Package net.shibboleth.idp.plugin.authn.webauthn.context

# Class BaseWebAuthnContext

java.lang.Object
org.opensaml.messaging.context.BaseContext
net.shibboleth.idp.plugin.authn.webauthn.context.BaseWebAuthnContext

All Implemented Interfaces:
  `Iterable<BaseContext>`

Direct Known Subclasses:
  `WebAuthnAuthenticationContext`, `WebAuthnRegistrationContext`

public class BaseWebAuthnContext extends BaseContext
The base WebAuthn context for both registration and authentication ceremonies.

## Nested Class Summary

## Nested classes/interfaces inherited from class org.opensaml.messaging.context.BaseContext

`BaseContext.ContextSetNoRemoveIteratorDecorator, BaseContext.DeprecatedContextClassNameLookAside`

## Field Summary

Fields
Modifier and Type
Field
Description
`private boolean`
`credentialsSet`
Have the existingCredentials been set.
`private Collection<EnhancedCredentialRecord>`
`existingCredentials`
Credentials that have already been registered with the IdP.
`private String`
`rawUsername`
The raw username entered by the user in one of the username collection steps.
`private byte[]`
`serverChallenge`
The challenge sent to the authenticator in both registration and authentication ceremonies.
`private byte[]`
`userId`
The user.id supplied to the authenticator during registration.
`private String`
`username`
The internal IdP username of the user, used as a key to store credentials against.
`private com.yubico.webauthn.data.UserVerificationRequirement`
`userVerificationRequirement`
Does the authentication/registration require user verification?

## Constructor Summary

Constructors
Constructor
Description
`BaseWebAuthnContext()`

## Method Summary

Modifier and Type
Method
Description
`Collection<EnhancedCredentialRecord>`
`getExistingCredentials()`
Get the user's credentials that have already been registered with the credential repository.
`String`
`getRawUsername()`
Gets the raw username entered by the user in one of the username collection steps.
`byte[]`
`getServerChallenge()`
Get the server challenge sent to (or to send to) the authenticator.
`byte[]`
`getUserId()`
Get the WebAuthn user.id used to map public key credentials to the user's account.
`String`
`getUsername()`
Gets the internal IdP username.
`com.yubico.webauthn.data.UserVerificationRequirement`
`getUserVerificationRequirement()`
Get the user verification requirement.
`boolean`
`isWebAuthnAvailable()`
Does the user have existing, registered, credentials available to use for authentication.
`BaseWebAuthnContext`
`setExistingCredentials(Collection<EnhancedCredentialRecord> credentials)`
Set the user's credentials that have already been registered with the credential repository.
`BaseWebAuthnContext`
`setRawUsername(String name)`
Sets the raw username entered by the user in one of the username collection steps.
`BaseWebAuthnContext`
`setServerChallenge(byte[] challenge)`
Set the server challenge that forms part of the information the client authenticator needs to sign.
`BaseWebAuthnContext`
`setUserId(byte[] id)`
Set the WebAuthn user.id used to map public key credentials to the user's account.
`BaseWebAuthnContext`
`setUsername(String name)`
Sets the internal IdP username.
`BaseWebAuthnContext`
`setUserVerificationRequirement(com.yubico.webauthn.data.UserVerificationRequirement requirement)`
Set the user verification requirement.

### Methods inherited from class org.opensaml.messaging.context.BaseContext

`addSubcontext, addSubcontext, clearSubcontexts, containsSubcontext, createSubcontext, ensureSubcontext, ensureSubcontext, getParent, getSubcontext, getSubcontext, getSubcontext, getSubcontext, iterator, removeFromParent, removeSubcontext, removeSubcontext, setParent`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface java.lang.Iterable

`forEach, spliterator`

## Field Details

### username

@Nullable private String username
The internal IdP username of the user, used as a key to store credentials against. In the registration flow, this is likely the principal name of the authenticated user. In the passwordless flow, this is likely a c14n version of the username input by the user. In the usernameless flow, this will be set to the username key in the credential repository found from the credential presented during authentication.

If `null` in the authentication ceremony and we can not determine the user.id (and hence public key) to use, the flow will require a discoverable credential.

