[java-idp-plugin-webauthn] branch main updated: JWEBAUTHN-80 - Better default order of WebAuthn COSE algorithms

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-webauthn/commit/7c8574adf764e85aff692f350fbffd1e55a7f8f6

The following commit(s) were added to refs/heads/main by this push:
     new 7c8574a  JWEBAUTHN-80 - Better default order of WebAuthn COSE algorithms
7c8574a is described below

commit 7c8574adf764e85aff692f350fbffd1e55a7f8f6
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Jun 9 11:17:20 2026 +0100

    JWEBAUTHN-80 - Better default order of WebAuthn COSE algorithms
    
         - Change algorithm defaults to those recomended in the WebAuthn Level 3
        specification: EdDSA, ES256, RS256.
    
    https://shibboleth.atlassian.net/browse/JWEBAUTHN-80
---
 .../authn/webauthn/client/impl/YubicoWebauthnClientFactory.java   | 8 ++------
 .../src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml | 2 +-
 .../authn/webauthn/conf/authn/webauthn-registration.properties    | 2 +-
 .../idp/plugin/authn/webauthn/client/impl/MockWebAuthnClient.java | 8 ++------
 4 files changed, 6 insertions(+), 14 deletions(-)

diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebauthnClientFactory.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebauthnClientFactory.java
index 9c2ad7f..2bb32a4 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebauthnClientFactory.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/YubicoWebauthnClientFactory.java
@@ -93,13 +93,9 @@ public class YubicoWebauthnClientFactory extends AbstractInitializableComponent
         allowOriginSubdomain = false;
         origins = CollectionSupport.emptySet();
         preferredPublickeyParams = CollectionSupport.listOf(
-                        PublicKeyCredentialParameters.ES256,
                         PublicKeyCredentialParameters.EdDSA,
-                        PublicKeyCredentialParameters.ES384,
-                        PublicKeyCredentialParameters.ES512,
-                        PublicKeyCredentialParameters.RS256,
-                        PublicKeyCredentialParameters.RS384,
-                        PublicKeyCredentialParameters.RS512);
+                        PublicKeyCredentialParameters.ES256,
+                        PublicKeyCredentialParameters.RS256);
     }
     
     @Override protected void doInitialize() throws ComponentInitializationException {
diff --git a/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index cd615a2..3cde879 100644
--- a/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -90,7 +90,7 @@
         p:allowOriginSubdomain="%{idp.authn.webauthn.allowOriginSubdomain:false}"
         p:allowUntrustedAttestation="%{idp.authn.webauthn.allowUntrustedAttestation:true}"
         p:origins="%{idp.authn.webauthn.origins:}"
-        p:preferredPublickeyParams="%{idp.authn.webauthn.preferredPublicKeyParams:EdDSA,ES256,ES384,ES512,RS1,RS256,RS384,RS512}"
+        p:preferredPublickeyParams="%{idp.authn.webauthn.preferredPublicKeyParams:EdDSA,ES256,RS256}"
         p:credentialRepository="#{getObject('shibboleth.authn.WebAuthn.CredentialRepository') ?: getObject('shibboleth.authn.WebAuthn.DefaultCredentialRepository')}"
         p:fidoMetadataService="#{'false'.equals('%{idp.authn.webauthn.metadata.enabled:false}') ? null : getObject('shibboleth.authn.WebAuthn.WebAuthnFidoMetadataServiceFactory') ?: getObject('shibboleth.authn.WebAuthn.DefaultWebAuthnFidoMetadataServiceFactory')}"/>
 
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties
index 0f56175..fdfa08d 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn-registration.properties
@@ -41,7 +41,7 @@
 #idp.authn.webauthn.registration.residentKey = preferred
 
 # Preferred set of COSE signature algorithms which a created credential will use. The sequence is ordered from the most preferred to the least. The client makes best effort to create the most preferred it can.
-#idp.authn.webauthn.preferredPublicKeyParams = EdDSA,ES256,ES384,ES512,RS1,RS256,RS384,RS512
+#idp.authn.webauthn.preferredPublicKeyParams = EdDSA,ES256,RS256
 
 # The authenticator attachment (authenticator type) requirement. One-of 'any', 'cross-platform', or 'platform'. 
 #idp.authn.webauthn.registration.authenticatorAttachment = any
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/MockWebAuthnClient.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/MockWebAuthnClient.java
index e23b872..c8b8824 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/MockWebAuthnClient.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/client/impl/MockWebAuthnClient.java
@@ -64,13 +64,9 @@ public class MockWebAuthnClient implements WebAuthnAuthenticationClient {
     
     @Nonnull @NonnullElements private final List<PublicKeyCredentialParameters>  preferredPublickeyParams = 
             CollectionSupport.listOf(
-            PublicKeyCredentialParameters.ES256,
             PublicKeyCredentialParameters.EdDSA,
-            PublicKeyCredentialParameters.ES384,
-            PublicKeyCredentialParameters.ES512,
-            PublicKeyCredentialParameters.RS256,
-            PublicKeyCredentialParameters.RS384,
-            PublicKeyCredentialParameters.RS512);
+            PublicKeyCredentialParameters.ES256,
+            PublicKeyCredentialParameters.RS256);
     
 
     /**

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.