WebAuthn: Issue with Fido metadata?

[Mats Luspa]

Hello!

A little late but to follow up this I managed to do what I wanted to 
accomplish by reading the documenation and adding some Javascript code.
That means a user with passkey registered will only be able to login 
with passkey. A user with no passkey will fallback to password but will 
not be able to degrade a user with passkey as said.
I send the documentation in the attachment if it can be of interest.

/Regards Mats

On 11/6/24 6:22 AM, Mats Luspa wrote:
> Thanks for the clarification!
>
> /Regards Mats
>
> Den 5 nov. 2024 19:11 skrev Philip Smart <Philip.Smart at jisc.ac.uk>:
>
>     I've added a note on pre-populating the username set in the
>     passwordless step to the Username and Password login page.
>     https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3878256667/WebAuthnAuthentication#Prepopulating-the-username-input-in-the-authn%2FPassword-flow
>
>
>     Echoing Scott’s comment about the free support.
>
>     Phil
>
>
>         On 5 Nov 2024, at 14:04, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>             Ok, I'm sorry about the many questions, but I was interested
>             to see if  it could be done.
>
>
>         Anything can be done, it requires reading the documentation
>         and doing development work in Java or Javascript.
>
>         What you're trying to do is what the MFA flow is for, it's not
>         got anything to do with the plugin. Orchestrating custom
>         behavior is why it exists.
>
>         But we are not subsidized any longer to help people online. A
>         question or two is fine, but exhaustive exploration of the
>         software's features is just not realistic.
>
>         -- Scott
>
>
>
>
>     Jisc is a registered charity (number 1149740) and a company
>     limited by guarantee which is registered in England under company
>     number. 05747339, VAT number GB 197 0632 86. Jisc’s registered
>     office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
>     Jisc Services Limited is a wholly owned Jisc subsidiary and a
>     company limited by guarantee which is registered in England under
>     company number 02881024, VAT number GB 197 0632 86. The registered
>     office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
>     Jisc Commercial Limited is a wholly owned Jisc subsidiary and a
>     company limited by shares which is registered in England under
>     company number 09316933, VAT number GB 197 0632 86. The registered
>     office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
>     For more details on how Jisc handles your data see our privacy
>     notice here: https://www.jisc.ac.uk/website/privacy-notice
>
>
>
> Thanks for the clarification!
>
> /Regards Mats
>
>
> Den 5 nov. 2024 19:11 skrev Philip Smart<Philip.Smart at jisc.ac.uk>:
>> I've added a note on pre-populating the username set in the passwordless step to the Username and Password login page.https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3878256667/WebAuthnAuthentication#Prepopulating-the-username-input-in-the-authn%2FPassword-flow 
>>
>> Echoing Scott’s comment about the free support.
>>
>> Phil
>>
>>
>>> On 5 Nov 2024, at 14:04, Cantor, Scott<cantor.2 at osu.edu> wrote:
>>>
>>>> Ok, I'm sorry about the many questions, but I was interested
>>>> to see if  it could be done.
>>>
>>> Anything can be done, it requires reading the documentation and doing development work in Java or Javascript.
>>>
>>> What you're trying to do is what the MFA flow is for, it's not got anything to do with the plugin. Orchestrating custom behavior is why it exists.
>>>
>>> But we are not subsidized any longer to help people online. A question or two is fine, but exhaustive exploration of the software's features is just not realistic.
>>>
>>> -- Scott
>>>
>>>
>>
>> Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>>
>> Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>>
>> Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>>
>> For more details on how Jisc handles your data see our privacy notice here:https://www.jisc.ac.uk/website/privacy-notice
>
-- 
-- 
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik               Fax: +46 (0)980 79 050
Swedish Institute of Space Physics      email:matsl at irf.se
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
-- 
PGP Public Key:https://www.irf.se/pgp/matsl
Digital vcard:https://www.irf.se/vcard/mats.luspa

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20250602/2133726f/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: WebAuthn-with-password-fallback.md
Type: text/markdown
Size: 13238 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20250602/2133726f/attachment-0001.md>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4382 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20250602/2133726f/attachment-0001.p7s>