<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<br id="lineBreakAtBeginningOfMessage">
<div><br>
<blockquote type="cite">
<div>On 5 Dec 2024, at 09:32, Philip Smart via dev <dev@shibboleth.net> wrote:</div>
<br class="Apple-interchange-newline">
<div>
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<br class="Apple-interchange-newline">
<br>
<blockquote type="cite">
<div>On 4 Dec 2024, at 20:11, Equbay Kiflay via dev <dev@shibboleth.net> wrote:</div>
<br class="Apple-interchange-newline">
<div>
<div dir="ltr">
<div>
<div>Good day,
<div>I tested the WebAuthn plugin and this is what I got so far.</div>
<div><b><br>
</b></div>
<div><b>My test environment</b> is <br>
OS: Debian 12 (ver. 12.8)</div>
<div> IdP: 5.1.3</div>
<div> WebAuthn plugin: 0.9.0</div>
<div> other installed plugins: storage.jdbc 2.0.1, nashorn 2.0.0 and fudiscr 2.1.0</div>
<div><b><br>
</b></div>
<div><b>Set up</b></div>
</div>
<div>WebAuthn as the sole factor but with password fallback for registration</div>
<div><br>
</div>
<div><b>Result</b></div>
<div>I was able to register a Hyper Fido Pro key (which is FIDO 2 compliant) and a google authenticator on phone for a user. However, I was not able to login with the registered keys later.</div>
</div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Is there anything in the logs about why it was not accepted?</div>
<br>
<blockquote type="cite">
<div>
<div dir="ltr">
<div>
<div><br>
</div>
<div>For the Fido key windows says the key can not be used (the same key can be used with privacyIDEA as a second factor on a server with the exact same environment without problem).</div>
</div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Can not be registered? or can not be used to authenticate?</div>
<div><br>
</div>
<div>If it can not be registered, it might be it is not compatible with the current registration options: <a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3879206915/WebAuthnRegistration#%5BinlineExtension%5DCredential-Generation-Options">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3879206915/WebAuthnRegistration#%5BinlineExtension%5DCredential-Generation-Options</a></div>
<br>
<blockquote type="cite">
<div>
<div dir="ltr">
<div>
<div><br>
</div>
<div>For the google authenticator, Shibboleth says to check the device but nothing comes on the phone.</div>
</div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Shibboleth, or the the WebAuthn browser dialog? The browser or platform presents the authenticator and credential selector, not directly the IdP. Usually, a phone involves a cross-device flow with a QR code, do you see that?</div>
<br>
<blockquote type="cite">
<div>
<div dir="ltr">
<div>
<div><br>
</div>
<div>I also tried Microsoft Authenticator on iPhone. But I can not register. The Authenticator saying it does not support this passkey.</div>
</div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Again. This might depend on what you are registering (the options, see the link above). </div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Noting, I do not think MS Authenticator is the passkey provider on iPhone (even if you use the app), I
<i>think</i> it is still iCloud Keychain. So you would need that enabled. I might be wrong.</div>
<div><br>
</div>
<div>Phil</div>
<br>
<blockquote type="cite">
<div>
<div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<br>
<blockquote type="cite">
<div>
<div dir="ltr">
<div>
<div><br>
</div>
<div>I don't know what kind of device can be used.</div>
<div><br>
</div>
<div>Regards,</div>
</div>
<div><br>
</div>
<span class="gmail_signature_prefix">--<span class="Apple-converted-space"> </span></span><br>
<div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">
<table width="320" cellspacing="0" cellpadding="0" style="width: 320px; margin: 0px; padding: 0px; font-family: Verdana, Geneva, sans-serif; font-size: 13px; line-height: 10px; color: rgb(23, 61, 111); border-collapse: collapse;">
<tbody>
<tr>
<td style="margin: 0px; padding: 0px;">
<table width="320" cellspacing="0" cellpadding="0" style="width: 320px; margin: 0px; padding: 0px; font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 10px; line-height: 10px; border-collapse: collapse;">
