[java-idp-plugin-webauthn] branch main updated: Improve naming of public key credential responses
Phil Smart
philip.smart at jisc.ac.uk
Wed Jun 5 10:06:40 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=804980479854f82501622b9671b265e0bfab4956
The following commit(s) were added to refs/heads/main by this push:
new 8049804 Improve naming of public key credential responses
8049804 is described below
commit 804980479854f82501622b9671b265e0bfab4956
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jun 5 11:06:38 2024 +0100
Improve naming of public key credential responses
- make it clear the outer object is a PublicKeyCredential type which
carries either an assertion or an attestation.
---
.../client/WebAuthnAuthenticationClient.java | 17 ++++----
.../context/WebAuthnAuthenticationContext.java | 25 ++++++-----
.../context/WebAuthnRegistrationContext.java | 24 +++++-----
...icKeyCredentialAttestationFromFormRequest.java} | 38 ++++++++--------
.../ValidateAuthenticatorAttestationResponse.java | 11 ++---
...blicKeyCredentialAssertionFromFormRequest.java} | 51 +++++++++-------------
.../LookupRegisteredCredentialsFromUserHandle.java | 2 +-
.../webauthn/impl/ValidateWebAuthnAssertion.java | 2 +-
.../webauthn-registration-beans.xml | 4 +-
.../webauthn-registration-flow.xml | 2 +-
.../idp/flows/authn/WebAuthn/webauthn-beans.xml | 4 +-
.../idp/flows/authn/WebAuthn/webauthn-flow.xml | 2 +-
.../plugin/authn/webauthn/views/webauthn-authn.vm | 6 +--
.../authn/webauthn/views/webauthn-register.vm | 10 ++---
...kupRegisteredCredentialsFromUserHandleTest.java | 8 ++--
.../impl/ValidateWebAuthnAssertionTest.java | 4 +-
16 files changed, 103 insertions(+), 107 deletions(-)
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/WebAuthnAuthenticationClient.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/WebAuthnAuthenticationClient.java
index 876cff7..607708c 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/WebAuthnAuthenticationClient.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/WebAuthnAuthenticationClient.java
@@ -63,14 +63,14 @@ public interface WebAuthnAuthenticationClient {
/**
- * Validate the Authenticator Assertion Response from an authentication request.
+ * Validate the PublicKeyCredential authenticator assertion response from an authentication request.
*
* @param username the username of the users account on the IdP. Should map one-to-one with the user.id.
* @param userId the user.id of the users account on the IdP. Should match the userHandle in the assertion response
* @param publicKeyCredentialRequestOptions the options used when generating an assertion for authentication.
- * @param authenticatorAssertionResponse the assertion response.
+ * @param publicKeyCredentialAssertionResponse the assertion response.
*
- * @return an assertion result if the assertion was valid.
+ * @return an assertion result iff the assertion was valid.
*
* @throws AssertionFailureException if the assertion is not valid
*/
@@ -78,22 +78,23 @@ public interface WebAuthnAuthenticationClient {
@Nullable final byte[] userId,
@Nonnull final PublicKeyCredentialRequestOptions publicKeyCredentialRequestOptions,
@Nonnull final PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs>
- authenticatorAssertionResponse) throws AssertionFailureException;
+ publicKeyCredentialAssertionResponse) throws AssertionFailureException;
/**
- * Validate the Authenticator Attestation Response from a registration request.
+ * Validate the PublicKeyCredential authenticator attestation response from a registration request.
*
* @param publicKeyCredentialCreationOptions the options used when requesting a new public key credential
- * @param authenticatorAttestationResponse the response to the client's request to create a public key credential
+ * @param publicKeyCredentialAttestationResponse the response to the client's request to create a public key
+ * credential
*
- * @return a registration result of the registration was valid
+ * @return a registration result iff the registration was valid
*
* @throws RegistrationFailureException if the registration is not valid
*/
@Nonnull RegistrationResult validateAuthenticatorAttestationResponse(
@Nonnull final PublicKeyCredentialCreationOptions publicKeyCredentialCreationOptions,
@Nonnull final PublicKeyCredential<AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs>
- authenticatorAttestationResponse) throws RegistrationFailureException;
+ publicKeyCredentialAttestationResponse) throws RegistrationFailureException;
}
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnAuthenticationContext.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnAuthenticationContext.java
index 9bbedfd..1788d4d 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnAuthenticationContext.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnAuthenticationContext.java
@@ -28,10 +28,10 @@ public final class WebAuthnAuthenticationContext extends BaseWebAuthnContext {
/** Are we operating in usernameless mode.*/
private boolean usernameless;
- /** An assertion response that is the result of an authentication.*/
+ /** A public key credential with assertion response that is the result of an authentication.*/
@Nullable
- private
- PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs> authenticatorAssertionResponse;
+ private PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs>
+ publicKeyCredentialAssertionResponse;
/** The public key credential request options for authentication.*/
@Nullable private PublicKeyCredentialRequestOptions publicKeyCredentialRequestOptions;
@@ -81,27 +81,28 @@ public final class WebAuthnAuthenticationContext extends BaseWebAuthnContext {
}
/**
- * Set the raw authenticator assertion response, returned after the authentication ceremony.
+ * Set the raw public key credential with authenticator assertion response, returned after the authentication
+ * ceremony.
*
- * @param assertion The authenticator assertion response to set.
+ * @param pkCredAssertion The public key credential containing an authenticator assertion response to set.
*
* @return this context
*/
- public WebAuthnAuthenticationContext setAuthenticatorAssertionResponse(
+ public WebAuthnAuthenticationContext setPublicKeyCredentialAssertionResponse(
@Nullable final PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs>
- assertion) {
- authenticatorAssertionResponse = assertion;
+ pkCredAssertion) {
+ publicKeyCredentialAssertionResponse = pkCredAssertion;
return this;
}
/**
- * Get the authenticator assertion response, returned after the authentication ceremony.
+ * Get the public key credential with authenticator assertion response, from the authentication ceremony.
*
- * @return the authenticator a ssertion response.
+ * @return the public key credential with authenticator a assertion response.
*/
@Nullable public PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs>
- getAuthenticatorAssertionResponse() {
- return authenticatorAssertionResponse;
+ getPublicKeyCredentialAssertionResponse() {
+ return publicKeyCredentialAssertionResponse;
}
/**
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnRegistrationContext.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnRegistrationContext.java
index efcb713..2905995 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnRegistrationContext.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/WebAuthnRegistrationContext.java
@@ -27,9 +27,9 @@ public final class WebAuthnRegistrationContext extends BaseWebAuthnContext {
/** The original username. */
@Nullable private String username;
- /** An assertion response that is the result of an authentication.*/
+ /** A public key credential containing the assertion response that is the result of creating a new credential.*/
@Nullable private PublicKeyCredential<AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs>
- authenticatorAttestationResponse;
+ publicKeyCredentialAttestationResponse;
/** The public key credential creation options for registration.*/
@Nullable private PublicKeyCredentialCreationOptions publicKeyCredentialCreationOptions;
@@ -86,33 +86,33 @@ public final class WebAuthnRegistrationContext extends BaseWebAuthnContext {
/**
- * Get the attestation response as a result of creating a new credential.
+ * Get the public key credential containing the attestation response as a result of creating a new credential.
*
* @return the authenticator attestation response.
*/
@Nullable public PublicKeyCredential<AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs>
- getAuthenticatorAttestationResponse() {
- return authenticatorAttestationResponse;
+ getPublicKeyCredentialAttestationResponse() {
+ return publicKeyCredentialAttestationResponse;
}
/**
- * Set the attestation response as a result of creating a new credential.
+ * Set the public key credential containing the attestation response as a result of creating a new credential.
*
- * @param attestation The authenticatorAttestationResponse to set.
+ * @param pkCredAttestation The public key credential containing the attestation response to set.
