001/*
002 * oauth2-oidc-sdk
003 *
004 * Copyright 2012-2016, Connect2id Ltd and contributors.
005 *
006 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use
007 * this file except in compliance with the License. You may obtain a copy of the
008 * License at
009 *
010 *    http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software distributed
013 * under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
014 * CONDITIONS OF ANY KIND, either express or implied. See the License for the
015 * specific language governing permissions and limitations under the License.
016 */
017
018package com.nimbusds.openid.connect.sdk.claims;
019
020
021import com.nimbusds.oauth2.sdk.id.Identifier;
022import com.nimbusds.oauth2.sdk.util.StringUtils;
023import net.jcip.annotations.Immutable;
024
025import java.util.Collection;
026import java.util.LinkedList;
027import java.util.List;
028
029
030/**
031 * Authentication Method Reference ({@code amr}). It identifies the method
032 * used in authentication.
033 *
034 * <p>The AMR is represented by a string or a URI string.
035 *
036 * <p>Related specifications:
037 *
038 * <ul>
039 *     <li>Authentication Method Reference Values (RFC 8176)
040 *     <li>OpenID Connect Core 1.0
041 * </ul>
042 */
043@Immutable
044public final class AMR extends Identifier {
045        
046        
047        private static final long serialVersionUID = -6833651441441953910L;
048        
049        
050        /**
051         * Biometric authentication (RFC 4949) using facial recognition.
052         */
053        public static final AMR FACE = new AMR("face");
054        
055        
056        /**
057         * Biometric authentication (RFC 4949) using a fingerprint.
058         */
059        public static final AMR FPT = new AMR("fpt");
060        
061        
062        /**
063         * Use of geolocation information for authentication, such as that
064         * provided by W3C REC-geolocation-API-20161108.
065         */
066        public static final AMR GEO = new AMR("geo");
067        
068        
069        /**
070         * Proof-of-Possession (PoP) of a hardware-secured key. See Appendix C
071         * of RFC 4211 for a discussion on PoP.
072         */
073        public static final AMR HWK = new AMR("hwk");
074        
075        
076        /**
077         * Biometric authentication (RFC 4949) using an iris scan.
078         */
079        public static final AMR IRIS = new AMR("iris");
080        
081        
082        /**
083         * Retina scan biometric.
084         */
085        @Deprecated
086        public static final AMR EYE = new AMR("eye");
087        
088        
089        /**
090         * Knowledge-based authentication (NIST.800-63-2, ISO29115).
091         */
092        public static final AMR KBA = new AMR("kba");
093        
094        
095        /**
096         * Multiple-channel authentication (MCA). The authentication involves
097         * communication over more than one distinct communication channel. For
098         * instance, a multiple-channel authentication might involve both
099         * entering information into a workstation's browser and providing
100         * information on a telephone call to a pre-registered number.
101         */
102        public static final AMR MCA = new AMR("mca");
103        
104        
105        /**
106         * Multiple-factor authentication (NIST.800-63-2, ISO29115). When this
107         * is present, specific authentication methods used may also be
108         * included.
109         */
110        public static final AMR MFA = new AMR("mfa");
111        
112        
113        /**
114         * One-time password (RFC 4949). One-time password specifications that
115         * this authentication method applies to include RFC 4226 and RFC 6238.
116         */
117        public static final AMR OTP = new AMR("otp");
118        
119        
120        /**
121         * Personal Identification Number (PIN) (RFC 4949) or pattern (not
122         * restricted to containing only numbers) that a user enters to unlock
123         * a key on the device. This mechanism should have a way to deter an
124         * attacker from obtaining the PIN by trying repeated guesses.
125         */
126        public static final AMR PIN = new AMR("pin");
127        
128        
129        /**
130         * Proof-of-possession (PoP) of a key. See Appendix C of RFC 4211 for a
131         * discussion on PoP.
132         */
133        @Deprecated
134        public static final AMR POP = new AMR("pop");
135        
136        
137        /**
138         * Password-based authentication (RFC 4949).
139         */
140        public static final AMR PWD = new AMR("pwd");
141        
142        
143        /**
144         * Risk-based authentication (Williamson, G., "Enhanced Authentication
145         * In Online Banking", Journal of Economic Crime Management 4.2: 18-19,
146         * 2006).
147         */
148        public static final AMR RBA = new AMR("rba");
149        
150        
151        /**
152         * Smart card (RFC 4949).
153         */
154        public static final AMR SC = new AMR("sc");
155        
156        
157        /**
158         * Confirmation using SMS text message to the user at a registered
159         * number.
160         */
161        public static final AMR SMS = new AMR("sms");
162        
163        
164        /**
165         * Proof-of-Possession (PoP) of a software-secured key. See Appendix C
166         * of RFC 4211 for a discussion on PoP.
167         */
168        public static final AMR SWK = new AMR("swk");
169        
170        
171        /**
172         * Confirmation by telephone call to the user at a registered number.
173         * This authentication technique is sometimes also referred to as
174         * "call back" (RFC 4949).
175         */
176        public static final AMR TEL = new AMR("tel");
177        
178        
179        /**
180         * User presence test. Evidence that the end user is present and
181         * interacting with the device.  This is sometimes also referred to as
182         * "test of user presence" (W3C WD-webauthn-20170216).
183         */
184        public static final AMR USER = new AMR("user");
185        
186        
187        /**
188         * Biometric authentication (RFC 4949) using a voiceprint.
189         */
190        public static final AMR VBM = new AMR("vbm");
191        
192        
193        /**
194         * Windows integrated authentication (Microsoft, "Integrated Windows
195         * Authentication with Negotiate", September 2011).
196         */
197        public static final AMR WIA = new AMR("wia");
198        
199        
200        /**
201         * Creates a new Authentication Method Reference (AMR) with the
202         * specified value.
203         *
204         * @param value The AMR value. Must not be {@code null}.
205         */
206        public AMR(final String value) {
207
208                super(value);
209        }
210
211
212        @Override
213        public boolean equals(final Object object) {
214
215                return object instanceof AMR &&
216                       this.toString().equals(object.toString());
217        }
218
219
220        /**
221         * Parses an AMR list from the specified string collection.
222         *
223         * @param collection The string collection, {@code null} if not
224         *                   specified.
225         *
226         * @return The AMR list, {@code null} if not specified.
227         */
228        public static List<AMR> parseList(final Collection<String> collection) {
229
230                if (collection == null)
231                        return null;
232
233                List<AMR> amrList = new LinkedList<>();
234                for (String v: collection) {
235                        if (StringUtils.isNotBlank(v)) {
236                                amrList.add(new AMR(v));
237                        }
238                }
239
240                return ! amrList.isEmpty() ? amrList : null;
241        }
242}