<tbody>
<tr>
<td style="margin: 0px; padding: 0px; font-family: Verdana, Geneva, sans-serif; white-space: nowrap;">
<p style="margin: 5px 0px; padding: 0px;"><a href="mailto:equbay.kiflay@concordia.ab.ca" target="_blank" style="border: medium; text-decoration: none; color: rgb(23, 61, 111); font-size: 15px; font-weight: bold; margin: 0px; padding: 0px;">Equbay Kiflay</a></p>
<p style="margin: 0px 0px 5px;"><span style="color: rgb(23, 61, 111); font-size: 12px;">IT Operations Coordinator</span></p>
<p style="margin: 0px 0px 5px;"><span style="color: rgb(23, 61, 111); font-size: 12px;">Information Technology Services</span></p>
</td>
</tr>
<tr>
<td style="width: 320px; margin: 0px; padding: 0px; font-family: Verdana, Geneva, sans-serif; font-size: 11px; line-height: 15px; border-collapse: collapse;">
<p style="margin: 0px 10px 5px 0px;">Toll-Free: +1 866 479 5200</p>
</td>
</tr>
<tr>
<td style="width: 320px; margin: 0px; padding: 0px; font-family: Verdana, Geneva, sans-serif; font-size: 10px; line-height: 15px; border-collapse: collapse;">
<p style="margin: 0px 10px 5px 0px;"><a href="https://concordia.ab.ca/" target="_blank" style="border: medium; text-decoration: none; color: rgb(23, 61, 111); font-size: 13px; font-weight: bold; margin: 0px; padding: 0px;"></a></p>
<p style="margin: 0px 10px 1px 0px;"><span style="width: 120px; margin: 0px; padding: 0px;"><a href="https://concordia.ab.ca/" target="_blank" style="border: medium; text-decoration: none; margin: 0px; padding: 0px;"><img src="https://static.concordia.ab.ca/img/esignaturelogo2021031701.jpg" alt="Concordia University of Edmonton" height="82" width="365" align="top"><span class="Apple-converted-space"> </span></a></span></p>
<p style="margin: 0px 10px 1px 0px;"><a href="https://concordia.ab.ca/" target="_blank" style="border: medium; text-decoration: none; color: rgb(23, 61, 111); font-size: 13px; font-weight: bold; margin: 0px; padding: 0px;">concordia.ab.ca</a></p>
</td>
</tr>
<tr>
<td style="width: 320px; margin: 0px; padding: 0px; font-family: Verdana, Geneva, sans-serif; font-size: 10px; line-height: 1px; border-collapse: collapse;">
<p style="margin: 0px 10px 2px 0px;"><br>
<a href="https://twitter.com/CUEdmonton" target="_blank" style="border: medium; text-decoration: none; font-size: 14px; margin: 0px; padding: 0px;"><img src="https://static.concordia.ab.ca/img/twitterlogo2016062701.png" alt="Concordia University of Edmonton Twitter" height="25" width="25"></a><span class="Apple-converted-space"> </span><a href="https://instagram.com/cuedmonton/" target="_blank" style="border: medium; text-decoration: none; font-size: 14px; margin: 0px; padding: 0px;"><img src="https://static.concordia.ab.ca/img/instagramlogo2016062701.png" alt="Concordia University of Edmonton Instagram" height="25" width="25"></a><span class="Apple-converted-space"> </span><a href="https://facebook.com/CUEdmonton" target="_blank" style="border: medium; text-decoration: none; font-size: 14px; margin: 0px; padding: 0px;"><img src="https://static.concordia.ab.ca/img/facebooklogo2016062701.png" alt="Concordia University of Edmonton Facebook" height="25" width="25"></a></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</div>
--<span class="Apple-converted-space"> </span><br>
To unsubscribe from this list send an email to dev-unsubscribe@shibboleth.net<br>
</div>
</blockquote>
</div>
<br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<mc type="body" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><font size="1"><font face="Corbel"><br>
<p>Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>For more details on how Jisc handles your data see our privacy notice here:<span class="Apple-converted-space"> </span><a href="https://www.jisc.ac.uk/website/privacy-notice">https://www.jisc.ac.uk/website/privacy-notice</a></p>
</font></font>--<span class="Apple-converted-space"> </span><br>
To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span><a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a></mc></div>
</blockquote>
</div>
<br>
</body>
</html>