*
* @return this context
*/
- @Nonnull public WebAuthnRegistrationContext setAuthenticatorAttestationResponse(
+ @Nonnull public WebAuthnRegistrationContext setPublicKeyCredentialAttestationResponse(
@Nullable final PublicKeyCredential<AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs>
- attestation) {
- authenticatorAttestationResponse = attestation;
+ pkCredAttestation) {
+ publicKeyCredentialAttestationResponse = pkCredAttestation;
return this;
}
/**
* Set the options used to create public key credentials.
*
- * @param options The publicKeyCredentialCreationOptions to set.
+ * @param options The public key credential creation options to set.
*
* @return this context
*/
@@ -135,7 +135,7 @@ public final class WebAuthnRegistrationContext extends BaseWebAuthnContext {
* Set the registration result which is the result of registration of a new key pair generated
* by the authenticator.
*
- * @param result The registrationResult to set.
+ * @param result the registration result to set.
*
* @return this context
*/
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ExtractAuthenticatorAttestationFromFormRequest.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ExtractPublicKeyCredentialAttestationFromFormRequest.java
similarity index 75%
rename from webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ExtractAuthenticatorAttestationFromFormRequest.java
rename to webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ExtractPublicKeyCredentialAttestationFromFormRequest.java
index 8055614..fd9c692 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ExtractAuthenticatorAttestationFromFormRequest.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ExtractPublicKeyCredentialAttestationFromFormRequest.java
@@ -48,38 +48,39 @@ import net.shibboleth.shared.primitive.StringSupport;
* @pre <pre>ProfileRequestContext.getSubcontext(WebAuthnRegistrationContext.class) != null</pre>
* @post add an AuthenticatorAttestationResponse to the registration context
*/
-public class ExtractAuthenticatorAttestationFromFormRequest extends AbstractWebAuthnRegistrationAction {
+public class ExtractPublicKeyCredentialAttestationFromFormRequest extends AbstractWebAuthnRegistrationAction {
- /** Default assertion parameter name. */
- @Nonnull @NotEmpty public static final String DEFAULT_ASSERTION_FIELD_NAME = "authenticatorAttestation";
+ /** Default public key credential assertion parameter name. */
+ @Nonnull @NotEmpty public static final String DEFAULT_PK_ASSERTION_FIELD_NAME = "publicKeyCredential";
/** Default nickname parameter name. */
@Nonnull @NotEmpty public static final String DEFAULT_NICKNAME_FIELD_NAME = "credentialNickname";
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(ExtractAuthenticatorAttestationFromFormRequest.class);
+ @Nonnull
+ private final Logger log = LoggerFactory.getLogger(ExtractPublicKeyCredentialAttestationFromFormRequest.class);
- /** Name of the attestation parameter. */
- @Nonnull @NotEmpty private String attestationParameterName;
+ /** Name of the public key credential attestation parameter. */
+ @Nonnull @NotEmpty private String publicKeyCredentialAttestationParameterName;
/** Name of the nickname parameter. */
@Nonnull @NotEmpty private String credentialNicknameParameterName;
/** Constructor. */
- public ExtractAuthenticatorAttestationFromFormRequest() {
- attestationParameterName = DEFAULT_ASSERTION_FIELD_NAME;
+ public ExtractPublicKeyCredentialAttestationFromFormRequest() {
+ publicKeyCredentialAttestationParameterName = DEFAULT_PK_ASSERTION_FIELD_NAME;
credentialNicknameParameterName = DEFAULT_NICKNAME_FIELD_NAME;
}
/**
- * Set the name of the parameter to extract the attestation response from.
+ * Set the name of the parameter to extract the public key credential attestation response from.
