Package net.shibboleth.idp.plugin.authn.webauthn.client.impl

# Class YubicoWebAuthnAuthenticationClient

java.lang.Object
net.shibboleth.idp.plugin.authn.webauthn.client.impl.YubicoWebAuthnAuthenticationClient

All Implemented Interfaces:
  `WebAuthnAuthenticationClient`

@ThreadSafe public class YubicoWebAuthnAuthenticationClient extends Object implements WebAuthnAuthenticationClient
Yubico implementation of a `WebAuthnAuthenticationClient`.

Thread-safe, only a single instance is required.

## Field Summary

Fields
Modifier and Type
Field
Description
`private final org.slf4j.Logger`
`log`
Class logger.
`private final List<com.yubico.webauthn.data.PublicKeyCredentialParameters>`
`preferredPublickeyParams`
List of acceptable public key algorithms.
`private final com.yubico.webauthn.RelyingParty`
`rp`
Information pertaining to the relying party.

## Constructor Summary

Constructors
Constructor
Description
`YubicoWebAuthnAuthenticationClient(com.yubico.webauthn.RelyingParty relyingParty, List<com.yubico.webauthn.data.PublicKeyCredentialParameters> publickeyParams)`
Package-private Constructor.

## Method Summary

Modifier and Type
Method
Description
`com.yubico.webauthn.data.PublicKeyCredentialRequestOptions`
`createAuthenticationRequest(CredentialRequestOptionsParameters requestParams)`
Create a PublicKeyCredentialRequestOptions for the WebAuthn 'get' call to generate an authentication assertion.
`com.yubico.webauthn.data.PublicKeyCredentialCreationOptions`
`createRegistrationRequest(CredentialCreationOptionsParameters creationOptions)`
Create a PublicKeyCredentialCreationOptions for the WebAuthn 'create' call to generate a new registration attestation.
`AssertionResult`
`validateAuthenticatorAssertionResponse(String username, byte[] userId, com.yubico.webauthn.data.PublicKeyCredentialRequestOptions publicKeyCredentialRequestOptions, com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> authenticatorAssertionResponse)`
Validate the PublicKeyCredential authenticator assertion response from an authentication request.
`RegistrationResult`
`validateAuthenticatorAttestationResponse(com.yubico.webauthn.data.PublicKeyCredentialCreationOptions publicKeyCredentialCreationOptions, com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAttestationResponse,com.yubico.webauthn.data.ClientRegistrationExtensionOutputs> authenticatorAttestationResponse)`
Validate the PublicKeyCredential authenticator attestation response from a registration request.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### rp

@Nonnull private final com.yubico.webauthn.RelyingParty rp
Information pertaining to the relying party.

### preferredPublickeyParams

@Nonnull @NonnullElements @NotLive private final List<com.yubico.webauthn.data.PublicKeyCredentialParameters> preferredPublickeyParams
List of acceptable public key algorithms.

## Constructor Details

### YubicoWebAuthnAuthenticationClient

YubicoWebAuthnAuthenticationClient(@Nonnull com.yubico.webauthn.RelyingParty relyingParty, @Nonnull @NonnullElements @NotLive List<com.yubico.webauthn.data.PublicKeyCredentialParameters> publickeyParams)
Package-private Constructor.

Should only be instantiated by the `YubicoWebauthnClientFactory`.

Parameters:
  `relyingParty` - information pertaining to the relying party.
  `publickeyParams` - list of preferred public key credential parameters to send to the authenticator during registration.

## Method Details

### createAuthenticationRequest

public com.yubico.webauthn.data.PublicKeyCredentialRequestOptions createAuthenticationRequest(@Nonnull CredentialRequestOptionsParameters requestParams) throws WebAuthnAuthenticationClientException
Description copied from interface: `WebAuthnAuthenticationClient`
Create a PublicKeyCredentialRequestOptions for the WebAuthn 'get' call to generate an authentication assertion.

Specified by:
  `createAuthenticationRequest` in interface `WebAuthnAuthenticationClient`
Parameters:
  `requestParams` - the options that should be present in the authentication request.
Returns:
  a PublicKeyCredentialRequestOptions object to supply to the WebAuthn 'get' call
Throws:
  `WebAuthnAuthenticationClientException` - if there is an error generating the authentication request

### createRegistrationRequest

public com.yubico.webauthn.data.PublicKeyCredentialCreationOptions createRegistrationRequest(@Nonnull CredentialCreationOptionsParameters creationOptions) throws WebAuthnAuthenticationClientException
Create a PublicKeyCredentialCreationOptions for the WebAuthn 'create' call to generate a new registration attestation.

Specified by:
  `createRegistrationRequest` in interface `WebAuthnAuthenticationClient`
Parameters:
  `creationOptions` - the options that should be present in the registration request.
Returns:
  a PublicKeyCredentialCreationOptions object to supply the WebAuthn 'create' call
Throws:
  `WebAuthnAuthenticationClientException` - if there is an error generating the creation request

### validateAuthenticatorAssertionResponse

public AssertionResult validateAuthenticatorAssertionResponse(@Nullable String username, @Nullable byte[] userId, @Nonnull com.yubico.webauthn.data.PublicKeyCredentialRequestOptions publicKeyCredentialRequestOptions, @Nonnull com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAssertionResponse,com.yubico.webauthn.data.ClientAssertionExtensionOutputs> authenticatorAssertionResponse) throws AssertionFailureException
Description copied from interface: `WebAuthnAuthenticationClient`
Validate the PublicKeyCredential authenticator assertion response from an authentication request.

Specified by:
  `validateAuthenticatorAssertionResponse` in interface `WebAuthnAuthenticationClient`
Parameters:
  `username` - the username of the users account on the IdP as set in the assertion request. Should map one-to-one with the user.id.
  `userId` - the user.id of the users account on the IdP as set in the assertion request. Should match the userHandle in the assertion response
  `publicKeyCredentialRequestOptions` - the options used when generating an assertion for authentication.
  `authenticatorAssertionResponse` - the assertion response.
Returns:
  an assertion result iff the assertion was valid.
Throws:
  `AssertionFailureException` - if the assertion is not valid

### validateAuthenticatorAttestationResponse

public RegistrationResult validateAuthenticatorAttestationResponse(@Nonnull com.yubico.webauthn.data.PublicKeyCredentialCreationOptions publicKeyCredentialCreationOptions, @Nonnull com.yubico.webauthn.data.PublicKeyCredential<com.yubico.webauthn.data.AuthenticatorAttestationResponse,com.yubico.webauthn.data.ClientRegistrationExtensionOutputs> authenticatorAttestationResponse) throws RegistrationFailureException
Validate the PublicKeyCredential authenticator attestation response from a registration request.

Specified by:
  `validateAuthenticatorAttestationResponse` in interface `WebAuthnAuthenticationClient`
Parameters:
  `publicKeyCredentialCreationOptions` - the options used when requesting a new public key credential
  `authenticatorAttestationResponse` - the response to the client's request to create a public key credential
Returns:
  a registration result iff the registration was valid
Throws:
  `RegistrationFailureException` - if the registration is invalid.