# All Classes and Interfaces

Class
Description
AaguidEntry
A entry in the Passkeys AAGUID JSON file.
AbstractAttributeContextUserIdentityStrategy<T>
A base class for functions that retrieve a single attribute value from the `attribute context`.
AbstractAuthenticatorPolicyRule
A base class for `authenticator policies`.
AbstractCredentialPolicyRule
A base class for `credential policies`.
AbstractWebAuthnAction<T>
A base class for WebAuthn actions.
AbstractWebAuthnAuditExtractor<T>
An abstract audit extractor function to extract values directly from various WebAuthn contexts.
AbstractWebAuthnAuditingAction<T>
A base class for actions that include audit logging support.
AbstractWebAuthnExtractionAction
A base class for WebAuthn actions that extract a username for subsequent use.
AbstractWebAuthnManagementAuditExtractor<T>
An abstract audit extractor function to extract values directly from the WebAuthn management context.
AbstractWebAuthnRegistrationAuditExtractor<T>
An abstract audit extractor function to extract values directly from the WebAuthn registration context.
AddAttestationConveyancePreference
Add an attestation conveyance preference to the `context`.
AddAuthenticatorAttachmentRequirement
Add an authenticator attachment requirement to the `context`.
AddDisplayName
An action to generate or lookup a user.displayName.
AddNicknameRequired
An action that sets onto the context if nickname collection is required.
AddResidentKeyRequirement
Add a ResidentKey requirement to the `context`.
AddUserId
An action to generate or lookup a user.id (stored by an authenticator as the userHandle).
AddUserName
An action to generate or lookup a WebAuthn user.name.
AddUserVerificationRequirement
Add a UserVerification requirement to the `context`.
AdminDeletePublicKeyCredential
An action that removes a public key credential from the credential repository based on the credential ID found in the management context.
AdminSearchCredentialsLookupFunction
A credential lookup function that returns the credentials belonging to the user that has been searched for in the management interface.
AllowCurrentUserAccessPredicate
An access control predicate that should implement comparison logic to allow access only to authenticated users who initiated the WebAuthn registration/authentication process.
AllowCurrentUserAccessPredicate.DefaultCurrentUserComparisonPredicate
Default comparison predicate which just compares the equality of the input strings.
AllowlistAuthenticatorPolicy
A basic authenticator policy that rejects all authenticators not in the allowed list.
AssertionFailureException
Exception that is throw if an authentication assertion is not valid.
AssertionResult
The result of calling `WebAuthnAuthenticationClient.validateAuthenticatorAssertionResponse(String, byte[], com.yubico.webauthn.data.PublicKeyCredentialRequestOptions, com.yubico.webauthn.data.PublicKeyCredential)`.
AssertionResult.Builder
The `AssertionResult` builder.
AssertionResult.IBuildStage
Builder stage.
AssertionResult.ISignatureCounterValidStage
Builder stage.
AssertionResult.ISuccessStage
Builder stage.
AssertionResult.IUserIdStage
Builder stage.
AssertionResult.IUsernameStage
Builder stage.
AssertionResult.IUserVerifiedStage
Builder stage.
AttributeContextByteArrayLookupStrategy
An `AbstractAttributeContextUserIdentityStrategy` that pulls out an `StringAttributeValue` from the attribute context and represents it as a UTF-8 encoded byte array.
AttributeContextStringLookupStrategy
An `AbstractAttributeContextUserIdentityStrategy` that pulls out an `StringAttributeValue` from the attribute context.
AuthenticatorCapabilitiesPolicyRule
An authenticator policy that inspects metadata to determine if the authenticator should be allowed or rejected.
AuthenticatorGetInfoUVCapable
An authenticator capability acceptor that only allows authenticators that support user verification.
AuthenticatorPolicy
An API for applying policy checks to an authenticator.
AuthenticatorPolicy.AuthenticatorPolicyOutcome
Representation of the three outcomes of an AuthenticatorPolicy.