*
- * @param field field name
+ * @param field the field name
*/
- public void setAttestationParameterName(@Nonnull @NotEmpty final String field) {
+ public void setPublickKeyCredentialAttestationParameterName(@Nonnull @NotEmpty final String field) {
checkSetterPreconditions();
- attestationParameterName = Constraint.isNotNull(StringSupport.trimOrNull(field),
+ publicKeyCredentialAttestationParameterName = Constraint.isNotNull(StringSupport.trimOrNull(field),
"Attestation parameter name cannot be null or empty");
}
@@ -106,18 +107,18 @@ public class ExtractAuthenticatorAttestationFromFormRequest extends AbstractWebA
return;
}
- final String pkCredAttestationJson = request.getParameter(attestationParameterName);
+ final String pkCredAttestationJson = request.getParameter(publicKeyCredentialAttestationParameterName);
if (StringSupport.trimOrNull(pkCredAttestationJson) == null) {
- log.debug("{} No authenticator attestation response in request", getLogPrefix());
+ log.debug("{} No PublicKeyCredential with authenticator attestation response in request", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
- log.trace("PublicKeyCredential authenticator response in JSON is '{}'",pkCredAttestationJson);
+ log.trace("PublicKeyCredential authenticator attestation response:'{}'",pkCredAttestationJson);
final String credNickname = request.getParameter(credentialNicknameParameterName);
log.trace("Credential nickname is '{}'",credNickname);
if (StringSupport.trimOrNull(credNickname) == null) {
- log.debug("{} No nickname in request", getLogPrefix());
+ log.debug("{} No credential nickname in request", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, WebAuthnRegistrationEventIds.INVALID_REGISTRATION);
return;
}
@@ -125,10 +126,11 @@ public class ExtractAuthenticatorAttestationFromFormRequest extends AbstractWebA
try {
final PublicKeyCredential<AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs>
pkCredAttestation = PublicKeyCredential.parseRegistrationResponseJson(pkCredAttestationJson);
- context.setAuthenticatorAttestationResponse(pkCredAttestation);
+ context.setPublicKeyCredentialAttestationResponse(pkCredAttestation);
context.setCredentialNickname(credNickname);
} catch (final IOException e) {
- log.debug("{} Could not parse PublicKeyCredential response from request parameter", getLogPrefix(), e);
+ log.debug("{} Could not parse PublicKeyCredential response from request parameter '{}'", getLogPrefix(),
+ credentialNicknameParameterName, e);
ActionSupport.buildEvent(profileRequestContext, WebAuthnRegistrationEventIds.INVALID_REGISTRATION);
return;
}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ValidateAuthenticatorAttestationResponse.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ValidateAuthenticatorAttestationResponse.java
index 46c88e9..651817f 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ValidateAuthenticatorAttestationResponse.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/ValidateAuthenticatorAttestationResponse.java
@@ -52,7 +52,7 @@ public class ValidateAuthenticatorAttestationResponse extends AbstractWebAuthnRe
/** The stashed public key credential creation options used to create a new credential.*/
@NonnullBeforeExec private PublicKeyCredentialCreationOptions pkCredCreationOptions;
- /** The stashed authenticator response.*/
+ /** The stashed public key credential authenticator attestation response.*/
@NonnullBeforeExec
private PublicKeyCredential<AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs> attestation;
@@ -66,16 +66,17 @@ public class ValidateAuthenticatorAttestationResponse extends AbstractWebAuthnRe
return false;
}
- attestation = context.getAuthenticatorAttestationResponse();
+ attestation = context.getPublicKeyCredentialAttestationResponse();
if (attestation == null) {
- log.error("{} Authenticator attestation response was null", getLogPrefix());
+ log.error("{} PublicKeyCredential containing the authenticator attestation response was null",
+ getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, WebAuthnRegistrationEventIds.INVALID_REGISTRATION);
return false;
}
pkCredCreationOptions = context.getPublicKeyCredentialCreationOptions();
if (pkCredCreationOptions == null) {
- log.error("{} Public key credential creation options was null", getLogPrefix());
+ log.error("{} PublicKeyCredential creation options was null", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, WebAuthnRegistrationEventIds.INVALID_REGISTRATION);
return false;
}
@@ -100,7 +101,7 @@ public class ValidateAuthenticatorAttestationResponse extends AbstractWebAuthnRe
athenticator, credentialPublicKey.isAttestationTrusted() ? "Yes" : "No");
// If valid. Add back to context
context.setRegistrationResult(credentialPublicKey);
- log.info("{} Public Key Registration was valid", getLogPrefix());
+ log.info("{} Public key registration was valid", getLogPrefix());
} catch (final RegistrationFailureException e) {
log.warn("{} Public key registration failed", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, WebAuthnRegistrationEventIds.INVALID_REGISTRATION);
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ExtractAuthenticatorAssertionFromFormRequest.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ExtractPublicKeyCredentialAssertionFromFormRequest.java
similarity index 72%
rename from webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ExtractAuthenticatorAssertionFromFormRequest.java
rename to webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ExtractPublicKeyCredentialAssertionFromFormRequest.java
index 1f6f276..974d686 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ExtractAuthenticatorAssertionFromFormRequest.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ExtractPublicKeyCredentialAssertionFromFormRequest.java
@@ -20,7 +20,6 @@ package net.shibboleth.idp.plugin.authn.webauthn.impl;
import java.io.IOException;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -44,29 +43,31 @@ import net.shibboleth.shared.primitive.StringSupport;
/**
- * An action that extracts the AuthenticatorAssertionResponse from the incoming HTTP request.
