Package net.shibboleth.idp.plugin.authn.webauthn.impl

# Class ValidateWebAuthnAssertion

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.authn.AbstractAuthenticationAction
net.shibboleth.idp.authn.AbstractValidationAction
net.shibboleth.idp.authn.impl.AbstractAuditingValidationAction
net.shibboleth.idp.plugin.authn.webauthn.impl.ValidateWebAuthnAssertion

All Implemented Interfaces:
  `PrincipalSupportingComponent`, `Component`, `DestructableComponent`, `InitializableComponent`, `ProfileAction`, `Aware`, `MessageSource`, `MessageSourceAware`, `Action`

public class ValidateWebAuthnAssertion extends AbstractAuditingValidationAction
An action that validates a WebAuthn authenticator assertion that results from a call to WebAuthn's 'get' credential API. If successful, populates the Subject with a `UsernamePrincipal` based on the username in the authentication context and a `WebAuthnUserIdPrinicpal` based on the user.id in the authentication context.

Event:
  `AuthnEventIds.INVALID_CREDENTIALS`, `AuthnEventIds.INVALID_AUTHN_CTX`

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`static class`
`ValidateWebAuthnAssertion.WebAuthnCleanupHook`
A default cleanup hook that removes the `WebAuthnAuthenticationContext` from the tree.

## Field Summary

Fields
Modifier and Type
Field
Description
`private WebAuthnAuthenticationContext`
`context`
The WebAuthn authentication context.
`private WebAuthnCredentialRepository`
`credentialRepository`
The credential repository to validate assertion responses against.
`private final org.slf4j.Logger`
`log`
Class logger.
`private com.yubico.webauthn.data.PublicKeyCredentialRequestOptions`
`publicKeyCredentialRequestOptions`
The options used to create the authentication request.
`private Predicate<ProfileRequestContext>`
`updateLastUsedTime`
Should we updated the last used time on successful validation?.
`private Predicate<ProfileRequestContext>`
`updateSignatureCount`
Should we update the signature count on the credential in the repository after successful validation? Defaults to true.
`private WebAuthnAuthenticationClient`
`webAuthnClient`
The WebAuthn client to use.
`private final Function<ProfileRequestContext,WebAuthnAuthenticationContext>`
`webauthnContextLookupStrategy`
Strategy used to locate or create the `WebAuthnAuthenticationContext` to populate.

## Constructor Summary

Constructors
Constructor
Description
`ValidateWebAuthnAssertion()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`protected void`
`buildAuthenticationResult(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)`
`protected void`
`doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)`
`protected void`
`doInitialize()`
`protected boolean`
`doPreExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)`
`protected Subject`
`populateSubject(Subject subject)`
`void`
`setCredentialRepository(WebAuthnCredentialRepository repository)`
Set the credential repository used to store WebAuthn credentials.
`void`
`setUpdateLastUsedTimePredicate(Predicate<ProfileRequestContext> predicate)`
Set the predicate to determine if we should update the last used time on the credential in the repository after successful validation?
`void`
`setUpdateSignatureCount(boolean flag)`
Set the flag to determine if we should update the signature count on the credential in the repository after successful validation?
`void`
`setUpdateSignatureCountPredicate(Predicate<ProfileRequestContext> predicate)`
Set the predicate to determine if we should update the signature count on the credential in the repository after successful validation?
`void`
`setWebAuthnClient(WebAuthnAuthenticationClient client)`
Set the WebAuthn client used to handle validation of the authentication ceremony.
`private void`
`updateLastUsedTime(String username, com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> assertion)`
Update the last used time of the credential to `Instant.now()`.
`private void`
`updateSignatureCount(String username, com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> assertion)`
Take the new signature count from the authenticator assertion response and update the stored credential with that value.

### Methods inherited from class net.shibboleth.idp.authn.impl.AbstractAuditingValidationAction

`doAudit, doExecute, getAuditContext, getAuditFields, recordFailure, recordSuccess, setAuditContextCreationStrategy, setPopulateAuditContextAction, setWriteAuditLogAction`

### Methods inherited from class net.shibboleth.idp.authn.AbstractValidationAction

`addDefaultPrincipals, getClassifiedErrors, getCleanupHook, getMetricName, getRequesterLookupStrategy, getResponderLookupStrategy, getResultCachingPredicate, getSubject, getSupportedPrincipals, handleError, handleError, handleWarning, setAddDefaultPrincipals, setClassifiedMessages, setCleanupHook, setMetricName, setRequesterLookupStrategy, setResponderLookupStrategy, setResultCachingPredicate, setSupportedPrincipals`

### Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

`doExecute, doPreExecute, setAuthenticationContextLookupStrategy`

### Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

`execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy`

### Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

`getActivationCondition, setActivationCondition`

### Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

`doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

`initialize, isInitialized`

## Field Details

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### webauthnContextLookupStrategy

@Nonnull private final Function<ProfileRequestContext,WebAuthnAuthenticationContext> webauthnContextLookupStrategy
Strategy used to locate or create the `WebAuthnAuthenticationContext` to populate.

