Shibboleth WebAuthn Plugin V0.9.0 Release Candidate 2 now available

[Philip Smart]

The Shibboleth project is pleased to announce the second release candidate of the WebAuthn plugin [1].

The second release candidate includes changes to address several issues identified in the first release candidate, which we considered important to resolve before version one. These changes include:
  1. Decoupling the user’s name sent to the authenticator during registration from the username the IdP stores credential registrations against.
  2. Dynamic authenticator metadata lookup (previously it was added once, if enabled, during initial registration).
  3. UI support for naming authenticators/providers not found in the FIDO 2 metadata feed (these are mostly software authenticators).

In addition, we are developing a basic authenticator policy engine that will enable deployers to allow credential registrations from authenticators based on their capabilities and/or type. Once this is complete, we will release the third and final release candidate. Hopefully, the official release will follow soon after that.

As usual by now, you can find the appropriate version for download by checking the project's Status page [2] from Friday the 27th of September. As this is a release candidate and not a production release, please review the installation instructions on the Plugin Testing Wiki page [3].

Note, that a release candidate plugin is for testing purposes only and should not be used in production. Testers are welcome to provide feedback and report bugs on the project's issues page [4].

Again, we would like to express our gratitude to Timo Tunturi from Aalto University for his valuable feedback on the first release candidate.

Phil on behalf of the team

[1] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3395321933/WebAuthnAuthnConfiguration

[2] https://shibboleth.net/cgi-bin/projstatus.cgi

[3] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3256057857/Plugin+Testing

[4] https://shibboleth.atlassian.net/jira/software/c/projects/JWEBAUTHN/issues



Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20240926/31678480/attachment.htm>