Implement FIDO2 credential picker #14033
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
FYI @kimlisa @zmb3 @xinding33, this is what we talked about last week. I'm tempted to backport to v10.0.0, as this is actually better in various ways. |
|
I'll leave it to @zmb3 to decide whether or not we should backport this to v10.0.0. This is a great UX improvement though, love it! |
|
Thanks folks for the feedback and quick review. Friendly ping @ravicious @strideynet ? |
codingllama
force-pushed
the
codingllama/credential-picker
branch
from
f635e2a to
3d3bae3
Compare
ravicious
approved these changes
Jul 1, 2022
|
@ravicious no need to sign/notarize, but you do need |
|
@codingllama See the table below for backport results.
|
codingllama
added a commit
that referenced
this pull request
Jul 1, 2022
Backport #14033 to branch/v10 Add a credential picker to the tsh FIDO2/WebAuthn backend. The PR pulls a recent patch in our go-libfido2 fork that makes it correctly return multiple assertions from the authenticator. This allows us to implement the credential picker for FIDO2, simplify our implementation and provide the exact same UX that browsers use (always 1-touch for bio, touch->PIN->touch otherwise). I've dropped concepts like "optimistic assertions" and "eager PIN prompts" in favor of a simple, uniform implementation. Issue #13901. * Prompt for credentials in LoginPrompt * Update go-libfido2 * Implement FIDO2 credential picker * Drop optimistic assertions, only set user if explicit * Add license to fido2_prompt_test.go
codingllama
added a commit
that referenced
this pull request
Jul 7, 2022
Add newline missing from PR #14033.
codingllama
added a commit
that referenced
this pull request
Jul 8, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add a credential picker to the
tshFIDO2/WebAuthn backend.The PR pulls a recent patch in our go-libfido2 fork that makes it correctly return multiple assertions from the authenticator. This allows us to implement the credential picker for FIDO2, simplify our implementation and provide the exact same UX that browsers use (always 1-touch for bio, touch->PIN->touch otherwise).
I've dropped concepts like "optimistic assertions" and "eager PIN prompts" in favor of a simple, uniform implementation.
Issue #13901.