### context

@NonnullBeforeExec private WebAuthnAuthenticationContext context
The WebAuthn authentication context.

### webAuthnClient

@NonnullAfterInit private WebAuthnAuthenticationClient webAuthnClient
The WebAuthn client to use.

### credentialRepository

@NonnullAfterInit private WebAuthnCredentialRepository credentialRepository
The credential repository to validate assertion responses against.

### publicKeyCredentialRequestOptions

@NonnullBeforeExec private com.yubico.webauthn.data.PublicKeyCredentialRequestOptions publicKeyCredentialRequestOptions
The options used to create the authentication request.

### updateSignatureCount

@Nonnull private Predicate<ProfileRequestContext> updateSignatureCount
Should we update the signature count on the credential in the repository after successful validation? Defaults to true.

### updateLastUsedTime

@Nonnull private Predicate<ProfileRequestContext> updateLastUsedTime
Should we updated the last used time on successful validation?. Defaults to false.

## Constructor Details

### ValidateWebAuthnAssertion

public ValidateWebAuthnAssertion()
Constructor.

## Method Details

### doInitialize

protected void doInitialize() throws ComponentInitializationException

Overrides:
  `doInitialize` in class `AbstractInitializableComponent`
Throws:
  `ComponentInitializationException`

### setCredentialRepository

public void setCredentialRepository(@Nonnull WebAuthnCredentialRepository repository)
Set the credential repository used to store WebAuthn credentials.

Parameters:
  `repository` - the repository to set.

### setWebAuthnClient

public void setWebAuthnClient(@Nonnull WebAuthnAuthenticationClient client)
Set the WebAuthn client used to handle validation of the authentication ceremony.

Parameters:
  `client` - the webauthnClient to set.

### setUpdateSignatureCount

public void setUpdateSignatureCount(boolean flag)
Set the flag to determine if we should update the signature count on the credential in the repository after successful validation?

Parameters:
  `flag` - the flag to set.

### setUpdateSignatureCountPredicate

public void setUpdateSignatureCountPredicate(@Nonnull Predicate<ProfileRequestContext> predicate)
Set the predicate to determine if we should update the signature count on the credential in the repository after successful validation?

Parameters:
  `predicate` - the predicate to set.

### setUpdateLastUsedTimePredicate

public void setUpdateLastUsedTimePredicate(@Nonnull Predicate<ProfileRequestContext> predicate)
Set the predicate to determine if we should update the last used time on the credential in the repository after successful validation?

Parameters:
  `predicate` - the predicate to set.
Since:
  1.1.0

### doPreExecute

protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AuthenticationContext authenticationContext)

Overrides:
  `doPreExecute` in class `AbstractValidationAction`

### doExecute

protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AuthenticationContext authenticationContext)

Overrides:
  `doExecute` in class `AbstractAuthenticationAction`

### updateLastUsedTime

private void updateLastUsedTime(@Nonnull String username, @Nonnull com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> assertion) throws AssertionFailureException
Update the last used time of the credential to `Instant.now()`. Any failure just gets logged and normal processing continues.

Parameters:
  `username` - the username of the user to update the last used time for
  `assertion` - the assertion with the credential Id to update
Throws:
  `AssertionFailureException` - on error updating the counter

### updateSignatureCount

private void updateSignatureCount(@Nonnull String username, @Nonnull com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> assertion) throws AssertionFailureException
Take the new signature count from the authenticator assertion response and update the stored credential with that value. It is assumed the assertion and signature counter is valid by the time this method is called.

Parameters:
  `username` - the username of the user to update signature count for
  `assertion` - the assertion with the credential Id to update, and the new signature count
Throws:
  `AssertionFailureException` - on error updating the counter

### buildAuthenticationResult

protected void buildAuthenticationResult(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AuthenticationContext authenticationContext)

Overrides:
  `buildAuthenticationResult` in class `AbstractValidationAction`

### populateSubject

protected Subject populateSubject(@Nonnull Subject subject)

Specified by:
  `populateSubject` in class `AbstractValidationAction`