Package net.shibboleth.idp.plugin.authn.webauthn.policy.impl

# Class SecondFactorOnlyCredentialPolicyRule

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.idp.plugin.authn.webauthn.policy.impl.AbstractCredentialPolicyRule
net.shibboleth.idp.plugin.authn.webauthn.policy.impl.SecondFactorOnlyCredentialPolicyRule

All Implemented Interfaces:
  `CredentialPolicy`, `Component`, `DestructableComponent`, `IdentifiableComponent`, `IdentifiedComponent`, `InitializableComponent`

public class SecondFactorOnlyCredentialPolicyRule extends AbstractCredentialPolicyRule
A `CredentialPolicy` that rejects credentials used in sole-factor mode if created by authenticators which should only be used for second factor authentication.

## Nested Class Summary

## Nested classes/interfaces inherited from interface net.shibboleth.idp.plugin.authn.webauthn.policy.CredentialPolicy

`CredentialPolicy.CredentialPolicyOutcome`

## Field Summary

Fields
Modifier and Type
Field
Description
`private final org.slf4j.Logger`
`log`
Class logger.
`private Set<com.yubico.fido.metadata.AAGUID>`
`secondFactorOnlyAuthenticators`
A set of authenticators that should only be used for second factor authentication, based on their AAGUID.

## Constructor Summary

Constructors
Constructor
Description
`SecondFactorOnlyCredentialPolicyRule()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`CredentialPolicy.CredentialPolicyOutcome`
`doEvaluate(EnhancedCredentialRecord credential, ProfileRequestContext prc, WebAuthnAuthenticationContext webAuthnContext)`
Execute the policy.
`void`
`setSecondFactorOnlyAuthenticators(Set<String> allowed)`
Set the authenticators that should only be used for second factor authentication based on their AAGUID.

### Methods inherited from class net.shibboleth.idp.plugin.authn.webauthn.policy.impl.AbstractCredentialPolicyRule

`evaluate, getFidoMetadataService, setActivationCondition, setActivationConditionStrategy, setFidoMetadataService, setWebAuthnContextLookupStrategy`

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

`setId`

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

`doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

`getId`

## Field Details

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### secondFactorOnlyAuthenticators

@Nonnull @NotLive @Unmodifiable private Set<com.yubico.fido.metadata.AAGUID> secondFactorOnlyAuthenticators
A set of authenticators that should only be used for second factor authentication, based on their AAGUID.

## Constructor Details

### SecondFactorOnlyCredentialPolicyRule

public SecondFactorOnlyCredentialPolicyRule()
Constructor.

## Method Details

### setSecondFactorOnlyAuthenticators

public void setSecondFactorOnlyAuthenticators(Set<String> allowed)
Set the authenticators that should only be used for second factor authentication based on their AAGUID.

Parameters:
  `allowed` - The second factor authenticators to set.

### doEvaluate

public CredentialPolicy.CredentialPolicyOutcome doEvaluate(@Nonnull EnhancedCredentialRecord credential, @Nonnull ProfileRequestContext prc, @Nonnull WebAuthnAuthenticationContext webAuthnContext)
Execute the policy. Implementations should override this method.

Specified by:
  `doEvaluate` in class `AbstractCredentialPolicyRule`
Parameters:
  `credential` - the credential to check the policy rules for
  `prc` - the profile request context
  `webAuthnContext` - the WebAuthn authentication context
Returns:
  the credential policy outcome