[java-idp-plugin-webauthn] branch main updated: Add usernameless flow UV not signalled test

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=a0a34ccdab3f618027d1be8fbd59e011c2e308d0

The following commit(s) were added to refs/heads/main by this push:
     new a0a34cc  Add usernameless flow UV not signalled test
a0a34cc is described below

commit a0a34ccdab3f618027d1be8fbd59e011c2e308d0
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Sep 3 09:54:18 2024 +0100

    Add usernameless flow UV not signalled test
---
 .../authn/webauthn/flow/TestUsernameslessFlow.java | 47 ++++++++++++++++++++++
 .../webauthn/storage/impl/MockAuthenticator.java   | 16 +++++++-
 2 files changed, 61 insertions(+), 2 deletions(-)

diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestUsernameslessFlow.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestUsernameslessFlow.java
index f18fd0b..24819d1 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestUsernameslessFlow.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/flow/TestUsernameslessFlow.java
@@ -107,6 +107,53 @@ public class TestUsernameslessFlow extends AbstractWebAuthnFlowTest{
 
     }
     
+    @SuppressWarnings("null")
+    @Test
+    public void testUsernamelessFlow_UserNotVerified() throws Exception {
+        
+        //Register a credential for use.
+        final CredentialRegistration registration = 
+                createCredentialRegistration(USERNAME, DISPLAY_NAME, USER_HANDLE_B64);
+        credentialRepo.addRegistrationByUsername(USERNAME, registration);
+        
+        final var prc = buildProfileRequestContext(false, false, null);
+
+        final Pair<FlowExecutionResult, FlowExecutionImpl> result = launchExecution(FLOW_ID, null, externalContext, 
+                addToConversationScopeMap(Map.of("opensamlProfileRequestContext", prc)));
+
+        assertFlowExecutionActive(result.getSecond());
+        assertCurrentStateEquals("DisplayWebAuthnView", result.getSecond());
+        assertPublicKeyCredentialRequestOptions(prc, false, true);
+        
+        // Do assertion validation half of flow
+        
+        // Get the challenge that was set into the PublicKeyCredentialRequestOptions. 
+        // otherwise we will end up signing a different one, which will provide its own test.
+        final WebAuthnAuthenticationContext authnContext = getWebAuthnAuthenticationContext(prc);
+        final ByteArray challenge = authnContext.getPublicKeyCredentialRequestOptions().getChallenge();
+        
+        // Updated the authenticator to say no UV
+        mockAuthenticator.setUVNotPerformed(true);
+        final PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs>        
+            assertionResponse = createAssertionReponseFrom(
+                registration.getCredential().getCredentialId().getBytes(), challenge.getBytes());
+
+        final String assertionResponseJson = jsonMapper.writeValueAsString(assertionResponse);
+        
+        // Re-set external context to holder
+        ExternalContextHolder.setExternalContext(externalContext);
+        setHttpFormRequest("POST", Map.of(ExtractPublicKeyCredentialAssertionFromFormRequest.DEFAULT_PARAMETER_NAME, 
+                assertionResponseJson));
+        externalContext.setEventId("proceed");
+        result.getSecond().setCurrentState("DisplayWebAuthnView");
+        result.getSecond().resume(externalContext);
+        
+        // This should fail, as UV was required
+        assertEquals(result.getSecond().getOutcome().getId(),  AuthnEventIds.INVALID_CREDENTIALS);
+        assertAuthenticationFailureConditions(prc);
+
+    }
+    
     @SuppressWarnings("null")
     @Test
     public void testUsernamelessFlow_BadSignature() throws Exception {
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/MockAuthenticator.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/MockAuthenticator.java
index 3d611dd..3c38725 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/MockAuthenticator.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/MockAuthenticator.java
@@ -117,6 +117,9 @@ public class MockAuthenticator {
     
     /** Testing flag to produce bad assertion signatures.*/
     private boolean produceBadAssertionSignatures;
+
+    /** Testing flag to set UV to false if true.*/
+    private boolean overrideUvToFalse;
     
     /**
      * 
@@ -140,9 +143,18 @@ public class MockAuthenticator {
                 .build();
         createdCredentialsMaps = new HashMap<>();
         produceBadAssertionSignatures = false;
+        overrideUvToFalse = false;
         
     }
     
+    public void setUVNotPerformed(final boolean noUv) {
+        if (noUv) {
+            overrideUvToFalse = true;
+        } else {
+            overrideUvToFalse = false;
+        }
+    }
+    
     public void setProduceBadAssertionSignatures(final boolean badSigs) {
         produceBadAssertionSignatures = badSigs;
     }
@@ -350,9 +362,9 @@ public class MockAuthenticator {
         // If we have a key, we need to create the attested data and set the appropriate AT flag, otherwise do not
         byte[] flags;
         if (createdKey !=null) {
-            flags = createFlags(true, true, true, false);
+            flags = createFlags(true, overrideUvToFalse ? false : true, true, false);
         } else {
-            flags = createFlags(true, true, false, false);
+            flags = createFlags(true, overrideUvToFalse ? false : true, false, false);
         }
         final byte[] signCount = createSignCount(1);
         

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.