[java-idp-plugin-webauthn] branch main updated: JWEBAUTHN-62 - Add revoke consent to the WebAuthn login view and flow

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=aa58502ded9dc873f0c3deb1817302624f42064e

The following commit(s) were added to refs/heads/main by this push:
     new aa58502  JWEBAUTHN-62 - Add revoke consent to the WebAuthn login view and flow
aa58502 is described below

commit aa58502ded9dc873f0c3deb1817302624f42064e
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Sep 25 11:42:51 2025 +0100

    JWEBAUTHN-62 - Add revoke consent to the WebAuthn login view and flow
    
     - Added logic to the WebAuthn flow to set the revokeConsent flag on the
    ConsentManagementContext
     - Updated webauthn-authn.vm to include a checkbox allowing users to
    clear prior consent during authentication.
    
    https://shibboleth.atlassian.net/browse/JWEBAUTHN-62
---
 .../shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml |  6 +++++-
 .../idp/plugin/authn/webauthn/views/webauthn-authn.vm     | 15 ++++++++-------
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
index 535e549..f68724a 100644
--- a/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/WebAuthn/webauthn-flow.xml
@@ -137,7 +137,11 @@
             <evaluate expression="flowRequestContext.getExternalContext().getNativeRequest()" result="viewScope.request" />
             <evaluate expression="flowRequestContext.getExternalContext().getNativeResponse()" result="viewScope.response" />
         </on-render>
-       <transition on="proceed" to="ExtractPublicKeyCredentialAssertion" />       
+       <transition on="proceed" to="ExtractPublicKeyCredentialAssertion" />
+       
+       <on-exit>
+            <evaluate expression="opensamlProfileRequestContext.addSubcontext(new net.shibboleth.idp.consent.context.ConsentManagementContext(), true).setRevokeConsent(requestParameters._shib_idp_revokeConsent == 'true')" />
+        </on-exit>       
     </view-state>
     
     <action-state id="ExtractPublicKeyCredentialAssertion">
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm
index d98f985..8bd7576 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-authn.vm
@@ -121,20 +121,21 @@ $response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 's
                         #set ($errorMessage = $errorMessageFunction.apply($profileRequestContext))
                         #if ($errorMessage)
                             <p class="output-message output--error">$encoder.encodeForHTML($errorMessage)</p>        
-                        #end
+                        #end                        
+                        <div class="centre">
+                            <button id="authenticate"
+                                class="form-element form-button">#springMessageText("idp.webauthn.authn.authenticate",
+                            "Login with passkey or security key")</button>
+                        </div>
                         <form id="authenticator_assertion_form" action="$flowExecutionUrl" method="post">
                             #parse("csrf/csrf.vm")
                             <input type="hidden" id="publicKeyCredential" name="publicKeyCredential" />
                             <button class="hidden" id="authenticationSubmit" type="submit"
                                 name="_eventId_proceed">#springMessageText("idp.webauthn.authn.submit", "Submit
                             authentication")</button>
+                            <input id="_shib_idp_revokeConsent" type="checkbox" name="_shib_idp_revokeConsent" value="true" />
+                            <label for="_shib_idp_revokeConsent">#springMessageText("idp.attribute-release.revoke", "Clear prior granting of permission for release of your information to this service.")</label>
                         </form>
-                        <div class="centre">
-                            <button id="authenticate"
-                                class="form-element form-button">#springMessageText("idp.webauthn.authn.authenticate",
-                            "Login with passkey or security key")</button>
-                        </div>
-                        
                         #if($debug == "true")
                             <hr />
                             <button type="button" class="collapsible-debug">#springMessageText("idp.webauthn.debug.title","Debugging")</button>    

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.