{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"6"},"outline":{"value":"false"},"style":{"value":"disc"},"type":{"value":"list"},"printable":{"value":"true"}},"macroMetadata":{"macroId":{"value":"352122b5-d756-43fc-a44b-4dedf7de516d"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"b0ae5fb6-c163-4857-a10c-1134cbe79cf0"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The plugin comes with an ","type":"text"},{"text":"administration flow","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510151"}}]},{"text":" for registering and managing FIDO2 credentials. The inbuilt flow represents the minimum viable product for implementing such a feature. In the future other plugins may provide this functionality. ","type":"text"}]},{"type":"paragraph","content":[{"text":"The registration flow can be accessed by navigating to:","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"http[s]://hostname/idp/profile/admin/webauthn-registration","type":"text","marks":[{"type":"code"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configuration Steps","type":"text"}]},{"type":"paragraph","content":[{"text":"Other than following steps 1 and 2, you do not need to change any of the default registration options to register and use a FIDO2 credential with the IdP successfully. If you do want more control over the process, there are a few options available:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Required) Decide how the user should ","type":"text"},{"text":"authenticate","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3879206915/WebAuthnRegistration#Integration-with-the-authentication-flow"}}]},{"text":" to the registration flow.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Required) Configure a suitable ","type":"text"},{"text":"access control policy","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3879206915/WebAuthnRegistration#%5BinlineExtension%5DAccessPolicy-Configuration"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Optional) Configure how ","type":"text"},{"text":"user account details","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3879206915/WebAuthnRegistration#%5BinlineExtension%5DUser-Identity-for-Credential-Generation"}}]},{"text":" are passed to the WebAuthn API and authenticator.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Optional) Decide what ","type":"text"},{"text":"type of authenticator","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3879206915/WebAuthnRegistration#%5BinlineExtension%5DCredential-Generation-Options"}}]},{"text":" you want to support.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Optional) Decide if you want to require only ‘trusted’ (from FIDO Alliance Metadata) authenticators to be ","type":"text"},{"text":"registered","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3879206915/WebAuthnRegistration#Credential-Registration-Policies"}}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Integration with the authentication flow","type":"text"}]},{"type":"paragraph","content":[{"text":"The registration flow uses the normal authentication process of the IdP to verify the user who intends to register a credential. It is recommended to implement authentication through the ","type":"text"},{"text":"MFA","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505534"}}]},{"text":" flow, and the following instructions assume you have completed that step.","type":"text"}]},{"type":"paragraph","content":[{"text":"By default, the flow collects the username as a first step so it can look up any existing credentials before passing control to the authentication system. This information can be accessed in the MFA configuration using the ","type":"text"},{"text":"isWebAuthnAvailable()","type":"text","marks":[{"type":"code"}]},{"text":" method on the ","type":"text"},{"text":"WebAuthnRegistrationContext","type":"text","marks":[{"type":"code"}]},{"text":", to decide which flow to use. The example ","type":"text"},{"text":"MFA Flow With Password Fallback","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3878256667/WebAuthnAuthentication#%5BinlineExtension%5DWebAuthn-as-the-sole-factor-with-password-fallback-for-registration"}}]},{"text":" is a suitable initial setup that allows users to register their first credentials upon inputting their username and password; other combinations are possible. ","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"ACPolicy"},"legacyAnchorId":{"value":"WebAuthnRegistration-ACPolicy"}},"macroMetadata":{"macroId":{"value":"096de0599900bae75ebff5fdf039f6f5ec2c2d909cbe781a5ddb4e755dabc0c2"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"4e485c2c-f884-4c30-8d22-fb3e58d10da6"}},{"text":"AccessPolicy Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"The user and client accessing the registration flow are subject to an ","type":"text"},{"text":"AccessControlConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/x/x4W0vg"}}]},{"text":" set by the property ","type":"text"},{"text":"idp.authn.webauthn.admin.registration.accessPolicy","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":"The default policy, ","type":"text"},{"text":"AccessByCurrentUser","type":"text","marks":[{"type":"code"}]},{"text":", is not defined in the IdP's access control configuration and needs to be added for the flow to load (see the next section).","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"AccessByCurrentUser Access Policy","type":"text"}]},{"type":"paragraph","content":[{"text":"The default policy, ","type":"text"},{"text":"AccessByCurrentUser","type":"text","marks":[{"type":"code"}]},{"text":" must be added to the map in ","type":"text"},{"text":"conf/access-control.xml","type":"text","marks":[{"type":"em"}]},{"text":" like so:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"...\n \n \n \n \n \n \n \n \n...","type":"text"}]},{"type":"paragraph","content":[{"text":"This policy is essential if you plan on creating an MFA flow (such as ","type":"text"},{"text":"MFA Flow With Password Bypass","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3878256667/WebAuthnAuthentication#%5BinlineExtension%5DWebAuthn-as-the-sole-factor-with-password-fallback-for-registration"}}]},{"text":") which provides another authentication method if the user has no registered credentials (e.g., either using ","type":"text"},{"text":"isWebAuthnAvailable()","type":"text","marks":[{"type":"code"}]},{"text":" or when ","type":"text"},{"text":"signalling a custom event","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3878256667/WebAuthnAuthentication#%5BinlineExtension%5DSignalling-custom-events-when-the-user-has-no-registered-credentials"}}]},{"text":").","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"AccessByCurrentUser","type":"text","marks":[{"type":"code"}]},{"text":" policy checks the username found in the registration context—collected by the username view when the user first enters the registration flow—is the same as the principal name (identity) of the user that authenticated. This is important, if we imagine a scenario where a nefarious user wanted to ‘change' or possibly 'downgrade’ a user’s