de.adesso.softauthn.authenticator

Class BrokenAuthenticator

java.lang.Object

de.adesso.softauthn.authenticator.BrokenAuthenticator

All Implemented Interfaces:

Authenticator

public class BrokenAuthenticator
extends java.lang.Object
implements Authenticator

Authenticator implementation that behaves like some other kind of Authenticator but always computes an invalid signature when creating an assertion.

Constructor Summary

Constructors

Constructor and Description
BrokenAuthenticator(Authenticator basis) Create a new broken authenticator.

Method Summary

Modifier and Type	Method and Description
AuthenticatorAssertionData	getAssertion(java.lang.String rpId, byte[] hash, java.util.List<com.yubico.webauthn.data.PublicKeyCredentialDescriptor> allowedCredentialDescriptorList, boolean requireUserVerification, byte[] extensions) Implementation that creates invalid assertions.
com.yubico.webauthn.data.AuthenticatorAttachment	getAttachment() Returns this authenticator's attachment.
com.upokecenter.cbor.CBORObject	makeCredential(byte[] hash, com.yubico.webauthn.data.RelyingPartyIdentity rpEntity, com.yubico.webauthn.data.UserIdentity userEntity, boolean requireResidentKey, boolean requireUserVerification, java.util.List<com.yubico.webauthn.data.PublicKeyCredentialParameters> credTypesAndPubKeyAlgs, java.util.Set<com.yubico.webauthn.data.PublicKeyCredentialDescriptor> excludeCredentials, boolean enterpriseAttestationPossible, byte[] extensions) Method that will be called by a client platform to create a new credential on this authenticator.
boolean	supportsClientSideDiscoverablePublicKeyCredentialSources() Returns whether this authenticator supports the creation of client-side discoverable credentials, also known as resident keys.
boolean	supportsUserVerification() Returns whether this authenticator can perform user verification.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

BrokenAuthenticator

public BrokenAuthenticator(Authenticator basis)

Create a new broken authenticator. The resulting authenticator will behave like the one passed as a parameter except that it returns invalid assertion signatures.

Parameters:

basis - The authenticator that will be used as the basis/delegate of this one.

Method Detail

makeCredential

public com.upokecenter.cbor.CBORObject makeCredential(byte[] hash,
                                                      com.yubico.webauthn.data.RelyingPartyIdentity rpEntity,
                                                      com.yubico.webauthn.data.UserIdentity userEntity,
                                                      boolean requireResidentKey,
                                                      boolean requireUserVerification,
                                                      java.util.List<com.yubico.webauthn.data.PublicKeyCredentialParameters> credTypesAndPubKeyAlgs,
                                                      java.util.Set<com.yubico.webauthn.data.PublicKeyCredentialDescriptor> excludeCredentials,
                                                      boolean enterpriseAttestationPossible,
                                                      byte[] extensions)
                                               throws java.lang.IllegalArgumentException,
                                                      java.lang.UnsupportedOperationException,
                                                      java.lang.IllegalStateException

Description copied from interface: Authenticator

Method that will be called by a client platform to create a new credential on this authenticator.

Specified by:

makeCredential in interface Authenticator

Parameters:

hash - The hash of the serialized client data, provided by the client.

rpEntity - The Relying Party entity

userEntity - The user account's entity, containing the user handle given by the Relying Party.

requireResidentKey - The effective resident key requirement for credential creation, a Boolean value determined by the client.

requireUserVerification - The effective user verification requirement for credential creation, a Boolean value determined by the client.

credTypesAndPubKeyAlgs - A sequence of credential types and algorithms requested by the Relying Party. This sequence is ordered from most preferred to least preferred. The authenticator makes a best-effort to create the most preferred credential that it can.

excludeCredentials - A nullable list of PublicKeyCredentialDescriptor objects provided by the Relying Party with the intention that, if any of these are known to the authenticator, it SHOULD NOT create a new credential. excludeCredentials contains a list of known credentials.

enterpriseAttestationPossible - A Boolean value that indicates that individually-identifying attestation MAY be returned by the authenticator.

extensions - A CBOR map from extension identifiers to their authenticator extension inputs, created by the client based on the extensions requested by the Relying Party, if any.

Returns:

An Attestation object created by the authenticator for the request.

Throws:

java.lang.IllegalArgumentException - If the parameters are malformed in any way.

java.lang.UnsupportedOperationException - If some requirement was requested that this authenticator does not support.

java.lang.IllegalStateException - If the current state of this authenticator prevents it from fulfilling the request.

See Also:

The authenticatorMakeCredential Operation

Implementation Note:

This implementation simply delegates to the authenticator set at creation time.

getAssertion

public AuthenticatorAssertionData getAssertion(java.lang.String rpId,
                                               byte[] hash,
                                               java.util.List<com.yubico.webauthn.data.PublicKeyCredentialDescriptor> allowedCredentialDescriptorList,
                                               boolean requireUserVerification,
                                               byte[] extensions)
                                        throws java.lang.IllegalArgumentException,
                                               java.util.NoSuchElementException

Implementation that creates invalid assertions. See Implementation Note for details.

Specified by:

getAssertion in interface Authenticator

Parameters:

rpId - The caller’s RP ID, as determined by the user agent and the client.

hash - The hash of the serialized client data, provided by the client.

allowedCredentialDescriptorList - A nullable list of PublicKeyCredentialDescriptors describing credentials acceptable to the Relying Party (possibly filtered by the client), if any.

requireUserVerification - The effective user verification requirement for assertion, a Boolean value provided by the client.

extensions - A CBOR map from extension identifiers to their authenticator extension inputs, created by the client based on the extensions requested by the Relying Party, if any.

Returns:

The result data of the assertion.

Throws:

java.lang.IllegalArgumentException - If the parameters are malformed in any way.

java.util.NoSuchElementException - If this authenticator cannot find any matching credential.

See Also:

The authenticatorGetAssertion Operation

Implementation Note:

This implementation does the following:

1. Delegate to the authenticator set at creation time
2. Replace the signature in the returned assertion data with random bytes (same length)
3. Return the modified assertion data.

getAttachment

public com.yubico.webauthn.data.AuthenticatorAttachment getAttachment()

Description copied from interface: Authenticator

Returns this authenticator's attachment.

Specified by:

getAttachment in interface Authenticator

Returns:

the attachment.

Implementation Note:

Delegates to the underlying authenticator.

supportsClientSideDiscoverablePublicKeyCredentialSources

public boolean supportsClientSideDiscoverablePublicKeyCredentialSources()

Description copied from interface: Authenticator

Returns whether this authenticator supports the creation of client-side discoverable credentials, also known as resident keys.

Specified by:

supportsClientSideDiscoverablePublicKeyCredentialSources in interface Authenticator

Returns:

Whether this authenticator can store credentials itself.

See Also:

Credential Storage Modality

Implementation Note:

Delegates to the underlying authenticator.

supportsUserVerification

public boolean supportsUserVerification()

Description copied from interface: Authenticator

Returns whether this authenticator can perform user verification.

Specified by:

supportsUserVerification in interface Authenticator

Returns:

Whether user verification is supported.

See Also:

Authentication Factor Capability

Implementation Note:

Delegates to the underlying authenticator.