[java-idp-plugin-webauthn] branch main updated: Improve validation action

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=d94d37f0b5521124b82b4d8e678e5eed125adbc6

The following commit(s) were added to refs/heads/main by this push:
     new d94d37f  Improve validation action
d94d37f is described below

commit d94d37f0b5521124b82b4d8e678e5eed125adbc6
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Sep 17 17:27:00 2024 +0100

    Improve validation action
    
     - Improve isSecondFactor conditional
     - re-confirm c14n principal name
---
 .../plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java    | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
index 8fddc18..9a09c96 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/impl/ValidateWebAuthnAssertion.java
@@ -33,6 +33,7 @@ import com.yubico.webauthn.data.PublicKeyCredentialRequestOptions;
 
 import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.idp.authn.impl.AbstractAuditingValidationAction;
 import net.shibboleth.idp.authn.principal.UsernamePrincipal;
 import net.shibboleth.idp.plugin.authn.webauthn.authn.AssertionResult;
@@ -251,6 +252,10 @@ public class ValidateWebAuthnAssertion extends AbstractAuditingValidationAction
     @Override protected void buildAuthenticationResult(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final AuthenticationContext authenticationContext) {
         super.buildAuthenticationResult(profileRequestContext, authenticationContext);
+        
+        // All WebAuthn flows already operate on a canonical name, so just re-confirm it.
+        profileRequestContext.ensureSubcontext(SubjectCanonicalizationContext.class)
+            .setPrincipalName(context.getUsername());
 
     }
 
@@ -263,8 +268,8 @@ public class ValidateWebAuthnAssertion extends AbstractAuditingValidationAction
             subject.getPrincipals().add(new WebAuthnUserIdPrinicpal(userId));
         }
         
-        if (context.isSecondFactor()) {
-            // If second factor, we already have a username principal and a canonical name, so do nothing
+        if (context.isSecondFactor() && subject.getPrincipals(UsernamePrincipal.class) != null) {
+            // If second factor, we already have a username principal so do nothing
             log.trace("{} second factor usage, username principal already set", getLogPrefix());
             return subject;
         } else {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.