AuthenticatorSupport
A helper class for various FIDO2 Authenticator functions.
BaseOptionsParameters
Abstract options parameters class.
BaseWebAuthnAuthenticationContextConsumer
A base class that pulls out the `WebAuthnAuthenticationContext` for consumers to use.
BaseWebAuthnContext
The base WebAuthn context for both registration and authentication ceremonies.
CacheService
A cache facade that handles the consistent conversion between `CredentialRecord`s and cache entries.
CacheServiceImpl
An implementation of a `CacheService` that handles the consistent conversion between `CredentialRecord`s and username cache entries using the supplied strategies.
CacheServiceImpl.Builder
A builder to safely construct this object.
CacheServiceImpl.IBuildStage
A builder stage.
CacheServiceImpl.IUserHandleMappingCacheStage
A builder stage.
ChainingAuthenticatorPolicyRule
A `AuthenticatorPolicy` implementation that verifies an authenticator is acceptable based on a chain of configured rules.
ChainingCredentialLabeller
A credential labeller that labels credentials based on a chain of other labellers.
ChainingCredentialPolicyRule
A `CredentialPolicy` implementation that verifies an authentication credential is acceptable based on a chain of configured rules.
CheckCredentialPolicy
A policy engine action that checks with the configured policy if the credential, used to sign the assertion can be used to authenticate.
CheckRegistrationPolicy
A registration policy engine action that checks with the configured policy if the authenticator can be used to register credentials with the IdP.
CheckUserHandleExistsIfNoAllowCredentials
An action which checks if the userHandle is returned in the assertion response if the set of allowedCredentials in the request was empty.
CreatePublicKeyCredentialCreationOptions
Action to create a PublicKeyCredentialCreationOptions from the parameters in the WebAuthn context using the available `client`.
CreatePublicKeyCredentialRequestOptions
Action to create CreatePublicKeyCredentialRequestOptions from the parameters in the WebAuthn context using the supplied `client`.
CredentialCreationOptionsParameters
A class to hold the parameters required to build a PublicKeyCredentialRequestOptions.
CredentialCreationOptionsParameters.Builder
Builder class.
CredentialCreationOptionsParameters.IAttestationConveyancePreferenceStage
Stage interface.
CredentialCreationOptionsParameters.IBuildStage
Stage interface.
CredentialCreationOptionsParameters.IChallengeStage
Stage interface.
CredentialCreationOptionsParameters.IDisplayNameStage
Stage interface.
CredentialCreationOptionsParameters.IExcludeCredentialsStage
Stage interface.
CredentialCreationOptionsParameters.INameStage
Stage interface.
CredentialCreationOptionsParameters.IResidentKeyRequirementStage
Stage interface.
CredentialCreationOptionsParameters.IUserHandleStage
Stage interface.
CredentialCreationOptionsParameters.IUserVerificationRequirementStage
Stage interface.
CredentialPolicy
An API for applying policy checks to an authentication credential.
CredentialPolicy.CredentialPolicyOutcome
Representation of the three outcomes of an CredentialPolicy.
CredentialRecord
A credential record used to hold a registered credential.
CredentialRecord.Builder
Builder.
CredentialRecord.IBuildStage
Optional builder stage.
CredentialRecord.ICredentialStage
Builder stage.
CredentialRecord.IRegistrationTimeStage
Builder stage.
CredentialRecord.ITransportsStage
Builder stage.
CredentialRecord.IUserIdentityStage
Builder stage.
CredentialRecord.IUsernameStage
Builder stage.
CredentialRegistrationSerializer
Serialize the set of CredentialRecords to a JSON string.
CredentialRepositoryException
An unchecked exception that is throw when there is an unrecoverable error occurs handling requests to the credential repository.
CredentialRequestOptionsParameters
The parameters required to build a PublicKeyCredentialRequestOptions.
CredentialRequestOptionsParameters.Builder
Builder class.