+ * An action that extracts the PublicKeyCredential containing the authenticator assertion response from the
+ * incoming HTTP request.
*
* @event {@link AuthnEventIds#NO_CREDENTIALS}
* @pre <pre>ProfileRequestContext.getSubcontext(WebAuthnAuthenticationContext.class) != null</pre>
* @post <pre>WebAuthnAuthenticationContext.getAuthenticatorAssertionResponse() == null</pre>
*/
-public class ExtractAuthenticatorAssertionFromFormRequest extends AbstractWebAuthnAuthenticationAction {
+//TODO similar to ExtractPublicKeyCredentialAttestationFromFormRequest
+public class ExtractPublicKeyCredentialAssertionFromFormRequest extends AbstractWebAuthnAuthenticationAction {
/** Default public key assertion parameter name. */
- @Nonnull @NotEmpty public static final String DEFAULT_PARAMETER_NAME = "publicKeyAssertion";
+ @Nonnull @NotEmpty public static final String DEFAULT_PARAMETER_NAME = "publicKeyCredential";
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(ExtractAuthenticatorAssertionFromFormRequest.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ExtractPublicKeyCredentialAssertionFromFormRequest.class);
- /** Name of assertion parameter. */
- @NonnullAfterInit @NotEmpty private String assertionParameterName;
+ /** Name of public key credential with the assertion response parameter. */
+ @NonnullAfterInit @NotEmpty private String publicKeyCredentialAssertionParameterName;
/** JSON object mapper. */
@NonnullAfterInit private ObjectMapper objectMapper;
/** Constructor. */
- public ExtractAuthenticatorAssertionFromFormRequest() {
- assertionParameterName = DEFAULT_PARAMETER_NAME;
+ public ExtractPublicKeyCredentialAssertionFromFormRequest() {
+ publicKeyCredentialAssertionParameterName = DEFAULT_PARAMETER_NAME;
}
@Override protected void doInitialize() throws ComponentInitializationException {
@@ -89,14 +90,14 @@ public class ExtractAuthenticatorAssertionFromFormRequest extends AbstractWebAut
}
/**
- * Set the name of the assertion parameter to examine.
+ * Set the name of the public key credential assertion parameter to extract.
*
- * @param field field name
+ * @param field the field name
*/
- public void setAssertionParameterName(@Nonnull @NotEmpty final String field) {
+ public void setPublicKeyCredentialAssertionParameterName(@Nonnull @NotEmpty final String field) {
checkSetterPreconditions();
- assertionParameterName =
+ publicKeyCredentialAssertionParameterName =
Constraint.isNotNull(StringSupport.trimOrNull(field), "Field name cannot be null or empty");
}
@@ -112,35 +113,25 @@ public class ExtractAuthenticatorAssertionFromFormRequest extends AbstractWebAut
return;
}
- final String pkCredAssertionJson = extractAuthenticatorAssertionResponse(request);
+ final String pkCredAssertionJson = request.getParameter(publicKeyCredentialAssertionParameterName);
if (pkCredAssertionJson == null) {
- log.debug("{} Public key assertion not found in HTTP request",getLogPrefix());
+ log.debug("{} No PublicKeyCredential with authenticator attestation response in request",getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
- log.trace("{} Authenticator assertion response: '{}'",getLogPrefix(), pkCredAssertionJson);
+ log.trace("{} PublicKeyCredential authenticator assertion response: '{}'",getLogPrefix(), pkCredAssertionJson);
try {
- final PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs> assertion =
+ final PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs> pkCredAssertion =
PublicKeyCredential.parseAssertionResponseJson(pkCredAssertionJson);
- context.setAuthenticatorAssertionResponse(assertion);
+ context.setPublicKeyCredentialAssertionResponse(pkCredAssertion);
} catch (final IOException e) {
- log.debug("{} Authenticator assertion could not be converted to the correct type",getLogPrefix(), e);
+ log.debug("{} Could not parse PublicKeyCredential response from request parameter '{}'",
+ getLogPrefix(), publicKeyCredentialAssertionParameterName, e);
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
return;
}
}
-
- /**
- * Extract the public key assertion response from the HTTP request parameters.
