[java-idp-plugin-webauthn] branch main updated: Fix client-side storage issues

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=57e79660a289811bd573d497f6fc9b62c2d1a125

The following commit(s) were added to refs/heads/main by this push:
     new 57e7966  Fix client-side storage issues
57e7966 is described below

commit 57e79660a289811bd573d497f6fc9b62c2d1a125
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Aug 16 13:16:13 2024 +0100

    Fix client-side storage issues
    
     - if you use the ClientSessionStorageService your WebAuthn credentials
    were not being saved back to, or loaded from, the client within the
    admin flows. You needed to go through the authentication flow to have
    them work.
---
 .../webauthn-management-flow.xml                   |  9 ++++++-
 .../webauthn-registration-flow.xml                 | 28 ++++++++++++++++++----
 2 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-management/webauthn-management-flow.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-management/webauthn-management-flow.xml
index 5bd1d36..0f21b69 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-management/webauthn-management-flow.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-management/webauthn-management-flow.xml
@@ -85,12 +85,19 @@
     <action-state id="DeleteKey">
         <evaluate expression="ExtractKeyRemovalInformationFromFormRequest"/>
         <evaluate expression="DeletePublicKeyCredential"/>
+         <evaluate expression="PopulateClientStorageSaveContext" />
         
         <evaluate expression="'proceed'" />
-        <transition on="proceed" to="LookupCredentials">
+        <transition on="proceed" to="ClientStorageSave">
              <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnManagementContext)).ensureSubcontext(T(net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnRegistrationInformationContext)).addClassifiedMessage('KeyRemoved')"/>
         </transition>
+        <transition on="NoSaveNeeded" to="LookupCredentials" />
     </action-state>  
+    
+    <subflow-state id="ClientStorageSave" subflow="client-storage/write">
+        <input name="calledAsSubflow" value="true" />
+        <transition on="proceed" to="LookupCredentials"/>
+    </subflow-state>
 
 
     <end-state id="ManagementComplete" view="webauthn/webauthn-end">
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-flow.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-flow.xml
index 6ad4aa3..7109581 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-flow.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-flow.xml
@@ -7,11 +7,18 @@
     <action-state id="InitializeProfileRequestContext">
         <evaluate expression="InitializeProfileRequestContext" />
         <evaluate expression="FlowStartPopulateAuditContext" />
+        <evaluate expression="PopulateClientStorageLoadContext" />
         <evaluate expression="'proceed'" />        
 
-        <transition on="proceed" to="DecideIfUsernameCollectionIsRequired" />
+        <transition on="proceed" to="ClientStorageLoad" />
+        <transition on="NoLoadNeeded" to="DecideIfUsernameCollectionIsRequired" />
     </action-state>
     
+    <subflow-state id="ClientStorageLoad" subflow="client-storage/read">
+        <input name="calledAsSubflow" value="true" />
+        <transition on="proceed" to="DecideIfUsernameCollectionIsRequired"/>
+    </subflow-state>
+    
     <!-- Has username collection been configured -->
     <decision-state id="DecideIfUsernameCollectionIsRequired">
         <if test="IsAdminUsernameCollectionEnabled.test(opensamlProfileRequestContext)"
@@ -106,7 +113,7 @@
         <evaluate expression="'proceed'" />
         
         <transition on="InvalidRegistration" to="GeneratePublicKeyCredentialCreationOptions"/>
-        <transition on="proceed" to="GeneratePublicKeyCredentialCreationOptions">
+        <transition on="proceed" to="DoClientStorageSaveContext">
             <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnRegistrationContext)).ensureSubcontext(T(net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnRegistrationInformationContext)).addClassifiedMessage('ValidRegistration')"/>
         </transition>
     </action-state>
@@ -116,10 +123,23 @@
         <evaluate expression="DeletePublicKeyCredential"/>
         
         <evaluate expression="'proceed'" />
-        <transition on="proceed" to="GeneratePublicKeyCredentialCreationOptions">
+        <transition on="proceed" to="DoClientStorageSaveContext">
             <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnRegistrationContext)).ensureSubcontext(T(net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnRegistrationInformationContext)).addClassifiedMessage('KeyRemoved')"/>       
         </transition>
-    </action-state> 
+    </action-state>
+    
+    <action-state id="DoClientStorageSaveContext">
+        <evaluate expression="PopulateClientStorageSaveContext" />
+        <evaluate expression="'proceed'" />
+
+        <transition on="proceed" to="ClientStorageSave" />
+        <transition on="NoSaveNeeded" to="GeneratePublicKeyCredentialCreationOptions" />
+    </action-state>
+    
+    <subflow-state id="ClientStorageSave" subflow="client-storage/write">
+        <input name="calledAsSubflow" value="true" />
+        <transition on="proceed" to="GeneratePublicKeyCredentialCreationOptions"/>
+    </subflow-state>
 
 
     <end-state id="RegistrationComplete" view="webauthn/webauthn-end">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.