[java-idp-plugin-webauthn] branch main updated: Add guard to context helping determine if WebAuthn creds are available

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=96a8ef0e5510d0735ccbf14ca9c0ec77aa262a46

The following commit(s) were added to refs/heads/main by this push:
     new 96a8ef0  Add guard to context helping determine if WebAuthn creds are available
96a8ef0 is described below

commit 96a8ef0e5510d0735ccbf14ca9c0ec77aa262a46
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Feb 28 10:15:11 2025 +0000

    Add guard to context helping determine if WebAuthn creds are available
    
     - This should only be effective if there is a mistake made in the flow
    configuration
---
 .../authn/webauthn/context/BaseWebAuthnContext.java      | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/BaseWebAuthnContext.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/BaseWebAuthnContext.java
index b9476de..d3c4214 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/BaseWebAuthnContext.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/BaseWebAuthnContext.java
@@ -38,7 +38,7 @@ public class BaseWebAuthnContext extends BaseContext {
      * The internal IdP username of the user, used as a key to store credentials against. In the registration flow, 
      * this is likely the principal name of the authenticated user. In the passwordless flow, this is likely a c14n 
      * version of the username input by the user. In the usernameless flow, this will be set to the username key 
-     * from the registered credential after authentication.
+     * in the credential repository found from the credential presented during authentication.
      * <p> 
      * If {@code null} in the authentication ceremony and we can not determine the 
      * user.id (and hence public key) to use, the flow will require a discoverable credential.
@@ -58,6 +58,9 @@ public class BaseWebAuthnContext extends BaseContext {
      */
     @Nullable private Collection<EnhancedCredentialRecord> existingCredentials;
     
+    /** Have the existingCredentials been set. */
+    private boolean credentialsSet;
+    
     /** The challenge sent to the authenticator in both registration and authentication ceremonies.*/
     @Nullable private byte[] serverChallenge;
     
@@ -71,11 +74,19 @@ public class BaseWebAuthnContext extends BaseContext {
     @Nullable private UserVerificationRequirement userVerificationRequirement;
     
     /**
-     * Does the user have existing, registered, credentials available to use for authentication.
+     * Does the user have existing, registered, credentials available to use for authentication. Only returns false
+     * if the collection of existing credentials has been set and is empty. Otherwise we assume WebAuthn is available
+     * to prevent this being used as a signal to fallback to an inferior authentication method when we do not yet
+     * know if the user has any credentials.
      * 
      * @return true iff existing credentials are available, false otherwise.
      */
     public boolean isWebAuthnAvailable() {
+        if (!credentialsSet) {
+            // return true if we do not know the user has no credentials yet, as a guard. Could also use a null 
+            // collection as signal, but this boolean has a clearer meaning.
+            return true;
+        }
         return existingCredentials != null && !existingCredentials.isEmpty();
     }
     
@@ -131,6 +142,7 @@ public class BaseWebAuthnContext extends BaseContext {
     @Nonnull public BaseWebAuthnContext setExistingCredentials(
             @Nullable final Collection<EnhancedCredentialRecord> credentials) {
         existingCredentials = credentials;
+        credentialsSet = true;
         return this;
     }
     

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.