55 |
56 | {% if FIDO2Tokens|length > 0 %}
57 | {% if showExitButton %}
58 |
59 |
64 | {% endif %}
65 | {% endif %}
66 | {% endif %}
67 | {% if authURL is defined and authURL|length > 0 %}
68 |
88 | {% endif %}
89 |
90 | {% endblock %}
91 |
--------------------------------------------------------------------------------
/config/module_webauthn.php.dist:
--------------------------------------------------------------------------------
1 | false,
8 |
9 | /* required configuration parameters */
10 | 'store' => [
11 | 'webauthn:Database',
12 | 'database.dsn' => 'mysql:host=db.example.org;dbname=fido2',
13 | 'database.username' => 'simplesaml',
14 | 'database.password' => 'sdfsdf',
15 | ],
16 |
17 | 'identifyingAttribute' => 'uid',
18 | 'attrib_displayname' => 'urn:oid:2.5.4.3',
19 |
20 | /* FIDO2 is phishing-resistent by binding generated credentials to a scope.
21 | * Browsers will only invoke the registration/authentication if the scope
22 | * matches the principal domain name the user is currently visiting.
23 | * If not specified, the scope will be the hostname of the IdP as per
24 | * its metadata. It is permissible to widen the scope up to the prinicpal
25 | * domain though (e.g. authentication service is "saml.example.com" => scope
26 | * can be extended to "example.com"; but not "examp1e2.com". A registered
27 | * FIDO2 token can then also be used on other servers in the same domain.
28 | * If configuring this item, be sure that the authentication server name and
29 | * the desired scope are a suffix match.
30 | *
31 | * If you do not control the entirety of your second-level domain, you must
32 | * set the scope here explicitly to your own hostname to prevent some
33 | * contrived attack scenarios with other servers in that same second-level
34 | * domain.
35 | */
36 | 'scope' => 'example.com',
37 |
38 | /**
39 | * The following options control how new FIDO2 keys are registered for a
40 | * given user.
41 | */
42 | 'registration' => [
43 |
44 | /*
45 | * You can specify which authenticators are considered acceptable.
46 | * This can be done with the following two configuration parameters.
47 | *
48 | * They are additive; if either the level is acceptable OR the authenti-
49 | * cator is in the whitelist, OR the attestation format matches,
50 | * registration will succeed.
51 | */
52 |
53 | /*
54 | * Do you require authenticators to be FIDO Certified, and if so, which
55 | * certification level?
56 | *
57 | * Setting this to anything but "0" will require the user to accept that
58 | * make and model are sent during the registration process, so that the
59 | * characteristics of the authenticator can be verified.
60 | *
61 | * WebAuthnRegistrationEvent::CERTIFICATION_NOT_REQUIRED is probably
62 | * acceptable for second-factor use, but most certainly not for Passwordless.
63 | *
64 | * Possible values:
65 | * WebAuthnRegistrationEvent::CERTIFICATION_NOT_REQUIRED => no
66 | * restriction (even authenticators which are NOT FIDO Certified
67 | * or not known to FIDO Alliance at all are acceptable!)
68 | * WebAuthnRegistrationEvent::FIDO_CERTIFIED_L1 => FIDO Certified Level 1
69 | * WebAuthnRegistrationEvent::FIDO_CERTIFIED_L1plus => FIDO Certified Level 1+
70 | * WebAuthnRegistrationEvent::FIDO_CERTIFIED_L2 => FIDO Certified Level 2
71 | * WebAuthnRegistrationEvent::FIDO_CERTIFIED_L3 => FIDO Certified Level 3
72 | * WebAuthnRegistrationEvent::FIDO_CERTIFIED_L3plus => FIDO Certified Level 3+
73 | */
74 | 'policy_2fa' => [
75 | 'minimum_certification_level' => WebAuthnRegistrationEvent::CERTIFICATION_NOT_REQUIRED,
76 | /*
77 | * If you specify a level above, you may want to make exceptions for
78 | * specific authenticators that are not on that level. This array
79 | * holds all the authenticators that are considered acceptable by
80 | * exception.
