[java-idp-plugin-webauthn] branch main updated: Add bad assertion signature test

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=369fec4663805672c99523ada55f254cf907fb7c

The following commit(s) were added to refs/heads/main by this push:
     new 369fec4  Add bad assertion signature test
369fec4 is described below

commit 369fec4663805672c99523ada55f254cf907fb7c
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Aug 13 12:01:24 2024 +0100

    Add bad assertion signature test
---
 .../authn/webauthn/flow/TestUsernameslessFlow.java | 46 ++++++++++++++++++++++
 .../webauthn/storage/impl/MockAuthenticator.java   |  3 +-
 2 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestUsernameslessFlow.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestUsernameslessFlow.java
index c35ade3..f18fd0b 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestUsernameslessFlow.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestUsernameslessFlow.java
@@ -107,6 +107,52 @@ public class TestUsernameslessFlow extends AbstractWebAuthnFlowTest{
 
     }
     
+    @SuppressWarnings("null")
+    @Test
+    public void testUsernamelessFlow_BadSignature() throws Exception {
+        
+        //Register a credential for use.
+        final CredentialRegistration registration = 
+                createCredentialRegistration(USERNAME, DISPLAY_NAME, USER_HANDLE_B64);
+        credentialRepo.addRegistrationByUsername(USERNAME, registration);
+        
+        final var prc = buildProfileRequestContext(false, false, null);
+
+        final Pair<FlowExecutionResult, FlowExecutionImpl> result = launchExecution(FLOW_ID, null, externalContext, 
+                addToConversationScopeMap(Map.of("opensamlProfileRequestContext", prc)));
+
+        assertFlowExecutionActive(result.getSecond());
+        assertCurrentStateEquals("DisplayWebAuthnView", result.getSecond());
+        assertPublicKeyCredentialRequestOptions(prc, false, true);
+        
+        // Do assertion validation half of flow
+        
+        // Get the challenge that was set into the PublicKeyCredentialRequestOptions. 
+        // otherwise we will end up signing a different one, which will provide its own test.
+        final WebAuthnAuthenticationContext authnContext = getWebAuthnAuthenticationContext(prc);
+        final ByteArray challenge = authnContext.getPublicKeyCredentialRequestOptions().getChallenge();
+        
+        // Update the mock authenticator to produce bad signatures
+        mockAuthenticator.setProduceBadAssertionSignatures(true);  
+        final PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs>
+        assertionResponse = createAssertionReponseFrom(
+                registration.getCredential().getCredentialId().getBytes(), challenge.getBytes());
+
+        final String assertionResponseJson = jsonMapper.writeValueAsString(assertionResponse);
+        
+        // Re-set external context to holder
+        ExternalContextHolder.setExternalContext(externalContext);
+        setHttpFormRequest("POST", Map.of(ExtractPublicKeyCredentialAssertionFromFormRequest.DEFAULT_PARAMETER_NAME, 
+                assertionResponseJson));
+        externalContext.setEventId("proceed");
+        result.getSecond().setCurrentState("DisplayWebAuthnView");
+        result.getSecond().resume(externalContext);
+        
+        assertEquals(result.getSecond().getOutcome().getId(),  AuthnEventIds.INVALID_CREDENTIALS);
+        assertAuthenticationFailureConditions(prc);
+
+    }
+    
     @SuppressWarnings("null")
     @Test
     public void testUsernamelessFlow_WrongOrigin() throws Exception {
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/MockAuthenticator.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/MockAuthenticator.java
index 3d5d460..3d611dd 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/MockAuthenticator.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/MockAuthenticator.java
@@ -258,7 +258,8 @@ public class MockAuthenticator {
     
     /**
      * Create the assertion signature by signing the combined authenticatorData and clientDataJSON using the private
-     * key given.
+     * key given. If {@code produceBadAssertionSignatures} is true, uses a new key to sign the data (which should
+     * trigger a failure in the IdP). 
      * 
      * @param authenticatorData the authenticator data
      * @param clientDataJSON the client data in JSON compact serialization format

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.