[java-idp-plugin-webauthn] branch main updated: JWEBAUTHN-44 - Document approach for conditionally requiring 2fa for the registration flow

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=cf9de91848df3c46930043ec9680b00df2f2a828

The following commit(s) were added to refs/heads/main by this push:
     new cf9de91  JWEBAUTHN-44 - Document approach for conditionally requiring 2fa for the registration flow
cf9de91 is described below

commit cf9de91848df3c46930043ec9680b00df2f2a828
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Feb 14 12:07:52 2025 +0000

    JWEBAUTHN-44 - Document approach for conditionally requiring 2fa for the
    registration flow
    
     - Wire up the forceAuthn property for admin flows and set the default
    to true
    
    https://shibboleth.atlassian.net/browse/JWEBAUTHN-44
---
 .../src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml   | 2 ++
 .../authn/webauthn/conf/authn/webauthn-registration.properties      | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index a1a655e..5124889 100644
--- a/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -42,6 +42,7 @@
             p:loggingId="%{idp.authn.webauthn.admin.registration.logging:WebAuthnCredentialRegistration}"
             p:policyName="%{idp.authn.webauthn.admin.registration.accessPolicy:AccessByCurrentUser}"
             p:nonBrowserSupported="false"
+            p:forceAuthn="%{idp.authn.webauthn.admin.registration.forceAuthn:true}"
             p:authenticated="%{idp.authn.webauthn.admin.registration.authenticated:true}"
             p:resolveAttributes="%{idp.authn.webauthn.admin.registration.resolveAttributes:true}">
         <property name="authenticationFlows">
@@ -64,6 +65,7 @@
             p:loggingId="%{idp.authn.webauthn.admin.management.logging:WebAuthnCredentialManagement}"
             p:policyName="%{idp.authn.webauthn.admin.management.accessPolicy:AccessByAdminUser}"
             p:nonBrowserSupported="false"
+            p:forceAuthn="%{idp.authn.webauthn.admin.management.forceAuthn:true}"
             p:authenticated="%{idp.authn.webauthn.admin.management.authenticated:true}"
             p:resolveAttributes="%{idp.authn.webauthn.admin.management.resolveAttributes:true}">
         <property name="authenticationFlows">
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties
index 62200a0..bcfc7de 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties
@@ -1,3 +1,6 @@
+# Always require authentication to the registration flow, even if there is an existing SSO session
+#idp.authn.webauthn.admin.registration.forceAuthn = true
+
 # Allow credential registrations to be untrusted. If false, this requires attestation statements from the 
 # authenticator using 'idp.authn.webauthn.registration.attestationConveyancePreference = DIRECT' and FIDO metadata is 
 # loaded.
@@ -80,6 +83,9 @@
 
 ## Administrator flow properties for managing user credentials
 
+# Always require authentication to the management flow, even if there is an existing SSO session
+#idp.authn.webauthn.admin.management.forceAuthn = true
+
 #idp.authn.webauthn.admin.management.logging = WebAuthnCredentialManagement
 #idp.authn.webauthn.admin.management.accessPolicy = AccessByAdmin
 #idp.authn.webauthn.admin.management.resolveAttributes = true

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.