Class PasskeySettings

java.lang.Object
com.iizix.server.user.passkey.PasskeySettings
public final class PasskeySettings extends Object
The passkey settings of an application (CC-LOGIN-L8-PASSKEYS), resolved from the custom application settings that exist already: the application's own (customApp of its module project settings) over the ones of the server environment it runs in (customApp of the serverConfigEnv). A value the application sets wins; a value it does not set is the environment's; a value nobody sets is the default.
  Key                                  Value                                   Default
  -----------------------------------  --------------------------------------  ----------------------------------
  signIn.passkeys                      true | false                            true
  signIn.passkey.rpId                  the domain the application is reached   the host of the server's external
                                       at, e.g. app.example.com                URL ($extServerURL)
  signIn.passkey.rpName                the name shown by the authenticator     the application's description,
                                                                               else its application ID
  signIn.passkey.origins               the origins of the application's pages  https://(rpId), and the origin of
                                       and apps, separated by spaces           the external URL when it is of rpId
  signIn.passkey.relatedOrigins        the https origins on OTHER domains that  none
                                       may use the relying party ID
  signIn.requirePasskeyWhereAvailable  true | false                            false
  signIn.passkey.iosApps               (team ID).(bundle ID) ..., for the      none
                                       apple-app-site-association file
  signIn.passkey.androidApps           (package)=(SHA-256 fingerprint) ...,    none
                                       for the assetlinks.json file

The relying party ID is configured, never taken from a request. It is the application's domain, as the owner ruled: per application, not per server. A passkey belongs to its relying party ID for good: changing the value orphans every passkey registered under the old one. Without a relying party ID the application offers no passkeys.

An origin is https://host or https://host:port with a host that is the relying party ID or a subdomain of it, http for localhost only, or android:apk-key-hash:... for a signed Android application. A related origin is https on any other domain: it is accepted as an origin and listed in the /.well-known/webauthn file of the relying party ID (WebAuthn related origin requests, which not every Browser makes). A value that is none of these is dropped and logged.

Author:
Christopher Mindus

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    final List<String[]>
    androidApps
    The Android applications, each the package and the fingerprint (upper case), unmodifiable.
    final boolean
    enabled
    Flag for passkeys offered by the application: enabled, with a relying party ID.
    final List<String>
    iosApps
    The iOS applications, (team ID).(bundle ID), unmodifiable.
    static final String
    KEY_ANDROID_APPS
    The keys of the custom application settings.
    static final String
    KEY_ENABLED
    The keys of the custom application settings.
    static final String
    KEY_IOS_APPS
    The keys of the custom application settings.
    static final String
    KEY_ORIGINS
    The keys of the custom application settings.
    static final String
    KEY_RELATED
    The keys of the custom application settings.
    static final String
    KEY_REQUIRE
    The keys of the custom application settings.
    static final String
    KEY_RP_ID
    The keys of the custom application settings.
    static final String
    KEY_RP_NAME
    The keys of the custom application settings.
    final Set<String>
    origins
    The origins a credential may come from, unmodifiable.
    final List<String>
    problems
    The problems of the configuration, for the log; unmodifiable.
    final Set<String>
    relatedOrigins
    The origins on other domains that may use the relying party ID, unmodifiable.
    final boolean
    requireWhereAvailable
    Flag for the policy "require a passkey where available".
    final String
    rpId
    The relying party ID, null when none is configured or the configured one is no domain.
    final String
    rpName
    The name of the relying party, shown by the authenticator.