CredentialRequestOptionsParameters.IAllowCredentialsStage
Stage interface.
CredentialRequestOptionsParameters.IBuildStage
Build the options.
CredentialRequestOptionsParameters.IChallengeStage
Stage interface.
CredentialRequestOptionsParameters.IUserVerificationRequirementStage
Stage interface.
DefaultUserHandleLookupStrategy
A strategy to locate the userHandle first from an assertion response and then, if that does not exist, from the userId in the WebAuthn authentication context.
DeletePublicKeyCredential
An action that removes a credential registration from the credential repository.
DisabledCacheServiceImpl
A no-op implementation of a `CacheService`.
EnhancedCredentialRecord
An ephemeral wrapper class that holds a `CredentialRecord` and any associated metadata.
EnsureAllowedCredentialsIsEmpty
An action that blanks any existing registered credentials in the WebAuthn authentication context.
ExistingAuthenticationCredentialsLookupStrategy
A credential lookup function that returns the list of existing credentials from the `WebAuthnAuthenticationContext`.
ExistingRegistrationCredentialsLookupStrategy
A credential lookup function that returns the list of existing credentials from the `WebAuthnRegistrationContext`.
ExtractKeyInformationFromFormRequest
An action that extracts the credential ID for from the incoming HTTP request and uses a `BiConsumer` to set it back onto an appropriate context.
ExtractNicknameFromFormRequest
An action that extracts the key nickname from the incoming HTTP request.
ExtractPublicKeyCredentialAssertionFromFormRequest
An action that extracts the PublicKeyCredential containing the authenticator assertion response from the incoming HTTP request.
ExtractPublicKeyCredentialAttestationFromFormRequest
An action that extracts the PublicKeyCredential containing the authenticator attestation response from the incoming HTTP request.
ExtractUsernameFromForm
An action to populate a username into the `BaseWebAuthnContext`.
ExtractUsernameFromRegistrationForm
An action to populate a username into the `BaseWebAuthnContext`.
ExtractUsernameSearchFromFormRequest
An action that extracts the username search value from the incoming HTTP request.
FidoMetadataServiceFactory
Spring factory bean for creating a `FidoMetadataService`.
FilterCredentialsOnPolicy
A policy engine that filters the set of existing credentials held in the context based on the policy.
FunctionalAuthenticatorPolicyRule
A `AuthenticatorPolicy` that evaluates a `BiFunction` to determine if the authenticator that created the credential registration should be accepted or rejected.
FunctionalCredentialPolicyRule
A `CredentialPolicy` that evaluates a `BiFunction` to determine if a credential should be accepted or rejected.
FunctionalRuleContext
A context class that provides access to the `ProfileRequestContext` and `FidoMetadataService` from `BiFunctions` that implement registration or authentication rules.
GenerateServerChallenge
An action to generate an appropriate server challenge for use in either the PublicKeyCredentialCreationOptions or the PublicKeyCredentialRequestOptions.
GenerateServerChallenge.DefaultChallengeGenerator
Default challenge generator that generates a 32 byte randomized challenge of sufficient entropy.
IdPStorageServiceCredentialRepository
A `CredentialRepository` adaptor for the Shibboleth `StorageService`.
InitializeAdminSubjectCanonicalizationContext
An action that creates a new `SubjectCanonicalizationContext` out of the search username in the admin context, ready for the c14n flows to canonicalize.
InitializeSubjectCanonicalizationContext
An action that creates a new `SubjectCanonicalizationContext` out of the username in the base context, ready for the c14n flows to canonicalize.
InlineEnrolmentContext
A context that holds information about a resumable SSO flow.
InlineEnrolmentRedirectFunction
A function that generates a redirect URL to return the user to a resource relative to the server root.
IsAdminUsernameCollectionEnabled
A predicate that determines if username collection is required as a first step to the registration process.
IsDiscoverableCredentialRequired
A predicate that determines if the authentication ceremony requires a discoverable credential (ResidentKey) supplied by the authenticator, or if we have a username to determine which credentials to use from the IdP.