81 | *
82 | */
83 | 'aaguid_whitelist' => [ ],
84 | /*
85 | * Some authenticators are more equal than others. Apple TouchID and
86 | * FaceID set their AAGUID to all-zeroes so can't be whitelisted. But
87 | * they do send their attestation data in a Apple-specific attestation
88 | * format. So seeing that format means an Apple product is identified.
89 | * Since these authenticators are quite common, here is an option that
90 | * allows to whitelist authenticators by their attestation format.
91 | *
92 | * The example is the obvious and single really useful value.
93 | *
94 | * https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-the-web/
95 | */
96 | 'attestation_format_whitelist' => [ ],
97 | ],
98 | 'policy_passwordless' => [
99 | 'minimum_certification_level' => WebAuthnRegistrationEvent::FIDO_CERTIFIED_L1,
100 | 'aaguid_whitelist' => [ ],
101 | 'attestation_format_whitelist' => ['apple'],
102 | ],
103 |
104 | /* optional parameter which determines whether you will be able to
105 | * register and manage tokens while authenticating or you want to use
106 | * the standalone registration page for these purposes.
107 | * If false => standalone registration page (user needs to visit
108 | * dedicated token management page and authenticate to that)
109 | * if true => inflow registration (automatically ask for registration
110 | * if no key registered; enable key management with a
111 | * checkbox post-authentication)
112 | * Defaults to true.
113 | */
114 | 'use_inflow_registration' => true,
115 |
116 | /* optional parameter that determines what auth source will be used to
117 | * authenticate to the standalone registration page.
118 | * Defaults to 'default-sp'.
119 | */
120 | 'auth_source' => 'default-sp',
121 | ],
122 | ];
123 |
--------------------------------------------------------------------------------
/templates/supercharged.twig:
--------------------------------------------------------------------------------
1 | {% set pagetitle = 'Passwordless future or username and password?'|trans %}
2 |
3 | {% extends "@core/base.twig" %}
4 |
5 | {% block preload %}
6 |
7 |
8 | {% endblock %}
9 |
10 | {% block postload %}
11 |
12 |
13 | {% if hasPreviouslyDonePasswordless == "YES" %}{% endif %}
14 | {% endblock %}
15 |
16 | {% block content %}
17 | {%- if not isProduction %}
18 |
19 |
20 | {% trans %}You are now accessing a pre-production system. This authentication setup is for testing and pre-production verification only. If someone sent you a link that pointed you here, and you are not a tester you probably got the wrong link, and should not be here.{% endtrans %}
21 |
93 | {{ 'Help! I don\'t remember my password.'|trans }}
94 |
{{ 'Without your username and password you cannot authenticate yourself for access to the service. There may be someone that can help you. Consult the help desk at your organization!'|trans }}
95 |
96 |
97 |
98 |
99 | {% endblock %}
100 |
--------------------------------------------------------------------------------
/src/Store.php:
--------------------------------------------------------------------------------
1 |
17 | * @author JAcob Christiansen
18 | */
19 |
20 | abstract class Store
21 | {
22 | /**
23 | * Constructor for the base class.
24 | *
25 | * This constructor should always be called first in any class which implements this class.
26 | *
27 | * @param array &$config The configuration for this storage handler.
28 | *
29 | * @phpstan-ignore constructor.unusedParameter
30 | */
31 | protected function __construct(array &$config)
32 | {
33 | }
34 |
35 |
36 | /**
37 | * is the user subject to 2nd factor at all?
38 | *
39 | * This function checks whether a given user has been enabled for WebAuthn.
40 | *
41 | * @param string $userId The hash identifying the user at an IdP.
