Package net.shibboleth.idp.plugin.authn.webauthn.policy.impl

# Class AbstractCredentialPolicyRule

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.idp.plugin.authn.webauthn.policy.impl.AbstractCredentialPolicyRule

All Implemented Interfaces:
  `CredentialPolicy`, `Component`, `DestructableComponent`, `IdentifiableComponent`, `IdentifiedComponent`, `InitializableComponent`

Direct Known Subclasses:
  `ChainingCredentialPolicyRule`, `FunctionalCredentialPolicyRule`, `SecondFactorOnlyCredentialPolicyRule`

@ThreadSafeAfterInit public abstract class AbstractCredentialPolicyRule extends AbstractIdentifiableInitializableComponent implements CredentialPolicy
A base class for `credential policies`. Ensures the credential is not null before it is passed to the policy rule implementation. Can be enabled and disabled using the activiation condition.

Returns `CredentialPolicy.CredentialPolicyOutcome.ACCEPT` if the credential is accepted, returns `CredentialPolicy.CredentialPolicyOutcome.REJECT` if the credential is rejected, returns `CredentialPolicy.CredentialPolicyOutcome.IGNORE` if the rule is to be ignored.

## Nested Class Summary

## Nested classes/interfaces inherited from interface net.shibboleth.idp.plugin.authn.webauthn.policy.CredentialPolicy

`CredentialPolicy.CredentialPolicyOutcome`

## Field Summary

Fields
Modifier and Type
Field
Description
`private BiPredicate<EnhancedCredentialRecord,ProfileRequestContext>`
`activationCondition`
Does this policy rule apply? Default is true.
`private com.yubico.fido.metadata.FidoMetadataService`
`fidoMetadataService`
FIDO metadata service resolver.
`private final org.slf4j.Logger`
`log`
Class logger.
`private Function<ProfileRequestContext,WebAuthnAuthenticationContext>`
`webauthnContextLookupStrategy`
Lookup strategy to locate the WebAuthn context.

## Constructor Summary

Constructors
Modifier
Constructor
Description
`protected`
`AbstractCredentialPolicyRule()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`protected abstract CredentialPolicy.CredentialPolicyOutcome`
`doEvaluate(EnhancedCredentialRecord credential, ProfileRequestContext prc, WebAuthnAuthenticationContext webAuthnContext)`
Execute the policy.
`CredentialPolicy.CredentialPolicyOutcome`
`evaluate(EnhancedCredentialRecord credential, ProfileRequestContext prc)`
Execute the policy.
`protected com.yubico.fido.metadata.FidoMetadataService`
`getFidoMetadataService()`
Get the metadata service to use.
`void`
`setActivationCondition(boolean flag)`
Set an activation condition for this policy rule.
`void`
`setActivationConditionStrategy(BiPredicate<EnhancedCredentialRecord,ProfileRequestContext> condition)`
Set an activation condition for this policy rule.
`void`
`setFidoMetadataService(com.yubico.fido.metadata.FidoMetadataService trustSource)`
Set the FIDO metadata source.
`void`
`setWebAuthnContextLookupStrategy(Function<ProfileRequestContext,WebAuthnAuthenticationContext> strategy)`
Set the WebAuthn context lookup strategy to use.

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

`setId`

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

`doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

`getId`

## Field Details

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### fidoMetadataService

@Nullable private com.yubico.fido.metadata.FidoMetadataService fidoMetadataService
FIDO metadata service resolver.

### activationCondition

@Nonnull private BiPredicate<EnhancedCredentialRecord,ProfileRequestContext> activationCondition
Does this policy rule apply? Default is true.

### webauthnContextLookupStrategy

@Nonnull private Function<ProfileRequestContext,WebAuthnAuthenticationContext> webauthnContextLookupStrategy
Lookup strategy to locate the WebAuthn context.

## Constructor Details

### AbstractCredentialPolicyRule

protected AbstractCredentialPolicyRule()
Constructor.

## Method Details

### setWebAuthnContextLookupStrategy

public void setWebAuthnContextLookupStrategy(@Nonnull Function<ProfileRequestContext,WebAuthnAuthenticationContext> strategy)
Set the WebAuthn context lookup strategy to use.

Parameters:
  `strategy` - lookup strategy

### setActivationConditionStrategy

public void setActivationConditionStrategy(@Nonnull BiPredicate<EnhancedCredentialRecord,ProfileRequestContext> condition)
Set an activation condition for this policy rule.

Parameters:
  `condition` - condition to set

### setActivationCondition

public void setActivationCondition(boolean flag)
Set an activation condition for this policy rule.

Parameters:
  `flag` - the flag to set

### setFidoMetadataService

public void setFidoMetadataService(@Nullable com.yubico.fido.metadata.FidoMetadataService trustSource)
Set the FIDO metadata source.

Parameters:
  `trustSource` - the attestation trust source.

### getFidoMetadataService

@Nullable protected com.yubico.fido.metadata.FidoMetadataService getFidoMetadataService()
Get the metadata service to use.

Returns:
  the metadata service.

### evaluate

public CredentialPolicy.CredentialPolicyOutcome evaluate(@Nonnull EnhancedCredentialRecord credential, @Nonnull ProfileRequestContext prc)
Execute the policy.

Tests the policy is active, extracts and presents the `WebAuthnAuthenticationContext` context from the `ProfileRequestContext` for convenience.

Specified by:
  `evaluate` in interface `CredentialPolicy`
Parameters:
  `credential` - the credential to accept or reject.
  `prc` - the profile request context
Returns:
  `CredentialPolicy.CredentialPolicyOutcome.ACCEPT` if allowed, `CredentialPolicy.CredentialPolicyOutcome.REJECT` if rejected, and `CredentialPolicy.CredentialPolicyOutcome.IGNORE` otherwise.

### doEvaluate

protected abstract CredentialPolicy.CredentialPolicyOutcome doEvaluate(@Nonnull EnhancedCredentialRecord credential, @Nonnull ProfileRequestContext prc, @Nonnull WebAuthnAuthenticationContext webAuthnContext)
Execute the policy. Implementations should override this method.

Parameters:
  `credential` - the credential to check the policy rules for
  `prc` - the profile request context
  `webAuthnContext` - the WebAuthn authentication context
Returns:
  the credential policy outcome