Package net.shibboleth.idp.plugin.authn.webauthn.impl

# Class AbstractWebAuthnAction<T>

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction<T>

Type Parameters:
  `T` - the WebAuthn context type

All Implemented Interfaces:
  `Component`, `DestructableComponent`, `InitializableComponent`, `ProfileAction`, `Aware`, `MessageSource`, `MessageSourceAware`, `Action`

Direct Known Subclasses:
  `AbstractWebAuthnAuditingAction`, `AddAttestationConveyancePreference`, `AddAuthenticatorAttachmentRequirement`, `AddDisplayName`, `AddNicknameRequired`, `AddResidentKeyRequirement`, `AddUserId`, `AddUserName`, `AddUserVerificationRequirement`, `CheckCredentialPolicy`, `CheckRegistrationPolicy`, `CheckUserHandleExistsIfNoAllowCredentials`, `CreatePublicKeyCredentialCreationOptions`, `CreatePublicKeyCredentialRequestOptions`, `EnsureAllowedCredentialsIsEmpty`, `ExtractNicknameFromFormRequest`, `ExtractPublicKeyCredentialAssertionFromFormRequest`, `ExtractPublicKeyCredentialAttestationFromFormRequest`, `ExtractUsernameSearchFromFormRequest`, `FilterCredentialsOnPolicy`, `GenerateServerChallenge`, `InitializeAdminSubjectCanonicalizationContext`, `InitializeSubjectCanonicalizationContext`, `LookupCredentialsForUser`, `LookupRegisteredCredentials`, `LookupRegisteredCredentialsFromUserHandle`, `UpdateAdminContextWithC14nPrincipal`, `UpdateWebAuthnContextWithC14nPrincipal`, `ValidateAuthenticatorAttestationResponse`

public class AbstractWebAuthnAction<T> extends AbstractProfileAction

A base class for WebAuthn actions. Makes available the WebAuthn client, credential repository, and metadata service

In addition to the work performed by `AbstractProfileAction`, this action also looks up and makes available a WebAuthn context.

WebAuthn implementations should override the `doExecute(ProfileRequestContext, T)` method.

Event:
  `EventIds.INVALID_PROFILE_CTX`
Precondition:

      ProfileRequestContext.getSubcontext(ProfileRequestContext.class) != null

## Field Summary

Fields
Modifier and Type
Field
Description
`private PasskeyAaguidMetadataService`
`aaguidService`
Supplementary description and icon information for passkey providers not in the MDS feed (mostly software providers).
`private WebAuthnCredentialRepository`
`credentialRepository`
The credential repository to store valid credentials in.
`private com.yubico.fido.metadata.FidoMetadataService`
`fidoMetadataService`
Optional FIDO metadata service resolver.
`private final org.slf4j.Logger`
`log`
Class logger.
`private WebAuthnAuthenticationClient`
`webAuthnClient`
The WebAuthn client to use.
`private T`
`webauthnContext`
The WebAuthn Context.
`private Function<ProfileRequestContext,T>`
`webauthnContextLookupStrategy`
Lookup strategy to locate the WebAuthn context.

