WebAuthn: Issue with Fido metadata?

[Philip Smart]

Yup, as Scott said, this is all highly configurable based on the usual IdP access control mechanisms. From a plugin perspective, if you did want to change the policy, you can by using the property (once you have defined the new policy):

idp.authn.webauthn.admin.management.accessPolicy = <SomePolicy>

Phil

> On 29 Oct 2024, at 14:03, Cantor, Scott via dev <dev at shibboleth.net> wrote:
>
>> The policy name is by default AccessByAdmin. How should
>> that be configured in access-controll.xml.
>
> Brute forcing that by listing usernames should be self-evident from the examples in the file unless you don't speak Spring XML, in which case you need to learn that before anything else. We reference that in the IdP documentation early on to make it clear that's a prerequisite.
>
> Just brute forcing names is just a demo/testing sort of approach obviously. Real world use assumes the use of attributes typically, which all admin flows can resolve if that option is enabled, and there are examples in the wiki of how to use Attribute-based rules for access control.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net


Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice