WIP: Webauthn-transport

Cargo.toml

@@ -162,14 +162,14 @@ wasm-bindgen = "^0.2.86"
 wasm-bindgen-futures = "^0.4.30"
 wasm-bindgen-test = "0.3.35"
 
-webauthn-authenticator-rs = "0.4.8"
-webauthn-rs = "0.4.8"
-webauthn-rs-core = "0.4.8"
-webauthn-rs-proto = "0.4.8"
-# webauthn-authenticator-rs = { path = "../webauthn-rs/webauthn-authenticator-rs" }
-# webauthn-rs = { path = "../webauthn-rs/webauthn-rs" }
-# webauthn-rs-core = { path = "../webauthn-rs/webauthn-rs-core" }
-# webauthn-rs-proto = { path = "../webauthn-rs/webauthn-rs-proto" }
+# webauthn-authenticator-rs = "0.5.0"
+# webauthn-rs = "0.5.0"
+# webauthn-rs-core = "0.5.0"
+# webauthn-rs-proto = "0.5.0"
+webauthn-authenticator-rs = { path = "../webauthn-rs/webauthn-authenticator-rs" }
+webauthn-rs = { path = "../webauthn-rs/webauthn-rs" }
+webauthn-rs-core = { path = "../webauthn-rs/webauthn-rs-core" }
+webauthn-rs-proto = { path = "../webauthn-rs/webauthn-rs-proto" }
 web-sys = "^0.3.62"
 whoami = "^1.4.1"
 walkdir = "2"

server/lib/Cargo.toml

@@ -81,7 +81,7 @@ users = { workspace = true }
 
 [dev-dependencies]
 criterion = { workspace = true, features = ["html_reports"] }
-webauthn-authenticator-rs = { workspace = true }
+webauthn-authenticator-rs = { workspace = true, features = ["softpasskey"] }
 
 futures = { workspace = true }
 kanidmd_lib_macros = { workspace = true }

server/lib/src/be/dbvalue.rs

@@ -6,7 +6,7 @@ use serde::{Deserialize, Serialize};
 use url::Url;
 use uuid::Uuid;
 use webauthn_rs::prelude::{
-    DeviceKey as DeviceKeyV4, Passkey as PasskeyV4, SecurityKey as SecurityKeyV4,
+    AttestedResidentKey as DeviceKeyV4, Passkey as PasskeyV4, SecurityKey as SecurityKeyV4,
 };
 use webauthn_rs_core::proto::{COSEKey, UserVerificationPolicy};
 

server/lib/src/entry.rs

@@ -40,7 +40,7 @@ use smartstring::alias::String as AttrString;
 use time::OffsetDateTime;
 use tracing::trace;
 use uuid::Uuid;
-use webauthn_rs::prelude::{DeviceKey as DeviceKeyV4, Passkey as PasskeyV4};
+use webauthn_rs::prelude::{AttestedResidentKey as DeviceKeyV4, Passkey as PasskeyV4};
 
 use crate::be::dbentry::{DbEntry, DbEntryV2, DbEntryVers};
 use crate::be::dbvalue::DbValueSetV2;

server/lib/src/idm/account.rs

@@ -7,7 +7,7 @@ use kanidm_proto::v1::{
 use time::OffsetDateTime;
 use uuid::Uuid;
 use webauthn_rs::prelude::{
-    AuthenticationResult, CredentialID, DeviceKey as DeviceKeyV4, Passkey as PasskeyV4,
+    AuthenticationResult, CredentialID, AttestedResidentKey as DeviceKeyV4, Passkey as PasskeyV4,
 };
 
 use crate::constants::UUID_ANONYMOUS;

server/lib/src/idm/credupdatesession.rs

@@ -12,7 +12,7 @@ use kanidm_proto::v1::{
 use serde::{Deserialize, Serialize};
 use time::OffsetDateTime;
 use webauthn_rs::prelude::{
-    CreationChallengeResponse, DeviceKey as DeviceKeyV4, Passkey as PasskeyV4, PasskeyRegistration,
+    CreationChallengeResponse, AttestedResidentKey as DeviceKeyV4, Passkey as PasskeyV4, PasskeyRegistration,
     RegisterPublicKeyCredential,
 };
 

