WebAuthn: Issue with Fido metadata?

[Mats Luspa]

Maybe I should rephrase the question.

I wonder if it's possible to use webauthn/MFA always even if the SP is 
not requiring that?

I was thinking this scenario:

If the user enters the SP the user gets the webauthn/MFA interface in 
passwordless flow. Enters the username and if the user does not have any 
passkey registered the user comes to username/password flow*if the SP is 
not requiring webauthn*, otherwise if*SP is requiring webauthn the 
resource is not accessible for the user*. If the user has passkey 
registered the login is proceeding in the usual way for passkey login.

/Regards Mats

On 2024-10-30 10:48, Philip Smart wrote:
>
>
>> On 30 Oct 2024, at 09:22, Mats Luspa via dev <dev at shibboleth.net> wrote:
>>
>> Hello again!
>>
>> Is it possible to configure so the authentication process falls back 
>> to username/password if a passkey can't be discovered? Right now 
>> passkey is used only if the SP requires that. But most of the SP:s at 
>> least here don't require passkeys and hence username/password is 
>> used. I want the idp to decide that passkey should be used if 
>> possible (passkey is discovered).
>>
> I guess this depends on what you mean by ‘discovered’. If you mean; 
> does the user have a passkey registered with the IdP, then there are 
> some options to signal ‘no passkeys’ to the MFA flow during 
> authentication. You can then use MFA logic to decide what to do next. 
> The docs need work, but this should be described in 
> https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3878256667/WebAuthnAuthentication#%5BinlineExtension%5DSignalling-custom-events-when-the-user-has-no-registered-credentials. 
> Please note the warning about enabling that feature (in the yellow box).
>
> Or maybe you meant something else?
>
> Phil
>
>> /Regards Mats
>>
>> On 2024-10-30 07:24, Mats Luspa via dev wrote:
>>>
>>> You are absolutely correct. irfAuthorizedService is an ldap 
>>> attribute not resolved. I have now made a scripted attribute that 
>>> checks if irfAuthorizedService contains shibAdmin and it works now.
>>>
>>> Thanks for pointing med to the right direction :)
>>>
>>> /Regards Mats
>>>
>>> On 2024-10-29 21:35, Michael Grady via dev wrote:
>>>>
>>>>
>>>>> On Oct 29, 2024, at 2:46 PM, Cantor, Scott via dev 
>>>>> <dev at shibboleth.net> wrote:
>>>>>
>>>>>> I think it has to do with that irfAuthorizedService is a multi
>>>>>> -value attribute.
>>>>>
>>>>> It doesn't.
>>>>
>>>> Yes the example I supplied (and that is from a working deployment), 
>>>> the attribute we used could have dozens and dozens of values, so 
>>>> multi-valued is most definitely not the issue.
>>>>
>>>> --
>>>> Michael A. Grady
>>>> IAM Architect, Unicon, Inc.
>>>>
>>>>
>>>>
>>>>
>>> -- 
>>> --
>>> Mats Luspa
>>> Phone: +46 (0)980 79 022
>>> Cellular phone: +46 (0)725813330
>>> Institutet för rymdfysik               Fax: +46 (0)980 79 050
>>> Swedish Institute of Space Physics      email:matsl at irf.se
>>> Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
>>> Postal address: Box 812, SE-981 28 Kiruna
>>> --
>>> PGP Public Key:https://www.irf.se/pgp/matsl
>>> Digital vcard:https://www.irf.se/vcard/mats.luspa
>>>
>> -- 
>> --
>> Mats Luspa
>> Phone: +46 (0)980 79 022
>> Cellular phone: +46 (0)725813330
>> Institutet för rymdfysik               Fax: +46 (0)980 79 050
>> Swedish Institute of Space Physics      email:matsl at irf.se
>> Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
>> Postal address: Box 812, SE-981 28 Kiruna
>> --
>> PGP Public Key:https://www.irf.se/pgp/matsl
>> Digital vcard:https://www.irf.se/vcard/mats.luspa
>> -- 
>> To unsubscribe from this list send an email to 
>> dev-unsubscribe at shibboleth.net
>
>
> Jisc is a registered charity (number 1149740) and a company limited by 
> guarantee which is registered in England under company number. 
> 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 
> Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
> Jisc Services Limited is a wholly owned Jisc subsidiary and a company 
> limited by guarantee which is registered in England under company 
> number 02881024, VAT number GB 197 0632 86. The registered office is: 
> 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
> Jisc Commercial Limited is a wholly owned Jisc subsidiary and a 
> company limited by shares which is registered in England under company 
> number 09316933, VAT number GB 197 0632 86. The registered office is: 
> 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
> For more details on how Jisc handles your data see our privacy notice 
> here: https://www.jisc.ac.uk/website/privacy-notice
>
-- 
--
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik               Fax: +46 (0)980 79 050
Swedish Institute of Space Physics      email:matsl at irf.se
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
--
PGP Public Key:https://www.irf.se/pgp/matsl
Digital vcard:https://www.irf.se/vcard/mats.luspa

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20241031/bc8a8ef0/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5037 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20241031/bc8a8ef0/attachment.p7s>