authenticate method from WebAuthn to, say, username and password (or whatever else was configured as a ‘backup’), all they would need to do is enter a non-existent username into the username collection step of the registration page and then have the MFA flow direct them to a different flow (because they do not have any registered credentials) where, for example, they can proceed to try different usernames and passwords for authentication. Importantly, the registration flow uses the principal name of the authenticated user to register credentials against. ","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"AccessByCurrentUser","type":"text","marks":[{"type":"code"}]},{"text":" policy safeguards this by ensuring that the username initially entered into the registration page—for which the credentials are retrieved, and any flow decision is based—matches the authenticating user's principal name. If they do not match, access to the registration page is denied. This measure prevents a user from switching usernames between the registration and authentication flows. ","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Custom Comparison Predicate","type":"text"}]},{"type":"paragraph","content":[{"text":"If the default comparison predicate used by the access policy is not sufficient for your needs. You can create a different comparison predicate and plug it into ","type":"text"},{"text":"AccessByCurrentUser","type":"text","marks":[{"type":"code"}]},{"text":": see the example below.","type":"text"}]},{"type":"expand","attrs":{"title":"Example AccessByCurrentUser Policy Using A Custom Comparison Predicate"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n \n \n \n \n \n \n \n \n \n \n","type":"text"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Disabling Registration Username Collection ","type":"text"}]},{"type":"paragraph","content":[{"text":"It is possible to turn off the username collection step in the registration flow to simplify this problem by setting the property ","type":"text"},{"text":"idp.authn.webauthn.registration.collectUsername","type":"text","marks":[{"type":"strong"}]},{"text":" to false. You’d then need to think about how best to support users trying to register their first credential.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Strong Authentication Access Policy","type":"text"},{"text":"(1.1.0)","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]},{"type":"paragraph","content":[{"text":"An access control policy is included in the distribution that can act as a guard against the use of ‘weak’ authentication methods to access the registration page if the user already has FIDO2 credentials. For example, as extra protection against using only single-factor Password authentication to access the registration page when the user has already registered a FIDO2 credential.","type":"text"}]},{"type":"paragraph","content":[{"text":"This approach is primarily effective for identifying misconfiguration e.g. you modify and weaken your MFA flow by mistake, forgot to set the guard, and the policy blocks access. Other use cases may arise, but we will leave that to the deployer to decide.","type":"text"}]},{"type":"paragraph","content":[{"text":"Enabling this policy means the user can only access the registration page if either:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The user has existing FIDO2 credentials and they have performed ‘strong' authentication (likely WebAuthn authentication, but it can be configured for any factor in an MFA flow you deem suitable).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The user does not have any FIDO2 credentials and has performed any type of authentication. For instance, only require password authentication for users to register their first FIDO2 credential.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"In both cases, the guard must be established for the policy to function correctly. Therefore blocking SSO access to the registration page.","type":"text"}]},{"type":"paragraph"},{"type":"expand","attrs":{"title":"Example AccessByCurrentUser Policy Using Both the AccessByCurrentUserPredicate and StrongAndFreshAuthenticationGuardPredicate"},"content":[{"type":"paragraph","content":[{"text":"The policy can be enabled by including it in, for example, the ","type":"text"},{"text":"AccessByCurrentUser","type":"text","marks":[{"type":"code"}]},{"text":" policy alongside the existing ","type":"text"},{"text":"AccessByCurrentUserPredicate","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"You then need to add a signal into the ","type":"text"},{"text":"WebAuthnGuardContext","type":"text","marks":[{"type":"code"}]},{"text":" whenever you think ‘strong' authentication has been performed. For example, in the MFA flow:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n \n \n ","type":"text"}]},{"type":"paragraph","content":[{"text":"The guard context can be used anywhere you want to signal strong authentication. ","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Note, if you have another second-factor authentication method available you can already mandate the use of ‘strong’ authentication by setting the ","type":"text"},{"text":"defaultAuthenticationMethods","type":"text","marks":[{"type":"code"}]},{"text":" property. In addition, from v1.1.0 onward you can force re-authentication to the registration page, and therefore if you use a suitable ","type":"text"},{"text":"MFA configuration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3878256667/WebAuthnAuthentication#%5BinlineExtension%5DConfiguration-of-the-MFA-flow"}}]},{"text":", this policy is unlikely to be of any additional benefit.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Access Policies and Subject Canonicalization ","type":"text"}]},{"type":"paragraph","content":[{"text":"There are some caveats to consider when enabling access policies, especially ","type":"text"},{"text":"AccessByCurrentUser","type":"text","marks":[{"type":"code"}]},{"text":". The principal name that results from authentication is determined by the ","type":"text"},{"text":"Authentication flow","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199511904"}}]},{"text":", the ","type":"text"},{"text":"SubjectCanonicalization","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199512211"}}]},{"text":" flow, and possibly any transformations that have been applied to the username. It is, therefore, entirely possible that the user who entered the registration flow is the same as the user who authenticated, but their username and principal name do not match. ","type":"text"}]},{"type":"paragraph","content":[{"text":"To address this, the registration process collects the username from the username input view and applies two transformations. The first transformation utilizes configurable string manipulations, while the second executes the ","type":"text"},{"text":"SubjectCanonicalization","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199512211"}}]},{"text":" subflow. Together, these two steps create a final output, which is then matched against the principal name obtained during the authentication process.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Registration Username String Transformations","type":"text"}]},{"type":"paragraph","content":[{"text":"The following properties control the string transformations applied to the registration username:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.username.uppercase : ","type":"text","marks":[{"type":"strong"}]},{"text":"upper case the username?","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.username.lowercase","type":"text","marks":[{"type":"strong"}]},{"text":" : lowercase the username?","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.username.trim","type":"text","marks":[{"type":"strong"}]},{"text":" : trim the username?","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"You can supply a custom transformation by defining the bean, ","type":"text"},{"text":"shibboleth.authn.webauthn.registration.UsernameTransformations. ","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Note, if you do this and you are using the passwordless authentication mode, you will need to supply the same transformation settings to the authentication flow, otherwise, it will not match with the username used to register the credential. ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.passwordless.username.uppercase : ","type":"text","marks":[{"type":"strong"}]},{"text":"upper case the username?","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.passwordless.username.lowercase","type":"text","marks":[{"type":"strong"}]},{"text":" : lower case the username?","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.passwordless.username.trim","type":"text","marks":[{"type":"strong"}]},{"text":" : trim the username?","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"You can supply a custom transformation by defining the bean, ","type":"text"},{"text":"shibboleth.authn.webauthn.passwordless.UsernameTransformations.","type":"text","marks":[{"type":"strong"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Subject Canonicalization","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"SubjectCanonicalization","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199512211"}}]},{"text":" subflow is run immediatly after username collection. By default, the IdP wide ","type":"text"},{"text":"shibboleth.PostLoginSubjectCanonicalizationFlows","type":"text","marks":[{"type":"strong"}]},{"text":" are run, but a different list of flows can be configured by setting the property","type":"text"},{"text":" idp.authn.webauthn.registration.c14n.postUsernameFlows","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"UserIdentityAttributes"},"legacyAnchorId":{"value":"WebAuthnRegistration-UserIdentityAttributes"}},"macroMetadata":{"macroId":{"value":"15cea19694b4f6993a4c57c2af059023ba8ef3d3c46daff56c647db3b480aeb8"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"14329348-14ca-4014-ac6b-8c8b64dd06a6"}},{"text":"User Identity for Credential Generation","type":"text"}]},{"type":"paragraph","content":[{"text":"The IdP will pass user account details to the WebAuthn API during registration. Some information is used to enhance the user experience while creating credentials, and the authenticator uses some of it to link credentials to user accounts at the IdP. The generation of this information is described in the following sections.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"User ID (UserHandle) Population","type":"text"}]},{"type":"paragraph","content":[{"text":"The user ID (user.id) should be the primary key of the user account within the IdP. It must not exceed 64 bytes in length and should not include personally identifiable information. The ID should not change for a given user and is used by the authenticator to bind a credential to a user during registration with the IdP. In an authentication response, it is returned as the user handle.","type":"text"}]},{"type":"paragraph","content":[{"text":"In the federated context, the credential is registered against the IdP and so the user ID of the credential will be the same no matter who the requesting, upstream, service provider is—an authenticator will only store one credential for the IdP per user ID.","type":"text"}]},{"type":"paragraph","content":[{"text":"By default, the user ID is generated at runtime using a random byte sequence of 64 bytes. To ensure that each user has only one ID, an ID will only be generated if the authenticated user does not already have one linked to an existing credential. ","type":"text"}]},{"type":"paragraph","content":[{"text":"You may prefer to pull this value from the attribute resolver. This can be achieved by modifying the following properties. in ","type":"text"},{"text":"conf/authn/webauthn-registration.properties","type":"text","marks":[{"type":"em"}]},{"text":":","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"change the property","type":"text"},{"text":" idp.authn.webauthn.registration.userid.strategy ","type":"text","marks":[{"type":"strong"}]},{"text":"to reference the bean ","type":"text"},{"text":"shibboleth.authn.webauthn.registration.AttributeContextUserIdLookupStrategy","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ensure the attribute resolver is enabled after authentication, ","type":"text"},{"text":"idp.authn.webauthn.admin.registration.resolveAttributes=true.","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"decide which attribute from the resolver context to use using ","type":"text"},{"text":"idp.authn.webauthn.registration.userid.attributeId","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Note, the ","type":"text"},{"text":"AttributeContextUserIdLookupStrategy","type":"text","marks":[{"type":"em"}]},{"text":" requires the attribute to be a single StringAttributeValue converted to a byte array assuming a UTF-8 character set.","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Complete control over the strategy is possible by defining your own bean in ","type":"text"},{"text":"conf/authn/webauthn-registration-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" of type ","type":"text"},{"text":"Function","type":"text","marks":[{"type":"code"}]},{"text":" and referenced by the ","type":"text"},{"text":"idp.authn.webauthn.registration.userid.strategy","type":"text","marks":[{"type":"strong"}]},{"text":" property in ","type":"text"},{"text":"conf/authn/webauthn-registration.properties","type":"text","marks":[{"type":"em"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"user.name"},"legacyAnchorId":{"value":"WebAuthnRegistration-user.name"}},"macroMetadata":{"macroId":{"value":"73897902b560c2d2e796d78ab1a0055fee32662b8d5ed59b266eb4c72c2537c1"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"72dd4dd9-bb35-480c-83fa-b92986ab06c0"}},{"text":"User Name Population ","type":"text"}]},{"type":"paragraph","content":[{"text":"The WebAuthn name (user.name) is a human-palatable identifier for a user’s account a credential is associated with. This is separate from the internal username the IdP uses to store the credential against and is only used by the authenticator to help the user select the correct credential to authenticate with. It may be truncated by the authenticator to 64 bytes.","type":"text"}]},{"type":"paragraph","content":[{"text":"By default, this is taken from the principal name of the user who authenticated (contained in the ","type":"text"},{"text":"SubjectContext)","type":"text","marks":[{"type":"em"}]},{"text":". You may prefer to pull this value from the attribute resolver: this is supported out of the box by utilizing a built-in strategy, which can be activated by modifying the following properties in ","type":"text"},{"text":"conf/authn/webauthn-registration.properties","type":"text","marks":[{"type":"em"}]},{"text":":","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"change the property","type":"text"},{"text":" idp.authn.webauthn.registration.name.strategy ","type":"text","marks":[{"type":"strong"}]},{"text":"to reference the bean ","type":"text"},{"text":"shibboleth.authn.webauthn.registration.AttributeContextWebAuthnNameLookupStrategy.","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ensure the attribute resolver is enabled after authentication, ","type":"text"},{"text":"idp.authn.webauthn.admin.registration.resolveAttributes=true.","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"decide which attribute from the resolver context to use using ","type":"text"},{"text":"idp.authn.webauthn.registration.name.attributeId","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Complete control over the strategy is possible by defining your own bean in ","type":"text"},{"text":"conf/authn/webauthn-registration-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" of type ","type":"text"},{"text":"Function","type":"text","marks":[{"type":"code"}]},{"text":" and referenced by the ","type":"text"},{"text":"idp.authn.webauthn.registration.name.strategy","type":"text","marks":[{"type":"strong"}]},{"text":" property in ","type":"text"},{"text":"conf/authn/webauthn-registration.properties","type":"text","marks":[{"type":"em"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"User Display Name Population","type":"text"}]},{"type":"paragraph","content":[{"text":"The user display name (user.displayName) is a human-palatable name for the user’s account. It is only intended for display to the user during registration. It is not used during authentication. Some authenticators do not currently show the display name.","type":"text"}]},{"type":"paragraph","content":[{"text":"By default, the user’s display name is taken from the principal name in the SubjectContext. That is, the canonical principal name of the subject that is authenticated to the registration endpoint. However, you may prefer to pull this value from the attribute resolver. This is supported by changing the following properties in ","type":"text"},{"text":"conf/authn/webauthn-registration.properties","type":"text","marks":[{"type":"em"}]},{"text":":","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"change the property","type":"text"},{"text":" idp.authn.webauthn.registration.displayname.strategy ","type":"text","marks":[{"type":"strong"}]},{"text":"to reference the bean ","type":"text"},{"text":"shibboleth.authn.webauthn.registration.AttributeContextDisplayNameLookupStrategy","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ensure the attribute resolver is enabled after authentication, ","type":"text"},{"text":"idp.authn.webauthn.admin.registration.resolveAttributes=true.","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"decide which attribute from the resolver context to use using ","type":"text"},{"text":"idp.authn.webauthn.registration.displayname.attributeId","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Complete control over the strategy is possible by defining your own bean in ","type":"text"},{"text":"conf/authn/webauthn-registration-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" of type ","type":"text"},{"text":"Function","type":"text","marks":[{"type":"code"}]},{"text":" and referenced by the ","type":"text"},{"text":"idp.authn.webauthn.registration.displayname.strategy","type":"text","marks":[{"type":"strong"}]},{"text":" property in ","type":"text"},{"text":"conf/authn/webauthn-registration.properties","type":"text","marks":[{"type":"em"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"CredentialGenerationOptions"},"legacyAnchorId":{"value":"WebAuthnRegistration-CredentialGenerationOptions"}},"macroMetadata":{"macroId":{"value":"41d7433c9a1f2459b88c99c2065ea9bedf7997892f284825143c5acc9d355b08"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"1533fa76-2e3a-40a5-a3d8-6198e0aae150"}},{"text":"Credential Generation Options","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Discoverable Credentials (Passkeys)","type":"text"}]},{"type":"paragraph","content":[{"text":"A Discoverable Credential, formally a Resident Key, stores the private key and associated metadata on the authenticator. This allows usernameless flows and is strictly what is required for a FIDO2 credential to be a ‘passkey’. The alternative allows the private key to be stored, in a protected format, at the relying party (for example, packaged inside the credential ID). Noting that some security keys have limited space for Discoverable Credentials. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Technically, a Discoverable Credential can either be synchronised via some sync fabric (a multi-device or synched passkey e.g, cloud-synched via iCloud Keychain) or bound to the device (single-device or device-bound passkey e.g, a security key). Note that currently there is no way in the plugin to set or detect the different types, the W3C work on this is still a working draft.","type":"text"}]},{"type":"paragraph","content":[{"text":"During the registration of a FIDO2 credential, you can explicitly configure the ResidentKeyRequirement by setting the ","type":"text"},{"text":"idp.authn.webauthn.registration.residentKey ","type":"text","marks":[{"type":"strong"}]},{"text":"property. The possible values, set in ","type":"text"},{"text":"conf/authn/webauthn-registration.properties","type":"text","marks":[{"type":"em"}]},{"text":", are listed below:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"941cde23-efaf-415a-b6f1-332b1a1307b9"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Option","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.residentKey","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"preferred","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Require a residentKey/DiscoverableCredential (passkey) to be created when registering a credential. One-of 'discouraged', 'preferred', 'required'","type":"text"}]}]}]}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"If you ‘preferred’ Discoverable Credentials during registration but require them for authentication, you may end up in a situation where the user registers a credential they can not later use.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Authenticator Attachment Options","type":"text"}]},{"type":"paragraph","content":[{"text":"Authenticator attachment modality specifies the mechanism by which a client can communicate with an authenticator. For example, can the authenticator be removed and ‘roam’ across platforms like a security key, or is the authenticator internal to the device and attached to the given platform like a Trusted Platform Module.","type":"text"}]},{"type":"paragraph","content":[{"text":"This distinction between roaming and platform attachments can be confusing when a platform authenticator can also be used in a roaming context. The most common example of this is that of a mobile device authenticator: when authenticating on the device itself it acts as a platform authenticator, but when authenticating another client via cross-device authentication (QR code and Bluetooth) it acts as a roaming authenticator.","type":"text"}]},{"type":"paragraph","content":[{"text":"During the registration of a FIDO2 credential, you can explicitly configure the AuthenticatorAttachment by setting the ","type":"text"},{"text":"idp.authn.webauthn.registration.authenticatorAttachment ","type":"text","marks":[{"type":"strong"}]},{"text":"property. The possible values, set in ","type":"text"},{"text":"conf/authn/webauthn-registration.properties","type":"text","marks":[{"type":"em"}]},{"text":", are listed below:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"16da12b7-545f-4d89-be70-7e0a91d8caca"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Option","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.authenticatorAttachment","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"any","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"The authenticator attachment (authenticator type) requirement. One-of 'any', 'cross-platform', or 'platform'","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"AttestationConveyance"},"legacyAnchorId":{"value":"WebAuthnRegistration-AttestationConveyance"}},"macroMetadata":{"macroId":{"value":"1074c111a922baca1a4eeb66c7bf76e9a4084efc032c2355f23e561c55e8f0eb"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"6f7feeb0-e83f-4476-9880-c8056cb2b754"}},{"text":"Attestation Conveyance","type":"text"}]},{"type":"paragraph","content":[{"text":"Attestation allows the IdP (acting as a WebAuthn RP) to verify the provenance of the authenticator used when registering a FIDO2 credential. This is provided in the form of an attestation statement. Attestation is optional as it can provide a poor user experience (the user must consent to the release of the attestation statement during registration), has an unclear meaning if the credential is synchronised around multiple devices (what created it might not be the same as what eventually uses it), and is a possible privacy concern (adds another data point for fingerprinting). ","type":"text"}]},{"type":"paragraph","content":[{"text":"During registration of a FIDO2 credential, you can explicitly configure the AttestationConveyencePreference by setting the ","type":"text"},{"text":"idp.authn.webauthn.registration.attestationConveyancePreference ","type":"text","marks":[{"type":"strong"}]},{"text":"property. The possible values, set in ","type":"text"},{"text":"conf/authn/webauthn-registration.properties","type":"text","marks":[{"type":"em"}]},{"text":", are listed below:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":748.0,"localId":"319b13ea-87d8-4e37-89a4-adb787e63ad4"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Option","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.attestationConveyancePreference","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"none","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"How should the attestation be conveyed during registration? One-of 'none', 'indirect', 'direct', or 'enterprise'. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Indirect allows the client to anonymise the attestation. Enterprise may include uniquely identifying information and might be required to only allow organizationally attested authenticators.","type":"text"}]}]}]}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"Noting, if you want to use the basic ","type":"text"},{"text":"support","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3878256667/WebAuthnAuthentication#Authentication-Credential-Policies"}}]},{"text":" for only allowing credentials to be registered from ‘trusted’ authenticators that are contained within the FIDO metadata feed, you’d typically need to enable ‘direct’ attestation.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"User Verification","type":"text"}]},{"type":"paragraph","content":[{"text":"User verification requires an authenticator to authorise a user to create or use credentials. Typically this involves some kind of authorization guester such as fingerprint recognition, face recognition, or a PIN. Whilst this is required during authentication to enable passwordless or usernameless modes, you can separately choose how it is handled during registration.","type":"text"}]},{"type":"paragraph","content":[{"text":"During the registration of a FIDO2 credential, you can explicitly configure the UserVerificationPreference by setting the ","type":"text"},{"text":"idp.authn.webauthn.registration.userVerification ","type":"text","marks":[{"type":"strong"}]},{"text":"property. The possible values, set in ","type":"text"},{"text":"conf/authn/webauthn-registration.properties","type":"text","marks":[{"type":"em"}]},{"text":", are listed below:","type":"text"}]},{"type":"table","attrs":{"layout":"center","width":760.0,"localId":"3defa1bc-cc55-4232-9d62-31bd7a45dbc8"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Option","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.userVerification","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"discouraged (so a registered key can be used as a second factor as well as a first factor)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Require User Verification on registration. One-of ‘discouraged’, ‘preferred’, ‘required’. ","type":"text"}]}]}]}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"Note that if user verification is required during registration, you may exclude authenticators that are usable in second-factor scenarios (which don’t require a user-verification-capable authenticator).","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Other Registration Options","type":"text"}]},{"type":"paragraph","content":[{"text":"The following additional registration options can be set in ","type":"text"},{"text":"conf/authn/webauthn-registration.properties","type":"text","marks":[{"type":"em"}]},{"text":". ","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"6b0c341a-f4d6-4733-ad32-2ea13f9b7716"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Option","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.preferredPublicKeyParams","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"EdDSA,ES256,ES384,ES512,RS1,RS256,RS384,RS512","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"The preferred set of COSE signature algorithms which a created credential will use. The sequence is ordered from the most preferred to the least. The client makes the best effort to create the most preferred it can.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Credential Registration Policies","type":"text"}]},{"type":"paragraph","content":[{"text":"The registration flow comes with a basic, extendable, policy engine for accepting and rejecting credentials based on the authenticator that created them. To enable policy checks, set the property ","type":"text"},{"text":"idp.authn.webauthn.registration.authenticator.policy.enabled","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text","marks":[{"type":"em"}]},{"text":"to true in ","type":"text"},{"text":"conf/authn/webauthn-registration.properties. ","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","content":[{"text":"Policies typically work off an Authenticator’s Attestation GUID (AAGUID) and require attestation statements from the authenticator. See the","type":"text"},{"text":" attestation conveyance","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3879206915#AttestationConveyance"}}]},{"text":" section on how to configure this.","type":"text"}]},{"type":"paragraph","content":[{"text":"The default policy is defined by a list ","type":"text"},{"text":"shibboleth.authn.WebAuthn.registration.ChainedRegistrationPolicyList","type":"text","marks":[{"type":"strong"}]},{"text":" of policies configured in ","type":"text"},{"text":"conf/authn/webauthn-registration-config.xml. ","type":"text","marks":[{"type":"em"}]},{"text":"The following policies are included out of the box:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"a1de617c-09d3-444b-85b6-1550d936e805"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Policy Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Value","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"AllowlistAuthenticatorPolicy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"An allowed list of authenticators based on their Authenticator Attestation GUID (AAGUID)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"The comma-separated list of authenticators can be directly specified in the XML configuration or, for convenience, set by the ","type":"text"},{"text":"idp.authn.webauthn.registration.authenticator.policy.allowedAuthenticators","type":"text","marks":[{"type":"em"}]},{"text":" property.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Labelling Credentials","type":"text"}]},{"type":"paragraph","content":[{"text":"In the registration interface, authenticators and credentials can be enhanced with labels using a basic and extensible labelling engine. Labels are for display purposes only and do not add any extra functionality to the registration or authentication process.","type":"text"}]},{"type":"paragraph","content":[{"text":"The labelling engine works for both the user registration view and the admin registration view. It is enabled by default and controllable by the list bean ","type":"text"},{"text":"shibboleth.authn.WebAuthn.CredentialLabellerList","type":"text","marks":[{"type":"strong"}]},{"text":" defined in both ","type":"text"},{"text":"conf/authn/webauthn-registration","type":"text","marks":[{"type":"em"}]},{"text":"-config.xml and ","type":"text"},{"text":"conf/authn/webauthn-management-config.xml. ","type":"text","marks":[{"type":"em"}]},{"text":"The following labellers are included out of the box:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"03fcc2f6-7733-4fcb-bc59-985a382ad005"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Labeller","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Default Label","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Value","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"SecondFactorOnlyCredentialLabeller","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"A list of authenticators based on their Authenticator Attestation GUID (AAGUID) that can only be used for second-factor authentication.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"SecondFactorOnly","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"The comma-separated list of authenticators can be directly specified in the XML configuration or, for convenience, set by the ","type":"text"},{"text":"idp.authn.webauthn.authenticator.policy.secondFactorOnlyAuthenticators ","type":"text","marks":[{"type":"em"}]},{"text":"property.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"PasskeyCredentialLabeller","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Labels credentials as ‘passkey’s if they are discoverable credentials.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Passkey","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Defined in either ","type":"text"},{"text":"conf/authn/webauthn-registration","type":"text","marks":[{"type":"em"}]},{"text":"-config.xml or ","type":"text"},{"text":"conf/authn/webauthn-management-config.xml","type":"text","marks":[{"type":"em"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Inline Registration","type":"text"}]},{"type":"paragraph","content":[{"text":"During the authentication process, the user has the option to 'Register a new credential.' This action will guide them to a new registration flow where they can create a credential. Once the registration is complete, the registration page will display a button to 'Resume' authentication. Clicking this button will return the user to the point in the authentication flow they left off, allowing them to continue the authentication process. ","type":"text"}]},{"type":"paragraph","content":[{"text":"This feature is enabled by default but can be disabled using the property ","type":"text"},{"text":"idp.authnwebauthn.registration.allowInline ","type":"text","marks":[{"type":"strong"}]},{"text":"in ","type":"text"},{"text":"conf/authn/webauthn-registration.properties.","type":"text","marks":[{"type":"em"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"expand","attrs":{"title":"Properties"},"content":[{"type":"table","attrs":{"layout":"full-width","width":1800.0,"localId":"542141b7-520a-4114-94a7-398b2c1c043e"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.allowUntrustedAttestation","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Allow untrusted authenticators to be registered. FIDO metadata is required to determine trusted authenticators (and they are hardware authenticators)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"dp.authn.webauthn.registration.collectUsername","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Collect a username as a first step of the registration flow.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.admin.registration.authenticate","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Require authentication to the registration flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.admin.registration.accessPolicy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Predicate","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"AccessByCurrentUser","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Allow access by the current user only. That is, the user who identified themselves as part of the registration process is the same as the user who authenticated to the registration flow.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.admin.registration.authenticationFlows","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Function>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Restrict the usable authentication flows","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.admin.registration.defaultAuthenticationMethods","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Function>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Limits, the authentication flows to use for requests by supported principals","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.admin.registration.logging","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"WebAuthnCredentialRegistration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"The flow logging ID","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.admin.registration.resolveAttributes","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Resolve attributes about the user after authentication. Required if you want to resolve WebAuthn ","type":"text"},{"text":"user.id","type":"text","marks":[{"type":"link","attrs":{"href":"http://user.id"}}]},{"text":" etc from identity attributes.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.name.strategy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Bean reference","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.registration.SubjectContextUsernameLookupStrategy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"How should the WebAuthn user.name be resolved.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.name.attributeId","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"WebAuthnUsername","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"If using the attribute context lookup strategy, which attribute should the user.name be taken from","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.userid.strategy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Bean reference","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.registration.RandomUserIdGenerator","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"How should the WebAuth ","type":"text"},{"text":"user.id","type":"text","marks":[{"type":"link","attrs":{"href":"http://user.id"}}]},{"text":" be resolved","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.userid.attributeId","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"WebAuthnUserID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"If using the attribute context lookup strategy, which attribute should the ","type":"text"},{"text":"user.id","type":"text","marks":[{"type":"link","attrs":{"href":"http://user.id"}}]},{"text":" be taken from","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.displayname.strategy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Bean reference","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.registration.SubjectContextDisplayNameLookupStrategy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"How should the WebAuth ","type":"text"},{"text":"user.","type":"text","marks":[{"type":"link","attrs":{"href":"http://user.id"}}]},{"text":"displayName be resolved","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.displayname.attributeId","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"mail","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"If using the attribute context lookup strategy, which attribute should the user.displayName be taken from","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.residentKey","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"preferred","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Require a resident/discoverable key (passkey) to be created when registering a credential. One-of 'discouraged', 'preferred', 'required'","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.preferredPublicKeyParams","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Strring","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"EdDSA,ES256,ES384,ES512,RS1,RS256,RS384,RS512","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"The comma-separated list of authenticators can be directly specified in the XML configuration or, for convenience, set by the idp.authn.webauthn.registration.authenticator.policy.allowedAuthenticators property.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.authenticatorAttachment","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"any","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"The authenticator attachment (authenticator type) requirement. One-of 'any', 'cross-platform', or 'platform'","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.userVerification","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"discouraged (so a registered key can be used as a second factor as well as a first factor)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Require User Verification on registration. One-of ‘discouraged’, ‘preferred’, ‘required’.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.attestationConveyancePreference","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"none","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"How should the attestation be conveyed during registration? One-of 'none', 'indirect', 'direct', or 'enterprise'.","type":"text"}]},{"type":"paragraph","content":[{"text":"Indirect allows the client to anonymise the attestation. Enterprise may include uniquely identifying information and might be required to only allow organizationally attested authenticators.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"dp.authn.webauthn.registration.authenticator.policy.enabled","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Enable the registration policy engine","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.authenticator.policy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Bean reference","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.registration.ChainedAuthenticatorPolicy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Set the authenticator policy to use.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.authenticator.policy.chainedlist","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Bean reference","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.ChainedCredentialPolicyList","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"When using the chained policy; name the policy list bean","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.authenticator.policy.allowedAuthenticators","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"List","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"When using the default chained policy; list allowed authenticator's by their attestation GUIDs (AAGUID)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authnwebauthn.registration.allowInline","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Enable inline self-enrollment. Records the user's state in the authentication flow to allow resumption after registration.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.username.uppercas","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Uppser case transformation that should be applied to the username that is initially collected in the registration flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.username.lowercase","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Lower case transformation that should be applied to the username that is initially collected in the registration flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.username.trim","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"String trimming transformation that should be applied to the username that is initially collected in the registration flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.c14n.postUsernameFlows","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Bean reference","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.PostLoginSubjectCanonicalizationFlows","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"The ID of the bean that supplies the c14n flows that are applied to the username entered during the registration flo","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.genericMessageID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.infoMessageFunction","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Bean reference","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"DefaultRegistrationInfoMessageFunction","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Information message function to pull out INFO messages for the views","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.errorMessageFunction","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Bean reference","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"DefaultRegistrationErrorMessageFunction","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Error message function to pull out ERROR messages for the views","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.audit.enabled","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Enable registration auditing. ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.audit.category","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Shibboleth-Audit.WebAuthnRegistration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"The category name of the registration audit logger.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.audit.format","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"%a|%T|%u|%WebAuthnAdminAO|%WebAuthnAdminAction|%WebAuthnAdminCR|%WebAuthnAdminCA|%WebAuthnAdminAU|%UA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"The registration audit format","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.admin.registration.forceAuthn","type":"text"},{"text":"1.1.0","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Require re-authentication to the registration flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.registration.nicknameRequired","type":"text"},{"text":"1.1.0","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Is nickname collection required?","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[167.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.webauthn.admin.management.forceAuthn","type":"text"},{"text":"1.1.0","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[124.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[235.0]},"content":[{"type":"paragraph","content":[{"text":"Require re-authentication to the management flow","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Beans"},"content":[{"type":"table","attrs":{"layout":"full-width","width":1800.0,"localId":"26948b25-66a6-4bd5-9831-d26e680144e9"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-accent-gray-subtlest, var(--ds-background-accent-gray-subtlest, #F1F2F4))","rowspan":1,"colwidth":[239.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.WebAuthnAuthenticationClientFactory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"WebAuthnAuthenticationClientFactory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[239.0]},"content":[{"type":"paragraph","content":[{"text":"The WebAuthn client factory that creates a ","type":"text"},{"text":"WebAuthnAuthenticationClient","type":"text","marks":[{"type":"code"}]},{"text":" that performs critical WebAuthn functions.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.CredentialRepository","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"WebAuthnCredentialRepository","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[239.0]},"content":[{"type":"paragraph","content":[{"text":"The credential repository to use","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.WebAuthnFidoMetadataServiceFactory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"FidoMetadataServiceFactory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[239.0]},"content":[{"type":"paragraph","content":[{"text":"The FIDO metadata factory that creates a ","type":"text"},{"text":"FidoMetadataService","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.registration.UsernameTransformations","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"List","type":"text","marks":[{"type":"underline"},{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.List"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[239.0]},"content":[{"type":"paragraph","content":[{"text":"Match patterns and replacement strings to apply to the username collected for passwordless authentication","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.registration.AttestationConveyancePreferenceLookupStrategy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":", AttestationConveyancePreference>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[239.0]},"content":[{"type":"paragraph","content":[{"text":"The lookup strategy used to determine which AttestationConveyencePreference to use.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.registration.ResidentKeyRequirementLookupStrategy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":", ResidentKeyRequirement>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[239.0]},"content":[{"type":"paragraph","content":[{"text":"The lookup strategy used to determine which ResidentKeyRequirement to use","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.registration.AuthenticatorAttachmentRequirementLookupStrategy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":", AuthenticatorAttachment>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[239.0]},"content":[{"type":"paragraph","content":[{"text":"The lookup strategy used to determine which AuthenticatorAttachmentRequirement to use","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.ChallengeGeneratorStrategy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",byte[]>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[239.0]},"content":[{"type":"paragraph","content":[{"text":"The strategy used to generate the WebAuthn challenge","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[233.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.WebAuthn.registration.audit.AuditExtractors","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"MapFactoryBean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[239.0]},"content":[{"type":"paragraph","content":[{"text":"A Map of audit extractors to use","type":"text"}]}]}]}]}]}],"version":1}

Browser not supported