server/lib/src/repl/proto.rs

@@ -10,7 +10,7 @@ use serde::{Deserialize, Serialize};
 use std::collections::{BTreeMap, BTreeSet};
 
 use webauthn_rs::prelude::{
-    DeviceKey as DeviceKeyV4, Passkey as PasskeyV4, SecurityKey as SecurityKeyV4,
+    AttestedResidentKey as DeviceKeyV4, Passkey as PasskeyV4, SecurityKey as SecurityKeyV4,
 };
 
 // Re-export this for our own usage.

server/lib/src/value.rs

@@ -21,7 +21,7 @@ use sshkeys::PublicKey as SshPublicKey;
 use time::OffsetDateTime;
 use url::Url;
 use uuid::Uuid;
-use webauthn_rs::prelude::{DeviceKey as DeviceKeyV4, Passkey as PasskeyV4};
+use webauthn_rs::prelude::{AttestedResidentKey as DeviceKeyV4, Passkey as PasskeyV4};
 
 use kanidm_proto::v1::ApiTokenPurpose;
 use kanidm_proto::v1::Filter as ProtoFilter;

server/lib/src/valueset/cred.rs

@@ -1,7 +1,7 @@
 use std::collections::btree_map::Entry as BTreeEntry;
 use std::collections::BTreeMap;
 
-use webauthn_rs::prelude::{DeviceKey as DeviceKeyV4, Passkey as PasskeyV4};
+use webauthn_rs::prelude::{AttestedResidentKey as DeviceKeyV4, Passkey as PasskeyV4};
 
 use crate::be::dbvalue::{
     DbValueCredV1, DbValueDeviceKeyV1, DbValueIntentTokenStateV1, DbValuePasskeyV1,

server/lib/src/valueset/mod.rs

@@ -6,7 +6,7 @@ use hashbrown::HashSet;
 use smolset::SmolSet;
 use time::OffsetDateTime;
 // use std::fmt::Debug;
-use webauthn_rs::prelude::DeviceKey as DeviceKeyV4;
+use webauthn_rs::prelude::AttestedResidentKey as DeviceKeyV4;
 use webauthn_rs::prelude::Passkey as PasskeyV4;
 
 use kanidm_proto::v1::Filter as ProtoFilter;

tools/cli/Cargo.toml

@@ -57,10 +57,9 @@ clap_complete = { workspace=true }
 uuid = { workspace=true }
 url = { workspace = true }
 
-[target."cfg(target_os = \"windows\")".dependencies.webauthn-authenticator-rs]
-workspace = true
-features = ["win10"]
+[target."cfg(target_os = \"windows\")".dependencies]
+webauthn-authenticator-rs = { workspace = true, features = ["win10"] }
 
-[target."cfg(not(any(target_os = \"windows\")))".dependencies.webauthn-authenticator-rs]
-workspace = true
-features = ["u2fhid"]
+[target."cfg(not(target_os = \"windows\"))".dependencies]
+futures.workspace = true
+webauthn-authenticator-rs = { workspace = true, features = ["nfc", "usb", "ui-cli"] }

tools/cli/src/cli/person.rs

@@ -902,7 +902,7 @@ async fn passkey_enroll_prompt(session_token: &CUSessionToken, client: &KanidmCl
     };
 
