WebAuthn: Issue with Fido metadata?

[Philip Smart]

> On 4 Nov 2024, at 13:37, Cantor, Scott via dev <dev at shibboleth.net> wrote:
>
>> Maybe I don't quite understand. Isn't the activateCondition
>> implemented on the idp side? The condition I use is that if
>> the user has a passkey then the authn/Password can not be
>> used (i.e. not downgrading). That check is done on the idp
>> side as I understand.
>
> Of course.
>
>> If the SP requires MFA and gets only authn/Password (if the
>> user hasn't a passkey) then the request will be rejected
>> anyway. Am I correct?
>
> A correctly configured IdP doesn't lie, and no IdP that isn't lying should be signalling an AuthnContext class signalling something in particular if it wasn't done.
>
> An SP that doesn't request a specific context class doesn't get to complain about what it gets or what was done.
>
> So generally, yes, worrying about a downgrade means you don't have effective use of SAML to enforce what's being done.

This, thanks, Scott.

I do not think your activation condition will work because the actual authentication flow is authn/MFA. So it is that activation condition the IdP will check and not the password flow condition. But given what Scott says, I am not sure you are going to need it? I think what you have already configured is fine.


Phil

>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net


Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice