WebAuthn: Issue with Fido metadata?

[Mats Luspa]

Ok, understand. I remove it.

/Regards Mats

Den 2024-11-03 kl. 17:33, skrev Philip Smart:
> Quick note: orchestrating it in this way, if you do ‘downgrade', it 
> would no longer satisfy an MFA request (or similar) from the SP.
>
> Phil
>
>> On 3 Nov 2024, at 15:04, Mats Luspa <mats.luspa at irf.se> wrote:
>>
>> Yes, you are correct. In the registration process it works but not in 
>> the authentication flow where you for those without passkeys 
>> registrated go to authn/Password.
>>
>> I tested with activationCondition (activate authn/Password only if no 
>> passkey is regsistrated) according to below configuration but it 
>> didn't work that either.
>>
>> <bean id="authn/Password" parent="shibboleth.AuthenticationFlow"
>>                 p:passiveAuthenticationSupported="true"
>>                 p:forcedAuthenticationSupported="true"
>> p:activationCondition-ref="checkWebAuthnAvailability"/>
>>
>>
>> <bean id="checkWebAuthnAvailability" 
>> parent="shibboleth.Conditions.Scripted" factory-method="inlineScript">
>>                     <constructor-arg>
>>                                     <value>
>> <![CDATA[
>>                                                                 var 
>> webauthnRegCtx = 
>> profileRequestContext.getSubcontext(WebAuthnRegistrationContext.class);
>>                                                                 var 
>> result = webauthnRegCtx == null || !webauthnRegCtx.isWebAuthnAvailable();
>>                                                                 result;
>>                                                                 ]]>
>> </value>
>>
>>                        </constructor-arg>
>>
>>  </bean>
>>
>> Ok, I wait.
>>
>> /Regards Mats
>>
>> Den 2024-11-03 kl. 10:41, skrev Philip Smart:
>>>
>>>
>>>> On 3 Nov 2024, at 09:35, Philip Smart via dev <dev at shibboleth.net> 
>>>> wrote:
>>>>
>>>>
>>>>
>>>>> On 2 Nov 2024, at 20:19, Mats Luspa <mats.luspa at irf.se> wrote:
>>>>>
>>>>> However I discovered the known issue that the username (that has 
>>>>> no passkey) collected in the initial step is possible to alter in 
>>>>> the authn/Password step. That means that a user with passkey can 
>>>>> be degraded to username/password authentication.
>>>>>
>>>>> I've tested and it works to do that.
>>>>>
>>>>> Is it possible to secure that the username in the authn/Password 
>>>>> step is the same as the username in the initial step? The optimal 
>>>>> would be to only allow password input in the authn/Password step.
>>>>>
>>>> Yes, this should be covered by the ‘AccessByCurrentUser’ policy as 
>>>> shown in 
>>>> https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3879206915/WebAuthnRegistration#%5BinlineExtension%5DAccessPolicy-Configuration. 
>>>> Let me know if that is not working (it is working for me), as that 
>>>> is pretty fundamental.
>>>
>>> Sorry, I might have answered this too quickly. I guess you mean in 
>>> the authentication flow, not for registration. Yeah, this is why 
>>> there is a warning about that. I will get back to you next week.,
>>>
>>> Phil
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20241103/ea6d3ebd/attachment.htm>