No subject

[Philip Smart]

On 4 Dec 2024, at 20:11, Equbay Kiflay via dev <dev at shibboleth.net> wrote:

Good day,
I  tested the WebAuthn plugin and this is what I got so far.

My test environment is
  OS: Debian 12 (ver. 12.8)
  IdP:  5.1.3
  WebAuthn plugin: 0.9.0
  other installed plugins:  storage.jdbc 2.0.1, nashorn 2.0.0 and  fudiscr 2.1.0

Set up
WebAuthn as the sole factor but with password fallback for registration

Result
I was able to register a Hyper Fido Pro key (which is FIDO 2 compliant) and a google authenticator on phone for a user. However, I was not able to login with the registered keys later.

Is there anything in the logs about why it was not accepted?


For the Fido key windows says the key can not be used (the same key can be used with privacyIDEA as a second factor on a server with the exact same environment without problem).

Can not be registered? or can not be used to authenticate?

If it can not be registered, it might be it is not compatible with the current registration options: https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3879206915/WebAuthnRegistration#%5BinlineExtension%5DCredential-Generation-Options


For the google authenticator, Shibboleth says to check the device but nothing comes on the phone.

Shibboleth, or the the WebAuthn browser dialog? The browser or platform presents the authenticator and credential selector, not directly the IdP. Usually, a phone involves a cross-device flow with a QR code, do you see that?


I also tried Microsoft Authenticator on iPhone. But I can not register. The Authenticator saying it does not support this passkey.

Again. This might depend on what you are registering (the options, see the link above).


I don't know what kind of device can be used.

Regards,

--


Equbay Kiflay<mailto:equbay.kiflay at concordia.ab.ca>

IT Operations Coordinator

Information Technology Services

Toll-Free: +1 866 479 5200

<https://concordia.ab.ca/>

[Concordia University of Edmonton] <https://concordia.ab.ca/>

concordia.ab.ca<https://concordia.ab.ca/>

[Concordia University of Edmonton Twitter]<https://twitter.com/CUEdmonton> [Concordia University of Edmonton Instagram] <https://instagram.com/cuedmonton/>  [Concordia University of Edmonton Facebook] <https://facebook.com/CUEdmonton>

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net



Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20241205/ed8455d1/attachment-0001.htm>