WebAuthn: Issue with Fido metadata?

[Philip Smart]

Thanks, Micheal.

The admin flow should be resolving attributes by default, even if the properties file says it is not. That is a typo; I will commit a fix for that now.

Phil

On 29 Oct 2024, at 14:46, Michael Grady <mgrady at unicon.net> wrote:

You don't often get email from mgrady at unicon.net. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>


On Oct 29, 2024, at 9:31 AM, Philip Smart via dev <dev at shibboleth.net> wrote:

Yup, as Scott said, this is all highly configurable based on the usual IdP access control mechanisms. From a plugin perspective, if you did want to change the policy, you can by using the property (once you have defined the new policy):

idp.authn.webauthn.admin.management.accessPolicy = <SomePolicy>

An example for other admin endpoints is the following in admin/admin.properties:

#idp.resolvertest.logging = ResolverTest
idp.resolvertest.accessPolicy = ResolverAccessByAttribute
idp.resolvertest.authenticated = true
#idp.resolvertest.nonBrowserSupported = false
idp.resolvertest.defaultAuthenticationMethods = saml2/https://refeds.org/profile/mfa
idp.resolvertest.resolveAttributes = true
#idp.resolvertest.postAuthenticationFlows =

#idp.mdquery.logging = MetadataQuery
idp.mdquery.accessPolicy = ResolverAccessByAttribute
idp.mdquery.authenticated = true
#idp.mdquery.nonBrowserSupported = false
idp.mdquery.defaultAuthenticationMethods = saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
idp.mdquery.resolveAttributes = true
#idp.mdquery.postAuthenticationFlows =

and then something like this added into the shibboleth.AccessControlPolicies map in access-control.xml:

        <entry key="ResolverAccessByAttribute">
            <bean parent="shibboleth.PredicateAccessControl">
                <constructor-arg>
                    <bean parent="shibboleth.Conditions.SimpleAttribute">
                        <property name="attributeValueMap">
                            <map>
                               <entry key="activeDirectoryMemberOfShort">
                                    <list>
                                        <value>IDM--access-resolver</value>
                                    </list>
                               </entry>
                            </map>
                        </property>
                    </bean>
                </constructor-arg>
            </bean>
        </entry>

where you are saying a particular resolved attribute needs to have a particular value in order to have access.

--
Michael A. Grady
IAM Architect, Unicon, Inc.






Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20241029/80c99a03/attachment-0001.htm>