WebAuthn: Issue with Fido metadata?

[Mats Luspa]

Thanks, that suggestion sounds good.

We have an attribute called irfAuthorizedService which is an 
multi-valued attribute that contains all the services that a user has 
access to.
I was going to test the suggestion with the following configuration:

<entry key="AccessByAttribute">
             <bean parent="shibboleth.PredicateAccessControl">
                 <constructor-arg>
                     <bean parent="shibboleth.Conditions.SimpleAttribute">
                         <property name="attributeValueMap">
                             <map>
                                <entry key="irfAuthorizedService">
                                     <list>
<value>shibAdmin</value>
                                     </list>
                                </entry>
                             </map>
                         </property>
                     </bean>
                 </constructor-arg>
             </bean>
</entry>

I webauthn.properties file I have:

idp.authn.webauthn.admin.management.accessPolicy = AccessByAttribute

I have used irfAuthorizedService in other services as to said.

But it seems not to work with this attribute ("You do not have access to 
the requested resource."). I suppose there is more configuration I must 
make?

/Regards Mats

On 2024-10-29 15:57, Philip Smart via dev wrote:
> Thanks, Micheal.
>
> The admin flow should be resolving attributes by default, even if the 
> properties file says it is not. That is a typo; I will commit a fix 
> for that now.
>
> Phil
>
>> On 29 Oct 2024, at 14:46, Michael Grady <mgrady at unicon.net> wrote:
>>
>>
>> 	
>> You don't often get email from mgrady at unicon.net. Learn why this is 
>> important <https://aka.ms/LearnAboutSenderIdentification>
>> 	
>>
>>
>>
>>> On Oct 29, 2024, at 9:31 AM, Philip Smart via dev 
>>> <dev at shibboleth.net> wrote:
>>>
>>> Yup, as Scott said, this is all highly configurable based on the 
>>> usual IdP access control mechanisms. From a plugin perspective, if 
>>> you did want to change the policy, you can by using the property 
>>> (once you have defined the new policy):
>>>
>>> idp.authn.webauthn.admin.management.accessPolicy = <SomePolicy>
>>
>> An example for other admin endpoints is the following in 
>> admin/admin.properties:
>>
>> #idp.resolvertest.logging = ResolverTest
>> idp.resolvertest.accessPolicy = ResolverAccessByAttribute
>> idp.resolvertest.authenticated = true
>> #idp.resolvertest.nonBrowserSupported = false
>> idp.resolvertest.defaultAuthenticationMethods = 
>> saml2/https://refeds.org/profile/mfa
>> idp.resolvertest.resolveAttributes = true
>> #idp.resolvertest.postAuthenticationFlows =
>>
>> #idp.mdquery.logging = MetadataQuery
>> idp.mdquery.accessPolicy = ResolverAccessByAttribute
>> idp.mdquery.authenticated = true
>> #idp.mdquery.nonBrowserSupported = false
>> idp.mdquery.defaultAuthenticationMethods = 
>> saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
>> idp.mdquery.resolveAttributes = true
>> #idp.mdquery.postAuthenticationFlows =
>>
>> and then something like this added into the 
>> shibboleth.AccessControlPolicies map in access-control.xml:
>>
>>         <entry key="ResolverAccessByAttribute">
>>             <bean parent="shibboleth.PredicateAccessControl">
>>                 <constructor-arg>
>>                     <bean parent="shibboleth.Conditions.SimpleAttribute">
>>                         <property name="attributeValueMap">
>>                             <map>
>>                                <entry key="activeDirectoryMemberOfShort">
>> <list>
>> <value>IDM--access-resolver</value>
>> </list>
>>                                </entry>
>>                             </map>
>>                         </property>
>>                     </bean>
>>                 </constructor-arg>
>>             </bean>
>>         </entry>
>>
>> where you are saying a particular resolved attribute needs to have a 
>> particular value in order to have access.
>>
>> --
>> Michael A. Grady
>> IAM Architect, Unicon, Inc.
>>
>>
>>
>
>
> Jisc is a registered charity (number 1149740) and a company limited by 
> guarantee which is registered in England under company number. 
> 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 
> Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
> Jisc Services Limited is a wholly owned Jisc subsidiary and a company 
> limited by guarantee which is registered in England under company 
> number 02881024, VAT number GB 197 0632 86. The registered office is: 
> 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
> Jisc Commercial Limited is a wholly owned Jisc subsidiary and a 
> company limited by shares which is registered in England under company 
> number 09316933, VAT number GB 197 0632 86. The registered office is: 
> 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
> For more details on how Jisc handles your data see our privacy notice 
> here: https://www.jisc.ac.uk/website/privacy-notice
>
>
-- 
--
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik               Fax: +46 (0)980 79 050
Swedish Institute of Space Physics      email:matsl at irf.se
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
--
PGP Public Key:https://www.irf.se/pgp/matsl
Digital vcard:https://www.irf.se/vcard/mats.luspa

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20241029/9e5d24ef/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5037 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20241029/9e5d24ef/attachment-0001.p7s>