IsPasswordlessAuthenticationMode
A predicate that lookups into the context to find if the authentication flow is passwordless.
IsSecondFactor
A predicate that determines if the authentication flow is being used as a second factor of authentication, and not a first (and possibly only) factor.
IsSecondFactorAuthenticationMode
A predicate that lookups into the context to find if the authentication flow is acting as a second factor.
IsUsernameCollectionRequired
A predicate that determines if a username already exists in the authentication context.
IsUsernamelessAuthenticationMode
A predicate that lookups into the context to find if the authentication flow is usernameless.
LabelCredentialRecords
Use the labelling function to add labels to each `EnhancedCredentialRecord` found in the context.
LookupCredentialsForUser
An action that lookups registered credentials for a username contained in the WebAuthn management context and sets them back onto the context.
LookupRegisteredCredentials
An action that lookups existing registered credentials based on the username contained in the WebAuthn context and sets them back onto the context.
LookupRegisteredCredentialsFromUserHandle
An action that lookups existing registered credentials from the userHandle supplied in the authenticators assertion response and sets them back onto the context.
ManagementContextCredentialRemovalConsumer
A `BiConsumer` that sets the credential ID to remove onto the WebAuthn management context.
MultiPredicateAccessPredicate
Access control implementation based on a `List` of predicates over a `ProfileRequestContext`.
PasskeyAaguidMetadataFactory
A spring factory bean for create a `PasskeyAaguidMetadataService`.
PasskeyAaguidMetadataService
A service that looks up icons and descriptions about passkey providers (authenticators) from a map.
PasskeyCredentialLabeller
A credential labeller function that labels credentials as 'Passkey' if they are discoverable.
PopulateInlineEnrolmentContext
Populate the `InlineEnrolmentContext` from the HTTP referer header in the HTTP request iff the registration query parameter contains 'inline'.
PopulateWebAuthnAuthenticationContext
An action to create (or lookup) the `WebAuthnAuthenticationContext` and populate with the username found from the username lookup strategy.
PopulateWebAuthnManagementContext
An action to create (or lookup) the `WebAuthnManagementContext` and set the admin principal name from the lookup strategy.
PopulateWebAuthnRegistrationContext
An action to create (or lookup) the `WebAuthnRegistrationContext` and populate with the username found from the lookup strategy.
QueryByAllStrategy
A query strategy that loads all known credentials from the datasource based on the storage context label.
QueryByCredentialIdStrategy
A query strategy that uses the specialised query functionality of the `WebAuthnJDBCQueryAccelerator` to load credentials from the datasource with the given credentialId.
QueryByUserHandleStrategy
A query strategy that uses the specialised query functionality of the `WebAuthnJDBCQueryAccelerator` to load credentials from the datasource with the given userHandle.
RandomUserIdGenerator
A user.id generator that generates a random 64 byte user.id.
ReadAllCacheLoadingStrategy
A cache loading strategy that loads all known credentials from the datasource.
RegistrationContextCredentialRemovalConsumer
A `BiConsumer` that sets the credential ID to remove onto the WebAuthn registration context.
RegistrationContextCredentialToModifyConsumer
A `BiConsumer` that sets the credential ID to modify onto the WebAuthn registration context.
RegistrationErrorMessageLookupFunction
A function that examines the state of a request and produces an appropriate message for WebAuthn flow views.
RegistrationFailureException
Exception that is throw if a public key credential registration (attestation) is not valid.
RegistrationInfoMessageLookupFunction
A function that examines the state of a request and produces an appropriate message for WebAuthn flow views.
RegistrationResult
The result of a call to `(com.yubico.webauthn.data.PublicKeyCredentialCreationOptions, com.yubico.webauthn.data.PublicKeyCredential)`.
RegistrationResult.Builder
Builder.
RegistrationResult.IAttestationTrustedStage
Builder stage.
