[java-idp-plugin-webauthn] branch main updated: JWEBAUTHN-30 - two different NoRegisteredWebAuthnCredentials events

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=cede27744cf9e90566471284a76de0a96468a620

The following commit(s) were added to refs/heads/main by this push:
     new cede277  JWEBAUTHN-30 - two different NoRegisteredWebAuthnCredentials events
cede277 is described below

commit cede27744cf9e90566471284a76de0a96468a620
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Feb 14 10:51:00 2025 +0000

    JWEBAUTHN-30 - two different NoRegisteredWebAuthnCredentials events
    
     - Add another property for specifying a different eventID if credential
    lookup fails (0 credentials) for 2FA v Passwordless.
     - Defaults to the same settings as passwordless to maintain backward
    compatibility.
    
    https://shibboleth.atlassian.net/browse/JWEBAUTHN-30
---
 .../net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml    | 8 +++++++-
 .../net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml     | 4 ++--
 .../idp/plugin/authn/webauthn/conf/authn/webauthn.properties      | 4 ++++
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
index 88b8c4b..10c16eb 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-beans.xml
@@ -119,12 +119,18 @@
         p:webAuthnContextLookupStrategy-ref="shibboleth.ChildLookup.WebAuthnAuthenticationContextFromAuthenticationContext"
         p:userVerificationRequirement="discouraged" />
 
-    <bean id="LookupRegisteredCredentials" scope="prototype" parent="AbstractWebAuthnBaseAction"
+    <bean id="LookupRegisteredCredentialsForPasswordless" scope="prototype" parent="AbstractWebAuthnBaseAction"
         class="net.shibboleth.idp.plugin.authn.webauthn.impl.LookupRegisteredCredentials"
         p:triggerEventOnNoCredentials="%{idp.authn.webauthn.passwordless.signalEventOnNoCredentials:false}"
         p:noCredentialsEventId="%{idp.authn.webauthn.passwordless.noCredentialsEventId:NoRegisteredWebAuthnCredentials}"
         p:webAuthnContextLookupStrategy-ref="shibboleth.ChildLookup.WebAuthnAuthenticationContextFromAuthenticationContext" />
 
+    <bean id="LookupRegisteredCredentialsFor2FA" scope="prototype" parent="AbstractWebAuthnBaseAction"
+        class="net.shibboleth.idp.plugin.authn.webauthn.impl.LookupRegisteredCredentials"
+        p:triggerEventOnNoCredentials="%{idp.authn.webauthn.2fa.signalEventOnNoCredentials:%{idp.authn.webauthn.passwordless.signalEventOnNoCredentials:false}}"
+        p:noCredentialsEventId="%{idp.authn.webauthn.2fa.noCredentialsEventId:%{idp.authn.webauthn.passwordless.noCredentialsEventId:NoRegisteredWebAuthnCredentials}}"
+        p:webAuthnContextLookupStrategy-ref="shibboleth.ChildLookup.WebAuthnAuthenticationContextFromAuthenticationContext" />
+    
     <bean id="FilterCredentialsOnPolicy" scope="prototype" parent="AbstractWebAuthnAuthenticationAction"
         class="net.shibboleth.idp.plugin.authn.webauthn.impl.FilterCredentialsOnPolicy"
         p:activationCondition="%{idp.authn.webauthn.credential.filter.policy.enabled:false}"
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
index 1c330f9..535e549 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
@@ -77,7 +77,7 @@
     </action-state>
     
     <action-state id="PasswordlessLoginProceed">        
-        <evaluate expression="LookupRegisteredCredentials"/>
+        <evaluate expression="LookupRegisteredCredentialsForPasswordless"/>
         <evaluate expression="FilterCredentialsOnPolicy"/>
         <evaluate expression="AddUserVerificationRequired"/>
         <evaluate expression="'proceed'" />
@@ -101,7 +101,7 @@
      -->
     <action-state id="SecondFactorLogin">
         <evaluate expression="PopulateWebAuthnAuthenticationContextFor2FA"/>
-        <evaluate expression="LookupRegisteredCredentials"/>
+        <evaluate expression="LookupRegisteredCredentialsFor2FA"/>
         <evaluate expression="FilterCredentialsOnPolicy"/>
         <evaluate expression="AddUserVerificationNotRequired"/>
         <evaluate expression="'proceed'" />
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
index 3efde48..9ba3c34 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
@@ -44,6 +44,10 @@ idp.authn.webauthn.supportedPrincipals = \
 # The bean name of the username lookup strategy. By default, this comes from the principal name established by the first factor.
 #idp.authn.webauthn.2fa.username.strategy = shibboleth.authn.WebAuthn.CanonicalUsernameLookupStrategy
 
+# Should an event be built if there are no credentials found? Only applicable to 2fa authentication.
+#idp.authn.webauthn.2fa.signalEventOnNoCredentials = false
+#idp.authn.webauthn.2fa.noCredentialsEventId = NoRegisteredWebAuthnCredentials
+
 # Should we update an authenticators signature counter inside the credential repository after each successful authentication?  
 #idp.authn.webauthn.updateSignatureCount = true
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.