[java-idp-plugin-webauthn] 01/02: JWEBAUTHN-24 - Make user.name configurable

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=a08f7afe429c3a31d31fff7158330e6f0893a919

commit a08f7afe429c3a31d31fff7158330e6f0893a919
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Sep 5 18:53:04 2024 +0100

    JWEBAUTHN-24 - Make user.name configurable
    
     - User.name is now configurable via a property and comes with a built
    in bean for using the attribute context.
     - Noting, it would be unlikely anybody would want to change this
    
    https://shibboleth.atlassian.net/browse/JWEBAUTHN-24
---
 .../webauthn-registration-beans.xml                     | 17 ++++++++++-------
 .../idp/flows/authn/WebAuthn/webauthn-beans.xml         |  9 +++++++--
 .../authn/webauthn/conf/authn/webauthn.properties       | 11 ++++++++++-
 3 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
index 3a3c841..17f200c 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-registration/webauthn-registration-beans.xml
@@ -53,13 +53,16 @@
         class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.PopulateWebAuthnRegistrationContext"
         p:usernameRequired="true"
         p:removeExistingRegistrationContext="true"
-        p:usernameLookupStrategy="#{getObject('%{idp.authn.webauthn.registration.UsernameLookupStrategy:shibboleth.authn.webauthn.RegistrationUsernameLookupStrategy}')}">
-    </bean>
-        
-    <!-- Default username comes from the subject context. -->
-    <bean id="shibboleth.authn.webauthn.RegistrationUsernameLookupStrategy"
+        p:usernameLookupStrategy="#{getObject('%{idp.authn.webauthn.registration.username.strategy:shibboleth.authn.webauthn.SubjectContextUsernameLookupStrategy}')}">
+    </bean>        
+    
+    <bean id="shibboleth.authn.webauthn.SubjectContextUsernameLookupStrategy" lazy-init="true" scope="singleton"
         class="net.shibboleth.idp.plugin.authn.webauthn.context.navigate.UsernameLookupFromSubjectContext" />
     
+    <bean id="shibboleth.authn.webauthn.AttributeContextUserNameLookupStrategy" lazy-init="true" scope="singleton"
+        class="net.shibboleth.idp.plugin.authn.webauthn.context.navigate.AttributeContextStringLookupStrategy"
+        p:attributeId="%{idp.authn.webauthn.registration.username.attributeId:#{null}}"/>
+    
     <bean id="AddAttestationConveyancePreference" scope="prototype" parent="AbstractWebAuthnRegistrationAction"
         class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.AddAttestationConveyancePreference"
         p:attestationConveyancePreference="%{idp.authn.webauthn.registration.attestationConveyancePreference:none}"/>
@@ -92,9 +95,9 @@
     
     <bean id="AddDisplayName" parent="AbstractWebAuthnRegistrationAction" scope="prototype"
         class="net.shibboleth.idp.plugin.authn.webauthn.admin.impl.AddDisplayName"
-        p:displayNameLookupStrategy="#{getObject('%{idp.authn.webauthn.registration.displayname.strategy:shibboleth.authn.webauthn.SubjectDisplayNameLookupStrategy}')}"/>
+        p:displayNameLookupStrategy="#{getObject('%{idp.authn.webauthn.registration.displayname.strategy:shibboleth.authn.webauthn.SubjectContextDisplayNameLookupStrategy}')}"/>
     
-    <bean id="shibboleth.authn.webauthn.SubjectDisplayNameLookupStrategy" lazy-init="true"
+    <bean id="shibboleth.authn.webauthn.SubjectContextDisplayNameLookupStrategy" lazy-init="true"
         class="net.shibboleth.idp.plugin.authn.webauthn.context.navigate.UsernameLookupFromSubjectContext"/>
         
     <bean id="shibboleth.authn.webauthn.AttributeContextDisplayNameLookupStrategy" lazy-init="true" scope="singleton"
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
index b9beb9d..a6b046a 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
@@ -45,18 +45,23 @@
     
