[java-idp-plugin-webauthn] branch main updated: Improve logging and Javadoc
Phil Smart
philip.smart at jisc.ac.uk
Wed May 15 12:48:52 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=e77c04e41509059e6702358374aacd931a028c6e
The following commit(s) were added to refs/heads/main by this push:
new e77c04e Improve logging and Javadoc
e77c04e is described below
commit e77c04e41509059e6702358374aacd931a028c6e
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed May 15 13:48:50 2024 +0100
Improve logging and Javadoc
---
.../authn/webauthn/admin/impl/AddUserId.java | 15 ++++++++--
.../admin/impl/StorePublicKeyCredential.java | 32 ++++++++++++++++++----
.../impl/YubicoWebAuthnAuthenticationClient.java | 3 +-
3 files changed, 41 insertions(+), 9 deletions(-)
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddUserId.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddUserId.java
index c019875..73c3dc2 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddUserId.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/AddUserId.java
@@ -31,6 +31,8 @@ import com.yubico.webauthn.data.ByteArray;
import net.shibboleth.idp.plugin.authn.webauthn.admin.WebAuthnRegistrationEventIds;
import net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnRegistrationContext;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
+import net.shibboleth.shared.codec.Base64Support;
+import net.shibboleth.shared.codec.EncodingException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -123,8 +125,17 @@ public class AddUserId extends AbstractWebAuthnRegistrationAction {
log.warn("{}: User.id is larger than 64 bytes", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, WebAuthnRegistrationEventIds.INVALID_REGISTRATION);
return;
- }
- log.trace("{} Generated user.id '{}'",getLogPrefix(),userId);
+ }
+ if (log.isTraceEnabled()) {
+ String userIdBase64;
+ try {
+ userIdBase64 = Base64Support.encodeURLSafe(userId);
+ } catch (final EncodingException e) {
+ // Do nothing, just 'null' userId;
+ userIdBase64 = null;
+ }
+ log.trace("{} Generated user.id '{}'",getLogPrefix(),userIdBase64);
+ }
context.setUserId(userId);
}
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/StorePublicKeyCredential.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/StorePublicKeyCredential.java
index 5ed115f..e41d4b2 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/StorePublicKeyCredential.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/StorePublicKeyCredential.java
@@ -41,12 +41,18 @@ import net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnRegistrationCont
import net.shibboleth.idp.plugin.authn.webauthn.storage.CredentialRegistration;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.codec.Base64Support;
+import net.shibboleth.shared.codec.EncodingException;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An action that stores the public key credential into the credential repository.
*
+ * <p>Importantly, the registration is stored against the user in the context (the authenticated user). This way, even
+ * if the user changed the webauthn create request in the browser (e.g. to a different userId), it will still be
+ * registered against the authenticated user.</p>
+ *
* @event {WebAuthnRegistrationEventIds#INVALID_REGISTRATION}
* @pre <pre>ProfileRequestContext.getSubcontext(WebAuthnRegistrationContext.class) != null</pre>
* @post the credential from the registration context is added to the credential repository
@@ -80,6 +86,9 @@ public class StorePublicKeyCredential extends AbstractWebAuthnRegistrationAction
ActionSupport.buildEvent(profileRequestContext, WebAuthnRegistrationEventIds.INVALID_REGISTRATION);
return;
}
+
+ final byte[] userId = context.getUserId();
+
try {
final RegisteredCredential credential = RegisteredCredential.builder()
.credentialId(registrationResult.getKeyId().getId())
@@ -110,13 +119,24 @@ public class StorePublicKeyCredential extends AbstractWebAuthnRegistrationAction
.withUserVerified(registrationResult.isUserVerified())
.build();
- getCredentialRepository().addRegistrationByUsername(username, registration);
+ getCredentialRepository().addRegistrationByUsername(username, registration);
- log.debug("{} Added public key credential registration for user '{}' and key '{}'. Using a "
- + "discoverable credential '{}' and user verification '{}'",
- getLogPrefix(), username, registrationResult.getKeyId().getId().getBase64Url(),
- registrationResult.isDiscoverable().isPresent() ? registrationResult.isDiscoverable() : "unknown",
- registrationResult.isUserVerified());
+ if (log.isInfoEnabled()) {
+
+ String userIdBase64;
+ try {
+ userIdBase64 = context.getUserId()!=null ? Base64Support.encodeURLSafe(userId) : null;
+ } catch (final EncodingException e) {
+ // Do nothing, just 'null' userId;
+ userIdBase64 = "null";
+ }
+
+ log.info("{} Added public key credential registration for user '{}' with user.id '{}' and key '{}'. "
+ + "Using a discoverable credential '{}' and user verification '{}'",
+ getLogPrefix(), username, userIdBase64, registrationResult.getKeyId().getId().getBase64Url(),
+ registrationResult.isDiscoverable().isPresent() ? registrationResult.isDiscoverable() :
+ "unknown", registrationResult.isUserVerified());
+ }
} catch (final Exception e) {
log.error("{} Unable to store registration for key '{}'",getLogPrefix(),
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebAuthnAuthenticationClient.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebAuthnAuthenticationClient.java
index ab92652..4307585 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebAuthnAuthenticationClient.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebAuthnAuthenticationClient.java
@@ -148,6 +148,7 @@ public class YubicoWebAuthnAuthenticationClient implements WebAuthnAuthenticatio
if (creation == null) {
throw new WebAuthnAuthenticationClientException("Unable to build public key credential creation options");
}
+
return creation;
}
@@ -214,7 +215,7 @@ public class YubicoWebAuthnAuthenticationClient implements WebAuthnAuthenticatio
.request(publicKeyCredentialCreationOptions)
.response(authenticatorAttestationResponse)
.build());
-
+
final RegistrationResult registrationResult = RegistrationResult.builder()
.withAttestationTrusted(result.isAttestationTrusted())
.withAttestationType(result.getAttestationType())
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list