WebAuthn: Issue with Fido metadata?

[Mats Luspa]

It sounds logical.

I, as said, want a user to always use passkey when the user has a 
passkey registrated and not be able to use authn/Password.

But there is a problem when SP allows authn/Password. It works as I want 
when the SP requires authn/MFA so there it's no problem.

In the passwordless flow you collect the username that wants to login to 
an SP allowing authn/Password. If the username don't have a passkey 
registrated then the user will get an authn/Password dialogue with 
username (which is prefilled with the collected username) and password. 
The issue is that you can change username input to a username that has a 
passkey registrated and succeed to login with password. There I mean the 
authentication has been downgraded for that user.

I want it to work like in registration flow where you have an access 
control policy AccessByCurrentUser which stop the change of username. I 
see that it should be possible to accomplish that as in the 
authn/Password dialogue the username is prefilled so the username is 
known when entering authn/Password. I mean then a check could be done so 
that the username entered to authn/Password is the same as the username 
leaving authn/Password. However I don't simply know how to do that. 
Probably you have some advice to give in this matter.

/Regards Mats

On 2024-11-04 19:47, Cantor, Scott via dev wrote:
>> I do not think your activation condition will work because the
>> actual authentication flow is authn/MFA. So it is that
>> activation condition the IdP will check and not the password
>> flow condition.
> Actually the MFA flow doesn't check a flow's activation condition when it runs login flows because you're the one telling it to run them. There are some things it checks/enforces, but not that.
>
> The decision logic governing when/whether to run Password is up to your MFA flow logic entirely.
>
> -- Scott
>
>
>
>
-- 
--
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik               Fax: +46 (0)980 79 050
Swedish Institute of Space Physics      email: matsl at irf.se
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
--
PGP Public Key: https://www.irf.se/pgp/matsl
Digital vcard: https://www.irf.se/vcard/mats.luspa

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5037 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20241105/a2779bc9/attachment-0001.p7s>