     <bean id="PopulateWebAuthnAuthenticationContextFor2FA" scope="prototype"
         class="net.shibboleth.idp.plugin.authn.webauthn.impl.PopulateWebAuthnAuthenticationContext"
-        p:usernameRequired="true">
+        p:usernameRequired="true"
+        p:usernameLookupStrategy="#{getObject('%{idp.authn.webauthn.2fa.username.strategy:shibboleth.authn.webauthn.CanonicalUsernameLookupStrategy}')}">        
         <property name="contextUpdateConsumer">
             <bean id="setUsernamelessConsumer" scope="prototype"
                 class="net.shibboleth.idp.plugin.authn.webauthn.impl.SetSecondFactorUsageToContextConsumer"/>
         </property>
     </bean>
     
+    <bean id="shibboleth.authn.webauthn.CanonicalUsernameLookupStrategy" lazy-init="true" scope="singleton"
+        class="net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy" />
+    
     <bean id="IsUsernameCollectionRequired" scope="prototype"
         class="net.shibboleth.idp.plugin.authn.webauthn.context.logic.IsUsernameCollectionRequired"/>
 
     <bean id="IsSecondFactor" scope="prototype"
-        class="net.shibboleth.idp.plugin.authn.webauthn.context.logic.IsSecondFactor" 
+        class="net.shibboleth.idp.plugin.authn.webauthn.context.logic.IsSecondFactor"
+        p:usernameLookupStrategy="#{getObject('%{idp.authn.webauthn.2fa.username.strategy:shibboleth.authn.webauthn.CanonicalUsernameLookupStrategy}')}"
         p:secondFactorOverride="#{getObject('shibboleth.authn.webauthn.SecondFactorOverride') != null ? 
             getObject('shibboleth.authn.webauthn.SecondFactorOverride') : %{idp.authn.webauthn.2fa.forceSecondFactorFlow:false}}"
         p:allowedPreviousFactors="%{idp.authn.webauthn.2fa.allowedPreviousFactors:authn/Password}"
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
index 83866f9..d932664 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
@@ -52,13 +52,19 @@ idp.authn.webauthn.supportedPrincipals = \
 # The flow logging ID
 #idp.authn.webauthn.admin.registration.logging = WebAuthnCredentialRegistration
 
+# The bean name of the user.name lookup strategy. Think carefully before you change this bean, you nearly always
+# want to use the principal name in the subject context.
+#idp.authn.webauthn.registration.username.strategy = shibboleth.authn.webauthn.SubjectContextUsernameLookupStrategy
+# If using the attribute context lookup strategy, which attribute should the user.name be taken from
+#idp.authn.webauthn.registration.username.attributeId = WebAuthnUsername
+
 # The bean name of the user.id generator or lookup strategy
 #idp.authn.webauthn.registration.userid.strategy = shibboleth.authn.webauthn.RandomUserIdGenerator
 # If using the attribute context lookup strategy, which attribute should the user.id be taken from
 #idp.authn.webauthn.registration.userid.attributeId = WebAuthnUserID
 
 # The bean name of the user.displayName lookup strategy
-#idp.authn.webauthn.registration.displayname.strategy = shibboleth.authn.webauthn.SubjectDisplayNameLookupStrategy
+#idp.authn.webauthn.registration.displayname.strategy = shibboleth.authn.webauthn.SubjectContextDisplayNameLookupStrategy
 # If using the attribute context lookup strategy, which attribute should the user.displayName be taken from
 #idp.authn.webauthn.registration.displayname.attributeId = mail
 
@@ -120,6 +126,9 @@ idp.authn.webauthn.supportedPrincipals = \
 # Force second factor even if no acceptable previous factors ran
 #idp.authn.webauthn.2fa.forceSecondFactorFlow = false
 
+# The bean name of the user.name lookup strategy. By default, this comes from the principal name established by the first factor.
+#idp.authn.webauthn.2fa.username.strategy = shibboleth.authn.webauthn.CanonicalUsernameLookupStrategy
+
 # Should we update an authenticators signature counter inside the credential repository after each successful authentication?  
 #idp.authn.webauthn.updateSignatureCount = true
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.