[java-idp-plugin-webauthn] branch main updated: JWEBAUTHN-6 - Signal an end-state from the authentication flow if user has no registered credentials
Phil Smart
philip.smart at jisc.ac.uk
Fri Apr 12 16:16:01 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=5aa20a416988e543a79febe0cca57c9159f7706a
The following commit(s) were added to refs/heads/main by this push:
new 5aa20a4 JWEBAUTHN-6 - Signal an end-state from the authentication flow if user has no registered credentials
5aa20a4 is described below
commit 5aa20a416988e543a79febe0cca57c9159f7706a
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Apr 12 17:15:58 2024 +0100
JWEBAUTHN-6 - Signal an end-state from the authentication flow if user
has no registered credentials
- First PoC when used with the correct mfa config for the passwordless
flow
https://shibboleth.atlassian.net/browse/JWEBAUTHN-6
---
.../authn/WebAuthnAuthenticationEventIds.java | 38 ++++++++++++++++++
.../webauthn/impl/LookupRegisteredCredentials.java | 45 +++++++++++++++++++++-
.../idp/flows/authn/WebAuthn/webauthn-beans.xml | 2 +
.../authn/webauthn/conf/authn/webauthn.properties | 4 ++
.../webauthn/client/impl/MockWebAuthnClient.java | 1 +
.../impl/ValidateWebAuthnAssertionTest.java | 1 +
.../storage/impl/InMemoryRegistrationStorage.java | 7 ++++
7 files changed, 97 insertions(+), 1 deletion(-)
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/WebAuthnAuthenticationEventIds.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/WebAuthnAuthenticationEventIds.java
new file mode 100644
index 0000000..98fcfae
--- /dev/null
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/authn/WebAuthnAuthenticationEventIds.java
@@ -0,0 +1,38 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.webauthn.authn;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+
+/**
+ * Constants to use for {@link org.opensaml.profile.action.ProfileAction}
+ * {@link org.opensaml.profile.context.EventContext} results related to
+ * WebAuthn authentication.
+ */
+public final class WebAuthnAuthenticationEventIds {
+
+ /** Private constructor.*/
+ private WebAuthnAuthenticationEventIds() {
+
+ }
+
+ /** The user has no registered WebAuthn credentials. */
+ @Nonnull @NotEmpty
+ public static final String NO_REGISTERED_WEBAUTHN_CREDENTIALS = "NoRegisteredWebAuthnCredentials";
+
+
+}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/LookupRegisteredCredentials.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/LookupRegisteredCredentials.java
index 7698947..d4bc589 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/LookupRegisteredCredentials.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/LookupRegisteredCredentials.java
@@ -24,8 +24,11 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import net.shibboleth.idp.authn.AuthnEventIds;
+import net.shibboleth.idp.plugin.authn.webauthn.authn.WebAuthnAuthenticationEventIds;
import net.shibboleth.idp.plugin.authn.webauthn.context.BaseWebAuthnContext;
import net.shibboleth.idp.plugin.authn.webauthn.storage.CredentialRegistration;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -40,6 +43,41 @@ public class LookupRegisteredCredentials extends AbstractWebAuthnBaseAction {
/** Class logger. */
@Nonnull
private final Logger log = LoggerFactory.getLogger(LookupRegisteredCredentials.class);
+
+ /** Should an event be built if there are no credentials found?.*/
+ private boolean triggerEventOnNoCredentials;
+
+ /**
+ * The EventID of the event to build if no credentials are foud and <code>triggerEventOnNoCredentials<code>
+ * is set.
+ */
+ @Nonnull @NotEmpty private String noCredentialsEventId;
+
+ /** Constructor. */
+ public LookupRegisteredCredentials() {
+ noCredentialsEventId = WebAuthnAuthenticationEventIds.NO_REGISTERED_WEBAUTHN_CREDENTIALS;
+ }
+
+ /**
+ * Set a flag which triggers a non-proceed event to be built if no credentials are found?
+ *
+ * @param trigger the flag to set
+ */
+ public void setTriggerEventOnNoCredentials(final boolean trigger) {
+ checkSetterPreconditions();
+ triggerEventOnNoCredentials = trigger;
+ }
+
+ /**
+ * Set the EventID of the event to build if no credentials are foud and <code>triggerEventOnNoCredentials<code>
+ * is set.