RegistrationResult.IAttestationTypeStage
Builder stage.
RegistrationResult.IBuildStage
Builder stage.
RegistrationResult.ICredentialStage
Builder stage.
RequireStrongFreshAuthnAccessPredicate
Access control predicate, used within a WebAuthn registration flow, to check if a user with existing WebAuthn/FIDO2 credentials has performed a fresh, strong, authentication.
SecondFactorOnlyCredentialLabeller
A credential labeller function that labels credentials as 'SecondFactor' if the authenticator that created the credential should only be used as a second factor, and not sole factor of authentication.
SecondFactorOnlyCredentialPolicyRule
A `CredentialPolicy` that rejects credentials used in sole-factor mode if created by authenticators which should only be used for second factor authentication.
SetPaswordlessUsageToContextConsumer
A consumer that sets the isPasswordless mode flag to the authentication context.
SetSecondFactorUsageToContextConsumer
A consumer that sets the isSecondFactor mode flag to the authentication context.
SetUsernamelessUsageToContextConsumer
A consumer that sets the isUsernameless mode flag to the authentication context.
StorageServiceCredentialRepositoryFactory
A factory bean that decides which credential repository implementation to create based on the options set.
StorageServiceCredentialRepositoryFactory.AcceleratorType
The type of JDBC accelerator.
StorageServiceCredentialRepositoryFactory.Base64URLKeyExtractionStrategy
An extraction strategy that converts the `ByteArray` into a base64Url encoded string.
StorageServiceCredentialRepositoryFactory.CredentialIdB64FromCredentialExtractionStrategy
An extraction strategy that converts the `CredentialRecord` into a base64Url encoded string of the credentialId inside the credential.
StorageServiceCredentialRepositoryFactory.UserHandleB64FromCredentialExtractionStrategy
An extraction strategy that converts the `CredentialRecord` into a base64Url encoded string of the userHandle inside the credential.
StorageServiceCredentialRepositoryFactory.UsernameFromCredentialExtractionStrategy
An extraction strategy that converts the `CredentialRecord` into a username inside the registration.
StorePublicKeyCredential
An action that adds the public key credential in the registration context to the credential repository.
StrategyBasedIdPStorageServiceCredentialRepository
An extension of the `IdPStorageServiceCredentialRepository` that utalizes specialised lookup functions to improve the performance of userHandle and credentialId lookup operations.
TriggerRegistrationOnLoad
Predicate wrapping an injectable predicate, indicating whether the WebAuthn registration ceremony should be automatically triggered when the page loads.
UpdateAdminContextWithC14nPrincipal
A WebAuthn management action that sets the principal name from the SubjectCanonicalizationContext back onto the WebAuthn context as the search username.
UpdateCredentialNickname
An action that updates the nickname of a credential in the credential repository.
UpdateWebAuthnContextWithC14nPrincipal
A WebAuthn action that sets the principal name from the SubjectCanonicalizationContext back onto the WebAuthn context.
UsernameFromAuthenticationContextLookupStrategy
A strategy that takes the UsernamePrincipal from the authentication context iff there is only one.
UsernamelessFlowEnabled
Predicate to determine if the user is required to enter their username or not.
UsernameLookupFromHttpRequest
Extract a username from the HTTP request, returning `null` if not found.
UsernameLookupFromRegistrationContext
Pull out a username from a WebAuthn Registration Context if it exists.
UsernameLookupFromSubjectContext
Pull out a username/principalName from the `SubjectContext.getPrincipalName()` if it exists.
ValidateAuthenticatorAttestationResponse
Validate the public key registration attempt by delegating the created public key credential to the WebAuthn client.
ValidateWebAuthnAssertion
An action that validates a WebAuthn authenticator assertion that results from a call to WebAuthn's 'get' credential API.
ValidateWebAuthnAssertion.WebAuthnCleanupHook
A default cleanup hook that removes the `WebAuthnAuthenticationContext` from the tree.