     // Setup and connect to the webauthn handler ...
-    let mut wa = get_authenticator();
+    let mut wa = get_authenticator().await;
 
     eprintln!("Your authenticator will now flash for you to interact with.");
     eprintln!("You may be asked to enter the PIN for your device.");

tools/cli/src/cli/session.rs

@@ -199,7 +199,7 @@ async fn do_passkey(
     client: &mut KanidmClient,
     pkr: RequestChallengeResponse,
 ) -> Result<AuthResponse, ClientError> {
-    let mut wa = get_authenticator();
+    let mut wa = get_authenticator().await;
     println!("Your authenticator will now flash for you to interact with it.");
     let auth = wa
         .do_authentication(client.get_origin().clone(), pkr)
@@ -216,7 +216,7 @@ async fn do_securitykey(
     client: &mut KanidmClient,
     pkr: RequestChallengeResponse,
 ) -> Result<AuthResponse, ClientError> {
-    let mut wa = get_authenticator();
+    let mut wa = get_authenticator().await;
     println!("Your authenticator will now flash for you to interact with it.");
     let auth = wa
         .do_authentication(client.get_origin().clone(), pkr)

tools/cli/src/cli/webauthn/mod.rs

@@ -1,12 +1,7 @@
-#[cfg(not(any(target_os = "windows")))]
-mod mozilla;
-#[cfg(not(any(target_os = "windows")))]
-use mozilla::get_authenticator_backend;
-
-#[cfg(target_os = "windows")]
-mod win10;
-#[cfg(target_os = "windows")]
-use win10::get_authenticator_backend;
+#[cfg_attr(target_os = "windows", path = "win10.rs")]
+#[cfg_attr(not(target_os = "windows"), path = "transport.rs")]
+mod backend;
+use backend::get_authenticator_backend;
 
 use webauthn_authenticator_rs::{AuthenticatorBackend, WebauthnAuthenticator};
 
@@ -17,10 +12,11 @@ use webauthn_authenticator_rs::{AuthenticatorBackend, WebauthnAuthenticator};
 ///
 ///   This supports BLE, NFC and USB tokens.
 ///
-/// * On other platforms, this uses Mozilla's `authenticator-rs`.
+/// * On other platforms, this uses `webauthn-authenticator-rs`' `AnyTransport`.
 ///
-///   This only supports USB tokens, and doesn't work on Windows systems which
-///   have the platform WebAuthn API available.
-pub(crate) fn get_authenticator() -> WebauthnAuthenticator<impl AuthenticatorBackend> {
-    WebauthnAuthenticator::new(get_authenticator_backend())
+///   In the default configuration, this supports NFC and USB tokens, but
+///   doesn't work on Windows systems which have the platform WebAuthn API
+///   available.
+pub(crate) async fn get_authenticator() -> WebauthnAuthenticator<impl AuthenticatorBackend> {
+    WebauthnAuthenticator::new(get_authenticator_backend().await)
 }

tools/cli/src/cli/webauthn/transport.rs

@@ -0,0 +1,36 @@
+use futures::StreamExt;
+use webauthn_authenticator_rs::{
+    ctap2::CtapAuthenticator,
+    transport::{AnyToken, AnyTransport, Transport, TokenEvent},
+    ui::Cli,
+};
+
+static CLI: Cli = Cli {};
+
+pub async fn get_authenticator_backend() -> CtapAuthenticator<'static, AnyToken, Cli> {
+    let t = AnyTransport::new().await.unwrap();
+    match t.watch().await {
+        Ok(mut tokens) => {
+            while let Some(event) = tokens.next().await {
+                match event {
+                    TokenEvent::Added(token) => {
+                        let auth = CtapAuthenticator::new(token, &CLI).await;
+
+                        if let Some(auth) = auth {
+                            return auth;
+                        }
+                    }
+
+                    TokenEvent::EnumerationComplete => {
+                        info!("device enumeration completed without detecting a FIDO2 authenticator, connect one to authenticate!");
+                    }
+
+                    TokenEvent::Removed(_) => {}
+                }
+            }
+        }
+        Err(e) => panic!("Error: {e:?}"),
+    }
+
+    panic!("No authenticators available!");
+}

tools/cli/src/cli/webauthn/win10.rs

@@ -1,5 +1,5 @@
 use webauthn_authenticator_rs::win10::Win10;
 
-pub fn get_authenticator_backend() -> Win10 {
+pub async fn get_authenticator_backend() -> Win10 {
     Default::default()
 }