  • Method Summary

    Modifier and Type
    Method
    Description
    static boolean
    isDomain(String s)
    Checks if a text is a domain name that can be a relying party ID: lower case labels of letters, digits and hyphens, no IP address.
    static boolean
    isRpIdValidFor(String rpId, String host)
    Checks if a relying party ID is valid for the host a page was opened on, as the Browser checks it before any ceremony (WebAuthn: the relying party ID is equal to the origin's host, or a domain suffix of it): mindus.co is valid for app.mindus.co and for mindus.co, not for mindus.com, localhost or 127.0.0.1 (CC-FIX-SIGNIN-RECOVERY, the third amendment).
    static PasskeySettings
    of(AppFactory appFactory)
    Resolves the settings of an application of the running server, and logs the problems of its configuration, each once.
    static PasskeySettings
    resolve(UnaryOperator<String> application, UnaryOperator<String> environment, String externalURL, String defaultName)
    Resolves the settings from the two sources of values.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • KEY_ENABLED

      public static final String KEY_ENABLED
      The keys of the custom application settings.
      See Also:

    • KEY_RP_ID

      public static final String KEY_RP_ID
      The keys of the custom application settings.
      See Also:

    • KEY_RP_NAME

      public static final String KEY_RP_NAME
      The keys of the custom application settings.
      See Also:

    • KEY_ORIGINS

      public static final String KEY_ORIGINS
      The keys of the custom application settings.
      See Also:

    • KEY_REQUIRE

      public static final String KEY_REQUIRE
      The keys of the custom application settings.
      See Also:

    • KEY_IOS_APPS

      public static final String KEY_IOS_APPS
      The keys of the custom application settings.
      See Also:

    • KEY_ANDROID_APPS

      public static final String KEY_ANDROID_APPS
      The keys of the custom application settings.
      See Also:

    • enabled

      public final boolean enabled
      Flag for passkeys offered by the application: enabled, with a relying party ID.

    • rpId

      public final String rpId
      The relying party ID, null when none is configured or the configured one is no domain.

    • rpName

      public final String rpName
      The name of the relying party, shown by the authenticator.

    • origins

      public final Set<String> origins
      The origins a credential may come from, unmodifiable.

    • relatedOrigins

      public final Set<String> relatedOrigins
      The origins on other domains that may use the relying party ID, unmodifiable. They are among the origins too.

    • requireWhereAvailable

      public final boolean requireWhereAvailable
      Flag for the policy "require a passkey where available".

    • iosApps

      public final List<String> iosApps
      The iOS applications, (team ID).(bundle ID), unmodifiable.

    • androidApps

      public final List<String[]> androidApps
      The Android applications, each the package and the fingerprint (upper case), unmodifiable.

    • problems

      public final List<String> problems
      The problems of the configuration, for the log; unmodifiable.

  • Method Details

    • of

      public static PasskeySettings of(AppFactory appFactory)
      Resolves the settings of an application of the running server, and logs the problems of its configuration, each once.
      Parameters:
      appFactory - The application.
      Returns:
      The settings.
      Throws:
      NullPointerException - If appFactory is null.

    • resolve

      public static PasskeySettings resolve(UnaryOperator<String> application, UnaryOperator<String> environment, String externalURL, String defaultName)
      Resolves the settings from the two sources of values.
      Parameters:
      application - The values of the application, by key; null for a key it does not set.
      environment - The values of the server environment, by key; null likewise.
      externalURL - The external URL of the server, null for none.
      defaultName - The name of the relying party when none is configured.
      Returns:
      The settings.
      Throws:
      NullPointerException - If application or environment is null.

    • isRpIdValidFor

      public static boolean isRpIdValidFor(String rpId, String host)
      Checks if a relying party ID is valid for the host a page was opened on, as the Browser checks it before any ceremony (WebAuthn: the relying party ID is equal to the origin's host, or a domain suffix of it): mindus.co is valid for app.mindus.co and for mindus.co, not for mindus.com, localhost or 127.0.0.1 (CC-FIX-SIGNIN-RECOVERY, the third amendment). The public suffix list is not consulted: a relying party ID that is a public suffix is the administrator's mistake, and the Browser refuses it on its own. A page whose host is not known (no web client) is not refused here.
      Parameters:
      rpId - The relying party ID, lower case; null for none.
      host - The host the page was opened on, in any case; null when it is not known.
      Returns:
      true when a ceremony with this relying party ID can succeed on the page.

    • isDomain

      public static boolean isDomain(String s)
      Checks if a text is a domain name that can be a relying party ID: lower case labels of letters, digits and hyphens, no IP address.
      Parameters:
      s - The text.
      Returns:
      true when it is.