Package net.shibboleth.idp.plugin.authn.webauthn.impl

# Class CheckCredentialPolicy

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction<WebAuthnAuthenticationContext>
net.shibboleth.idp.plugin.authn.webauthn.impl.CheckCredentialPolicy

All Implemented Interfaces:
  `Component`, `DestructableComponent`, `InitializableComponent`, `ProfileAction`, `Aware`, `MessageSource`, `MessageSourceAware`, `Action`

public class CheckCredentialPolicy extends AbstractWebAuthnAction<WebAuthnAuthenticationContext>
A policy engine action that checks with the configured policy if the credential, used to sign the assertion can be used to authenticate. If it is rejected by the policy, a `WebAuthnAuthenticationEventIds.CREDENTIAL_POLICY_REJECTION` is returned. Similarly, if a credential can not be found to evaluate the policy returns an `WebAuthnAuthenticationEventIds.CREDENTIAL_POLICY_REJECTION`.

Event:
  {EventIds#INVALID_PROFILE_CTX}, {WebAuthnAuthenticationEventIds#CREDENTIAL_POLICY_REJECTION}
Precondition:

      ProfileRequestContext.getSubcontext(WebAuthnRegistrationContext.class) != null

Postcondition:
  the credential is allowed to be used for authentication, or an error event is triggered

## Field Summary

Fields
Modifier and Type
Field
Description
`private com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs>`
`assertion`
The stashed assertion response.
`private AuthenticationContext`
`authnContext`
The stashed authentication context.
`private CredentialPolicy`
`credentialPolicy`
The credential policy to check.
`private final org.slf4j.Logger`
`log`
Class logger.
`private WebAuthnCredentialRepository`
`repository`
The credential repository to use.
`private Function<ProfileRequestContext,byte[]>`
`userHandleLookupStrategy`
Get the userHandle to help find the credential used to sign the assertion.

## Constructor Summary

Constructors
Modifier
Constructor
Description
`protected`
`CheckCredentialPolicy()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`protected void`
`doExecute(ProfileRequestContext profileRequestContext, WebAuthnAuthenticationContext context)`
Performs this WebAuthn authentication action using the supplied WebAuthn context.
`protected void`
`doInitialize()`
`protected boolean`
`doPreExecute(ProfileRequestContext profileRequestContext, WebAuthnAuthenticationContext context)`
Performs this authentication action's pre-execute step.
`void`
`setCredentialPolicy(CredentialPolicy policy)`
Set the policy to verify that the credential can be used for authentication.
`void`
`setUserHandleLookupStrategy(Function<ProfileRequestContext,byte[]> strategy)`
Set the strategy to locate the userHandle of the user that holds the credential used to sign the assertion.

### Methods inherited from class net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction

`doExecute, doPreExecute, enhancedCredentialRecord, getAaguidMetadata, getAaguidService, getAuthenticatorMetadata, getCredentialRepository, getFidoMetadataService, getWebAuthnClient, setAaguidService, setCredentialRepository, setFidoMetadataService, setWebAuthnClient, setWebAuthnContextLookupStrategy`

### Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

`doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy`

### Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

`getActivationCondition, setActivationCondition`

### Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

`doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

`initialize, isInitialized`

## Field Details

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### assertion

@NonnullBeforeExec private com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> assertion
The stashed assertion response.

### userHandleLookupStrategy

@Nonnull private Function<ProfileRequestContext,byte[]> userHandleLookupStrategy
Get the userHandle to help find the credential used to sign the assertion.

### credentialPolicy

@Nullable private CredentialPolicy credentialPolicy
The credential policy to check.

### repository

@NonnullAfterInit private WebAuthnCredentialRepository repository
The credential repository to use.

### authnContext

@NonnullBeforeExec private AuthenticationContext authnContext
The stashed authentication context.

## Constructor Details

### CheckCredentialPolicy

protected CheckCredentialPolicy()
Constructor.

## Method Details

### setCredentialPolicy

public void setCredentialPolicy(@Nullable CredentialPolicy policy)
Set the policy to verify that the credential can be used for authentication.

Parameters:
  `policy` - The authenticator policy to set.

### setUserHandleLookupStrategy

public void setUserHandleLookupStrategy(Function<ProfileRequestContext,byte[]> strategy)
Set the strategy to locate the userHandle of the user that holds the credential used to sign the assertion.

Parameters:
  `strategy` - The user handle lookup strategy to set.
Since:
  1.1.0

### doInitialize

protected void doInitialize() throws ComponentInitializationException

Overrides:
  `doInitialize` in class `AbstractWebAuthnAction<WebAuthnAuthenticationContext>`
Throws:
  `ComponentInitializationException`

### doPreExecute

protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull WebAuthnAuthenticationContext context)
Performs this authentication action's pre-execute step. Default implementation just returns true.

Overrides:
  `doPreExecute` in class `AbstractWebAuthnAction<WebAuthnAuthenticationContext>`
Parameters:
  `profileRequestContext` - the current IdP profile request context
  `context` - the WebAuthn context
Returns:
  true iff execution should continue

### doExecute

protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull WebAuthnAuthenticationContext context)
Description copied from class: `AbstractWebAuthnAction`
Performs this WebAuthn authentication action using the supplied WebAuthn context. Implementations should override this method.

Overrides:
  `doExecute` in class `AbstractWebAuthnAction<WebAuthnAuthenticationContext>`
Parameters:
  `profileRequestContext` - the current IdP profile request context
  `context` - the WebAuthn context