42 | * @param bool $defaultIfNx if not found in the DB, should the user be considered enabled (true)
43 | * or disabled(false)
44 | * @param bool $useDatabase a bool that determines whether to use local database or not
45 | * @param bool $toggle variable which is associated with $force because it determines its meaning, it either
46 | * simply means whether to trigger webauthn authentication or switch the default settings,
47 | * @param bool $force switch that determines how $toggle will be used, if true then value of $toggle
48 | * will mean whether to trigger (true) or not (false) the webauthn authentication,
49 | * if false then $toggle means whether to switch the value of $defaultEnabled and then use that
50 | *
51 | * @return bool True if the user is enabled for 2FA, false if not
52 | */
53 | abstract public function is2FAEnabled(
54 | string $userId,
55 | bool $defaultIfNx,
56 | bool $useDatabase = true,
57 | bool $toggle = false,
58 | bool $force = true,
59 | ): bool;
60 |
61 |
62 | /**
63 | * does a given credentialID already exist?
64 | *
65 | * This function checks whether a given credential ID already exists in the database
66 | *
67 | * @param string $credIdHex The hex representation of the credentialID to look for.
68 | *
69 | * @return bool True if the credential exists, false if not
70 | */
71 | abstract public function doesCredentialExist(string $credIdHex): bool;
72 |
73 |
74 | /**
75 | * store newly enrolled token data
76 | *
77 | * @param string $userId The user.
78 | * @param string $credentialId The id identifying the credential.
79 | * @param string $credential The credential.
80 | * @param int $algo The algorithm used.
81 | * @param int $presenceLevel UV or UP?
82 | * @param int $signCounter The signature counter for this credential.
83 | * @param string $friendlyName A user-supplied name for this token.
84 | * @param string $hashedId hashed ID of the user
85 | */
86 | abstract public function storeTokenData(
87 | string $userId,
88 | string $credentialId,
89 | string $credential,
90 | int $algo,
91 | int $presenceLevel,
92 | int $isResidentKey,
93 | int $signCounter,
94 | string $friendlyName,
95 | string $hashedId,
96 | string $aaguid,
97 | string $attLevel,
98 | ): true;
99 |
100 |
101 | /**
102 | * remove an existing credential from the database
103 | *
104 | * @param string $credentialId the credential
105 | */
106 | abstract public function deleteTokenData(string $credentialId): true;
107 |
108 |
109 | /**
110 | * increment the signature counter after a successful authentication
111 | *
112 | * @param string $credentialId the credential
113 | * @param int $signCounter the new counter value
114 | */
115 | abstract public function updateSignCount(string $credentialId, int $signCounter): true;
116 |
117 |
118 | /**
119 | * Retrieve existing token data
120 | *
121 | * @param string $userId the username
122 | * @return array Array of all crypto data we have on file.
123 | */
124 | abstract public function getTokenData(string $userId): array;
125 |
126 |
127 | /**
128 | * Retrieve username, given a credential ID
129 | *
130 | * @param string $hashedId the credential ID
131 | * @return string the username, if found (otherwise, empty string)
132 | */
133 | abstract public function getUsernameByHashedId(string $hashedId): string;
134 |
135 |
136 | /**
137 | * Get statistics for all consent given in the consent store
138 | *
139 | * @return mixed Statistics from the consent store
140 | *
141 | * @throws \Exception
142 | */
143 | public function getStatistics()
144 | {
145 | throw new Exception('Not implemented: getStatistics()');
146 | }
147 |
148 |
149 | /**
150 | * Parse consent storage configuration.
151 | *
152 | * This function parses the configuration for a consent storage method. An exception will be thrown if
153 | * configuration parsing fails.
154 | *
155 | * @param string|array $config The configuration.
156 | * @return \SimpleSAML\Module\webauthn\Store An object which implements the \SimpleSAML\Module\webauthn\Store class.
157 | *
158 | * @throws \Exception if the configuration is invalid.
