Package net.shibboleth.idp.plugin.authn.webauthn.metadata.impl

Class FidoMetadataServiceFactory

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.idp.plugin.authn.webauthn.metadata.impl.FidoMetadataServiceFactory
All Implemented Interfaces:
Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent, FactoryBean<com.yubico.fido.metadata.FidoMetadataService>
public class FidoMetadataServiceFactory extends AbstractIdentifiableInitializableComponent implements FactoryBean<com.yubico.fido.metadata.FidoMetadataService>
Spring factory bean for creating a FidoMetadataService. Only downloads or loads FIDO metadata on creation.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • trustRootFiles

      @Nonnull @NotLive private List<Resource> trustRootFiles
      The locations of the trust roots that verify the downloaded metadata's signature.

    • cacheFile

      @Nullable private Resource cacheFile
      Where to cache the metadata blob.

    • metadataBlobUrl

      @Nullable private Resource metadataBlobUrl
      The HTTPS location of the metadata blob to download.

    • metadataBlobFile

      @Nullable private Resource metadataBlobFile
      The File location of the metadata blob. If this file is specified, metadata will never be downloaded over HTTP.

    • verifyDownloadOnly

      private boolean verifyDownloadOnly
      Only verify the signature in the blob file from a fresh download.

    • expectedLegalHeaders

      @NonnullAfterInit private String[] expectedLegalHeaders
      The expected set of legal headers on the FIDO metadata blob.

    • crls

      @Nonnull private List<Resource> crls
      A List of CRLs to check the revocation status of the metadata signature.

  • Constructor Details

    • FidoMetadataServiceFactory

      public FidoMetadataServiceFactory()
      Constructor.

  • Method Details

    • getObject

      public com.yubico.fido.metadata.FidoMetadataService getObject() throws Exception
      Specified by:
      getObject in interface FactoryBean<com.yubico.fido.metadata.FidoMetadataService>
      Throws:
      Exception

    • convertTrustRoots

      private Set<TrustAnchor> convertTrustRoots(@Nonnull List<Resource> trustRootFiles)
      Convert the list of trust root files into Java TrustAnchors. Any that fail to be converted throw a fatal bean exception.
      Parameters:
      trustRootFiles - the list of files to use as trust roots
      Returns:
      a set of converted TrustAnchors.
      Throws:
      FatalBeanException - if a trust root file does not exist or cannot be converted to a TrustAnchor
      Since:
      1.4.3

    • loadCrls

      @Nonnull private Collection<CRL> loadCrls()
      Load CRLs from the given set of CRL resources into a collection of CRL objects.
      Returns:
      the loaded CRL collection

    • loadMetadataJwt

      @Nonnull private String loadMetadataJwt(@Nonnull Resource file) throws IOException
      Load the given metadata blob file into a String.
      Parameters:
      file - the metadata blob file to load
      Returns:
      the metadata blob as a string
      Throws:
      IOException - if the file does not exist or there is a problem reading from the file

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractIdentifiedInitializableComponent
      Throws:
      ComponentInitializationException

    • setCacheFile

      public void setCacheFile(@Nullable String file)
      Set where to cache the metadata blob. As the cachefile does not need to exist before the metadata is downloaded, we restrict the file to be a FileSystemResource type.
      Parameters:
      file - The cacheFile to set.

    • getCacheFile

      @Nullable private Resource getCacheFile()
      Get where to cache the metadata blob.
      Returns:
      where to cache the metadata blob.

    • setTrustRootFile

      @Deprecated(since="1.4.3", forRemoval=true) public void setTrustRootFile(@Nullable Resource file)
      Deprecated, for removal: This API element is subject to removal in a future version.
      use setTrustRootFiles(List)
      Set the trust root file.
      Parameters:
      file - the trust root file

    • getTrustRootFiles

      @Nonnull @NotLive public List<Resource> getTrustRootFiles()
      Get the trust root files.
      Returns:
      the list of trust root files.
      Since:
      1.4.3

    • setTrustRootFiles

      public void setTrustRootFiles(@Nullable List<Resource> roots)
      Set the trust roots.
      Parameters:
      roots - the trust roots
      Since:
      1.4.3

    • getMetadataBlobUrl

      @Nullable private Resource getMetadataBlobUrl()
      Get the URL of the metadata blob file to fetch.
      Returns:
      the metadata blob file URL.

    • setMetadataBlobUrl

      public void setMetadataBlobUrl(@Nullable Resource url)
      Set the URL of the metadata blob file to fetch.
      Parameters:
      url - the metadata blob file

    • setMetadataBlobFile

      public void setMetadataBlobFile(@Nullable Resource file)
      Set the location of the local metadata blob file. If this file is specified, metadata will never be downloaded over HTTP.
      Parameters:
      file - The metadataBlobFile to set.

    • getMetadataBlobFile

      @Nullable private Resource getMetadataBlobFile()
      Get the metadata blob file.
      Returns:
      the metadata blob file.

    • setExpectedLegalHeaders

      public void setExpectedLegalHeaders(@Nonnull String[] headers)
      Set the expected legal headers on the FIDO metadata blob.
      Parameters:
      headers - The expected legal headers to set.

    • getExpectedLegalHeaders

      @NonnullAfterInit private String[] getExpectedLegalHeaders()
      Get the expected legal headers on the FIDO metadata blob.
      Returns:
      the expected legal headers.

    • setCrls

      public void setCrls(@Nullable List<Resource> revocationLists)
      Set the CRLs to use to check the revocation status of the metadata signature.
      Parameters:
      revocationLists - The crls to set.

    • getCrls

      @Nonnull @Live private List<Resource> getCrls()
      Get the CRLs to use to check the revocation status of the metadata signature.
      Returns:
      the crls.

    • setVerifyDownloadOnly

      public void setVerifyDownloadOnly(boolean downloadOnly)
      Set if signatures are only verified in the blob file from a fresh download.
      Parameters:
      downloadOnly - should we verify only newly downloaded metadata.

    • isVerifyDownloadOnly

      public boolean isVerifyDownloadOnly()
      Only verify the signature in the blob file from a fresh download?
      Returns:
      true if signatures are only verified in a new blob file download (i.e. ignored from a cache file), false if they are always verified, no matter where the blob is loaded from.

    • getObjectType

      public Class<?> getObjectType()
      Specified by:
      getObjectType in interface FactoryBean<com.yubico.fido.metadata.FidoMetadataService>