[java-idp-plugin-webauthn] branch main updated: Fix regression in 2FA support

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=4f8ac4324fe607ee97b6998d16cbd8a9df0188b0

The following commit(s) were added to refs/heads/main by this push:
     new 4f8ac43  Fix regression in 2FA support
4f8ac43 is described below

commit 4f8ac4324fe607ee97b6998d16cbd8a9df0188b0
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Feb 6 14:44:46 2024 +0000

    Fix regression in 2FA support
---
 .../PopulateWebAuthnAuthenticationContext.java     | 52 ++++++++++++++++++++++
 .../idp/flows/authn/WebAuthn/webauthn-beans.xml    |  5 +++
 .../idp/flows/authn/WebAuthn/webauthn-flow.xml     |  2 +-
 3 files changed, 58 insertions(+), 1 deletion(-)

diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/PopulateWebAuthnAuthenticationContext.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/PopulateWebAuthnAuthenticationContext.java
index d98749e..de11d69 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/PopulateWebAuthnAuthenticationContext.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/PopulateWebAuthnAuthenticationContext.java
@@ -16,6 +16,7 @@
 package net.shibboleth.idp.plugin.authn.webauthn.impl;
 
 import java.util.function.Function;
+import java.util.function.Predicate;
 
 import javax.annotation.Nonnull;
 
@@ -28,6 +29,9 @@ import org.slf4j.Logger;
 import net.shibboleth.idp.authn.AbstractAuthenticationAction;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnAuthenticationContext;
+import net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
@@ -49,6 +53,12 @@ public class PopulateWebAuthnAuthenticationContext extends AbstractAuthenticatio
     @Nonnull 
     private final Function<ProfileRequestContext,WebAuthnAuthenticationContext> webauthnAuthContextCreationStrategy;
     
+    /** Lookup strategy for username to match against Duo identity. */
+    @Nonnull private Function<ProfileRequestContext, String> usernameLookupStrategy;
+    
+    /** Is the username required?*/
+    private Predicate<ProfileRequestContext> usernameRequiredPredicate;
+    
 
     /** Constructor.*/
     public PopulateWebAuthnAuthenticationContext() {
@@ -56,8 +66,39 @@ public class PopulateWebAuthnAuthenticationContext extends AbstractAuthenticatio
         webauthnAuthContextCreationStrategy =
                 new ChildContextLookup<>(WebAuthnAuthenticationContext.class, true).
                 compose(new ChildContextLookup<>(AuthenticationContext.class));
+        
+        usernameLookupStrategy = new CanonicalUsernameLookupStrategy();
+        usernameRequiredPredicate = PredicateSupport.alwaysFalse();
 
     }
+    
+    /**
+     * @param flag The usernameRequired to set.
+     */
+    public void setUsernameRequired(final boolean flag) {
+        checkSetterPreconditions();
+        usernameRequiredPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+    }
+    
+    /**
+     * @param usernameRequiredPredicate The usernameRequiredPredicate to set.
+     */
+    public void setUsernameRequiredPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate){
+        checkSetterPreconditions();
+        usernameRequiredPredicate = Constraint.isNotNull(predicate, "Username required predicate can not be null");
+    }
+    
+    /**
+     * Set the lookup strategy to use for the username to match against Duo identity.
+     * 
+     * @param strategy lookup strategy
+     */
+    public void setUsernameLookupStrategy(
+            @Nonnull final Function<ProfileRequestContext, String> strategy) {
+        checkSetterPreconditions();
+
+        usernameLookupStrategy = Constraint.isNotNull(strategy, "Username lookup strategy cannot be null");
+    }
 
     /** {@inheritDoc} */
     @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -71,6 +112,17 @@ public class PopulateWebAuthnAuthenticationContext extends AbstractAuthenticatio
             ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
             return;
         }
+        
+        if (usernameRequiredPredicate.test(profileRequestContext)) {
+            final String username = usernameLookupStrategy.apply(profileRequestContext);
+            if (username == null && usernameRequiredPredicate.test(profileRequestContext)) {
+                log.error("{} Error creating WebauthnAuthenticationContext, no username found", getLogPrefix());
+                ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+                return;
+            }
+            context.setUsername(username);
+        }
+
         log.debug("Created Webauthn authentication context");
         
     }
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
index f849186..dd3a6b4 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
@@ -17,6 +17,11 @@
 
     <bean id="PopulateWebAuthnAuthenticationContext" scope="prototype"
         class="net.shibboleth.idp.plugin.authn.webauthn.impl.PopulateWebAuthnAuthenticationContext">
+    </bean>    
+    
+    <bean id="PopulateWebAuthnAuthenticationContextFor2FA" scope="prototype"
+        class="net.shibboleth.idp.plugin.authn.webauthn.impl.PopulateWebAuthnAuthenticationContext"
+        p:usernameRequired="true">
     </bean>
 
     <bean id="IsSecondFactor" scope="prototype"
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
index 04971c1..7d5e59d 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
@@ -78,7 +78,7 @@
     
     <!-- If we are running after a first factor, perform 2FA only. Needs existing username -->
     <action-state id="SecondFactorLogin">
-        <evaluate expression="PopulateWebAuthnAuthenticationContext"/>
+        <evaluate expression="PopulateWebAuthnAuthenticationContextFor2FA"/>
         <evaluate expression="LookupRegisteredCredentials"/>
         <evaluate expression="AddUserVerificationNotRequired"/>
         <evaluate expression="'proceed'" />

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.