[java-idp-plugin-webauthn] branch main updated: Remove username lookup from registration context
Phil Smart
philip.smart at jisc.ac.uk
Fri Feb 16 18:35:57 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=ff8046b4a0247083f2fce07343dc7f33f8a2996c
The following commit(s) were added to refs/heads/main by this push:
new ff8046b Remove username lookup from registration context
ff8046b is described below
commit ff8046b4a0247083f2fce07343dc7f33f8a2996c
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Feb 16 18:35:55 2024 +0000
Remove username lookup from registration context
- Add username lookup from AuthnResult to registration flow.
---
.../UsernameLookupFromAuthenticationResult.java | 68 ++++++++++++++++++++++
.../UsernameLookupFromRegistrationContext.java | 56 ------------------
.../PopulateWebAuthnAuthenticationContext.java | 2 +-
.../webauthn-registration-beans.xml | 11 +++-
.../webauthn-registration-flow.xml | 8 ++-
.../idp/flows/authn/WebAuthn/webauthn-beans.xml | 8 +--
6 files changed, 85 insertions(+), 68 deletions(-)
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromAuthenticationResult.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromAuthenticationResult.java
new file mode 100644
index 0000000..d467687
--- /dev/null
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromAuthenticationResult.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.webauthn.context.navigate;
+
+import java.util.Set;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import net.shibboleth.idp.authn.AuthenticationResult;
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.authn.principal.UsernamePrincipal;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
+/**
+ * Pull out a username from a the authentication result if it exists. Useful when operating inside a WebAuthn
+ * registration flow.
+ */
+public class UsernameLookupFromAuthenticationResult implements Function<ProfileRequestContext, String> {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(UsernameLookupFromAuthenticationResult.class);
+
+ /** {@inheritDoc} */
+ @Override
+ public String apply(@Nullable final ProfileRequestContext input) {
+ if (input == null) {
+ log.trace("Profile context was null, can not find existing username");
+ return null;
+ }
+ final AuthenticationContext authnContext = input.getSubcontext(AuthenticationContext.class);
+ if (authnContext == null) {
+ log.debug("Authentication context was null, can not find existing username");
+ return null;
+ }
+ final AuthenticationResult result = authnContext.getAuthenticationResult();
+ if (result == null) {
+ log.debug("Authentication result was null, can not find existing username");
+ return null;
+ }
+
+ final Set<UsernamePrincipal> usernamePrincipals = result.getSubject().getPrincipals(UsernamePrincipal.class);
+ if (usernamePrincipals != null && usernamePrincipals.size() == 1) {
+ final String username = usernamePrincipals.iterator().next().getName();
+ log.debug("Found existing username '{}' from authentication result", username);
+ return username;
+ }
+ log.debug("Could not find existing username from authentication result");
+ return null;
+ }
+
+}
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromRegistrationContext.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromRegistrationContext.java
deleted file mode 100644
index 64f3991..0000000
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/UsernameLookupFromRegistrationContext.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.plugin.authn.webauthn.context.navigate;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnRegistrationContext;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Pull out a username from a WebAuthn Registration Context if it exists. Useful when operating inside a WebAuthn
- * registration flow.
- */
-public class UsernameLookupFromRegistrationContext implements Function<ProfileRequestContext, String> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(UsernameLookupFromRegistrationContext.class);
-
- /** {@inheritDoc} */
- @Override
- public String apply(@Nullable final ProfileRequestContext input) {
- if (input == null) {
- log.trace("Profile context was null, can not find existing username");
- return null;
- }
- final WebAuthnRegistrationContext registrationContext =
- input.getSubcontext(WebAuthnRegistrationContext.class);
- if (registrationContext == null) {
- log.trace("WebAuthn registration context was null, can not find existing username");
- return null;
- }
- final String username = registrationContext.getUsername();
- log.debug("{}", username != null ? "Found existing username" :
- "Did not find existing username");
- return username;
- }
-
-}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/PopulateWebAuthnAuthenticationContext.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/PopulateWebAuthnAuthenticationContext.java
index 95225cc..5a4f215 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/PopulateWebAuthnAuthenticationContext.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/PopulateWebAuthnAuthenticationContext.java
@@ -53,7 +53,7 @@ public class PopulateWebAuthnAuthenticationContext extends AbstractAuthenticatio
@Nonnull
private final Function<ProfileRequestContext,WebAuthnAuthenticationContext> webauthnAuthContextCreationStrategy;
- /** Lookup strategy for username to match against Duo identity. */
+ /** Lookup strategy for username. */
@Nonnull private Function<ProfileRequestContext, String> usernameLookupStrategy;
/** Is the username required?*/
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
index 34f82ac..9e15dfa 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
@@ -18,7 +18,7 @@
class="org.opensaml.messaging.context.navigate.ChildContextLookup"
c:type="#{ T(net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnRegistrationContext) }" />
- <bean id="PopulateWebAuthnRegistrationContext" scope="prototype"
+ <bean id="PopulateInitialWebAuthnRegistrationContext" scope="prototype"
class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.PopulateWebAuthnRegistrationContext">
<property name="usernameLookupStrategy">
<bean id="usernameFromHttpRequest" scope="prototype"
@@ -27,6 +27,15 @@
</property>
</bean>
+ <!-- Important that this gets the username from the authn result, not the initial context that is created -->
+ <bean id="PopulateWebAuthnRegistrationContext" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.PopulateWebAuthnRegistrationContext">
+ <property name="usernameLookupStrategy">
+ <bean id="usernameFromAuthnResult" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.webauthn.context.navigate.UsernameLookupFromAuthenticationResult"/>
+ </property>
+ </bean>
+
<bean id="AddAttestationConveyancePreference" scope="prototype" parent="AbstractWebAuthnRegistrationAction"
class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.AddAttestationConveyancePreference"
p:attestationConveyancePreference="%{idp.authn.webauthn.registration.attestationConveyancePreference:none}"/>
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-flow.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-flow.xml
index 04e4cfa..e1598d6 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-flow.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-flow.xml
@@ -29,8 +29,9 @@
</view-state>
+ <!-- TODO if we want to do this, we would want this to populate a different context -->
<action-state id="ExtractUsernameAndPopulateContext">
- <evaluate expression="PopulateWebAuthnRegistrationContext"/>
+ <evaluate expression="PopulateInitialWebAuthnRegistrationContext"/>
<evaluate expression="LookupRegisteredCredentials"/>
<evaluate expression="'proceed'" />
@@ -47,7 +48,9 @@
<transition on="proceed" to="GeneratePublicKeyCredentialCreationOptions" />
</action-state>
- <action-state id="GeneratePublicKeyCredentialCreationOptions">
+ <action-state id="GeneratePublicKeyCredentialCreationOptions">
+ <evaluate expression="PopulateWebAuthnRegistrationContext"/>
+ <evaluate expression="LookupRegisteredCredentials"/>
<evaluate expression="GenerateServerChallenge"/>
<evaluate expression="AddUserId"/>
<evaluate expression="AddResidentKeyRequirement"/>
@@ -122,7 +125,6 @@
</view-state>
<action-state id="RegisterAnotherKey">
- <!-- TODO should we clear the existing registration context here, other than username -->
<evaluate expression="LookupRegisteredCredentials"/>
<evaluate expression="'proceed'" />
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
index f4bc07e..5a4e552 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
@@ -16,13 +16,7 @@
<bean id="PopulateWebAuthnAuthenticationContextPasswordless" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.webauthn.impl.PopulateWebAuthnAuthenticationContext">
- <!-- In-case a username has been supplied by an outer WebAuthn registration context -->
- <property name="usernameLookupStrategy">
- <bean id="UsernameLookupFromRegistrationContext"
- class="net.shibboleth.idp.plugin.authn.webauthn.context.navigate.UsernameLookupFromRegistrationContext"/>
- </property>
- </bean>
+ class="net.shibboleth.idp.plugin.authn.webauthn.impl.PopulateWebAuthnAuthenticationContext"/>
<bean id="PopulateWebAuthnAuthenticationContextUsernameless" scope="prototype"
class="net.shibboleth.idp.plugin.authn.webauthn.impl.PopulateWebAuthnAuthenticationContext"/>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list