[java-idp-plugin-webauthn] 02/04: Improve properties files and split metadata into its own

Fri Nov 8 16:24:45 UTC 2024

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=d1c2c36a7e4c039ea6fcf5053a895f55a2be4330

commit d1c2c36a7e4c039ea6fcf5053a895f55a2be4330
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Nov 8 15:53:39 2024 +0000

    Improve properties files and split metadata into its own
---
 .../conf/authn/webauthn-metadata.properties        | 19 +++++++
 .../conf/authn/webauthn-registration.properties    | 30 +---------
 .../authn/webauthn/conf/authn/webauthn.properties  |  4 +-
 .../idp/plugin/authn/webauthn/module.properties    | 66 ++++++++++++----------
 4 files changed, 57 insertions(+), 62 deletions(-)

diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-metadata.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-metadata.properties
new file mode 100644
index 0000000..c2f8d94
--- /dev/null
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-metadata.properties
@@ -0,0 +1,19 @@
+# Enable FIDO Alliance metadata? If you want to use the metadata service, you *must* download and set the trust root and the legal blob file headers
+#idp.authn.webauthn.metadata.enabled = false
+#idp.authn.webauthn.metadata.trustRootFile = %{idp.home}/credentials/root-r3.crt
+#idp.authn.webauthn.metadata.expectedLegalHeaders = Retrieval and use of this BLOB indicates acceptance of the appropriate agreement located at https://fidoalliance.org/metadata/metadata-legal-terms/
+# Downloaded CRLs to check metadata signature revocation status.
+#idp.authn.webauthn.metadata.crls = %{idp.home}/credentials/root-r3.crl
+
+# If you want to download the metadata from a URL when the IdP starts, you must specify a cache file (.bin) and the URL to fetch the metadata
+#idp.authn.webauthn.metadata.cacheFile = %{idp.home}/metadata/fido-metadata.bin
+#idp.authn.webauthn.metadata.metadataBlobUrl = https://mds3.fidoalliance.org
+
+# If you want to load the metadata from a file *only*, set the metadata blob file location. This will override the metadataBlobUrl property
+#idp.authn.webauthn.metadata.metadataBlobFile = %{idp.home}/metadata/blob-mds3.jwt
+
+## Supplementary AAGUID Metadata
+
+# To provide an icon and description in the registration interface for those authenticators/providers not in the FIDO metadata feed
+#idp.authn.webauthn.metadata.aaguid.enabled = false
+#idp.authn.webauthn.metadata.aaguid.passkeyAaguidFile = aaguid.json
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties
index c8527e6..bbd3c4e 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties
@@ -1,5 +1,3 @@
-#### Registration properties.
-
 # Should the registration process collect a username before initiating authentication?
 #idp.authn.webauthn.registration.collectUsername = true
 
@@ -76,34 +74,8 @@
 #idp.authn.webauthn.registration.audit.category = Shibboleth-Audit.WebAuthnRegistration
 #idp.authn.webauthn.registration.audit.format = %a|%T|%u|%WebAuthnAdminAO|%WebAuthnAdminAction|%WebAuthnAdminCR|%WebAuthnAdminCA|%WebAuthnAdminAU|%UA
 
-#### FIDO Metadata 
-
-# Allow credential registrations to be untrusted, the default. If false, this requires attestation statements from the 
-# authenticator using 'idp.authn.webauthn.registration.attestationConveyancePreference = DIRECT' and FIDO metadata is 
-# loaded and trusted.
-#idp.authn.webauthn.allowUntrustedAttestation = true
-
-# Enable FIDO Alliance metadata? If you want to use the metadata service, you *must* download and set the trust root and the legal blob file headers
-#idp.authn.webauthn.metadata.enabled = false
-#idp.authn.webauthn.metadata.trustRootFile = %{idp.home}/credentials/root-r3.crt
-#idp.authn.webauthn.metadata.expectedLegalHeaders = Retrieval and use of this BLOB indicates acceptance of the appropriate agreement located at https://fidoalliance.org/metadata/metadata-legal-terms/
-# Downloaded CRLs to check metadata signature revocation status.
-#idp.authn.webauthn.metadata.crls = %{idp.home}/credentials/root-r3.crl
-
-## If you want to download the metadata from a URL when the IdP starts, you must specify a cache file (.bin) and the URL to fetch the metadata
-#idp.authn.webauthn.metadata.cacheFile = %{idp.home}/metadata/fido-metadata.bin
-#idp.authn.webauthn.metadata.metadataBlobUrl = https://mds3.fidoalliance.org
-
-## If you want to load the metadata from a file *only*, set the metadata blob file location. This will override the metadataBlobUrl property
-#idp.authn.webauthn.metadata.metadataBlobFile = %{idp.home}/metadata/blob-mds3.jwt
-
-##### Supplementary AAGUID Metadata
-# To provide an icon and description in the registration interface for those authenticators/providers not in the FIDO metadata feed
-#idp.authn.webauthn.metadata.aaguid.enabled = false
-#idp.authn.webauthn.metadata.aaguid.passkeyAaguidFile = aaguid.json
-
 
