WebAuthn: Issue with Fido metadata?

Tue Oct 29 13:55:44 UTC 2024

Thanks, it works now.

However I can't get 
https://testidpshibbpleth.irf.se/idp/profile/admin/webauthn-management 
to work.

It's not a software issue. The reason is that I have not enough 
knowledge to configure the admin users. As I understand that should be 
done in access-control.xml.
The policy name is by default AccessByAdmin. How should that be 
configured in access-controll.xml.

/Regards Mats

On 2024-10-29 11:35, Philip Smart wrote:
> Ah yes. Please see 
> https://shibboleth.net/pipermail/dev/2024-September/011213.html. 
> Specifically, 
> https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3256057857/Plugin+Testing. 
>
>
> As you will be downloading directly from Nexus, you will need to first 
> download (and trust) the Jenkins key ( 
> https://shibboleth.net/downloads/SHIBBOLETH_SNAPSHOT_PGP_KEYS).
>
> Which you can then use with the latest build of the SNAPSHOT:
>
> shibboleth-idp/bin/plugin.sh --noCheck --truststore 
> SHIBBOLETH_SNAPSHOT_PGP_KEYS -i <URL or filename of latest snapshot>
>
> Phil
>
>> On 29 Oct 2024, at 10:05, Mats Luspa via dev <dev at shibboleth.net> wrote:
>>
>> Hello!
>>
>> Thanks for the clarification.
>>
>> But I don't know how to download those snapshot-versions. I got that 
>> I miss a key in the truststore.
>> Are there instructions on how to download these versions or are you 
>> going to make a new prerelease version that is downloadable without key?
>>
>> /Regards Mats
>>
>> On 2024-10-29 10:58, Philip Smart via dev wrote:
>>> Hi Mats,
>>>
>>> Sorry for the confusion, but version 0.0.3 is not the latest version 
>>> of the plugin, I should probably remove that. The current release 
>>> candidate is 0.9.0-SNAPSHOT, see 
>>> https://shibboleth.net/cgi-bin/projstatus.cgi. That should be up to 
>>> date and include the fixed version of the Yubico metadata library 
>>> that deals gracefully with unrecognised fields.
>>>
>>> Please note that the release candidate (version 0.9.0) differs 
>>> slightly from the earlier beta version (0.0.3). So it would be best 
>>> to remove the old one and install the new one fresh.
>>>
>>> Phil
>>>
>>>> On 29 Oct 2024, at 06:31, Mats Luspa via dev <dev at shibboleth.net> 
>>>> wrote:
>>>>
>>>> Hello!
>>>>
>>>> I've installed webauthn plugin version 0.0.3 (downloadable 
>>>> pre-release) and I tried to use Fido metadata service.
>>>>
>>>> However I got the following error message:
>>>>
>>>> at 
>>>> net.shibboleth.idp.plugin.authn.webauthn.metadata.FidoMetadataServiceFactory.getObject(FidoMetadataServiceFactory.java:121)^M
>>>> Caused by: 
>>>> com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: 
>>>> Unrecognized field "iAPARThreshold" (class 
>>>> com.yubico.fido.metadata.BiometricAccuracyDescriptor$BiometricAccuracyDescriptorBuilder), 
>>>> not marked as ignorable (5 known properties: "blockSlowdown", 
>>>> "maxRetries", "maxTemplates", "selfAttestedFRR", "selfAttestedFAR"])
>>>>
>>>> It seems the field "iAPARThreshold" in the metadata is not recognized.
>>>>
>>>> When I disable the use of Fido metadata service the registration 
>>>> process works, but of course I want to use the service.
>>>>
>>>> Is it possible to work around this with some configuration?
>>>>
>>>> /Regards Mats
>>>>
>>>> -- 
>>>> --
>>>> Mats Luspa
>>>> Phone: +46 (0)980 79 022
>>>> Cellular phone: +46 (0)725813330
>>>> Institutet för rymdfysik               Fax: +46 (0)980 79 050
>>>> Swedish Institute of Space Physics      email: matsl at irf.se
>>>> Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
>>>> Postal address: Box 812, SE-981 28 Kiruna
>>>> --
>>>> PGP Public Key: https://www.irf.se/pgp/matsl
>>>> Digital vcard: https://www.irf.se/vcard/mats.luspa
>>>>
>>>> -- 
>>>> To unsubscribe from this list send an email to 
>>>> dev-unsubscribe at shibboleth.net
>>>
>>>
>>> Jisc is a registered charity (number 1149740) and a company limited 
>>> by guarantee which is registered in England under company number. 
>>> 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 
>>> Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>>>
>>> Jisc Services Limited is a wholly owned Jisc subsidiary and a 
>>> company limited by guarantee which is registered in England under 
>>> company number 02881024, VAT number GB 197 0632 86. The registered 
>>> office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>>>
>>> Jisc Commercial Limited is a wholly owned Jisc subsidiary and a 
>>> company limited by shares which is registered in England under 
>>> company number 09316933, VAT number GB 197 0632 86. The registered 
>>> office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>>>
>>> For more details on how Jisc handles your data see our privacy 
>>> notice here: https://www.jisc.ac.uk/website/privacy-notice
>>>
>>>
>> -- 
>> --
>> Mats Luspa
>> Phone: +46 (0)980 79 022
>> Cellular phone: +46 (0)725813330
>> Institutet för rymdfysik               Fax: +46 (0)980 79 050
>> Swedish Institute of Space Physics      email:matsl at irf.se
>> Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
>> Postal address: Box 812, SE-981 28 Kiruna
>> --
>> PGP Public Key:https://www.irf.se/pgp/matsl
>> Digital vcard:https://www.irf.se/vcard/mats.luspa
>> -- 
>> To unsubscribe from this list send an email to 
>> dev-unsubscribe at shibboleth.net
>
-- 
--
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik               Fax: +46 (0)980 79 050
Swedish Institute of Space Physics      email:matsl at irf.se
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
--
PGP Public Key:https://www.irf.se/pgp/matsl
Digital vcard:https://www.irf.se/vcard/mats.luspa

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20241029/a8dff459/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5037 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20241029/a8dff459/attachment-0001.p7s>