[java-idp-plugin-webauthn] branch main updated: Add additional test to check cross-registration and use of credentials

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=57d4bb918ed4cdddfdd9b1cec02f4cc624d9e727

The following commit(s) were added to refs/heads/main by this push:
     new 57d4bb9  Add additional test to check cross-registration and use of credentials
57d4bb9 is described below

commit 57d4bb918ed4cdddfdd9b1cec02f4cc624d9e727
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Sep 2 14:31:16 2024 +0100

    Add additional test to check cross-registration and use of credentials
---
 .../YubicoWebauthnAuthenticationClientTest.java    | 26 ++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebauthnAuthenticationClientTest.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebauthnAuthenticationClientTest.java
index 933be35..460214c 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebauthnAuthenticationClientTest.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebauthnAuthenticationClientTest.java
@@ -211,6 +211,32 @@ public class YubicoWebauthnAuthenticationClientTest extends AbstractWebAuthnTest
         
     }
     
+    /* Ensure that a key registered for a different user can not be used, as the user in the context will not match.*/
+    @Test(expectedExceptions = AssertionFailureException.class)
+    public void testValidateAuthentication_Fail_CredentialRegisteredForDifferentUser() throws Exception {   
+        
+        mockAuthenticator = new MockAuthenticator(RPID);
+        
+        final var credentialRegistration = createCredentialRegistration(); 
+        // Register the credential for the correct user
+        storage.addRegistrationByUsername(USERNAME, credentialRegistration);
+        
+        final Map<String, String> clientDataGet = createClientData("webauthn.get", ORIGIN, CHALLENGE_B64); 
+        
+        // Now generate an assertion (authentication) and check it is valid
+        final PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs> 
+            assertion = mockAuthenticator.createAuthenticatorAssertionResponse(
+                    credentialRegistration.getCredential().getCredentialId().getBytes(), 
+                    clientDataGet, null);
+
+        // The username used here is not the same as has user that has the credential registered for
+        final AssertionResult result = 
+                client.validateAuthenticatorAssertionResponse("DifferentUser", Base64Support.decode(USER_HANDLE_B64), 
+                credentialRequestOptions, assertion);
+        assertNotNull(result);
+        
+    }
+    
     @Test(expectedExceptions = AssertionFailureException.class)
     public void testValidateAuthentication_Fail_WrongOrigin() throws Exception {   
         

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.