[java-idp-plugin-webauthn] branch main updated: JWEBAUTHN-13 - Add option to disable signature count updates
Phil Smart
philip.smart at jisc.ac.uk
Fri May 24 09:56:21 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=da007dba53aec4cccbc124ec046cdd4db369a781
The following commit(s) were added to refs/heads/main by this push:
new da007db JWEBAUTHN-13 - Add option to disable signature count updates
da007db is described below
commit da007dba53aec4cccbc124ec046cdd4db369a781
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri May 24 10:56:17 2024 +0100
JWEBAUTHN-13 - Add option to disable signature count updates
- Added the flag shibboleth.authn.webauthn.updateSignatureCount and
predicate (which takes precedence if configured)
shibboleth.authn.webauthn.UpdateSignatureCountPredicate
https://shibboleth.atlassian.net/browse/JWEBAUTHN-13
---
.../webauthn/impl/ValidateWebAuthnAssertion.java | 37 ++++++++++++++++++++--
.../idp/flows/authn/WebAuthn/webauthn-beans.xml | 3 +-
.../authn/webauthn/conf/authn/webauthn.properties | 7 ++--
3 files changed, 42 insertions(+), 5 deletions(-)
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
index 54e0c7b..6561c98 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
@@ -1,6 +1,7 @@
package net.shibboleth.idp.plugin.authn.webauthn.impl;
import java.util.function.Function;
+import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.security.auth.Subject;
@@ -30,6 +31,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -62,10 +64,17 @@ public class ValidateWebAuthnAssertion extends AbstractValidationAction {
/** The options used to create the authentication request.*/
@NonnullBeforeExec private PublicKeyCredentialRequestOptions publicKeyCredentialRequestOptions;
+ /**
+ * Should we update the signature count on the credential in the repository after successful validation?
+ * Defaults to true.
+ */
+ @Nonnull private Predicate<ProfileRequestContext> updateSignatureCount;
+
/** Constructor. */
public ValidateWebAuthnAssertion() {
webauthnContextLookupStrategy = new ChildContextLookup<>(WebAuthnAuthenticationContext.class)
.compose(new ChildContextLookup<>(AuthenticationContext.class));
+ updateSignatureCount = PredicateSupport.alwaysTrue();
}
@@ -101,6 +110,28 @@ public class ValidateWebAuthnAssertion extends AbstractValidationAction {
webAuthnClient = Constraint.isNotNull(client, "WebAuthn client can not be null");
}
+ /**
+ * Set the flag to determine if we should update the signature count on the credential in the repository
+ * after successful validation?
+ *
+ * @param flag The flag to set.
+ */
+ public void setUpdateSignatureCount(final boolean flag) {
+ checkSetterPreconditions();
+ updateSignatureCount = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
+
+ /**
+ * Set the predicate to determine if we should update the signature count on the credential in the repository
+ * after successful validation?
+ *
+ * @param predicate The predicate to set.
+ */
+ public void setUpdateSignatureCountPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ checkSetterPreconditions();
+ updateSignatureCount = Constraint.isNotNull(predicate, "updateSignatureCount predicate can not be null");
+ }
+
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -150,8 +181,10 @@ public class ValidateWebAuthnAssertion extends AbstractValidationAction {
if (!result.isSignatureCounterValid()) {
throw new AssertionFailureException("Assestion was not valid, signature count is invalid");
}
- // Update the signature count with that from the assertion. It has already been validated at this point
- updateSignatureCount(result.getUsername(), assertion);
+ if (updateSignatureCount.test(profileRequestContext)) {
+ // Update the signature count with that from the assertion. It has already been validated at this point
+ updateSignatureCount(result.getUsername(), assertion);
+ }
log.info("{} WebAuthn authentication succeeded for '{}'",getLogPrefix(),result.getUsername());
// Add the username and user.id that matched the credential from the result back to the context.
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
index 4e12cc5..bd2c333 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
@@ -122,7 +122,8 @@
<bean id="ValidateWebAuthnAssertion" scope="prototype"
class="net.shibboleth.idp.plugin.authn.webauthn.impl.ValidateWebAuthnAssertion"
p:webAuthnClient="#{getObject('shibboleth.authn.webauthn.DefaultWebAuthnAuthenticationClientFactory')}"
- p:credentialRepository-ref="shibboleth.authn.webauthn.DefaultCredentialRepository"/>
+ p:credentialRepository-ref="shibboleth.authn.webauthn.DefaultCredentialRepository"
+ p:updateSignatureCountPredicate="#{getObject('shibboleth.authn.webauthn.UpdateSignatureCountPredicate') ?: %{idp.authn.webauthn.updateSignatureCount:true}}"/>
</beans>
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
index b5d10f1..1684641 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
@@ -121,8 +121,8 @@ idp.authn.webauthn.supportedPrincipals = \
# Force second factor even if no acceptable previous factors ran
#idp.authn.webauthn.2fa.forceSecondFactorFlow = false
-# Display debug information about the registration and authentication ceremony on their respective views?
-#idp.authn.webauthn.ui.debug = false
+# Should we update an authenticators signature count with the credential repository after each successful authentication?
+#idp.authn.webauthn.updateSignatureCount = true
# Should an event be built if there are no credentials found? Only applicable to passwordless authentication.
#idp.authn.webauthn.passwordless.signalEventOnNoCredentials = false
@@ -137,3 +137,6 @@ idp.authn.webauthn.supportedPrincipals = \
#idp.authn.webauthn.passwordless.username.uppercase = false
#idp.authn.webauthn.passwordless.username.lowercase = false
#idp.authn.webauthn.passwordless.username.trim = false
+
+# Display debug information about the registration and authentication ceremony on their respective views?
+#idp.authn.webauthn.ui.debug = false
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list