- *
- * @param httpRequest the http request
- *
- * @return the raw, unformatted, authenticator assertion response
- */
- @Nullable private String extractAuthenticatorAssertionResponse(@Nonnull final HttpServletRequest httpRequest) {
- return httpRequest.getParameter(assertionParameterName);
- }
}
\ No newline at end of file
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/LookupRegisteredCredentialsFromUserHandle.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/LookupRegisteredCredentialsFromUserHandle.java
index e61ab4f..37e9284 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/LookupRegisteredCredentialsFromUserHandle.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/LookupRegisteredCredentialsFromUserHandle.java
@@ -122,7 +122,7 @@ public class LookupRegisteredCredentialsFromUserHandle extends AbstractWebAuthnA
@Nonnull final WebAuthnAuthenticationContext context) {
final PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs> assertion =
- context.getAuthenticatorAssertionResponse();
+ context.getPublicKeyCredentialAssertionResponse();
if (assertion == null) {
log.error("{} Unable to find Assertion in WebAuthn authentication context", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
index 6561c98..8d908a3 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
@@ -159,7 +159,7 @@ public class ValidateWebAuthnAssertion extends AbstractValidationAction {
@Nonnull final AuthenticationContext authenticationContext) {
final PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs> assertion =
- context.getAuthenticatorAssertionResponse();
+ context.getPublicKeyCredentialAssertionResponse();
if (assertion == null) {
log.warn("{} No authenticator assertion found, {} can not authenticate",
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
index 25fcb01..afd3504 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
@@ -106,8 +106,8 @@
<bean id="CreatePublicKeyCredentialCreationOptions" parent="AbstractWebAuthnRegistrationAction" scope="prototype"
class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.CreatePublicKeyCredentialCreationOptions"/>
- <bean id="ExtractAuthenticatorAttestationFromFormRequest" parent="AbstractWebAuthnRegistrationAction" scope="prototype"
- class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.ExtractAuthenticatorAttestationFromFormRequest"
+ <bean id="ExtractPublicKeyCredentialAttestationFromFormRequest" parent="AbstractWebAuthnRegistrationAction" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.ExtractPublicKeyCredentialAttestationFromFormRequest"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
<bean id="ExtractKeyRemovalInformationFromFormRequest" parent="AbstractWebAuthnRegistrationAction" scope="prototype"
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-flow.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-flow.xml
index 5caf889..b308e87 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-flow.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-flow.xml
@@ -91,7 +91,7 @@
</view-state>
<action-state id="AddKey">
- <evaluate expression="ExtractAuthenticatorAttestationFromFormRequest"/>
+ <evaluate expression="ExtractPublicKeyCredentialAttestationFromFormRequest"/>
<evaluate expression="ValidateAuthenticatorAttestationResponse"/>
<evaluate expression="StorePublicKeyCredential"/>
<evaluate expression="'proceed'" />
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
index bd2c333..bb624f7 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
@@ -108,8 +108,8 @@
<bean id="CreatePublicKeyCredentialRequestOptions" scope="prototype" parent="AbstractWebAuthnAuthenticationAction"
class="net.shibboleth.idp.plugin.authn.webauthn.impl.CreatePublicKeyCredentialRequestOptions"/>
- <bean id="ExtractAuthenticatorAssertionFromFormRequest" scope="prototype" parent="AbstractWebAuthnAuthenticationAction"
- class="net.shibboleth.idp.plugin.authn.webauthn.impl.ExtractAuthenticatorAssertionFromFormRequest"
+ <bean id="ExtractPublicKeyCredentialAssertionFromFormRequest" scope="prototype" parent="AbstractWebAuthnAuthenticationAction"