159 | */
160 | public static function parseStoreConfig(string|array $config): Store
161 | {
162 | if (is_string($config)) {
163 | $arrayUtils = new Utils\Arrays();
164 | $config = $arrayUtils->arrayize($config);
165 | }
166 |
167 | Assert::isArray($config, 'Invalid configuration for consent store option: ' . var_export($config, true));
168 | Assert::keyExists($config, 0, 'Consent store without name given.');
169 |
170 | $className = Module::resolveClass(
171 | $config[0],
172 | 'WebAuthn\Store',
173 | '\SimpleSAML\Module\webauthn\Store',
174 | );
175 |
176 | /** @var \SimpleSAML\Module\webauthn\Store */
177 | return new $className($config);
178 | }
179 | }
180 |
--------------------------------------------------------------------------------
/src/Controller/Registration.php:
--------------------------------------------------------------------------------
1 | authState = $authState;
65 | }
66 |
67 |
68 | /**
69 | * Inject the \SimpleSAML\Auth\Simple dependency.
70 | *
71 | * @param \SimpleSAML\Auth\Simple $authSimple
72 | */
73 | public function setAuthSimple(Auth\Simple $authSimple): void
74 | {
75 | $this->authSimple = $authSimple;
76 | }
77 |
78 |
79 | /**
80 | * Inject the \SimpleSAML\Logger dependency.
81 | *
82 | * @param \SimpleSAML\Logger $logger
83 | */
84 | public function setLogger(Logger $logger): void
85 | {
86 | $this->logger = $logger;
87 | }
88 |
89 |
90 | /**
91 | * @param \Symfony\Component\HttpFoundation\Request $request
92 | * @return \SimpleSAML\HTTP\RunnableResponse A Symfony Response-object.
93 | */
94 | public function main(/** @scrutinizer ignore-unused */ Request $request): RunnableResponse
95 | {
96 | $moduleConfig = Configuration::getOptionalConfig('module_webauthn.php');
97 | $registrationConfig = $moduleConfig->getArray('registration');
98 | $registrationAuthSource = $registrationConfig['auth_source'] ?? 'default-sp';
99 |
100 | $state = [];
101 | $state['SPMetadata']['entityid'] = "WEBAUTHN-SP-REGISTRATION";
102 |
103 | $authSimple = $this->authSimple;
104 | $as = new $authSimple($registrationAuthSource);
105 | $as->requireAuth();
106 | $attrs = $as->getAttributes();
107 |
108 | $state['Attributes'] = $attrs;
109 |
110 | $stateData = new StateData();
111 | // phpcs:disable Generic.Files.LineLength.TooLong
112 | $stateData->requestTokenModel = ($registrationConfig['policy_2fa']['minimum_certification_level'] == WebAuthnRegistrationEvent::CERTIFICATION_NOT_REQUIRED ? false : true);
113 | $stateData->minCertLevel2FA = $registrationConfig['policy_2fa']['minimum_certification_level'];
114 | $stateData->aaguidWhitelist2FA = $registrationConfig['policy_2fa']['aaguid_whitelist'] ?? [];
115 | $stateData->attFmtWhitelist2FA = $registrationConfig['policy_2fa']['attestation_format_whitelist'] ?? [];
116 | $stateData->minCertLevelPasswordless = $registrationConfig['policy_passwordless']['minimum_certification_level'];
117 | $stateData->aaguidWhitelistPasswordless = $registrationConfig['policy_passwordless']['aaguid_whitelist'] ?? [];
118 | $stateData->attFmtWhitelistPasswordless = $registrationConfig['policy_passwordless']['attestation_format_whitelist'] ?? [];
119 | // phpcs:enable Generic.Files.LineLength.TooLong
120 |
121 | try {
122 | $stateData->store = Store::parseStoreConfig($moduleConfig->getArray('store'));
123 | } catch (Exception $e) {
124 | $this->logger::error(
125 | 'webauthn: Could not create storage: ' . $e->getMessage(),
126 | );
127 | }
128 |
129 | $stateData->scope = $moduleConfig->getOptionalString('scope', null);
130 | $httpUtils = new Utils\HTTP();
131 | $baseurl = $httpUtils->getSelfHost();