-#### Administrator properties for managing user credentials
+## Administrator properties for managing user credentials
 
 #idp.authn.webauthn.admin.management.logging = WebAuthnCredentialManagement
 #idp.authn.webauthn.admin.management.accessPolicy = AccessByAdmin
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
index 5e70f5e..ee36c1e 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
@@ -70,7 +70,7 @@ idp.authn.webauthn.supportedPrincipals = \
 #idp.authn.webauthn.credential.policy = shibboleth.authn.WebAuthn.ChainedCredentialPolicy
 # When using the default chained policy, which policy list should we use?
 #idp.authn.webauthn.credential.policy.chainedlist = shibboleth.authn.WebAuthn.ChainedCredentialPolicyList
-# When using the default chained set of inspectors; list authenticators (by attestation GUIDs (AAGUID)) to tag as only allowed for second factor authentication
+# When using the default chained list of policies; list authenticators (by attestation GUIDs (AAGUID)) to tag as only allowed for second factor authentication
 #idp.authn.webauthn.authenticator.policy.secondFactorOnlyAuthenticators = 
 
 # Audit
@@ -78,7 +78,7 @@ idp.authn.webauthn.supportedPrincipals = \
 #idp.authn.webauthn.audit.format = %a|%T|%SP|%I|%s|%AF|%CV|%u|%WebAuthnUID|%WebAuthnUV|%WebAuthnFM|%tu|%AR|%UA
 #idp.authn.webauthn.audit.category = Shibboleth-Audit.WebAuthn
 
-#### Debugging
+# Debugging
 
 # Display debug information about the registration and authentication ceremony on their respective views?
 #idp.authn.webauthn.ui.debug = false
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/module.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/module.properties
index ebbf6da..179231d 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/module.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/module.properties
@@ -14,55 +14,59 @@ idp.authn.WebAuthn.1.src = /net/shibboleth/idp/plugin/authn/webauthn/conf/authn/
 idp.authn.WebAuthn.1.dest = conf/authn/webauthn.properties
 idp.authn.WebAuthn.1.replace = false
 
-idp.authn.WebAuthn.2.src = /net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties
-idp.authn.WebAuthn.2.dest = conf/authn/webauthn-registration.properties
+idp.authn.WebAuthn.2.src = /net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-metadata.properties
+idp.authn.WebAuthn.2.dest = conf/authn/webauthn-metadata.properties
 idp.authn.WebAuthn.2.replace = false
 
-idp.authn.WebAuthn.3.src = /net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-config.xml
-idp.authn.WebAuthn.3.dest = conf/authn/webauthn-config.xml
+idp.authn.WebAuthn.3.src = /net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties
+idp.authn.WebAuthn.3.dest = conf/authn/webauthn-registration.properties
 idp.authn.WebAuthn.3.replace = false
 
-idp.authn.WebAuthn.4.src = /net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration-config.xml
-idp.authn.WebAuthn.4.dest = conf/authn/webauthn-registration-config.xml
+idp.authn.WebAuthn.4.src = /net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-config.xml
+idp.authn.WebAuthn.4.dest = conf/authn/webauthn-config.xml
 idp.authn.WebAuthn.4.replace = false
 
-idp.authn.WebAuthn.5.src = /net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-management-config.xml
-idp.authn.WebAuthn.5.dest = conf/authn/webauthn-management-config.xml
+idp.authn.WebAuthn.5.src = /net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration-config.xml
+idp.authn.WebAuthn.5.dest = conf/authn/webauthn-registration-config.xml
 idp.authn.WebAuthn.5.replace = false
 