+ class="net.shibboleth.idp.plugin.authn.webauthn.impl.ExtractPublicKeyCredentialAssertionFromFormRequest"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
p:objectMapper-ref="shibboleth.authn.WebAuthn.JSONObjectMapper" />
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
index 63af39e..0469bc6 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
@@ -117,7 +117,7 @@
</view-state>
<action-state id="AuthenticatePublicKeyCredential">
- <evaluate expression="ExtractAuthenticatorAssertionFromFormRequest"/>
+ <evaluate expression="ExtractPublicKeyCredentialAssertionFromFormRequest"/>
<!-- lookup credentials here so we can exit the process before validation if no registered credentials exist and
the authentication plugin has been configured to trigger a custom event. Useful for the usernameless flow. -->
<evaluate expression="LookupRegisteredCredentialsFromUserHandle"/>
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm
index 0ceabcd..1ab9f10 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm
@@ -74,8 +74,8 @@ $response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 's
var pkCredRequestOptions = $webAuthnEncoder.serializePublicKeyCredentialRequestOptionsAsJSON($webauthnContext.publicKeyCredentialRequestOptions)
var parsedRequestOptions = parseRequestOptionsFromJSON(pkCredRequestOptions);
await get(parsedRequestOptions)
- .then(function (assertion) {
- document.getElementById("publicKeyAssertion").value = JSON.stringify(assertion);
+ .then(function (pkCredAssertion) {
+ document.getElementById("publicKeyCredential").value = JSON.stringify(pkCredAssertion);
document.getElementById("authenticationSubmit").click();
}).catch(function (err) {
console.error(err);
@@ -119,7 +119,7 @@ $response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 's
<div class="content">
<form id="authenticator_assertion_form" action="$flowExecutionUrl" method="post">
#parse("csrf/csrf.vm")
- <input type="hidden" id="publicKeyAssertion" name="publicKeyAssertion" />
+ <input type="hidden" id="publicKeyCredential" name="publicKeyCredential" />
<button class="hidden" id="authenticationSubmit" type="submit"
name="_eventId_proceed">#springMessageText("idp.webauthn.authn.authenticate.submit", "Submit
authentication")</button>
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-register.vm b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-register.vm
index 62cb905..b96a8f0 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-register.vm
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-register.vm
@@ -48,10 +48,10 @@ $response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 's
var pkCredOptions = $webAuthnEncoder.serializePublicKeyCredentialOptionsAsJSON($webauthnRegContext.publicKeyCredentialCreationOptions);
var pkCredOptionsParsed = parseCreationOptionsFromJSON(pkCredOptions);
await create(pkCredOptionsParsed)
- .then(function (attestation){
+ .then(function (publicKeyCredentialAttestation){
var nickname = prompt('#springMessageText("idp.webauthn.register.credential.nickanme", "Credential Nickname")');
document.getElementById("credentialNickname").value = nickname;
- document.getElementById("authenticatorAttestation").value = JSON.stringify(attestation);
+ document.getElementById("publicKeyCredential").value = JSON.stringify(publicKeyCredentialAttestation);
document.getElementById("registrationSubmit").click();
}).catch(function (err){
console.error(err);
@@ -84,7 +84,7 @@ $response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 's
if (!isSupported){
document.getElementById('supportedDiv').classList.add('hidden')
document.getElementById("supportedDiv").disabled = true;
- document.getElementById("authenticatorAttestationForm").disabled = true;
+ document.getElementById("publicKeyCredentialAttestationForm").disabled = true;
document.getElementById("registrationSubmit").disabled = true;
document.getElementById("unsupportedDiv").disabled = false;