132 | $hostname = parse_url($baseurl, PHP_URL_HOST);
133 | if ($hostname !== null) {
134 | $stateData->derivedScope = $hostname;
135 | }
136 | $stateData->usernameAttrib = $moduleConfig->getString('identifyingAttribute');
137 | $stateData->displaynameAttrib = $moduleConfig->getString('attrib_displayname');
138 |
139 | StaticProcessHelper::prepareState($stateData, $state);
140 |
141 | $metadataHandler = MetaDataStorageHandler::getMetadataHandler();
142 | $metadata = $metadataHandler->getMetaDataCurrent('saml20-idp-hosted');
143 | $state['Source'] = $metadata;
144 | $state['IdPMetadata'] = $metadata;
145 | // inflow users are not allowed to enter the Registration page. If they
146 | // did, kill the session
147 | $moduleConfig = Configuration::getOptionalConfig('module_webauthn.php')->toArray();
148 |
149 | if ($moduleConfig['registration']['use_inflow_registration']) {
150 | throw new Exception("Attempt to access the stand-alone registration page in inflow mode!");
151 | }
152 |
153 | $state['Registration'] = true;
154 | $state['FIDO2WantsRegister'] = true;
155 | if (
156 | isset($state['Attributes']['FIDO2AuthSuccessful'])
157 | && is_array($state['Attributes']['FIDO2AuthSuccessful'])
158 | && count($state['Attributes']['FIDO2AuthSuccessful']) > 0
159 | ) {
160 | $state['FIDO2AuthSuccessful'] = $state['Attributes']['FIDO2AuthSuccessful'][0];
161 | }
162 |
163 | return new RunnableResponse([StaticProcessHelper::class, 'saveStateAndRedirect'], [&$state]);
164 | }
165 | }
166 |
--------------------------------------------------------------------------------
/src/Auth/Process/WebAuthn.php:
--------------------------------------------------------------------------------
1 |
10 | * @package SimpleSAMLphp
11 | */
12 |
13 | declare(strict_types=1);
14 |
15 | namespace SimpleSAML\Module\webauthn\Auth\Process;
16 |
17 | use SimpleSAML\Auth;
18 | use SimpleSAML\Configuration;
19 | use SimpleSAML\Logger;
20 | use SimpleSAML\Module;
21 | use SimpleSAML\Module\webauthn\WebAuthn\StateData;
22 | use SimpleSAML\Module\webauthn\WebAuthn\StaticProcessHelper;
23 | use SimpleSAML\Session;
24 |
25 | class WebAuthn extends Auth\ProcessingFilter
26 | {
27 | /**
28 | * @var boolean should new users be considered as enabled by default?
29 | */
30 | private bool $defaultEnabled;
31 |
32 | /**
33 | * @var boolean switch that determines how 'toggle' will be used, if true then value of 'toggle'
34 | * will mean whether to trigger (true) or not (false) the webauthn authentication,
35 | * if false then $toggle means whether to switch the value of $defaultEnabled and then use that
36 | */
37 | private bool $force;
38 |
39 | /**
40 | * @var string an attribute which is associated with 'force' because it determines its meaning,
41 | * it either simply means whether to trigger webauthn authentication or switch the default settings,
42 | * if null (was not sent as attribute) then the information from database is used
43 | */
44 | private string $toggleAttrib;
45 |
46 | /**
47 | * @var bool a bool that determines whether to use local database or not
48 | */
49 | private bool $useDatabase;
50 |
51 | /**
52 | * @var string|null AuthnContextClassRef
53 | */
54 | private ?string $authnContextClassRef = null;
55 |
56 | /**
57 | * An object with all the parameters that will be needed in the process
58 | *
59 | * @var \SimpleSAML\Module\webauthn\WebAuthn\StateData
60 | */
61 | private StateData $stateData;
62 |
63 | /**
64 | * Maximum age of second-factor authentication in authproc
65 | */
66 | private int $SecondFactorMaxAge;
67 |
68 |
69 | /**
70 | * Initialize filter.
