WebAuthn: Issue with Fido metadata?

[Philip Smart]

On 29 Oct 2024, at 15:32, Mats Luspa via dev <dev at shibboleth.net> wrote:


Thanks, that suggestion sounds good.

We have an attribute called irfAuthorizedService which is an multi-valued attribute that contains all the services that a user has access to.
I was going to test the suggestion with the following configuration:

<entry key="AccessByAttribute">
            <bean parent="shibboleth.PredicateAccessControl">
                <constructor-arg>
                    <bean parent="shibboleth.Conditions.SimpleAttribute">
                        <property name="attributeValueMap">
                            <map>
                               <entry key="irfAuthorizedService">
                                    <list>
                                        <value>shibAdmin</value>
                                    </list>
                               </entry>
                            </map>
                        </property>
                    </bean>
                </constructor-arg>
            </bean>
</entry>

I webauthn.properties file I have:

idp.authn.webauthn.admin.management.accessPolicy = AccessByAttribute

I have used irfAuthorizedService in other services as to said.

But it seems not to work with this attribute ("You do not have access to the requested resource."). I suppose there is more configuration I must make?

There shouldn't be. Is there anything in the logs about what attributes are being resolved, what access policy is being used, and what attributes are being checked (e.g. `Checking for attribute:` in the log)?


/Regards Mats

On 2024-10-29 15:57, Philip Smart via dev wrote:
Thanks, Micheal.

The admin flow should be resolving attributes by default, even if the properties file says it is not. That is a typo; I will commit a fix for that now.

Phil

On 29 Oct 2024, at 14:46, Michael Grady <mgrady at unicon.net><mailto:mgrady at unicon.net> wrote:


You don't often get email from mgrady at unicon.net<mailto:mgrady at unicon.net>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>



On Oct 29, 2024, at 9:31 AM, Philip Smart via dev <dev at shibboleth.net><mailto:dev at shibboleth.net> wrote:

Yup, as Scott said, this is all highly configurable based on the usual IdP access control mechanisms. From a plugin perspective, if you did want to change the policy, you can by using the property (once you have defined the new policy):

idp.authn.webauthn.admin.management.accessPolicy = <SomePolicy>

An example for other admin endpoints is the following in admin/admin.properties:

#idp.resolvertest.logging = ResolverTest
idp.resolvertest.accessPolicy = ResolverAccessByAttribute
idp.resolvertest.authenticated = true
#idp.resolvertest.nonBrowserSupported = false
idp.resolvertest.defaultAuthenticationMethods = saml2/https://refeds.org/profile/mfa
idp.resolvertest.resolveAttributes = true
#idp.resolvertest.postAuthenticationFlows =

#idp.mdquery.logging = MetadataQuery
idp.mdquery.accessPolicy = ResolverAccessByAttribute
idp.mdquery.authenticated = true
#idp.mdquery.nonBrowserSupported = false
idp.mdquery.defaultAuthenticationMethods = saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
idp.mdquery.resolveAttributes = true
#idp.mdquery.postAuthenticationFlows =

and then something like this added into the shibboleth.AccessControlPolicies map in access-control.xml:

        <entry key="ResolverAccessByAttribute">
            <bean parent="shibboleth.PredicateAccessControl">
                <constructor-arg>
                    <bean parent="shibboleth.Conditions.SimpleAttribute">
                        <property name="attributeValueMap">
                            <map>
                               <entry key="activeDirectoryMemberOfShort">
                                    <list>
                                        <value>IDM--access-resolver</value>
                                    </list>
                               </entry>
                            </map>
                        </property>
                    </bean>
                </constructor-arg>
            </bean>
        </entry>

where you are saying a particular resolved attribute needs to have a particular value in order to have access.

--
Michael A. Grady
IAM Architect, Unicon, Inc.






Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice



--
--
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik               Fax: +46 (0)980 79 050
Swedish Institute of Space Physics      email: matsl at irf.se<mailto:matsl at irf.se>
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
--
PGP Public Key: https://www.irf.se/pgp/matsl
Digital vcard: https://www.irf.se/vcard/mats.luspa

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20241029/72322fc2/attachment-0001.htm>