Package net.shibboleth.idp.plugin.authn.webauthn.admin.impl

# Class AllowCurrentUserAccessPredicate

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.idp.plugin.authn.webauthn.admin.impl.AllowCurrentUserAccessPredicate

All Implemented Interfaces:
  `Predicate<ProfileRequestContext>`, `Component`, `DestructableComponent`, `IdentifiableComponent`, `IdentifiedComponent`, `InitializableComponent`

public class AllowCurrentUserAccessPredicate extends AbstractIdentifiableInitializableComponent implements Predicate<ProfileRequestContext>
An access control predicate that should implement comparison logic to allow access only to authenticated users who initiated the WebAuthn registration/authentication process. If the authenticated user is not the same as the user who started the registration/authentication process (as determined by the initial username collection step), access should be denied.

It is important to prevent users from changing their username between the registration and authentication flows. If this is allowed, it would create a loophole in the WebAuthn authentication process which could allow a user bypass. For instance, a user who starts the registration of a new WebAuthn credential, without any previous WebAuthn credentials, could then login with an inferior authentication mechanism as another user who should only be using WebAuthn (although the overall flow is the responsibility of the MFA flow logic).

More complicated comparison predicates might be needed if either the principal in the subject context and or the username in the registration context have been transformed into different forms but are still logically equivalent.

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`static class`
`AllowCurrentUserAccessPredicate.DefaultCurrentUserComparisonPredicate`
Default comparison predicate which just compares the equality of the input strings.

## Field Summary

Fields
Modifier and Type
Field
Description
`private BiPredicate<ProfileRequestContext,Pair<String,String>>`
`comparisonPredicate`
The predicate that performs the comparison.
`private final org.slf4j.Logger`
`log`
Class logger.
`private Function<ProfileRequestContext,SubjectContext>`
`subjectContextLookupStrategy`
Strategy function to lookup SubjectContext.
`private Function<ProfileRequestContext,WebAuthnAuthenticationContext>`
`webauthnContextLookupStrategy`
Lookup strategy to locate the WebAuthn authentication context.
`private Function<ProfileRequestContext,WebAuthnRegistrationContext>`
`webauthnRegistrationContextLookupStrategy`
Lookup strategy to locate the WebAuthn registration context.

## Constructor Summary

Constructors
Constructor
Description
`AllowCurrentUserAccessPredicate()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`void`
`setComparisonPredicate(BiPredicate<ProfileRequestContext,Pair<String,String>> predicate)`
Set the predicate that performs the comparison between the principal name from the subject context (as the first item in the pair) with the username in the registration context (as the second item in the pair).
`void`
`setSubjectContextLookupStrategy(Function<ProfileRequestContext,SubjectContext> strategy)`
Set the lookup strategy to use to locate the `SubjectContext`.
`void`
`setWebauthnContextLookupStrategy(Function<ProfileRequestContext,WebAuthnAuthenticationContext> strategy)`
Set the WebAuthn authentication context lookup strategy to use.
`void`
`setWebauthnRegistrationContextLookupStrategy(Function<ProfileRequestContext,WebAuthnRegistrationContext> strategy)`
Set the WebAuthn registration context lookup strategy to use.
`boolean`
`test(ProfileRequestContext profileRequestContext)`

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

`setId`

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

`doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

`getId`

### Methods inherited from interface java.util.function.Predicate

`and, negate, or`

## Field Details

### log

@Nonnull @NotEmpty private final org.slf4j.Logger log
Class logger.

### webauthnRegistrationContextLookupStrategy

@Nonnull private Function<ProfileRequestContext,WebAuthnRegistrationContext> webauthnRegistrationContextLookupStrategy
Lookup strategy to locate the WebAuthn registration context.

### webauthnContextLookupStrategy

@Nonnull private Function<ProfileRequestContext,WebAuthnAuthenticationContext> webauthnContextLookupStrategy
Lookup strategy to locate the WebAuthn authentication context.

### subjectContextLookupStrategy

@Nonnull private Function<ProfileRequestContext,SubjectContext> subjectContextLookupStrategy
Strategy function to lookup SubjectContext.

### comparisonPredicate

@Nonnull private BiPredicate<ProfileRequestContext,Pair<String,String>> comparisonPredicate
The predicate that performs the comparison.

## Constructor Details

### AllowCurrentUserAccessPredicate

public AllowCurrentUserAccessPredicate()
Constructor.

## Method Details

### setWebauthnContextLookupStrategy

public void setWebauthnContextLookupStrategy(@Nonnull Function<ProfileRequestContext,WebAuthnAuthenticationContext> strategy)
Set the WebAuthn authentication context lookup strategy to use.

Parameters:
  `strategy` - lookup strategy

### setSubjectContextLookupStrategy

public void setSubjectContextLookupStrategy(@Nonnull Function<ProfileRequestContext,SubjectContext> strategy)
Set the lookup strategy to use to locate the `SubjectContext`.

Parameters:
  `strategy` - lookup function to use

### setComparisonPredicate

public void setComparisonPredicate(@Nonnull BiPredicate<ProfileRequestContext,Pair<String,String>> predicate)
Set the predicate that performs the comparison between the principal name from the subject context (as the first item in the pair) with the username in the registration context (as the second item in the pair). The profile request context adds additional information if required.

Parameters:
  `predicate` - The comparison predicate to set.

### setWebauthnRegistrationContextLookupStrategy

public void setWebauthnRegistrationContextLookupStrategy(@Nonnull Function<ProfileRequestContext,WebAuthnRegistrationContext> strategy)
Set the WebAuthn registration context lookup strategy to use.

Parameters:
  `strategy` - lookup strategy

### test

public boolean test(ProfileRequestContext profileRequestContext)

Specified by:
  `test` in interface `Predicate<ProfileRequestContext>`