71 | *
72 | * Validates and parses the configuration.
73 | *
74 | * @param array $config Configuration information.
75 | * @param mixed $reserved For future use.
76 | *
77 | * @throws \SimpleSAML\Error\Exception if the configuration is not valid.
78 | */
79 | public function __construct(array $config, $reserved)
80 | {
81 | parent::__construct($config, $reserved);
82 |
83 | $moduleConfig = Configuration::getOptionalConfig('module_webauthn.php')->toArray();
84 |
85 | $initialStateData = new Module\webauthn\WebAuthn\StateData();
86 | Module\webauthn\Controller\WebAuthn::loadModuleConfig($moduleConfig, $initialStateData);
87 | $this->stateData = $initialStateData;
88 |
89 | $this->force = $config['force'] ?? true;
90 | $this->toggleAttrib = $config['attrib_toggle'] ?? 'toggle';
91 | $this->useDatabase = $config['use_database'] ?? true;
92 | $this->defaultEnabled = $config['default_enable'] ?? false;
93 | $this->authnContextClassRef = $config['authncontextclassref'] ?? null;
94 | $this->SecondFactorMaxAge = $config['secondfactormaxage'] ?? -1;
95 |
96 | if (array_key_exists('use_inflow_registration', $moduleConfig['registration'])) {
97 | $this->stateData->useInflowRegistration = $moduleConfig['registration']['use_inflow_registration'];
98 | } else {
99 | $this->stateData->useInflowRegistration = true;
100 | }
101 | }
102 |
103 |
104 | /**
105 | * Process a authentication response
106 | *
107 | * This function saves the state, and redirects the user to the page where
108 | * the user can register or authenticate with his token.
109 | *
110 | * @param array &$state The state of the response.
111 | */
112 | public function process(array &$state): void
113 | {
114 | if (!array_key_exists($this->stateData->usernameAttrib, $state['Attributes'])) {
115 | Logger::warning('webauthn: cannot determine if user needs second factor, missing attribute "' .
116 | $this->stateData->usernameAttrib . '".');
117 | return;
118 | }
119 |
120 | $state['saml:AuthnContextClassRef'] = $this->authnContextClassRef ??
121 | 'urn:rsa:names:tc:SAML:2.0:ac:classes:FIDO';
122 | Logger::debug('webauthn: userid: ' . $state['Attributes'][$this->stateData->usernameAttrib][0]);
123 |
124 | $localToggle = !empty($state['Attributes'][$this->toggleAttrib]) &&
125 | !empty($state['Attributes'][$this->toggleAttrib][0]);
126 |
127 | if (
128 | $this->stateData->store->is2FAEnabled(
129 | $state['Attributes'][$this->stateData->usernameAttrib][0],
130 | $this->defaultEnabled,
131 | $this->useDatabase,
132 | $localToggle,
133 | $this->force,
134 | ) === false
135 | ) {
136 | // nothing to be done here, end authprocfilter processing
137 | return;
138 | }
139 |
140 | if // did we do Passwordless mode successfully before?
141 | (
142 | isset($state['Attributes']['internal:FIDO2PasswordlessAuthentication']) &&
143 | // phpcs:ignore Generic.Files.LineLength.TooLong
144 | $state['Attributes']['internal:FIDO2PasswordlessAuthentication'][0] == $state['Attributes'][$this->stateData->usernameAttrib][0]
145 | ) {
146 | // then no need to trigger a second 2-Factor via authproc
147 | // just delete the internal attribute then
148 | unset($state['Attributes']['internal:FIDO2PasswordlessAuthentication']);
149 | return;
150 | }
151 | $session = Session::getSessionFromRequest();
152 | $lastSecondFactor = $session->getData("DateTime", 'LastSuccessfulSecondFactor');
153 | if // do we need to do secondFactor in interval, or even every time?
