Package org.keycloak.credential

Class WebAuthnCredentialProvider

java.lang.Object

org.keycloak.credential.WebAuthnCredentialProvider

All Implemented Interfaces:

CredentialInputValidator, CredentialProvider<WebAuthnCredentialModel>, Provider

Direct Known Subclasses:

WebAuthnPasswordlessCredentialProvider

public class WebAuthnCredentialProvider
extends Object
implements CredentialProvider<WebAuthnCredentialModel>, CredentialInputValidator

Credential provider for WebAuthn 2-factor credential of the user

Constructor Summary

Constructors

Constructor	Description
WebAuthnCredentialProvider(KeycloakSession session, WebAuthnMetadataService metadataService, com.webauthn4j.converter.util.ObjectConverter objectConverter)

Method Summary

Modifier and Type	Method	Description
CredentialModel	createCredential(RealmModel realm, UserModel user, WebAuthnCredentialModel credentialModel)
boolean	deleteCredential(RealmModel realm, UserModel user, String credentialId)
void	dumpCredentialModel(WebAuthnCredentialModel credential, WebAuthnCredentialModelInput auth)
WebAuthnCredentialModel	getCredentialForPresentationFromModel(CredentialModel model)	Get the credential (usually stored credential retrieved from the DB) and decorates it with additional metadata to be present for example in the admin console.
WebAuthnCredentialModel	getCredentialFromModel(CredentialModel model)
CredentialMetadata	getCredentialMetadata(WebAuthnCredentialModel credentialModel, CredentialTypeMetadata credentialTypeMetadata)
WebAuthnCredentialModel	getCredentialModelFromCredentialInput(CredentialInput input, String userLabel)	Convert WebAuthn credential input to the model, which can be saved in the persistent storage (DB)
CredentialTypeMetadata	getCredentialTypeMetadata(CredentialTypeMetadataContext metadataContext)
protected KeycloakSession	getKeycloakSession()
String	getType()
protected com.webauthn4j.WebAuthnAuthenticationManager	getWebAuthnAuthenticationManager()
protected WebAuthnPolicy	getWebAuthnPolicy()
boolean	isConfiguredFor(RealmModel realm, UserModel user, String credentialType)
boolean	isValid(RealmModel realm, UserModel user, CredentialInput input)	Tests whether a credential is valid
boolean	supportsCredentialType(String credentialType)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.keycloak.credential.CredentialProvider

close, getDefaultCredential, supportsCredentialType

Constructor Details

WebAuthnCredentialProvider

public WebAuthnCredentialProvider(KeycloakSession session,
 WebAuthnMetadataService metadataService,
 com.webauthn4j.converter.util.ObjectConverter objectConverter)

Method Details

createCredential

public CredentialModel createCredential(RealmModel realm,
 UserModel user,
 WebAuthnCredentialModel credentialModel)

Specified by:

createCredential in interface CredentialProvider<WebAuthnCredentialModel>

deleteCredential

public boolean deleteCredential(RealmModel realm,
 UserModel user,
 String credentialId)

Specified by:

deleteCredential in interface CredentialProvider<WebAuthnCredentialModel>

getCredentialFromModel

public WebAuthnCredentialModel getCredentialFromModel(CredentialModel model)

Specified by:

getCredentialFromModel in interface CredentialProvider<WebAuthnCredentialModel>

getCredentialForPresentationFromModel

public WebAuthnCredentialModel getCredentialForPresentationFromModel(CredentialModel model)

Description copied from interface: CredentialProvider

Get the credential (usually stored credential retrieved from the DB) and decorates it with additional metadata to be present for example in the admin console. Those additional metadata could be various metadata, which are not saved in the DB, but can be retrieved from saved data to be presented to admins/users in the nice way (For example display "authenticator Provider" for WebAuthn credential based on the AAGUID of WebAuthn credential)

Specified by:

getCredentialForPresentationFromModel in interface CredentialProvider<WebAuthnCredentialModel>

Parameters:

model - stored credential retrieved from the DB

Returns:

credential model useful for the presentation (not necessarily only stored data, but possibly some other metadata added)

getCredentialModelFromCredentialInput

public WebAuthnCredentialModel getCredentialModelFromCredentialInput(CredentialInput input,
 String userLabel)

Convert WebAuthn credential input to the model, which can be saved in the persistent storage (DB)

Parameters:

input - should be typically WebAuthnCredentialModelInput

userLabel - label for the credential

supportsCredentialType

public boolean supportsCredentialType(String credentialType)

Specified by:

supportsCredentialType in interface CredentialInputValidator

Specified by:

supportsCredentialType in interface CredentialProvider<WebAuthnCredentialModel>

isConfiguredFor

public boolean isConfiguredFor(RealmModel realm,
 UserModel user,
 String credentialType)

Specified by:

isConfiguredFor in interface CredentialInputValidator

isValid

public boolean isValid(RealmModel realm,
 UserModel user,
 CredentialInput input)

Description copied from interface: CredentialInputValidator

Tests whether a credential is valid

Specified by:

isValid in interface CredentialInputValidator

Parameters:

realm - The realm in which to which the credential belongs to

user - The user for which to test the credential

input - the credential details to verify

Returns:

true if the passed secret is correct

getWebAuthnAuthenticationManager

protected com.webauthn4j.WebAuthnAuthenticationManager getWebAuthnAuthenticationManager()

getWebAuthnPolicy

protected WebAuthnPolicy getWebAuthnPolicy()

getType

public String getType()

Specified by:

getType in interface CredentialProvider<WebAuthnCredentialModel>

dumpCredentialModel

public void dumpCredentialModel(WebAuthnCredentialModel credential,
 WebAuthnCredentialModelInput auth)

getCredentialTypeMetadata

public CredentialTypeMetadata getCredentialTypeMetadata(CredentialTypeMetadataContext metadataContext)

Specified by:

getCredentialTypeMetadata in interface CredentialProvider<WebAuthnCredentialModel>

getKeycloakSession

protected KeycloakSession getKeycloakSession()

getCredentialMetadata

public CredentialMetadata getCredentialMetadata(WebAuthnCredentialModel credentialModel,
 CredentialTypeMetadata credentialTypeMetadata)

Specified by:

getCredentialMetadata in interface CredentialProvider<WebAuthnCredentialModel>