WebAuthn: Issue with Fido metadata?

[Mats Luspa]

Hello again!

Maybe I don't quite understand. Isn't the activateCondition implemented 
on the idp side? The condition I use is that if the user has a passkey 
then the authn/Password can not be used (i.e. not downgrading). That 
check is done on the idp side as I understand. If the SP requires MFA 
and gets only authn/Password (if the user hasn't a passkey) then the 
request will be rejected anyway. Am I correct?

/Regards Mats

On 2024-11-03 19:13, Mats Luspa via dev wrote:
>
> Ok, understand. I remove it.
>
> /Regards Mats
>
> Den 2024-11-03 kl. 17:33, skrev Philip Smart:
>> Quick note: orchestrating it in this way, if you do ‘downgrade', it 
>> would no longer satisfy an MFA request (or similar) from the SP.
>>
>> Phil
>>
>>> On 3 Nov 2024, at 15:04, Mats Luspa <mats.luspa at irf.se> wrote:
>>>
>>> Yes, you are correct. In the registration process it works but not 
>>> in the authentication flow where you for those without passkeys 
>>> registrated go to authn/Password.
>>>
>>> I tested with activationCondition (activate authn/Password only if 
>>> no passkey is regsistrated) according to below configuration but it 
>>> didn't work that either.
>>>
>>> <bean id="authn/Password" parent="shibboleth.AuthenticationFlow"
>>> p:passiveAuthenticationSupported="true"
>>>                 p:forcedAuthenticationSupported="true"
>>> p:activationCondition-ref="checkWebAuthnAvailability"/>
>>>
>>>
>>> <bean id="checkWebAuthnAvailability" 
>>> parent="shibboleth.Conditions.Scripted" factory-method="inlineScript">
>>>                     <constructor-arg>
>>>                                     <value>
>>>                                                         <![CDATA[
>>>                                                                 var 
>>> webauthnRegCtx = 
>>> profileRequestContext.getSubcontext(WebAuthnRegistrationContext.class);
>>>                                                                 var 
>>> result = webauthnRegCtx == null || 
>>> !webauthnRegCtx.isWebAuthnAvailable();
>>>                                                                 result;
>>>                                                                 ]]>
>>> </value>
>>>
>>>                        </constructor-arg>
>>>
>>>  </bean>
>>>
>>> Ok, I wait.
>>>
>>> /Regards Mats
>>>
>>> Den 2024-11-03 kl. 10:41, skrev Philip Smart:
>>>>
>>>>
>>>>> On 3 Nov 2024, at 09:35, Philip Smart via dev <dev at shibboleth.net> 
>>>>> wrote:
>>>>>
>>>>>
>>>>>
>>>>>> On 2 Nov 2024, at 20:19, Mats Luspa <mats.luspa at irf.se> wrote:
>>>>>>
>>>>>> However I discovered the known issue that the username (that has 
>>>>>> no passkey) collected in the initial step is possible to alter in 
>>>>>> the authn/Password step. That means that a user with passkey can 
>>>>>> be degraded to username/password authentication.
>>>>>>
>>>>>> I've tested and it works to do that.
>>>>>>
>>>>>> Is it possible to secure that the username in the authn/Password 
>>>>>> step is the same as the username in the initial step? The optimal 
>>>>>> would be to only allow password input in the authn/Password step.
>>>>>>
>>>>> Yes, this should be covered by the ‘AccessByCurrentUser’ policy as 
>>>>> shown in 
>>>>> https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3879206915/WebAuthnRegistration#%5BinlineExtension%5DAccessPolicy-Configuration. 
>>>>> Let me know if that is not working (it is working for me), as that 
>>>>> is pretty fundamental.
>>>>
>>>> Sorry, I might have answered this too quickly. I guess you mean in 
>>>> the authentication flow, not for registration. Yeah, this is why 
>>>> there is a warning about that. I will get back to you next week.,
>>>>
>>>> Phil
>
-- 
--
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik               Fax: +46 (0)980 79 050
Swedish Institute of Space Physics      email:matsl at irf.se
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
--
PGP Public Key:https://www.irf.se/pgp/matsl
Digital vcard:https://www.irf.se/vcard/mats.luspa

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20241104/581af69d/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5037 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20241104/581af69d/attachment-0001.p7s>