Class RelyingParty.RelyingPartyBuilder
- java.lang.Object
-
- com.yubico.webauthn.RelyingParty.RelyingPartyBuilder
-
- Enclosing class:
- RelyingParty
public static class RelyingParty.RelyingPartyBuilder extends java.lang.Object
-
-
Nested Class Summary
Nested Classes Modifier and Type Class Description static class
RelyingParty.RelyingPartyBuilder.MandatoryStages
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description RelyingParty.RelyingPartyBuilder
allowOriginPort(boolean allowOriginPort)
Iftrue
, the origin matching rule is relaxed to allow any port number.RelyingParty.RelyingPartyBuilder
allowOriginSubdomain(boolean allowOriginSubdomain)
Iftrue
, the origin matching rule is relaxed to allow any subdomain, of any depth, of the values oforigins
.RelyingParty.RelyingPartyBuilder
allowUnrequestedExtensions(boolean allowUnrequestedExtensions)
Iftrue
,finishRegistration
andfinishAssertion
will accept responses containing extension outputs for which there was no extension input.RelyingParty.RelyingPartyBuilder
allowUntrustedAttestation(boolean allowUntrustedAttestation)
Iffalse
,finishRegistration
will only allow registrations where the attestation signature can be linked to a trusted attestation root.RelyingParty.RelyingPartyBuilder
appId(@NonNull AppId appId)
The extension input to set for theappid
extension when initiating authentication operations.RelyingParty.RelyingPartyBuilder
appId(@NonNull java.util.Optional<AppId> appId)
The extension input to set for theappid
extension when initiating authentication operations.RelyingParty.RelyingPartyBuilder
attestationConveyancePreference(@NonNull AttestationConveyancePreference attestationConveyancePreference)
The argument for theattestation
parameter in registration operations.RelyingParty.RelyingPartyBuilder
attestationConveyancePreference(@NonNull java.util.Optional<AttestationConveyancePreference> attestationConveyancePreference)
The argument for theattestation
parameter in registration operations.RelyingParty
build()
RelyingParty.RelyingPartyBuilder
credentialRepository(@NonNull CredentialRepository credentialRepository)
An abstract database which can look up credentials, usernames and user handles from usernames, user handles and credential IDs.RelyingParty.RelyingPartyBuilder
identity(@NonNull RelyingPartyIdentity identity)
TheRelyingPartyIdentity
that will be set as therp
parameter when initiating registration operations, and whichAuthenticatorData.getRpIdHash()
will be compared against.RelyingParty.RelyingPartyBuilder
metadataService(@NonNull MetadataService metadataService)
AMetadataService
instance to use for looking up device attestation metadata.RelyingParty.RelyingPartyBuilder
metadataService(@NonNull java.util.Optional<MetadataService> metadataService)
AMetadataService
instance to use for looking up device attestation metadata.RelyingParty.RelyingPartyBuilder
origins(@NonNull java.util.Set<java.lang.String> origins)
The allowed origins that returned authenticator responses will be compared against.RelyingParty.RelyingPartyBuilder
preferredPubkeyParams(@NonNull java.util.List<PublicKeyCredentialParameters> preferredPubkeyParams)
The argument for thepubKeyCredParams
parameter in registration operations.java.lang.String
toString()
RelyingParty.RelyingPartyBuilder
validateSignatureCounter(boolean validateSignatureCounter)
Iftrue
,finishAssertion
will fail if thesignature counter value
in the response is not strictly greater than thestored signature counter value
.
-
-
-
Method Detail
-
appId
public RelyingParty.RelyingPartyBuilder appId(@NonNull @NonNull java.util.Optional<AppId> appId)
The extension input to set for theappid
extension when initiating authentication operations.If this member is set,
startAssertion
will automatically set theappid
extension input, andfinishAssertion
will adjust its verification logic to also accept this AppID as an alternative to the RP ID.By default, this is not set.
-
appId
public RelyingParty.RelyingPartyBuilder appId(@NonNull @NonNull AppId appId)
The extension input to set for theappid
extension when initiating authentication operations.If this member is set,
startAssertion
will automatically set theappid
extension input, andfinishAssertion
will adjust its verification logic to also accept this AppID as an alternative to the RP ID.By default, this is not set.
-
attestationConveyancePreference
public RelyingParty.RelyingPartyBuilder attestationConveyancePreference(@NonNull @NonNull java.util.Optional<AttestationConveyancePreference> attestationConveyancePreference)
The argument for theattestation
parameter in registration operations.Unless your application has a concrete policy for authenticator attestation, it is recommended to leave this parameter undefined.
By default, this is not set.
-
attestationConveyancePreference
public RelyingParty.RelyingPartyBuilder attestationConveyancePreference(@NonNull @NonNull AttestationConveyancePreference attestationConveyancePreference)
The argument for theattestation
parameter in registration operations.Unless your application has a concrete policy for authenticator attestation, it is recommended to leave this parameter undefined.
By default, this is not set.
-
metadataService
public RelyingParty.RelyingPartyBuilder metadataService(@NonNull @NonNull java.util.Optional<MetadataService> metadataService)
AMetadataService
instance to use for looking up device attestation metadata. This matters only ifRelyingParty.getAttestationConveyancePreference()
is non-empty and not set toAttestationConveyancePreference.NONE
.By default, this is not set.
