Package net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl

# Class AbstractAuthenticatorPolicyRule

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.idp.plugin.authn.webauthn.admin.policy.impl.AbstractAuthenticatorPolicyRule

All Implemented Interfaces:
  `AuthenticatorPolicy`, `Component`, `DestructableComponent`, `IdentifiableComponent`, `IdentifiedComponent`, `InitializableComponent`

Direct Known Subclasses:
  `AllowlistAuthenticatorPolicy`, `AuthenticatorCapabilitiesPolicyRule`, `ChainingAuthenticatorPolicyRule`, `FunctionalAuthenticatorPolicyRule`

@ThreadSafeAfterInit public abstract class AbstractAuthenticatorPolicyRule extends AbstractIdentifiableInitializableComponent implements AuthenticatorPolicy
A base class for `authenticator policies`. Ensures the AAGUID is not null before it is passed to the policy rule implementation. Can be enabled and disabled by the activiation condition.

Returns `AuthenticatorPolicy.AuthenticatorPolicyOutcome.ACCEPT` if the authenticator is accepted, returns `AuthenticatorPolicy.AuthenticatorPolicyOutcome.REJECT` if the authenticator is rejected, returns `AuthenticatorPolicy.AuthenticatorPolicyOutcome.IGNORE` if the rule is to be ignored.

## Nested Class Summary

## Nested classes/interfaces inherited from interface net.shibboleth.idp.plugin.authn.webauthn.admin.policy.AuthenticatorPolicy

`AuthenticatorPolicy.AuthenticatorPolicyOutcome`

## Field Summary

Fields
Modifier and Type
Field
Description
`private BiPredicate<com.yubico.fido.metadata.AAGUID,ProfileRequestContext>`
`activationCondition`
Does this policy rule apply? Default is true.
`private com.yubico.fido.metadata.FidoMetadataService`
`fidoMetadataService`
FIDO metadata service resolver.
`private final org.slf4j.Logger`
`log`
Class logger.

## Constructor Summary

Constructors
Modifier
Constructor
Description
`protected`
`AbstractAuthenticatorPolicyRule()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`protected abstract AuthenticatorPolicy.AuthenticatorPolicyOutcome`
`doAccept(com.yubico.fido.metadata.AAGUID aaguid, ProfileRequestContext prc)`
Execute the policy.
`AuthenticatorPolicy.AuthenticatorPolicyOutcome`
`evaluate(com.yubico.fido.metadata.AAGUID aaguid, ProfileRequestContext prc)`
Execute and evaluate the policy.
`protected com.yubico.fido.metadata.FidoMetadataService`
`getFidoMetadataService()`
Get the metadata service to use.
`void`
`setActivationCondition(boolean flag)`
Set an activation condition for this policy rule.
`void`
`setActivationConditionStrategy(BiPredicate<com.yubico.fido.metadata.AAGUID,ProfileRequestContext> condition)`
Set an activation condition for this policy rule.
`void`
`setFidoMetadataService(com.yubico.fido.metadata.FidoMetadataService trustSource)`
Set the attestation trust source.

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

`setId`

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

`doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

`getId`

## Field Details

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### fidoMetadataService

@Nullable private com.yubico.fido.metadata.FidoMetadataService fidoMetadataService
FIDO metadata service resolver.

### activationCondition

@Nonnull private BiPredicate<com.yubico.fido.metadata.AAGUID,ProfileRequestContext> activationCondition
Does this policy rule apply? Default is true.

## Constructor Details

### AbstractAuthenticatorPolicyRule

protected AbstractAuthenticatorPolicyRule()
Constructor.

## Method Details

### setActivationConditionStrategy

public void setActivationConditionStrategy(@Nonnull BiPredicate<com.yubico.fido.metadata.AAGUID,ProfileRequestContext> condition)
Set an activation condition for this policy rule.

Parameters:
  `condition` - condition to set

### setActivationCondition

public void setActivationCondition(boolean flag)
Set an activation condition for this policy rule.

Parameters:
  `flag` - the flag to set

### setFidoMetadataService

public void setFidoMetadataService(@Nullable com.yubico.fido.metadata.FidoMetadataService trustSource)
Set the attestation trust source.

Parameters:
  `trustSource` - the attestation trust source.

### getFidoMetadataService

@Nullable protected com.yubico.fido.metadata.FidoMetadataService getFidoMetadataService()
Get the metadata service to use.

Returns:
  the metadata service.

### evaluate

public AuthenticatorPolicy.AuthenticatorPolicyOutcome evaluate(@Nullable com.yubico.fido.metadata.AAGUID aaguid, @Nonnull ProfileRequestContext prc)
Execute and evaluate the policy. Return `AuthenticatorPolicy.AuthenticatorPolicyOutcome.ACCEPT` if allowed, `AuthenticatorPolicy.AuthenticatorPolicyOutcome.REJECT` if rejected, and `AuthenticatorPolicy.AuthenticatorPolicyOutcome.IGNORE` otherwise.

Specified by:
  `evaluate` in interface `AuthenticatorPolicy`
Parameters:
  `aaguid` - the authenticator attestation GUID.
  `prc` - the profile request context
Returns:
  the authenticator policy outcome: ACCEPT if allowed, REJECT if rejected, and IGNORE if the policy is to be ignored (e.g. the policy is not active)

### doAccept

protected abstract AuthenticatorPolicy.AuthenticatorPolicyOutcome doAccept(@Nonnull com.yubico.fido.metadata.AAGUID aaguid, @Nonnull ProfileRequestContext prc)
Execute the policy. Return true if allowed, false otherwise. Implementations should override this method.

Parameters:
  `aaguid` - the authenticator attestation GUID.
  `prc` - the profile request context
Returns:
  true if the policy allows the authenticator, false otherwise.