-idp.authn.WebAuthn.6.src = /net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-authentication-config.xml
-idp.authn.WebAuthn.6.dest = conf/authn/webauthn-authentication-config.xml
+idp.authn.WebAuthn.6.src = /net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-management-config.xml
+idp.authn.WebAuthn.6.dest = conf/authn/webauthn-management-config.xml
 idp.authn.WebAuthn.6.replace = false
 
-idp.authn.WebAuthn.7.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm
-idp.authn.WebAuthn.7.dest = views/webauthn/webauthn-authn.vm
+idp.authn.WebAuthn.7.src = /net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-authentication-config.xml
+idp.authn.WebAuthn.7.dest = conf/authn/webauthn-authentication-config.xml
+idp.authn.WebAuthn.7.replace = false
 
-idp.authn.WebAuthn.8.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-register.vm
-idp.authn.WebAuthn.8.dest = views/webauthn/webauthn-register.vm
+idp.authn.WebAuthn.8.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm
+idp.authn.WebAuthn.8.dest = views/webauthn/webauthn-authn.vm
 
-idp.authn.WebAuthn.9.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-register-username.vm
-idp.authn.WebAuthn.9.dest = views/webauthn/webauthn-register-username.vm
+idp.authn.WebAuthn.9.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-register.vm
+idp.authn.WebAuthn.9.dest = views/webauthn/webauthn-register.vm
 
-idp.authn.WebAuthn.10.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn-username.vm
-idp.authn.WebAuthn.10.dest = views/webauthn/webauthn-authn-username.vm
+idp.authn.WebAuthn.10.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-register-username.vm
+idp.authn.WebAuthn.10.dest = views/webauthn/webauthn-register-username.vm
 
-idp.authn.WebAuthn.11.src = /net/shibboleth/idp/plugin/authn/webauthn/css/webauthn.css
-idp.authn.WebAuthn.11.dest = edit-webapp/css/webauthn.css
-idp.authn.WebAuthn.11.postenable = Customize edit-webapp/css/webauthn.css and rebuild war to deploy.
+idp.authn.WebAuthn.11.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn-username.vm
+idp.authn.WebAuthn.11.dest = views/webauthn/webauthn-authn-username.vm
 
-idp.authn.WebAuthn.12.src = /net/shibboleth/idp/plugin/authn/webauthn/js/webauthn-json.browser-ponyfill.min.js
-idp.authn.WebAuthn.12.dest = edit-webapp/js/webauthn/webauthn-json.browser-ponyfill.min.js
+idp.authn.WebAuthn.12.src = /net/shibboleth/idp/plugin/authn/webauthn/css/webauthn.css
+idp.authn.WebAuthn.12.dest = edit-webapp/css/webauthn.css
+idp.authn.WebAuthn.12.postenable = Customize edit-webapp/css/webauthn.css and rebuild war to deploy.
 
-idp.authn.WebAuthn.13.src = /net/shibboleth/idp/plugin/authn/webauthn/js/webauthn-support.js
-idp.authn.WebAuthn.13.dest = edit-webapp/js/webauthn/webauthn-support.js
+idp.authn.WebAuthn.13.src = /net/shibboleth/idp/plugin/authn/webauthn/js/webauthn-json.browser-ponyfill.min.js
+idp.authn.WebAuthn.13.dest = edit-webapp/js/webauthn/webauthn-json.browser-ponyfill.min.js
 
-idp.authn.WebAuthn.14.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-end.vm
-idp.authn.WebAuthn.14.dest = views/webauthn/webauthn-end.vm
+idp.authn.WebAuthn.14.src = /net/shibboleth/idp/plugin/authn/webauthn/js/webauthn-support.js
+idp.authn.WebAuthn.14.dest = edit-webapp/js/webauthn/webauthn-support.js
 
-idp.authn.WebAuthn.15.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management.vm
-idp.authn.WebAuthn.15.dest = views/webauthn/webauthn-management.vm
+idp.authn.WebAuthn.15.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-end.vm
+idp.authn.WebAuthn.15.dest = views/webauthn/webauthn-end.vm
 
-idp.authn.WebAuthn.16.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management-search.vm
-idp.authn.WebAuthn.16.dest = views/webauthn/webauthn-management-search.vm
+idp.authn.WebAuthn.16.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management.vm
+idp.authn.WebAuthn.16.dest = views/webauthn/webauthn-management.vm
+
+idp.authn.WebAuthn.17.src = /net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management-search.vm
+idp.authn.WebAuthn.17.dest = views/webauthn/webauthn-management-search.vm
 
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