-
metadataService
public RelyingParty.RelyingPartyBuilder metadataService(@NonNull @NonNull MetadataService metadataService)
AMetadataService
instance to use for looking up device attestation metadata. This matters only ifRelyingParty.getAttestationConveyancePreference()
is non-empty and not set toAttestationConveyancePreference.NONE
.By default, this is not set.
-
identity
public RelyingParty.RelyingPartyBuilder identity(@NonNull @NonNull RelyingPartyIdentity identity)
TheRelyingPartyIdentity
that will be set as therp
parameter when initiating registration operations, and whichAuthenticatorData.getRpIdHash()
will be compared against. This is a required parameter.A successful registration or authentication operation requires
AuthenticatorData.getRpIdHash()
to exactly equal the SHA-256 hash of this member'sid
member. Alternatively, it may instead equal the SHA-256 hash ofappId
if the latter is present.
-
origins
public RelyingParty.RelyingPartyBuilder origins(@NonNull @NonNull java.util.Set<java.lang.String> origins)
The allowed origins that returned authenticator responses will be compared against.The default is the set containing only the string
"https://" +
.RelyingParty.getIdentity()
.getId()If
allowOriginPort
andallowOriginSubdomain
are bothfalse
(the default), then a successful registration or authentication operation requiresCollectedClientData.getOrigin()
to exactly equal one of these values.If
allowOriginPort
istrue
, then the above rule is relaxed to allow any port number inCollectedClientData.getOrigin()
, regardless of any port specified.If
allowOriginSubdomain
istrue
, then the above rule is relaxed to allow any subdomain, of any depth, of any of these values.For either of the above relaxations to take effect, both the allowed origin and the client data origin must be valid URLs. Origins that are not valid URLs are matched only by exact string equality.
- See Also:
RelyingParty.getIdentity()
-
credentialRepository
public RelyingParty.RelyingPartyBuilder credentialRepository(@NonNull @NonNull CredentialRepository credentialRepository)
An abstract database which can look up credentials, usernames and user handles from usernames, user handles and credential IDs. This is a required parameter.This is used to look up:
- the user handle for a user logging in via user name
- the user name for a user logging in via user handle
- the credential IDs to include in
PublicKeyCredentialCreationOptions.getExcludeCredentials()
- the credential IDs to include in
PublicKeyCredentialRequestOptions.getAllowCredentials()
- that the correct user owns the credential when verifying an assertion
- the public key to use to verify an assertion
- the stored signature counter when verifying an assertion
-
preferredPubkeyParams
public RelyingParty.RelyingPartyBuilder preferredPubkeyParams(@NonNull @NonNull java.util.List<PublicKeyCredentialParameters> preferredPubkeyParams)
The argument for thepubKeyCredParams
parameter in registration operations.This is a list of acceptable public key algorithms and their parameters, ordered from most to least preferred.
The default is the following list:
-
allowOriginPort
public RelyingParty.RelyingPartyBuilder allowOriginPort(boolean allowOriginPort)
Iftrue
, the origin matching rule is relaxed to allow any port number.The default is
false
.Examples with
origins: ["https://example.org", "https://accounts.example.org", "https://acme.com:8443"]
-
allowOriginPort: false
Accepted:
https://example.org
https://accounts.example.org
https://acme.com:8443
Rejected:
https://example.org:8443
https://shop.example.org
https://acme.com
https://acme.com:9000
-
allowOriginPort: true
Accepted:
https://example.org
https://example.org:8443
https://accounts.example.org
https://acme.com
https://acme.com:8443
https://acme.com:9000
Rejected:
https://shop.example.org
-
-
allowOriginSubdomain
public RelyingParty.RelyingPartyBuilder allowOriginSubdomain(boolean allowOriginSubdomain)
Iftrue
, the origin matching rule is relaxed to allow any subdomain, of any depth, of the values oforigins
.The default is
false
.Examples with
origins: ["https://example.org", "https://acme.com:8443"]
-
allowOriginSubdomain: false
Accepted:
https://example.org
https://acme.com:8443
Rejected:
https://example.org:8443
https://accounts.example.org
https://acme.com
https://eu.shop.acme.com:8443
-
allowOriginSubdomain: true
Accepted:
https://example.org
https://accounts.example.org
https://acme.com:8443
https://eu.shop.acme.com:8443
Rejected:
https://example.org:8443
https://acme.com
-
-
allowUnrequestedExtensions
public RelyingParty.RelyingPartyBuilder allowUnrequestedExtensions(boolean allowUnrequestedExtensions)
Iftrue
,finishRegistration
andfinishAssertion
will accept responses containing extension outputs for which there was no extension input.The default is
false
.- See Also:
- §9. WebAuthn Extensions
-
allowUntrustedAttestation
public RelyingParty.RelyingPartyBuilder allowUntrustedAttestation(boolean allowUntrustedAttestation)
Iffalse
,finishRegistration
will only allow registrations where the attestation signature can be linked to a trusted attestation root. This excludes self attestation and none attestation.Regardless of the value of this option, invalid attestation statements of supported formats will always be rejected. For example, a "packed" attestation statement with an invalid signature will be rejected even if this option is set to
true
.The default is
true
.
-
validateSignatureCounter
public RelyingParty.RelyingPartyBuilder validateSignatureCounter(boolean validateSignatureCounter)
Iftrue
,finishAssertion
will fail if thesignature counter value
in the response is not strictly greater than thestored signature counter value
.The default is
true
.
-
build
public RelyingParty build()
-
toString
public java.lang.String toString()
- Overrides:
toString
in classjava.lang.Object
-
-