Examples with AuthenticatorToBeFiltered com.yubico.fido.metadata.FidoMetadataService.Filters.AuthenticatorToBeFiltered used on opensource projects

Example 1 with AuthenticatorToBeFiltered

use of com.yubico.fido.metadata.FidoMetadataService.Filters.AuthenticatorToBeFiltered in project java-webauthn-server by Yubico.

the class FidoMetadataService method findEntries.

/**
 * Look up metadata entries matching a given attestation certificate chain or AAGUID.
 *
 * @param attestationCertificateChain an attestation certificate chain, presumably from a WebAuthn
 *     attestation statement.
 * @param aaguid the AAGUID of the authenticator to look up, if available.
 * @return All metadata entries which satisfy ALL of the following:
 *     <ul>
 *       <li>It satisfies the {@link FidoMetadataServiceBuilder#prefilter(Predicate) prefilter}.
 *       <li>It satisfies AT LEAST ONE of the following:
 *           <ul>
 *             <li><code>aaguid</code> is present and equals the {@link
 *                 MetadataBLOBPayloadEntry#getAaguid() AAGUID} of the metadata entry.
 *             <li><code>aaguid</code> is present and equals the {@link
 *                 MetadataBLOBPayloadEntry#getAaguid() AAGUID} of the {@link
 *                 MetadataBLOBPayloadEntry#getMetadataStatement() metadata statement}, if any, in
 *                 the metadata entry.
 *             <li>The certificate subject key identifier of any certificate in <code>
 *                 attestationCertificateChain</code> matches any element of {@link
 *                 MetadataBLOBPayloadEntry#getAttestationCertificateKeyIdentifiers()
 *                 attestationCertificateKeyIdentifiers} in the metadata entry.
 *             <li>The certificate subject key identifier of any certificate in <code>
 *                 attestationCertificateChain</code> matches any element of {@link
 *                 MetadataStatement#getAttestationCertificateKeyIdentifiers()
 *                 attestationCertificateKeyIdentifiers} in the {@link
 *                 MetadataBLOBPayloadEntry#getMetadataStatement() metadata statement}, if any, in
 *                 the metadata entry.
 *           </ul>
 *       <li>It satisfies the {@link FidoMetadataServiceBuilder#filter(Predicate) filter} together
 *           with <code>attestationCertificateChain</code> and <code>aaguid</code>.
 *     </ul>
 *
 * @see #findEntries(List)
 * @see #findEntries(List, AAGUID)
 */
public Set<MetadataBLOBPayloadEntry> findEntries(@NonNull List<X509Certificate> attestationCertificateChain, @NonNull Optional<AAGUID> aaguid) {
    final Set<String> certSubjectKeyIdentifiers = attestationCertificateChain.stream().map(cert -> {
        try {
            return new ByteArray(CertificateParser.computeSubjectKeyIdentifier(cert)).getHex();
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException("SHA-1 hash algorithm is not available in JCA context.", e);
        }
    }).collect(Collectors.toSet());
    final Optional<AAGUID> nonzeroAaguid = aaguid.filter(a -> !a.isZero());
    log.debug("findEntries(certSubjectKeyIdentifiers = {}, aaguid = {})", certSubjectKeyIdentifiers, aaguid);
    if (!nonzeroAaguid.isPresent()) {
        log.debug("findEntries: ignoring zero AAGUID");
    }
    final Set<MetadataBLOBPayloadEntry> result = Stream.concat(nonzeroAaguid.map(prefilteredEntriesByAaguid::get).map(Collection::stream).orElseGet(Stream::empty), certSubjectKeyIdentifiers.stream().flatMap(cski -> Optional.ofNullable(prefilteredEntriesByCertificateKeyIdentifier.get(cski)).map(Collection::stream).orElseGet(Stream::empty))).filter(metadataBLOBPayloadEntry -> this.filter.test(new AuthenticatorToBeFiltered(attestationCertificateChain, metadataBLOBPayloadEntry, aaguid.orElse(null)))).collect(Collectors.toSet());
    log.debug("findEntries(certSubjectKeyIdentifiers = {}, aaguid = {}) => {} matches", certSubjectKeyIdentifiers, aaguid, result.size());
    return result;
}