+ *
+ * @param eventId the eventId to build.
+ */
+ public void setNoCredentialsEventId(@Nonnull @NotEmpty final String eventId) {
+ checkSetterPreconditions();
+ noCredentialsEventId = Constraint.isNotEmpty(eventId, "NoCredentialsEventId can not be null or empty");
+ }
/** {@inheritDoc} */
@Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -56,8 +94,13 @@ public class LookupRegisteredCredentials extends AbstractWebAuthnBaseAction {
getCredentialRepository().getRegistrationsByUsername(username);
log.debug("{} Found '{}' registered credentials for '{}'", getLogPrefix(), credentials.size(), username);
+ context.setExistingCredentials(credentials);
- context.setExistingCredentials(credentials);
+ if (triggerEventOnNoCredentials && credentials.isEmpty()) {
+ log.error("{} Triggering event '{}' ", getLogPrefix(), noCredentialsEventId);
+ ActionSupport.buildEvent(profileRequestContext, noCredentialsEventId);
+ return;
+ }
}
}
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
index 9413bc9..8b22d66 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
@@ -77,6 +77,8 @@
<bean id="LookupRegisteredCredentials" parent="AbstractWebAuthnBaseAction"
class="net.shibboleth.idp.plugin.authn.webauthn.impl.LookupRegisteredCredentials"
+ p:triggerEventOnNoCredentials="%{idp.authn.webauthn.triggerEventOnNoCredentials:false}"
+ p:noCredentialsEventId="%{idp.authn.webauthn.noCredentialsEventId:NoRegisteredWebAuthnCredentials}"
p:webAuthnBaseContextLookupStrategy-ref="shibboleth.ChildLookup.WebAuthnAuthenticationContextFromAuthenticationContext" />
<bean id="GenerateServerChallenge" parent="AbstractWebAuthnBaseAction"
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
index 60ac8a4..c95b94b 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
@@ -90,3 +90,7 @@ idp.authn.webauthn.metadata.crls = classpath:/net/shibboleth/idp/plugin/authn/we
## Display debug information about the registration and authentication ceremony on their respective views?
#idp.authn.webauthn.ui.debug = false
+
+## Should an event be built if there are no credentials found?
+#idp.authn.webauthn.triggerEventOnNoCredentials = false
+#idp.authn.webauthn.noCredentialsEventId = NoRegisteredWebAuthnCredentials
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/MockWebAuthnClient.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/MockWebAuthnClient.java
index 0131aa1..f25845e 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/MockWebAuthnClient.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/MockWebAuthnClient.java
@@ -144,6 +144,7 @@ public class MockWebAuthnClient implements WebAuthnAuthenticationClient {
}
/** {@inheritDoc} */
+ @SuppressWarnings("null")
@Override
public AssertionResult validateAuthenticatorAssertionResponse(final String username, final byte[] userId,
final PublicKeyCredentialRequestOptions publicKeyCredentialRequestOptions,
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertionTest.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertionTest.java
index 859a2af..7643cc3 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertionTest.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertionTest.java
@@ -70,6 +70,7 @@ public class ValidateWebAuthnAssertionTest extends AbstractWebAuthnTest {
action = new ValidateWebAuthnAssertion();
action.setWebAuthnClient(new MockWebAuthnClient(rp, true, true));
+ action.setCredentialRepository(credentialRepo);
final Map<String, String> clientDataCreate = createClientData("webauthn.create", ORIGIN, CHALLENGE_B64);
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/InMemoryRegistrationStorage.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/InMemoryRegistrationStorage.java
index 31242ff..95a7e40 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/InMemoryRegistrationStorage.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/InMemoryRegistrationStorage.java
@@ -167,4 +167,11 @@ public class InMemoryRegistrationStorage implements StorageServiceCredentialRepo
public boolean userExists(final String username) {
return !getRegistrationsByUsername(username).isEmpty();
}
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean updateSignatureCounter(final String username, final ByteArray credentialId, final long newSignatureCount) {
+ // TODO Fill this in if needed.
+ return true;
+ }
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list