WebAuthn: Issue with Fido metadata?

[Michael Grady]

> On Oct 29, 2024, at 9:31 AM, Philip Smart via dev <dev at shibboleth.net> wrote:
> 
> Yup, as Scott said, this is all highly configurable based on the usual IdP access control mechanisms. From a plugin perspective, if you did want to change the policy, you can by using the property (once you have defined the new policy):
> 
> idp.authn.webauthn.admin.management.accessPolicy = <SomePolicy>

An example for other admin endpoints is the following in admin/admin.properties:

#idp.resolvertest.logging = ResolverTest
idp.resolvertest.accessPolicy = ResolverAccessByAttribute
idp.resolvertest.authenticated = true
#idp.resolvertest.nonBrowserSupported = false
idp.resolvertest.defaultAuthenticationMethods = saml2/https://refeds.org/profile/mfa
idp.resolvertest.resolveAttributes = true
#idp.resolvertest.postAuthenticationFlows =

#idp.mdquery.logging = MetadataQuery
idp.mdquery.accessPolicy = ResolverAccessByAttribute
idp.mdquery.authenticated = true
#idp.mdquery.nonBrowserSupported = false
idp.mdquery.defaultAuthenticationMethods = saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
idp.mdquery.resolveAttributes = true
#idp.mdquery.postAuthenticationFlows =

and then something like this added into the shibboleth.AccessControlPolicies map in access-control.xml:

        <entry key="ResolverAccessByAttribute">
            <bean parent="shibboleth.PredicateAccessControl">
                <constructor-arg>
                    <bean parent="shibboleth.Conditions.SimpleAttribute">
                        <property name="attributeValueMap">
                            <map>
                               <entry key="activeDirectoryMemberOfShort">
                                    <list>
                                        <value>IDM--access-resolver</value>
                                    </list>
                               </entry>
                            </map>
                        </property>
                    </bean>
                </constructor-arg>
            </bean>
        </entry>

where you are saying a particular resolved attribute needs to have a particular value in order to have access.

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20241029/6575b80c/attachment-0001.htm>