webauthn

Documentation

Overview

Package webauthn implements webauthn.

Index

• Variables
• type ClientData
• type Config
  • func (c *Config) BeginEnrollment(session *types.Session, existingCreds []*types.Credential) (*webauthnpb.PublicKeyCredentialCreationOptions, error)
  • func (c *Config) BeginLogin(s *types.Session, creds []*types.Credential) (*jssopb.StartLoginReply, error)
  • func (c *Config) FinishEnrollment(session *types.Session, req *jssopb.FinishEnrollmentRequest) (*types.Credential, error)
  • func (c *Config) FinishLogin(s *types.Session, creds []*types.Credential, req *jssopb.FinishLoginRequest) (*types.Credential, error)

Variables

var (
	ErrNoCredentials          = errors.New("no credentials; try enrolling an authenticator")
	ErrNotPublicKey           = errors.New("the authentication material is not of type 'public-key'")
	ErrNotAttestationResponse = errors.New("AuthenticatorResponse is not an AuthenticatorAttestationResponse")
	ErrNotAssertionResponse   = errors.New("AuthenticatorResponse is not an AuthenticatorAssertionResponse")
)

Types

type ClientData

type ClientData struct {
	Challenge   string `json:"challenge"`
	CrossOrigin bool   `json:"crossOrigin"`
	Origin      string `json:"origin"`
	Type        string `json:"type"`
}

type Config

type Config struct {
	RelyingPartyID   string
	RelyingPartyName string
	Origin           string
}

func (*Config) BeginEnrollment

func (c *Config) BeginEnrollment(session *types.Session, existingCreds []*types.Credential) (*webauthnpb.PublicKeyCredentialCreationOptions, error)

BeginEnrollment starts the enrollment process, returning a PublicKeyCredentialCreationOptions for the browser.

func (*Config) BeginLogin

func (c *Config) BeginLogin(s *types.Session, creds []*types.Credential) (*jssopb.StartLoginReply, error)

BeginLogin fills out a StartLoginReply so that login can begin.

func (*Config) FinishEnrollment

func (c *Config) FinishEnrollment(session *types.Session, req *jssopb.FinishEnrollmentRequest) (*types.Credential, error)

FinishEnrollment verifies the authenticator response generated by the client. Because we use a slightly different RPC format than Duo's webauthn library, we do the non-crypto things here, and delegate to that library to verify signations. The steps below are from: https://www.w3.org/TR/webauthn/#registering-a-new-credential

func (*Config) FinishLogin

func (c *Config) FinishLogin(s *types.Session, creds []*types.Credential, req *jssopb.FinishLoginRequest) (*types.Credential, error)

FinishLogin validates a signature against of allowed credentials.