[java-idp-plugin-webauthn] branch main updated: JWEBAUTHN-36 - giving a username that does canonicalize to management search leads to uncaught exception
Phil Smart
philip.smart at jisc.ac.uk
Mon Jan 20 13:49:05 UTC 2025
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=ea74d946268e7205f91f8d2fe8e0a9ae782731d0
The following commit(s) were added to refs/heads/main by this push:
new ea74d94 JWEBAUTHN-36 - giving a username that does canonicalize to management search leads to uncaught exception
ea74d94 is described below
commit ea74d946268e7205f91f8d2fe8e0a9ae782731d0
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Jan 20 13:49:02 2025 +0000
JWEBAUTHN-36 - giving a username that does canonicalize to management
search leads to uncaught exception
- Added a new event that gets signalled if C14N fails and the username
is null/empty
- Added a new, customisable, error message for the admin username
search view if this occurs.
https://shibboleth.atlassian.net/browse/JWEBAUTHN-36
---
.../authn/webauthn/admin/WebAuthnRegistrationEventIds.java | 5 ++++-
.../admin/impl/UpdateAdminContextWithC14nPrincipal.java | 12 ++++++++++--
.../admin/webauthn-management/webauthn-management-flow.xml | 8 +++++++-
.../shibboleth/idp/plugin/authn/webauthn/messages.properties | 3 +++
.../authn/webauthn/views/webauthn-management-search.vm | 12 +++++++++++-
5 files changed, 35 insertions(+), 5 deletions(-)
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/WebAuthnRegistrationEventIds.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/WebAuthnRegistrationEventIds.java
index f67a93f..3e7b2ea 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/WebAuthnRegistrationEventIds.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/WebAuthnRegistrationEventIds.java
@@ -38,7 +38,10 @@ public final class WebAuthnRegistrationEventIds {
* A general event ID that is signalled if there is an issue performing an 'admin' action (e.g., registration or
* user management).
*/
- @Nonnull @NotEmpty public static final String INVALID_ADMIN_ACTION = "InvalidAdminAction";
+ @Nonnull @NotEmpty public static final String INVALID_ADMIN_ACTION = "InvalidAdminAction";
+
+ /** There is no search username to search on in the management interface because c14n failed.*/
+ @Nonnull @NotEmpty public static final String NO_SEARCH_USERNAME_AFTER_C14N = "NoSearchUsernameAfterC14N";
/** Private constructor.*/
private WebAuthnRegistrationEventIds() {
diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/UpdateAdminContextWithC14nPrincipal.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/UpdateAdminContextWithC14nPrincipal.java
index 8ae569f..20999c6 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/UpdateAdminContextWithC14nPrincipal.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/UpdateAdminContextWithC14nPrincipal.java
@@ -26,10 +26,12 @@ import org.slf4j.Logger;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
+import net.shibboleth.idp.plugin.authn.webauthn.admin.WebAuthnRegistrationEventIds;
import net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnManagementContext;
import net.shibboleth.idp.plugin.authn.webauthn.impl.AbstractWebAuthnAction;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
/**
* A WebAuthn management action that sets the principal name from the SubjectCanonicalizationContext back onto the
@@ -82,12 +84,18 @@ public class UpdateAdminContextWithC14nPrincipal extends AbstractWebAuthnAction<
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.UNKNOWN_USERNAME);
return;
}
+ final String principalName = c14n.getPrincipalName();
+ if (StringSupport.trimOrNull(principalName) == null) {
+ log.debug("{} No username in c14n context", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, WebAuthnRegistrationEventIds.NO_SEARCH_USERNAME_AFTER_C14N);
+ return;
+ }
// Update the username in the WebAuthn context to the c14n version
- context.setSearchUsername(c14n.getPrincipalName());
+ context.setSearchUsername(principalName);
// Now remove the c14n context to avoid confusion with later authentication
c14n.removeFromParent();
log.debug("{} Updated WebAuthn management context with search username '{}' from the subject "
- + "canonicalization context", getLogPrefix(), c14n.getPrincipalName());
+ + "canonicalization context", getLogPrefix(), principalName);
}
diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-management/webauthn-management-flow.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-management/webauthn-management-flow.xml
index 8cc5a5b..f5bbd7d 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-management/webauthn-management-flow.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/admin/webauthn-management/webauthn-management-flow.xml
@@ -41,6 +41,8 @@
<evaluate expression="T(net.shibboleth.idp.plugin.authn.webauthn.impl.WebAuthnEncoder)" result="viewScope.webAuthnEncoder"/>
<evaluate expression="flowRequestContext.getExternalContext().getNativeRequest()" result="viewScope.request" />
<evaluate expression="flowRequestContext.getExternalContext().getNativeResponse()" result="viewScope.response" />
+ <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().getBean('AdminInfoMessageFunction')" result="viewScope.adminInfoMessageFunction" />
+ <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().getBean('AdminErrorMessageFunction')" result="viewScope.adminErrorMessageFunction" />
</on-render>
<transition on="proceed" to="ExtractSearchFields" />
@@ -61,13 +63,17 @@
<input name="calledAsSubflow" value="true" />
<transition on="proceed" to="UpdateSearchName" />
- <transition on="SubjectCanonicalizationError" to="InvalidSubjectCanonicalizationContext" />
+ <transition on="SubjectCanonicalizationError" to="UpdateSearchName" />
</subflow-state>
<action-state id="UpdateSearchName">
<evaluate expression="UpdateAdminSearchUsernameWithC14nPrincipal"/>
<evaluate expression="'proceed'" />
+
+ <transition on="NoSearchUsernameAfterC14N" to="UsernameSearchView">
+ <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnManagementContext)).ensureSubcontext(T(net.shibboleth.idp.plugin.authn.webauthn.context.WebAuthnRegistrationErrorContext)).addClassifiedError('SearchUsernameNotFoundAfterC14N')"/>
+ </transition>
<transition on="proceed" to="LookupCredentials" />
</action-state>
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/messages.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/messages.properties
index 8bc6a84..99db804 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/messages.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/messages.properties
@@ -64,6 +64,9 @@ InvalidRegistration = Key registration unsuccessful
ValidRegistration = Key was registered successfully
KeyRemoved = Key was removed successfully
+# Messages to report back to the admin during key management
+SearchUsernameNotFoundAfterC14N = Error determining username to search for
+
# Messages to report back to the user during authentication
InvalidWebAuthnCredential = authn
CredentialPolicyRejection = webauthn-policy
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management-search.vm b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management-search.vm
index 3b554c3..faf6fda 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management-search.vm
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management-search.vm
@@ -13,6 +13,8 @@
## response - HttpServletResponse
## environment - Spring Environment object for property resolution
## custom - arbitrary object injected by deployer
+## adminInfoMessageFunction - function to return info admin messages
+## adminErrorMessageFunction - function to return error admin messages
##
## Add CSP directives
@@ -40,9 +42,17 @@ $response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 's
<div>
<div class="hidden output-message output--error" id="error_div">
<p id="error_message"></p>
- </div>
+ </div>
<div>
<h1>#springMessageText("idp.webauthn.admin.search.title", "Search for user")</h1>
+ #set ($infoMessage = $adminInfoMessageFunction.apply($profileRequestContext))
+ #if ($infoMessage)
+ <p id="reg-success-outcome" class="output-message output--success">$encoder.encodeForHTML($infoMessage)</p>
+ #end
+ #set ($errorMessage = $adminErrorMessageFunction.apply($profileRequestContext))
+ #if ($errorMessage)
+ <p id="reg-error-outcome" class="output-message output--error">$encoder.encodeForHTML($errorMessage)</p>
+ #end
<form id="username_search_form" action="$flowExecutionUrl" method="post">
#parse("csrf/csrf.vm")
<label for="username_search">#springMessageText("idp.webauthn.admin.search.label", "Username")</label>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list