@@ -169,10 +169,10 @@ $response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 's
</div>
- <form id="authenticatorAttestationForm" action="$flowExecutionUrl" method="post">
+ <form id="publicKeyCredentialAttestationForm" action="$flowExecutionUrl" method="post">
#parse("csrf/csrf.vm")
<input type="hidden" id="credentialNickname" name="credentialNickname"/>
- <input type="hidden" id="authenticatorAttestation" name="authenticatorAttestation"/>
+ <input type="hidden" id="publicKeyCredential" name="publicKeyCredential"/>
<button class="hidden" id="registrationSubmit" type="submit" name="_eventId_addKey">#springMessageText("idp.webauthn.register.submit", "Submit Registration")</button>
</form>
</div>
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/impl/LookupRegisteredCredentialsFromUserHandleTest.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/impl/LookupRegisteredCredentialsFromUserHandleTest.java
index 5463365..d9bde51 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/impl/LookupRegisteredCredentialsFromUserHandleTest.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/impl/LookupRegisteredCredentialsFromUserHandleTest.java
@@ -112,7 +112,7 @@ public class LookupRegisteredCredentialsFromUserHandleTest extends AbstractWebAu
assertion = mockAuthenticator.createAuthenticatorAssertionResponse(attestation.getId().getBytes(),
clientDataGet);
- webAuthnContext.setAuthenticatorAssertionResponse(assertion);
+ webAuthnContext.setPublicKeyCredentialAssertionResponse(assertion);
final Event event = lookup.execute(src);
assertNull(event);
@@ -167,7 +167,7 @@ public class LookupRegisteredCredentialsFromUserHandleTest extends AbstractWebAu
assertion = mockAuthenticator.createAuthenticatorAssertionResponse(attestation.getId().getBytes(),
clientDataGet);
- webAuthnContext.setAuthenticatorAssertionResponse(assertion);
+ webAuthnContext.setPublicKeyCredentialAssertionResponse(assertion);
final Event event = lookup.execute(src);
assertEquals(event.getId(), AuthnEventIds.NO_CREDENTIALS);
@@ -196,7 +196,7 @@ public class LookupRegisteredCredentialsFromUserHandleTest extends AbstractWebAu
assertion = mockAuthenticator.createAuthenticatorAssertionResponse(attestation.getId().getBytes(),
clientDataGet);
- webAuthnContext.setAuthenticatorAssertionResponse(assertion);
+ webAuthnContext.setPublicKeyCredentialAssertionResponse(assertion);
final Event event = lookup.execute(src);
assertEquals(event.getId(), WebAuthnAuthenticationEventIds.NO_REGISTERED_WEBAUTHN_CREDENTIALS);
@@ -226,7 +226,7 @@ public class LookupRegisteredCredentialsFromUserHandleTest extends AbstractWebAu
assertion = mockAuthenticator.createAuthenticatorAssertionResponse(attestation.getId().getBytes(),
clientDataGet);
- webAuthnContext.setAuthenticatorAssertionResponse(assertion);
+ webAuthnContext.setPublicKeyCredentialAssertionResponse(assertion);
final Event event = lookup.execute(src);
assertNull(event);
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertionTest.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertionTest.java
index c1fa2ba..cd3ed88 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertionTest.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertionTest.java
@@ -105,7 +105,7 @@ public class ValidateWebAuthnAssertionTest extends AbstractWebAuthnTest {
clientDataGet);
//Set the assertion (authentication) response based on the credential we've already registered
- context.setAuthenticatorAssertionResponse(assertion);
+ context.setPublicKeyCredentialAssertionResponse(assertion);
final Event event = action.execute(src);
assertNull(event);
@@ -126,7 +126,7 @@ public class ValidateWebAuthnAssertionTest extends AbstractWebAuthnTest {
clientDataGet);
//Set the assertion (authentication) response based on the credential we've already registered
- context.setAuthenticatorAssertionResponse(assertion);
+ context.setPublicKeyCredentialAssertionResponse(assertion);
final Event event = action.execute(src);
assertNotNull(event);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list