154 | // we skip only if an interval is configured AND we did successfully authenticate,
155 | // AND are within the interval
156 | (
157 | $this->SecondFactorMaxAge >= 0 && $lastSecondFactor instanceof \DateTime
158 | ) {
159 | $interval = $lastSecondFactor->diff(new \DateTime());
160 | if ($interval->invert == 1) {
161 | throw new \Exception("We are talking to a future self. Amazing.");
162 | }
163 | // phpcs:ignore Generic.Files.LineLength.TooLong
164 | $totalAge = $interval->s + 60 * $interval->i + 3600 * $interval->h + 86400 * $interval->d + 86400 * 30 * $interval->m + 86400 * 365 * $interval->y;
165 | if ($totalAge < $this->SecondFactorMaxAge) { // we are within the interval indeed, skip calling the AuthProc
166 | return;
167 | }
168 | }
169 | StaticProcessHelper::prepareState($this->stateData, $state);
170 | StaticProcessHelper::saveStateAndRedirect($state);
171 | }
172 | }
173 |
--------------------------------------------------------------------------------
/src/Controller/RegProcess.php:
--------------------------------------------------------------------------------
1 | authState = $authState;
65 | }
66 |
67 |
68 | /**
69 | * Inject the \SimpleSAML\Logger dependency.
70 | *
71 | * @param \SimpleSAML\Logger $logger
72 | */
73 | public function setLogger(Logger $logger): void
74 | {
75 | $this->logger = $logger;
76 | }
77 |
78 |
79 | /**
80 | * @param \Symfony\Component\HttpFoundation\Request $request
81 | * @return \Symfony\Component\HttpFoundation\RedirectResponse|\SimpleSAML\HTTP\RunnableResponse
82 | * A Symfony Response-object.
83 | */
84 | public function main(Request $request): Response
85 | {
86 | $this->logger::info('FIDO2 - Accessing WebAuthn enrollment validation');
87 |
88 | $stateId = $request->query->get('StateId');
89 | if ($stateId === null) {
90 | throw new Error\BadRequest('Missing required StateId query parameter.');
91 | }
92 |
93 | $moduleConfig = Configuration::getOptionalConfig('module_webauthn.php');
94 | $debugEnabled = $moduleConfig->getOptionalBoolean('debug', false);
95 |
96 | $state = $this->authState::loadState($stateId, 'webauthn:request');
97 |
98 | // registering a credential is only allowed for new users or after being authenticated
99 | if (WebAuthn::workflowStateMachine($state) !== WebAuthn::STATE_MGMT) {
100 | throw new Exception("Attempt to register new token in unacceptable context.");
101 | }
102 |
103 | $fido2Scope = ($state['FIDO2Scope'] === null ? $state['FIDO2DerivedScope'] : $state['FIDO2Scope']);
104 | if ($fido2Scope === null) {
105 | throw new Exception("FIDO2Scope cannot be null!");
106 | }
107 |
108 | $regObject = new WebAuthnRegistrationEvent(
109 | $request->request->get('type'),
110 | $fido2Scope,
111 | $state['FIDO2SignupChallenge'],
112 | base64_decode($request->request->get('attestation_object')),
113 | $request->request->get('response_id'),
114 | $request->request->get('attestation_client_data_json'),
115 | ($request->request->get('passwordless') == "on" ?
116 | $state['authenticatorAcceptabilityPasswordless'] : $state['authenticatorAcceptability2FA']),
117 | $debugEnabled,
118 | );
119 | // at this point, we need to talk to the DB
120 | /**
121 | * STEP 19 of the validation procedure in § 7.1 of the spec: see if this credential is already registered
122 | */
123 | $store = $state['webauthn:store'];
124 | if ($store->doesCredentialExist(bin2hex($regObject->getCredentialId())) === false) {
125 | // credential does not exist yet in database, good.
