Class WebAuthnAuthenticator
java.lang.Object
org.keycloak.authentication.authenticators.browser.WebAuthnAuthenticator
- All Implemented Interfaces:
Authenticator
,CredentialValidator<WebAuthnCredentialProvider>
,Provider
- Direct Known Subclasses:
WebAuthnPasswordlessAuthenticator
public class WebAuthnAuthenticator
extends Object
implements Authenticator, CredentialValidator<WebAuthnCredentialProvider>
Authenticator for WebAuthn authentication, which will be typically used when WebAuthn is used as second factor.
-
Constructor Summary
-
Method Summary
Modifier and TypeMethodDescriptionvoid
action
(AuthenticationFlowContext context) Called from a form action invocation.void
authenticate
(AuthenticationFlowContext context) Initial call for the authenticator.void
close()
boolean
configuredFor
(KeycloakSession session, RealmModel realm, UserModel user) Is this authenticator configured for this user.getCredentialProvider
(KeycloakSession session) protected String
getRequiredActions
(KeycloakSession session) Overwrite this if the authenticator is associated withprotected String
getRpID
(AuthenticationFlowContext context) protected WebAuthnPolicy
boolean
Does this authenticator require that the user has already been identified? That AuthenticatorContext.getUser() is not null?void
setRequiredActions
(KeycloakSession session, RealmModel realm, UserModel user) Set actions to configure authenticatorprotected boolean
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
Methods inherited from interface org.keycloak.authentication.Authenticator
areRequiredActionsEnabled
Methods inherited from interface org.keycloak.authentication.CredentialValidator
getCredentials, getType
-
Constructor Details
-
WebAuthnAuthenticator
-
-
Method Details
-
authenticate
Description copied from interface:Authenticator
Initial call for the authenticator. This method should check the current HTTP request to determine if the request satisfies the Authenticator's requirements. If it doesn't, it should send back a challenge response by calling the AuthenticationFlowContext.challenge(Response). If this challenge is a authentication, the action URL of the form must point to /realms/{realm}/login-actions/authenticate?code={session-code}&execution={executionId} or /realms/{realm}/login-actions/registration?code={session-code}&execution={executionId} {session-code} pertains to the code generated from AuthenticationFlowContext.generateAccessCode(). The {executionId} pertains to the AuthenticationExecutionModel.getId() value obtained from AuthenticationFlowContext.getExecution(). The action URL will invoke the action() method described below.- Specified by:
authenticate
in interfaceAuthenticator
-
getWebAuthnPolicy
-
getRpID
-
getCredentialType
-
shouldDisplayAuthenticators
-
action
Description copied from interface:Authenticator
Called from a form action invocation.- Specified by:
action
in interfaceAuthenticator
-
requiresUser
public boolean requiresUser()Description copied from interface:Authenticator
Does this authenticator require that the user has already been identified? That AuthenticatorContext.getUser() is not null?- Specified by:
requiresUser
in interfaceAuthenticator
- Returns:
-
configuredFor
Description copied from interface:Authenticator
Is this authenticator configured for this user.- Specified by:
configuredFor
in interfaceAuthenticator
- Returns:
-
setRequiredActions
Description copied from interface:Authenticator
Set actions to configure authenticator- Specified by:
setRequiredActions
in interfaceAuthenticator
-
getRequiredActions
Description copied from interface:Authenticator
Overwrite this if the authenticator is associated with- Specified by:
getRequiredActions
in interfaceAuthenticator
- Returns:
-
close
public void close() -
getCredentialProvider
- Specified by:
getCredentialProvider
in interfaceCredentialValidator<WebAuthnCredentialProvider>
-