WebAuthnAuthenticationProvider implements AuthenticationProvider { @Override public Authentication authenticate(Authentication authentication) { if (!supports(authentication.getClass())) { throw new IllegalArgumentException("Only WebAuthnAssertionAuthenticationToken is supported, " + authentication.getClass() + " was attempted"); } WebAuthnAssertionAuthenticationToken authenticationToken = (WebAuthnAssertionAuthenticationToken) authentication; WebAuthnAuthenticationRequest credentials = authenticationToken.getCredentials(); if (credentials == null) { logger.debug("Authentication failed: no credentials provided"); throw new BadCredentialsException(messages.getMessage( "WebAuthnAuthenticationProvider.badCredentials", "Bad credentials")); } byte[] credentialId = credentials.getCredentialId(); WebAuthnAuthenticator webAuthnAuthenticator = retrieveAuthenticator(credentialId); doAuthenticate(authenticationToken, webAuthnAuthenticator); authenticatorService.updateCounter(credentialId, webAuthnAuthenticator.getCounter()); return createSuccessAuthentication(authenticationToken, webAuthnAuthenticator); } WebAuthnAuthenticationProvider(
            WebAuthnAuthenticatorService authenticatorService,
            WebAuthnManager webAuthnManager); @Override Authentication authenticate(Authentication authentication); @Override boolean supports(Class<?> authentication); boolean isHideCredentialIdNotFoundExceptions(); void setHideCredentialIdNotFoundExceptions(boolean hideCredentialIdNotFoundExceptions);  }
@Test(expected = IllegalArgumentException.class) public void authenticate_with_invalid_authenticationToken() { Authentication token = new UsernamePasswordAuthenticationToken("username", "password"); authenticationProvider.authenticate(token); }
@Test(expected = BadCredentialsException.class) public void authenticate_with_authenticationToken_without_args() { Authentication token = new WebAuthnAssertionAuthenticationToken(null, null, null); authenticationProvider.authenticate(token); }
@Test public void authenticate_test() { byte[] credentialId = new byte[32]; GrantedAuthority grantedAuthority = new SimpleGrantedAuthority("ROLE_ADMIN"); UserDetails webAuthnPrincipal = new TestUserDetailsImpl("dummy", Collections.singletonList(grantedAuthority)); WebAuthnAuthenticator webAuthnAuthenticator = mock(WebAuthnAuthenticator.class, RETURNS_DEEP_STUBS); when(webAuthnAuthenticator.getUserPrincipal()).thenReturn(webAuthnPrincipal); when(webAuthnAuthenticator.getAttestedCredentialData().getCredentialId()).thenReturn(credentialId); WebAuthnAuthenticationRequest request = mock(WebAuthnAuthenticationRequest.class); WebAuthnAuthenticationParameters parameters = mock(WebAuthnAuthenticationParameters.class); when(request.getCredentialId()).thenReturn(credentialId); when(authenticatorService.loadAuthenticatorByCredentialId(credentialId)).thenReturn(webAuthnAuthenticator); Authentication token = new WebAuthnAssertionAuthenticationToken(request, parameters, null); Authentication authenticatedToken = authenticationProvider.authenticate(token); ArgumentCaptor<AuthenticationRequest> requestCaptor = ArgumentCaptor.forClass(AuthenticationRequest.class); ArgumentCaptor<AuthenticationParameters> parameterCaptor = ArgumentCaptor.forClass(AuthenticationParameters.class); verify(webAuthnManager).validate(requestCaptor.capture(), parameterCaptor.capture()); assertThat(authenticatedToken.getPrincipal()).isEqualTo(webAuthnPrincipal); assertThat(authenticatedToken.getCredentials()).isEqualTo(request); assertThat(authenticatedToken.getAuthorities().toArray()).containsExactly(grantedAuthority); }
@Test(expected = BadChallengeException.class) public void authenticate_with_BadChallengeException_from_authenticationContextValidator_test() { byte[] credentialId = new byte[32]; WebAuthnAuthenticatorImpl authenticator = mock(WebAuthnAuthenticatorImpl.class, RETURNS_DEEP_STUBS); WebAuthnAuthenticator webAuthnAuthenticator = mock(WebAuthnAuthenticator.class); when(authenticator.getAttestedCredentialData().getCredentialId()).thenReturn(credentialId); doThrow(com.webauthn4j.validator.exception.BadChallengeException.class).when(webAuthnManager).validate((AuthenticationRequest) any(), any()); WebAuthnAuthenticationRequest request = mock(WebAuthnAuthenticationRequest.class); WebAuthnAuthenticationParameters parameters = mock(WebAuthnAuthenticationParameters.class); when(request.getCredentialId()).thenReturn(credentialId); when(authenticatorService.loadAuthenticatorByCredentialId(credentialId)).thenReturn(webAuthnAuthenticator); Authentication token = new WebAuthnAssertionAuthenticationToken(request, parameters, null); authenticationProvider.authenticate(token); }