Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Only add the none verifier when attestation conveyance preference is none (26.4) #43766

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ahus1 merged 1 commit into from
Oct 28, 2025
Merged

Only add the none verifier when attestation conveyance preference is none (26.4) #43766

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 20 additions & 11 deletions services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@
import org.keycloak.utils.StringUtil;

import com.webauthn4j.converter.util.ObjectConverter;
import com.webauthn4j.data.AttestationConveyancePreference;
import com.webauthn4j.data.attestation.authenticator.AttestedCredentialData;
import com.webauthn4j.data.attestation.statement.AttestationStatement;
import com.webauthn4j.data.attestation.statement.COSEAlgorithmIdentifier;
Expand All @@ -72,6 +73,7 @@
import com.webauthn4j.data.RegistrationParameters;
import com.webauthn4j.server.ServerProperty;
import com.webauthn4j.util.exception.WebAuthnException;
import com.webauthn4j.verifier.attestation.statement.AttestationStatementVerifier;
import com.webauthn4j.verifier.attestation.statement.androidkey.AndroidKeyAttestationStatementVerifier;
import com.webauthn4j.verifier.attestation.statement.androidsafetynet.AndroidSafetyNetAttestationStatementVerifier;
import com.webauthn4j.verifier.attestation.statement.none.NoneAttestationStatementVerifier;
Expand Down Expand Up @@ -264,7 +266,7 @@ public void processAction(RequiredActionContext context) {
AuthenticatorUtil.logoutOtherSessions(context);
}

WebAuthnRegistrationManager webAuthnRegistrationManager = createWebAuthnRegistrationManager();
WebAuthnRegistrationManager webAuthnRegistrationManager = createWebAuthnRegistrationManager(policy.getAttestationConveyancePreference());
try {
// parse
RegistrationData registrationData = webAuthnRegistrationManager.parse(registrationRequest);
Expand Down Expand Up @@ -314,22 +316,29 @@ public void processAction(RequiredActionContext context) {
* Create WebAuthnRegistrationManager instance
* Can be overridden in subclasses to customize the used attestation validators
*
* @param attestationPreference The attestation selected in the policy
* @return webauthn4j WebAuthnRegistrationManager instance
*/
protected WebAuthnRegistrationManager createWebAuthnRegistrationManager() {
protected WebAuthnRegistrationManager createWebAuthnRegistrationManager(String attestationPreference) {
List<AttestationStatementVerifier> verifiers = new ArrayList<>(6);
if (attestationPreference == null
|| Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED.equals(attestationPreference)
|| AttestationConveyancePreference.NONE.getValue().equals(attestationPreference)) {
verifiers.add(new NoneAttestationStatementVerifier());
}
verifiers.add(new PackedAttestationStatementVerifier());
verifiers.add(new TPMAttestationStatementVerifier());
verifiers.add(new AndroidKeyAttestationStatementVerifier());
verifiers.add(new AndroidSafetyNetAttestationStatementVerifier());
verifiers.add(new FIDOU2FAttestationStatementVerifier());

return new WebAuthnRegistrationManager(
Arrays.asList(
new NoneAttestationStatementVerifier(),
new PackedAttestationStatementVerifier(),
new TPMAttestationStatementVerifier(),
new AndroidKeyAttestationStatementVerifier(),
new AndroidSafetyNetAttestationStatementVerifier(),
new FIDOU2FAttestationStatementVerifier()
), this.certPathtrustVerifier,
verifiers,
this.certPathtrustVerifier,
new DefaultSelfAttestationTrustworthinessVerifier(),
Collections.emptyList(), // Custom Registration Verifier is not supported
new ObjectConverter()
);
);
}

/**
Expand Down
36 changes: 36 additions & 0 deletions .../java/org/keycloak/testsuite/webauthn/registration/AttestationConveyanceRegisterTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,10 @@
import static org.hamcrest.CoreMatchers.is;
import static org.hamcrest.CoreMatchers.notNullValue;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.containsString;
import static org.junit.Assert.assertTrue;
import static org.keycloak.models.Constants.DEFAULT_WEBAUTHN_POLICY_NOT_SPECIFIED;
import static org.keycloak.testsuite.util.WaitUtils.waitForPageToLoad;
import static org.keycloak.testsuite.webauthn.authenticators.DefaultVirtualAuthOptions.DEFAULT;

/**
Expand Down Expand Up @@ -92,6 +95,39 @@ public void attestationConveyancePreferenceDirect() {
}
}

@Test
public void attestationConveyancePreferenceNoneToDirect() throws IOException {
oauth.openLoginForm();
waitForPageToLoad();
loginPage.assertCurrent();
loginPage.clickRegister();

waitForPageToLoad();
registerPage.assertCurrent();
registerPage.register("firstName", "lastName", EMAIL, USERNAME, generatePassword(USERNAME));

// User was registered. Now he needs to register WebAuthn credential
waitForPageToLoad();
webAuthnRegisterPage.assertCurrent();
webAuthnRegisterPage.clickRegister();

try (AbstractWebAuthnRealmUpdater updater = getWebAuthnRealmUpdater()
.setWebAuthnPolicyAttestationConveyancePreference(AttestationConveyancePreference.DIRECT.getValue())
.update()) {

testingClient.testing().disableTruststoreSpi();

assertTrue(webAuthnRegisterPage.isRegisterAlertPresent());
webAuthnRegisterPage.registerWebAuthnCredential("new webauth credential");

// should fail because none is not allowed
webAuthnErrorPage.isCurrent();
assertThat(webAuthnErrorPage.getError(), containsString("AttestationVerifier is not configured to handle the supplied AttestationStatement format 'none'."));
} finally {
testingClient.testing().reenableTruststoreSpi();
}
}

protected void assertAttestationConveyance(boolean shouldSuccess, AttestationConveyancePreference attestation) {
Credential credential = getDefaultResidentKeyCredential();

Expand Down
Loading