### rawUsername

@Nullable private String rawUsername
The raw username entered by the user in one of the username collection steps. Is not transformed or canonicalized in anyway.

### existingCredentials

@Nullable private Collection<EnhancedCredentialRecord> existingCredentials
Credentials that have already been registered with the IdP. The authenticator should use these to avoid creating duplicate credentials during registration, or to tell the browser which credentials to use during authentication.

### credentialsSet

private boolean credentialsSet
Have the existingCredentials been set.

### serverChallenge

@Nullable private byte[] serverChallenge
The challenge sent to the authenticator in both registration and authentication ceremonies.

### userId

@Nullable private byte[] userId
The user.id supplied to the authenticator during registration. Generated by the IdP. Returned in assertion responses as a userHandle.

### userVerificationRequirement

@Nullable private com.yubico.webauthn.data.UserVerificationRequirement userVerificationRequirement
Does the authentication/registration require user verification?

## Constructor Details

### BaseWebAuthnContext

public BaseWebAuthnContext()

## Method Details

### isWebAuthnAvailable

public boolean isWebAuthnAvailable()
Does the user have existing, registered, credentials available to use for authentication. Only returns false if the collection of existing credentials has been set and is empty. Otherwise we assume WebAuthn is available to prevent this being used as a signal to fallback to an inferior authentication method when we do not yet know if the user has any credentials.

Returns:
  true iff existing credentials are available, false otherwise.

### getUsername

@Nullable public String getUsername()
Gets the internal IdP username.

Returns:
  the internal username

### setUsername

@Nonnull public BaseWebAuthnContext setUsername(@Nullable String name)
Sets the internal IdP username.

Parameters:
  `name` - the internal username
Returns:
  this context

### getRawUsername

@Nullable public String getRawUsername()
Gets the raw username entered by the user in one of the username collection steps.

Returns:
  the raw username entered by the user

### setRawUsername

@Nonnull public BaseWebAuthnContext setRawUsername(@Nullable String name)
Sets the raw username entered by the user in one of the username collection steps.

Parameters:
  `name` - the raw username entered by the user
Returns:
  this context

### setExistingCredentials

@Nonnull public BaseWebAuthnContext setExistingCredentials(@Nullable Collection<EnhancedCredentialRecord> credentials)
Set the user's credentials that have already been registered with the credential repository.

Parameters:
  `credentials` - the set of credentials
Returns:
  this context

### getExistingCredentials

@Nonnull @Unmodifiable @NotLive public Collection<EnhancedCredentialRecord> getExistingCredentials()
Get the user's credentials that have already been registered with the credential repository.

Returns:
  the existing credentials.

### getServerChallenge

@Nullable public byte[] getServerChallenge()
Get the server challenge sent to (or to send to) the authenticator.

Returns:
  the server challenge.

### setServerChallenge

@Nonnull public BaseWebAuthnContext setServerChallenge(@Nonnull byte[] challenge)
Set the server challenge that forms part of the information the client authenticator needs to sign.

Parameters:
  `challenge` - the challenge, must not be empty and must be at minimum 16 bytes.
Returns:
  this context.

### setUserId

@Nonnull public BaseWebAuthnContext setUserId(@Nonnull byte[] id)
Set the WebAuthn user.id used to map public key credentials to the user's account. Maximum 64 bytes.

Parameters:
  `id` - The user.id to set.
Returns:
  this context

### getUserId

@Nullable public byte[] getUserId()
Get the WebAuthn user.id used to map public key credentials to the user's account. Sent to the authenticator during credential creation. Referred to as the userHandle in responses from the authenticator during authentication.

Returns:
  the user.id.

### setUserVerificationRequirement

@Nonnull public BaseWebAuthnContext setUserVerificationRequirement(@Nullable com.yubico.webauthn.data.UserVerificationRequirement requirement)
Set the user verification requirement.

Parameters:
  `requirement` - The user verification requirement to set.
Returns:
  this context

### getUserVerificationRequirement

@Nullable public com.yubico.webauthn.data.UserVerificationRequirement getUserVerificationRequirement()
Get the user verification requirement.

Returns:
  the user verification requirement.