## Constructor Summary

Constructors
Modifier
Constructor
Description
`protected`
`AbstractWebAuthnAction(Function<ProfileRequestContext,T> defaultStrategy)`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`protected final void`
`doExecute(ProfileRequestContext profileRequestContext)`
Delegates to `doExecute(ProfileRequestContext, Object)`.
`protected void`
`doExecute(ProfileRequestContext profileRequestContext, T context)`
Performs this WebAuthn authentication action using the supplied WebAuthn context.
`protected void`
`doInitialize()`
`protected final boolean`
`doPreExecute(ProfileRequestContext profileRequestContext)`
`protected boolean`
`doPreExecute(ProfileRequestContext profileRequestContext, T context)`
Performs this authentication action's pre-execute step.
`protected Collection<EnhancedCredentialRecord>`
`enhancedCredentialRecord(Collection<CredentialRecord> credentials)`
Create `EnhancedCredentialRecords` from the given `CredentialRecords` and add any appropriate metadata to each record.
`protected AaguidEntry`
`getAaguidMetadata(com.yubico.fido.metadata.AAGUID aaguid)`
Get basic authenticator/provider information from the AAGUID.
`PasskeyAaguidMetadataService`
`getAaguidService()`
Get the supplementary description service which contains descriptions and icons for passkey providers not in the MDS feed.
`protected Set<com.yubico.fido.metadata.MetadataBLOBPayloadEntry>`
`getAuthenticatorMetadata(com.yubico.webauthn.data.ByteArray authenticatorId)`
Find FIDO2 MDS metadata for the authenticator.
`protected WebAuthnCredentialRepository`
`getCredentialRepository()`
Get the credential repository used to store WebAuthn credentials.
`protected com.yubico.fido.metadata.FidoMetadataService`
`getFidoMetadataService()`
Get the FIDO Alliance metadata service resolver to use as the attestation trust source.
`protected WebAuthnAuthenticationClient`
`getWebAuthnClient()`
Get the WebAuthn client used to handle registration and authentication ceremonies.
`void`
`setAaguidService(PasskeyAaguidMetadataService service)`
Set the supplementary description service which contains descriptions and icons for passkey providers not in the MDS feed.
`void`
`setCredentialRepository(WebAuthnCredentialRepository repository)`
Set the credential repository used to store WebAuthn credentials.
`void`
`setFidoMetadataService(com.yubico.fido.metadata.FidoMetadataService service)`
Set the FIDO Alliance metadata service resolver to use as the attestation trust source.
`void`
`setWebAuthnClient(WebAuthnAuthenticationClient client)`
Set the WebAuthn client used to handle registration and authentication ceremonies.
`void`
`setWebAuthnContextLookupStrategy(Function<ProfileRequestContext,T> strategy)`
Set the WebAuthn context lookup strategy to use.

### Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

`doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy`

### Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

`getActivationCondition, setActivationCondition`

### Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

`doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

`initialize, isInitialized`

## Field Details

### log

@Nonnull @NotEmpty private final org.slf4j.Logger log
Class logger.

### webauthnContextLookupStrategy

@Nonnull private Function<ProfileRequestContext,T> webauthnContextLookupStrategy
Lookup strategy to locate the WebAuthn context.

### webauthnContext

@NonnullBeforeExec private T webauthnContext
The WebAuthn Context.

### webAuthnClient

@NonnullAfterInit private WebAuthnAuthenticationClient webAuthnClient
The WebAuthn client to use.

### credentialRepository

@Nullable private WebAuthnCredentialRepository credentialRepository
The credential repository to store valid credentials in.

### fidoMetadataService

@Nullable private com.yubico.fido.metadata.FidoMetadataService fidoMetadataService
Optional FIDO metadata service resolver.

### aaguidService

@Nullable private PasskeyAaguidMetadataService aaguidService
Supplementary description and icon information for passkey providers not in the MDS feed (mostly software providers). Enhances the UI.

## Constructor Details

### AbstractWebAuthnAction

protected AbstractWebAuthnAction(@Nonnull Function<ProfileRequestContext,T> defaultStrategy)
Constructor.

Parameters:
  `defaultStrategy` - the default WebAuthn context lookup strategy to use

## Method Details

### doInitialize

protected void doInitialize() throws ComponentInitializationException

Overrides:
  `doInitialize` in class `AbstractInitializableComponent`
Throws:
  `ComponentInitializationException`

### setWebAuthnClient

public void setWebAuthnClient(@Nonnull WebAuthnAuthenticationClient client)
Set the WebAuthn client used to handle registration and authentication ceremonies.

Parameters:
  `client` - The WebAuthn client to set.

### getWebAuthnClient

@NonnullAfterInit protected WebAuthnAuthenticationClient getWebAuthnClient()
Get the WebAuthn client used to handle registration and authentication ceremonies.

