Changeset 6768

Timestamp:

Jun 9, 2022, 8:49:13 AM (12 months ago)

Author:

Nicklas Nordborg

Message:

References #1396: Implement an login extension for WebAuthn?

The password is now verified before the security key.

Location:

extensions/net.sf.basedb.webauthn/trunk

Files:

• resources/webauthn-login.js (modified) (1 diff)
• src/net/sf/basedb/webauthn/PreLoginAuthenticationManager.java (modified) (4 diffs)
• src/net/sf/basedb/webauthn/WebAuthnServlet.java (modified) (1 diff)

extensions/net.sf.basedb.webauthn/trunk/resources/webauthn-login.js

@@ -35 +35 @@
     event.preventDefault();
     var frm = document.forms['login'];
-    var login = frm.login.value
+    var login = frm.login.value;
+    var pwd = frm.password.value;
     var home = Data.get(frm, 'home');
     var url = home+'/WebAuthn.servlet?ID='+App.getSessionId();
     url += '&cmd=StartWebAuthnLogin';
     url += '&login='+encodeURIComponent(login);
+    url += '&password='+encodeURIComponent(pwd);
     
     try

extensions/net.sf.basedb.webauthn/trunk/src/net/sf/basedb/webauthn/PreLoginAuthenticationManager.java

@@ -1 +1 @@
 package net.sf.basedb.webauthn;
-
-import com.yubico.webauthn.AssertionRequest;
 
 import net.sf.basedb.core.AuthenticationContext;
@@ -8 +6 @@
 import net.sf.basedb.core.authentication.LoginException;
 import net.sf.basedb.core.authentication.LoginRequest;
-import net.sf.basedb.core.authentication.UnknownLoginException;
 import net.sf.basedb.core.data.UserData;
 
@@ -40 +37 @@
     String login = request.getLogin();
 
-    // Check if the user exists and has configured a security key
-    UserData user = context.getUserByLogin(login);
-    if (user == null) throw new UnknownLoginException(login);
+    // Verify the login/password
+    AuthenticatedUser auth = context.verifyUserInternal(request);
+    
+    // Check if a security key has been registered
+    UserData user = context.getUserById(auth.getInternalId());
     if (user.getExtended("webAuthnCredentialId") == null)
     {
@@ -48 +47 @@
     }
     
+    // Initiate the WebAuthn login process
     String serverName = request.getAttribute("serverName");
     LoginProcessHandler handler = new LoginProcessHandler(user, serverName);
-    AssertionRequest assertionRequest = handler.getAssertionRequest();
-    
     context.getSessionControl().setSessionSetting("webauthn-login-handler", handler);
-    throw new AssertionRequestException(assertionRequest);
+    // The AssertionRequest contains the information that need to be sent to the client
+    // This exception is catched and handled in WebAuthnServlet
+    throw new AssertionRequestException(handler.getAssertionRequest());
   }
     

extensions/net.sf.basedb.webauthn/trunk/src/net/sf/basedb/webauthn/WebAuthnServlet.java

@@ -71 +71 @@
       {
         String login = StringUtil.setNotNullString(Values.getStringOrNull(req.getParameter("login")), "User.Login", User.MAX_LOGIN_LENGTH);
+        String password = StringUtil.setNotNullString(Values.getStringOrNull(req.getParameter("password")), "User.Password", Integer.MAX_VALUE);
         final SessionControl sc = Application.getSessionControl(ID, "net.sf.basedb.clients.web", req.getRemoteAddr(), false);
         
-        LoginRequest lr = new LoginRequest();
+        LoginRequest lr = new LoginRequest(login, password);
         lr.setVerifyOnly(true);
-        lr.setLogin(login);
         lr.setAttribute("login-form", "net.sf.basedb.webauthn.pre-login");
         lr.setAttribute("serverName", req.getServerName());