[java-idp-plugin-webauthn] branch main updated: Fix error handling in validation action

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=77f13cbc59ac59796ee19763cf6c21a413270c8e

The following commit(s) were added to refs/heads/main by this push:
     new 77f13cb  Fix error handling in validation action
77f13cb is described below

commit 77f13cbc59ac59796ee19763cf6c21a413270c8e
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue May 7 10:45:19 2024 +0100

    Fix error handling in validation action
---
 .../authn/webauthn/impl/ValidateWebAuthnAssertion.java      | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
index a70568c..c703601 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
@@ -32,8 +32,9 @@ import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
- * An action that validates a WebAuthn Authenticator Assertion that results from a call to 'get' (authentication). If 
- * succesful populates the Subject with a {@link UsernamePrincipal}.
+ * An action that validates a WebAuthn Authenticator Assertion that results from a call to WebAuthn's 'get' 
+ * (authentication) API. If successful, populates the Subject with a {@link UsernamePrincipal} based on the username in
+ * the authentication context.
  * 
  * @event {@link AuthnEventIds#INVALID_CREDENTIALS}
  * @event {@link AuthnEventIds#INVALID_AUTHN_CTX}
@@ -153,14 +154,15 @@ public class ValidateWebAuthnAssertion extends AbstractValidationAction {
             updateSignatureCount(result.getUsername(), assertion);
             
             log.info("{} WebAuthn authentication succeeded for '{}'",getLogPrefix(),result.getUsername());
+            // Add the username that matched the credential from the result back to the context. 
+            // The result is authorative.
             context.setUsername(result.getUsername());
             buildAuthenticationResult(profileRequestContext, authenticationContext);
             
         } catch (final AssertionFailureException e) {
             log.warn("{} Error validating authenticator assertion for '{}'", 
                     getLogPrefix(),context.getUsername() != null ? context.getUsername() : "unknown username", e);
-            handleError(profileRequestContext, authenticationContext, "InvalidResponseType",
-                    AuthnEventIds.INVALID_CREDENTIALS);
+            handleError(profileRequestContext, authenticationContext, e, AuthnEventIds.INVALID_CREDENTIALS);
             recordFailure(profileRequestContext);              
             return; 
         }
@@ -173,7 +175,8 @@ public class ValidateWebAuthnAssertion extends AbstractValidationAction {
      * 
      * @param username the username of the user to update signature count for
      * @param assertion the assertion with the credential Id to update, and the new signature count
-     * @throws AssertionFailureException 
+     * 
+     * @throws AssertionFailureException on error updating the counter
      */
     private void updateSignatureCount(@Nonnull final String username, @Nonnull 
             final PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs> assertion)

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.