Package com.yubico.webauthn.attestation

Class AttestationTrustSource.TrustRootsResult

java.lang.Object

com.yubico.webauthn.attestation.AttestationTrustSource.TrustRootsResult

Enclosing interface:

AttestationTrustSource

public static final class AttestationTrustSource.TrustRootsResult
extends Object

A result of looking up attestation trust roots for a particular attestation statement.

This primarily consists of a set of trust root certificates - see trustRoots(Set) - but may also:

• include a CertStore of additional CRLs and/or intermediate certificates to use during certificate path validation - see certStore(CertStore);
• disable certificate revocation checking for the relevant attestation statement - see enableRevocationChecking(boolean); and/or
• define a policy tree validator for the PKIX policy tree result - see policyTreeValidator(Predicate).

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	AttestationTrustSource.TrustRootsResult.TrustRootsResultBuilder

Method Summary

Modifier and Type	Method	Description
static AttestationTrustSource.TrustRootsResult.TrustRootsResultBuilder.Step1	builder()
boolean	equals(Object o)
Optional<CertStore>	getCertStore()	A CertStore of additional CRLs and/or intermediate certificates to use during certificate path validation, if any.
Optional<Predicate<PolicyNode>>	getPolicyTreeValidator()	If non-null, the PolicyQualifiersRejected flag will be set to false during certificate path validation.
@NonNull Set<X509Certificate>	getTrustRoots()	A set of attestation root certificates trusted to certify the relevant attestation statement.
int	hashCode()
boolean	isEnableRevocationChecking()	Whether certificate revocation should be checked during certificate path validation.
AttestationTrustSource.TrustRootsResult.TrustRootsResultBuilder	toBuilder()
String	toString()

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Method Details

getCertStore

public Optional<CertStore> getCertStore()

A CertStore of additional CRLs and/or intermediate certificates to use during certificate path validation, if any. This will not be used if trustRoots is empty.

Any certificates included in this CertStore are NOT considered trusted; they will be trusted only if they chain to any of the trustRoots.

The default is null.

getPolicyTreeValidator

public Optional<Predicate<PolicyNode>> getPolicyTreeValidator()

If non-null, the PolicyQualifiersRejected flag will be set to false during certificate path validation. See PKIXParameters.setPolicyQualifiersRejected(boolean).

The given Predicate will be used to validate the policy tree. The Predicate should return true if the policy tree is acceptable, and false otherwise.

Depending on your "PKIX" JCA provider configuration, this may be required if any certificate in the certificate path contains a certificate policies extension marked critical. If this is not set, then such a certificate will be rejected by the certificate path validator from the default provider.

Consult the Java PKI Programmer's Guide for how to use the PolicyNode argument of the Predicate.

The default is null.

builder

public static AttestationTrustSource.TrustRootsResult.TrustRootsResultBuilder.Step1 builder()

getTrustRoots

@NonNull
public @NonNull Set<X509Certificate> getTrustRoots()

A set of attestation root certificates trusted to certify the relevant attestation statement. If the attestation statement is not trusted, or if no trust roots were found, this should be an empty set.

isEnableRevocationChecking

public boolean isEnableRevocationChecking()

Whether certificate revocation should be checked during certificate path validation.

toBuilder

public AttestationTrustSource.TrustRootsResult.TrustRootsResultBuilder toBuilder()

equals

public boolean equals(Object o)

Overrides:

equals in class Object

hashCode

public int hashCode()

Overrides:

hashCode in class Object

toString

public String toString()

Overrides:

toString in class Object