule

public SecondFactorOnlyCredentialPolicyRule()

Constructor.

Method Details

setSecondFactorOnlyAuthenticators

public void setSecondFactorOnlyAuthenticators(Set<String> allowed)

Set the authenticators that should only be used for second factor authentication based on their AAGUID.

Parameters:

allowed - The second factor authenticators to set.

doEvaluate

public CredentialPolicy.CredentialPolicyOutcome doEvaluate(@Nonnull
 EnhancedCredentialRecord credential,
 @Nonnull
 ProfileRequestContext prc,
 @Nonnull
 WebAuthnAuthenticationContext webAuthnContext)

Execute the policy. Implementations should override this method.

Specified by:

doEvaluate in class AbstractCredentialPolicyRule

Parameters:

credential - the credential to check the policy rules for

prc - the profile request context

webAuthnContext - the WebAuthn authentication context

Returns:

the credential policy outcome