[java-idp-plugin-webauthn] branch main updated: JWEBAUTHN-5 - Add support for FIDO Alliance Metadata

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=ee37cc7c9392d417b27c018caea06f01d670295e

The following commit(s) were added to refs/heads/main by this push:
     new ee37cc7  JWEBAUTHN-5 - Add support for FIDO Alliance Metadata
ee37cc7 is described below

commit ee37cc7c9392d417b27c018caea06f01d670295e
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Mar 15 11:04:56 2024 +0000

    JWEBAUTHN-5 - Add support for FIDO Alliance Metadata
    
     - Add metadata properties to properties file
    
    https://shibboleth.atlassian.net/browse/JWEBAUTHN-5
---
 .../META-INF/net.shibboleth.idp/postconfig.xml     |  2 +-
 .../authn/webauthn/conf/authn/webauthn.properties  | 41 ++++++++++++++++------
 2 files changed, 32 insertions(+), 11 deletions(-)

diff --git a/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 269b7d6..efaf5c1 100644
--- a/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -72,7 +72,7 @@
         p:relyingPartyName="%{idp.authn.webauthn.relyingPartyName}"
         p:allowOriginPort="%{idp.authn.webauthn.allowOriginPort:false}"
         p:allowOriginSubdomain="%{idp.authn.webauthn.allowOriginSubdomain:false}"
-        p:allowUntrustedAttestation="%{idp.authn.webauthn.allowUntrustedAttestation:false}"
+        p:allowUntrustedAttestation="%{idp.authn.webauthn.allowUntrustedAttestation:true}"
         p:origins="%{idp.authn.webauthn.origins:}"
         p:preferredPublickeyParams="%{idp.authn.webauthn.preferredPublicKeyParams:EdDSA,ES256,ES384,ES512,RS1,RS256,RS384,RS512}"
         p:credentialRepository-ref="shibboleth.authn.webauthn.DefaultCredentialRepository"
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
index 00d669b..37ad201 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
@@ -1,3 +1,5 @@
+#### Relying Party properties
+
 # The relying party ID. Must be a valid domain string. A public key credential is only registered and valid for a single relying party ID.
 idp.authn.webauthn.relyingPartyId = localhost
 
@@ -10,6 +12,11 @@ idp.authn.webauthn.relyingPartyName = Shibboleth
 # Allow any subdomain of that origin
 #idp.authn.webauthn.allowOriginSubdomain = false
 
+# Allow credential registrations to be untrusted, the default. If false, this requires attestation statements from the 
+# authenticator using the idp.authn.webauthn.registration.attestationConveyancePreference = DIRECT property  
+# and FIDO metadata is loaded and itself trusted.
+#idp.authn.webauthn.allowUntrustedAttestation = true
+
 # Generic flow properties to adjust behavior
 #idp.authn.webauthn.order = 1000
 #idp.authn.webauthn.forcedAuthenticationSupported = true
@@ -21,26 +28,35 @@ idp.authn.webauthn.supportedPrincipals = \
     saml2/http://example.org/ac/classes/mfa, \
     saml1/http://example.org/ac/classes/mfa
 
+# An override of origins this RP allows in a responses from an authenticator
+#idp.authn.webauthn.origins = https://localhost
+
+# The storage service to use as a credential repository
+#idp.authn.webauthn.StorageService = shibboleth.StorageService
+
+#### Registration properties.
+
 # Access policy for the registration flow
 #idp.authn.webauthn.admin.registration.accessPolicy = 
 # Restrict the usable authentication flows
 #idp.authn.webauthn.admin.registration.authenticationFlows = 
 
-# An override of origins this RP allows in a responses from an authenticator
-#idp.authn.webauthn.origins = https://localhost
-
-### The storage service to use as a credential repository
-#idp.authn.webauthn.StorageService = shibboleth.StorageService
+# Enable FIDO Alliance metadata? If you want to use the metadata service, you *must* download and set the trust root and the legal blob file headers
+#idp.authn.webauthn.metadata.enabled = false
+#idp.authn.webauthn.metadata.trustRootFile=
+#idp.authn.webauthn.metadata.expectedLegalHeaders = Retrieval and use of this BLOB indicates acceptance of the appropriate agreement located at https://fidoalliance.org/metadata/metadata-legal-terms/
 
-## Which type of flow is supported? Usernameless or passwordless
-#idp.authn.webauthn.usernameless.enabled = true
+## If you want to download the metadata from a URL when the IdP starts, you must specify a cache file (.bin) and the URL to fetch the metadata
+#idp.authn.webauthn.metadata.cacheFile = 
+#idp.authn.webauthn.metadata.metadataBlobUrl = https://mds.fidoalliance.org
 
-# Registration properties.
+## If you want to load the metadata from a file *only*, set the metadata blob file location. This will override the metadataBlobUrl property
+#idp.authn.webauthn.metadata.metadataBlobFile = 
 
-### Which authentication flows to require 
+# Which authentication flows to require
 #idp.authn.webauthn.admin.registration.defaultAuthenticationMethods=saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
 
-# Require a residentKey (passkey) to be created when registering a credential. One-of 'discouraged', 'preferred', 'required'
+# Require a resident/discoverable key (passkey) to be created when registering a credential. One-of 'discouraged', 'preferred', 'required'
 #idp.authn.webauthn.registration.residentKey = preferred
 
 # Preferred set of COSE signature algorithms which a created credential will use. The sequence is ordered from the most preferred to the least. The client makes best effort to create the most preferred it can.
@@ -55,6 +71,11 @@ idp.authn.webauthn.supportedPrincipals = \
 # State the preference of the IdP during registration to receive an authenticator attestation. One-of 'none', 'indirect', 'direct', or 'enterprise'.
 #idp.authn.webauthn.registration.attestationConveyancePreference = none
 
+#### Authentication properties
+
+# Which type of flow is supported? Usernameless or passwordless
+#idp.authn.webauthn.usernameless.enabled = true
+
 # Enable this flow to act as a second factor. For example, after a password flow and only requiring a simple user gesture (user presence check)
 #idp.authn.webauthn.2fa.enabled = false
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.