Class CredentialRecordOwnerAuthorizationManager

java.lang.Object

org.springframework.security.web.webauthn.management.CredentialRecordOwnerAuthorizationManager

All Implemented Interfaces:

AuthorizationManager<Bytes>

public final class CredentialRecordOwnerAuthorizationManager
extends Object
implements AuthorizationManager<Bytes>

An AuthorizationManager that grants access when the CredentialRecord identified by the provided credential id is owned by the currently authenticated user.

Per the WebAuthn specification, a credential id must contain at least 16 bytes with at least 100 bits of entropy, making it practically unguessable. The specification also advises that credential ids should be kept private, as exposing them can leak personally identifying information (see § 14.6.3 Privacy leak via credential IDs). This AuthorizationManager is therefore intended as defense in depth: even if a credential id were somehow exposed, an unauthorized user could not delete another user's credential.

Since:

6.5.10

Constructor Summary

Constructors

Constructor	Description
CredentialRecordOwnerAuthorizationManager(UserCredentialRepository userCredentials, PublicKeyCredentialUserEntityRepository userEntities)	Creates a new instance.

Method Summary

Modifier and Type	Method	Description
AuthorizationResult	authorize(Supplier<? extends @Nullable Authentication> authentication, Bytes credentialId)	Determines if access is granted for a specific authentication and object.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface AuthorizationManager

verify

Constructor Details

CredentialRecordOwnerAuthorizationManager

public CredentialRecordOwnerAuthorizationManager(UserCredentialRepository userCredentials,
 PublicKeyCredentialUserEntityRepository userEntities)

Creates a new instance.

Parameters:

userCredentials - the UserCredentialRepository to use

userEntities - the PublicKeyCredentialUserEntityRepository to use

Method Details

authorize

public AuthorizationResult authorize(Supplier<? extends @Nullable Authentication> authentication,
 Bytes credentialId)

Description copied from interface: AuthorizationManager

Determines if access is granted for a specific authentication and object.

Specified by:

authorize in interface AuthorizationManager<Bytes>

Parameters:

authentication - the Supplier of the Authentication to authorize

credentialId - the T object to authorize

Returns:

an AuthorizationResult