Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow use of credProps extension during auth #1988

Merged
merged 6 commits into from
Nov 29, 2023
Merged

Allow use of credProps extension during auth #1988

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
76e88e1
Initial effort to allow credProps use during auth
MasterKale Oct 12, 2023
bd5ff7a
Incorporate PR feedback
MasterKale Oct 25, 2023
5025ea2
Restore rk instructions into client processing
MasterKale Oct 25, 2023
1d2d521
Align credProps output reference with other extensions
emlun Nov 10, 2023
2472df6
Add credProps client processing step to set authenticatorDisplayName
emlun Nov 10, 2023
22aa6ff
Merge pull request #1995 from emlun/add-credprops-to-make
MasterKale Nov 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 6 additions & 8 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6371,7 +6371,7 @@ The "compound" attestation statement format is used to pass multiple, self-conta

2. If sufficiently many (as determined by [=[RP]=] policy) [=list/items=] of |attStmt| verify successfully,
return implementation-specific values representing any combination of outputs from successful [=verification procedures=].


# <dfn>WebAuthn Extensions</dfn> # {#sctn-extensions}

Expand Down Expand Up @@ -6777,13 +6777,13 @@ During a transition from the FIDO U2F JavaScript API, a [=[RP]=] may have a popu

### Credential Properties Extension (<dfn>credProps</dfn>) ### {#sctn-authenticator-credential-properties-extension}

This [=client extension|client=] [=registration extension=] facilitates reporting certain [=credential properties=] known by the [=client=] to the requesting [=[WRP]=] upon creation of a [=public key credential source=] as a result of a [=registration ceremony=].
This [=client extension|client=] [=registration extension=] and [=authentication extension=] facilitates reporting certain [=credential properties=] known by the [=client=] to the requesting [=[WRP]=] upon creation or use of a [=public key credential source=].

: Extension identifier
:: `credProps`

: Operation applicability
:: [=registration extension|Registration=]
:: [=registration extension|Registration=] and [=authentication extension|authentication=]

: Client extension input
:: The Boolean value [TRUE] to indicate that this extension is requested by the [=[RP]=].
Expand All @@ -6797,9 +6797,7 @@ This [=client extension|client=] [=registration extension=] facilitates reportin
:: None, other than to report on credential properties in the output.

: Client extension output
:: [=map/Set=] <code>[=credentialCreationData/clientExtensionResults=]["{{AuthenticationExtensionsClientOutputs/credProps}}"]["rk"]</code> to the value of the |requireResidentKey| parameter that was used in the <a href='#CreateCred-InvokeAuthnrMakeCred'>invocation</a> of the [=authenticatorMakeCredential=] operation.
MasterKale marked this conversation as resolved.
Show resolved Hide resolved

<xmp class="idl">
:: <xmp class="idl">
dictionary CredentialPropertiesOutput {
boolean rk;
USVString authenticatorDisplayName;
Expand All @@ -6826,8 +6824,8 @@ This [=client extension|client=] [=registration extension=] facilitates reportin
:: This OPTIONAL property is a [=human palatability|human-palatable=] description of the credential's [=managing authenticator=],
chosen by the user.

The [=client=] MUST allow the user to choose this value,
MAY or MAY not present that choice during [=registration ceremonies=],
During [=registration ceremonies=] the [=client=] MUST allow the user to choose this value,
MAY or MAY not present that choice,
and MAY reuse the same value for multiple credentials with the same [=managing authenticator=] across multiple [=[RPS]=].
MasterKale marked this conversation as resolved.
Show resolved Hide resolved

MasterKale marked this conversation as resolved.
Show resolved Hide resolved
The [=client=] MAY query the [=authenticator=], by some unspecified mechanism, for this value.
Expand Down