126 | } else {
127 | throw new Exception("The credential with ID " . $regObject->getCredentialId() . " already exists.");
128 | }
129 |
130 | // THAT'S IT. This is a valid credential and can be enrolled to the user.
131 | $friendlyName = $request->request->get('tokenname');
132 |
133 | // if we know the token model, add it to the name
134 | $model = Translate::noop('unknown model');
135 | $aaguiddict = AAGUID::getInstance();
136 | if ($aaguiddict->hasToken($regObject->getAAGUID())) {
137 | $token = $aaguiddict->get($regObject->getAAGUID());
138 | $model = $token['metadataStatement']['description'];
139 | }
140 | $friendlyName .= " ($model)";
141 |
142 | /**
143 | * STEP 20 of the validation procedure in § 7.1 of the spec: store credentialId, credential,
144 | * signCount and associate with user
145 | */
146 |
147 | /*
148 | * Observed with YubiKey 5: the transaction counter is 0 if the key has NEVER been used, but
149 | * the first transaction is also transaction #0.
150 | * i.e. 0 means "before first transaction OR the very first transaction has already taken place"
151 | *
152 | * The very first use of a key should not trigger the physical object cloning alert, so a
153 | * transaction counter == 0 should be allowed for the first authentication of a new key.
154 | * The best way to do this is to set the current counter value to -1 when registering a key
155 | * with a transaction counter of 0.
156 | */
157 | $currentCounterValue = -1;
158 | if ($regObject->getCounter() > 0) {
159 | $currentCounterValue = $regObject->getCounter();
160 | }
161 |
162 | // did we get any client extensions?
163 | $isResidentKey = 0;
164 | if (
165 | strlen($request->request->get('clientext')) > 0 &&
166 | count(json_decode($request->request->get('clientext'), true)) > 0
167 | ) {
168 | $extensions = json_decode($request->request->get('clientext'), true);
169 | if (isset($extensions['credProps']['rk']) && $extensions['credProps']['rk'] === true) {
170 | $isResidentKey = 1;
171 | }
172 | }
173 |
174 | // we also need to store the hased user_id in case we need to retrieve
175 | // tokens in passwordless mode
176 | // use identical hashing as in JS generation step
177 | $configUtils = new Utils\Config();
178 | $username = hash('sha512', $state['FIDO2Username'] . '|' . $configUtils->getSecretSalt());
179 | $store->storeTokenData(
180 | $state['FIDO2Username'],
181 | $regObject->getCredentialId(),
182 | $regObject->getCredential(),
183 | $regObject->getAlgo(),
184 | $regObject->getPresenceLevel(),
185 | // we deny saving resident key properties if Passwordless mode
186 | // was not requested
187 | ($request->request->get('passwordless') == "on" ? $isResidentKey : 0),
188 | $currentCounterValue,
189 | $friendlyName,
190 | $username,
191 | $regObject->getAAGUID(),
192 | $regObject->getAttestationLevel(),
193 | );
194 |
195 | // make sure $state gets the news, the token is to be displayed to the user on the next page
196 | $state['FIDO2Tokens'][] = [
197 | 0 => $regObject->getCredentialId(),
198 | 1 => $regObject->getCredential(),
199 | 2 => $currentCounterValue,
200 | 3 => $friendlyName,
201 | 4 => $regObject->getAlgo(),
202 | 5 => $regObject->getPresenceLevel(),
203 | 6 => $isResidentKey,
204 | ];
205 |
206 | $id = $this->authState::saveState($state, 'webauthn:request');
207 | if ($debugEnabled === true) {
208 | $response = new RunnableResponse(
209 | function (WebAuthnRegistrationEvent $regObject, string $id) {
210 | echo $regObject->getDebugBuffer();
211 | echo $regObject->getValidateBuffer();
212 | echo "
{% if token.5 == 4 and token.6 == true %}