WebAuthnAuditFields
Audit fields for WebAuthn.
WebAuthnAuthenticationClient
A client that manages WebAuthn authentication and registration ceremonies.
WebAuthnAuthenticationClientException
An exception to signal an error condition during execution or creation of a Webauthn client.
WebAuthnAuthenticationClientFactory
Abstract factory for creating singleton `WebAuthnAuthenticationClient` instances.
WebAuthnAuthenticationContext
Authentication context for processing WebAuthn authentication ceremonies.
WebAuthnAuthenticationEventIds
Constants to use for `ProfileAction` `EventContext` results related to WebAuthn authentication.
WebAuthnCredentialRepository
A WebAuthn credential repository that extends the `CredentialRepository` interface to support additional read and write operations.
WebAuthnCredentialToRemoveAuditExtractor
`Function` that returns the base64 encoded credential identifier of the credential that has been removed.
WebAuthnEncoder
Encoder for `credentials` that converts raw values into a format suitable for views.
WebAuthnErrorMessageLookupFunction
A function that examines the state of a request and produces an appropriate message for WebAuthn flow views.
WebAuthnFlowModeAuditExtractor
`Function` that returns which mode of flow was run e.g.
WebAuthnGuardContext
A context to hold signals about the type of authentication performed.
WebAuthnJDBCAccelerator
A marker interface for a JDBC query accelerator that improves the performance of lookup operations.
WebAuthnJDBCAcceleratorImpl
Implementation of a `WebAuthnJDBCQueryAccelerator` and `WebAuthnJDBCReadAllAccelerator` that uses specialized queries to lookup credentials by userHandle and credentialId.
WebAuthnJDBCQueryAccelerator
An accelerator for JDBC queries to improve the performance of lookup operations that search for non-indexed fields, namely; userHandle and credentialId.
WebAuthnJDBCReadAllAccelerator
An accelerator for JDBC queries to improve the performance of lookup operations that read all records at once.
WebAuthnJDBCStorageRecord<T>
Storage record used by `WebAuthnJDBCAcceleratorImpl`.
WebAuthnManagementContext
A WebAuthn admin management context for the management admin flow.
WebAuthnModule
`IdP Module` implementation for the WebAuthn login flow.
WebAuthnPlugin
Plugin description about the WebAuthn plugin.
WebAuthnRegistrationContext
Registration context for processing WebAuthn Registration Ceremonies.
WebAuthnRegistrationErrorContext
A WebAuthn version of `AuthenticationErrorContext` that holds information about WebAuthn registration events.
WebAuthnRegistrationEventIds
Constants to use for `ProfileAction` `EventContext` results related to WebAuthn registration.
WebAuthnRegistrationInformationContext
A WebAuthn version of `AuthenticationWarningContext` that holds information about WebAuthn registration events.
WebAuthnSearchUserAuditExtractor
`Function` that returns which username that the admin user searched for.
WebAuthnSupport
Helper methods for WebAuthn.
WebAuthnUserCredentialAddedAuditExtractor
`Function` that returns the base64 encoded credential identifier of the credential that has been removed.
WebAuthnUserCredentialToRemoveAuditExtractor
`Function` that returns the base64 encoded credential identifier of the credential that has been removed.
WebAuthnUserIdAuditExtractor
`Function` that returns the user.id from the `BaseWebAuthnContext` base64 encoded, if any.
WebAuthnUserIdPrinicpal
Principal based on the WebAuthn user.id base64 encoded.
WebAuthnUsernameAuditExtractor
`Function` that returns the internal username from the `BaseWebAuthnContext`, if any.
WebAuthnUserVerificationAuditExtractor
`Function` that returns true if UserVerification was performed, false otherwise.
YubicoWebAuthnAuthenticationClient
Yubico implementation of a `WebAuthnAuthenticationClient`.
YubicoWebauthnClientFactory
Spring factory bean for creating a `YubicoWebAuthnAuthenticationClient`.