Returns:
  the WebAuthn client.

### setAaguidService

public void setAaguidService(@Nullable PasskeyAaguidMetadataService service)
Set the supplementary description service which contains descriptions and icons for passkey providers not in the MDS feed.

Parameters:
  `service` - The AAGUID service to set.

### getAaguidService

@Nullable public PasskeyAaguidMetadataService getAaguidService()
Get the supplementary description service which contains descriptions and icons for passkey providers not in the MDS feed.

Returns:
  the AAGUID service.

### setFidoMetadataService

public void setFidoMetadataService(@Nullable com.yubico.fido.metadata.FidoMetadataService service)
Set the FIDO Alliance metadata service resolver to use as the attestation trust source.

Parameters:
  `service` - The FIDO metadata service to set.

### getFidoMetadataService

@Nullable protected com.yubico.fido.metadata.FidoMetadataService getFidoMetadataService()
Get the FIDO Alliance metadata service resolver to use as the attestation trust source.

Returns:
  the FIDO metadata service.

### setCredentialRepository

public void setCredentialRepository(@Nonnull WebAuthnCredentialRepository repository)
Set the credential repository used to store WebAuthn credentials.

Parameters:
  `repository` - The respository to set.

### getCredentialRepository

@Nullable protected WebAuthnCredentialRepository getCredentialRepository()
Get the credential repository used to store WebAuthn credentials.

Returns:
  the credential repository.

### setWebAuthnContextLookupStrategy

public void setWebAuthnContextLookupStrategy(@Nonnull Function<ProfileRequestContext,T> strategy)
Set the WebAuthn context lookup strategy to use.

Parameters:
  `strategy` - lookup strategy

### doPreExecute

protected final boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext)

Overrides:
  `doPreExecute` in class `AbstractConditionalProfileAction`

### doExecute

protected final void doExecute(@Nonnull ProfileRequestContext profileRequestContext)
Delegates to `doExecute(ProfileRequestContext, Object)`. Implementations can not override this method.

Overrides:
  `doExecute` in class `AbstractProfileAction`
Parameters:
  `profileRequestContext` - the current IdP profile request context

### doPreExecute

protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull T context)
Performs this authentication action's pre-execute step. Default implementation just returns true.

Parameters:
  `profileRequestContext` - the current IdP profile request context
  `context` - the WebAuthn context
Returns:
  true iff execution should continue

### doExecute

protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull T context)
Performs this WebAuthn authentication action using the supplied WebAuthn context. Implementations should override this method.

Parameters:
  `profileRequestContext` - the current IdP profile request context
  `context` - the WebAuthn context

### getAuthenticatorMetadata

@Nonnull @NotLive @NonnullElements protected Set<com.yubico.fido.metadata.MetadataBLOBPayloadEntry> getAuthenticatorMetadata(com.yubico.webauthn.data.ByteArray authenticatorId)
Find FIDO2 MDS metadata for the authenticator.

Parameters:
  `authenticatorId` - the authenticator attestation GUID
Returns:
  the attestation metadata relating to the authenticator attestation GUID

### getAaguidMetadata

@Nullable protected AaguidEntry getAaguidMetadata(@Nullable com.yubico.fido.metadata.AAGUID aaguid)
Get basic authenticator/provider information from the AAGUID. Contains providers not in the FIDO2 MDS feed, for example, software authenticators.

Parameters:
  `aaguid` - the authenticator attestation GUID
Returns:
  the aaguid metadata, or null if not found.

### enhancedCredentialRecord

@NotLive @Unmodifiable @Nonnull protected Collection<EnhancedCredentialRecord> enhancedCredentialRecord(Collection<CredentialRecord> credentials)
Create `EnhancedCredentialRecords` from the given `CredentialRecords` and add any appropriate metadata to each record.

Parameters:
  `credentials` - the credentials to convert to `EnhancedCredentialRecords`.
Returns:
  a collection of enhanced credential records