Skip to content

[v12] Remove lib/auth/webauthn dependency from webauthncli #30509

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
codingllama merged 5 commits into from
Aug 15, 2023
Merged

[v12] Remove lib/auth/webauthn dependency from webauthncli #30509

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7c51d83
Represent `protocol` within `wanlib` and update go-webauthn (#29750)
codingllama Aug 2, 2023
0a4fd81
Undo go-webauthn compatibility changes
codingllama Aug 15, 2023
f29b6e8
Remove `lib/auth/webauthn` dependency from `webauthncli` (#30377)
codingllama Aug 14, 2023
0d91a02
chore: Drop the lib/auth/webauthn/httpserver test package (#30314)
codingllama Aug 11, 2023
c6ee2fd
Change httpfallback.go imports
codingllama Aug 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions api/proto/teleport/legacy/types/webauthn/webauthn.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ package webauthn;

import "gogoproto/gogo.proto";

option go_package = "github.com/gravitational/teleport/api/types/webauthn";
option go_package = "github.com/gravitational/teleport/api/types/webauthn;webauthnpb";
option (gogoproto.marshaler_all) = true;
option (gogoproto.unmarshaler_all) = true;

Expand Down Expand Up @@ -256,8 +256,9 @@ message CredentialParameter {
message RelyingPartyEntity {
string id = 1;
string name = 2;
// URL to the icon of the Relying Party.
string icon = 3;

reserved 3; // string icon
reserved "icon";
}

// User information.
Expand All @@ -273,6 +274,7 @@ message UserEntity {
// Human-palatable name for the user account, intended only for display.
// The Relying Party _should_ let the user choose this value.
string display_name = 3;
// URL to a resource which can be the avatar image for the user.
string icon = 4;

reserved 4; // string icon
reserved "icon";
}
249 changes: 73 additions & 176 deletions api/types/webauthn/webauthn.pb.go
View file
Open in desktop

Large diffs are not rendered by default.

6 changes: 3 additions & 3 deletions lib/auth/accountrecovery_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ import (
"github.com/gravitational/teleport/api/constants"
"github.com/gravitational/teleport/api/types"
apievents "github.com/gravitational/teleport/api/types/events"
wantypes "github.com/gravitational/teleport/api/types/webauthn"
wanpb "github.com/gravitational/teleport/api/types/webauthn"
"github.com/gravitational/teleport/lib/defaults"
"github.com/gravitational/teleport/lib/events"
"github.com/gravitational/teleport/lib/events/eventstest"
Expand Down Expand Up @@ -358,7 +358,7 @@ func TestVerifyAccountRecovery_WithAuthnErrors(t *testing.T) {
AuthnCred: &proto.VerifyAccountRecoveryRequest_MFAAuthenticateResponse{
MFAAuthenticateResponse: &proto.MFAAuthenticateResponse{
Response: &proto.MFAAuthenticateResponse_Webauthn{
Webauthn: &wantypes.CredentialAssertionResponse{}, // invalid response
Webauthn: &wanpb.CredentialAssertionResponse{}, // invalid response
},
},
},
Expand Down Expand Up @@ -873,7 +873,7 @@ func TestCompleteAccountRecovery_WithErrors(t *testing.T) {
NewAuthnCred: &proto.CompleteAccountRecoveryRequest_NewMFAResponse{
NewMFAResponse: &proto.MFARegisterResponse{
Response: &proto.MFARegisterResponse_Webauthn{
Webauthn: &wantypes.CredentialCreationResponse{},
Webauthn: &wanpb.CredentialCreationResponse{},
},
},
},
Expand Down
13 changes: 7 additions & 6 deletions lib/auth/auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ import (
"github.com/gravitational/teleport/lib/auth/keystore"
"github.com/gravitational/teleport/lib/auth/native"
wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
"github.com/gravitational/teleport/lib/authz"
"github.com/gravitational/teleport/lib/backend"
"github.com/gravitational/teleport/lib/circleci"
Expand Down Expand Up @@ -2485,7 +2486,7 @@ func (a *Server) createRegisterChallenge(ctx context.Context, req *newRegisterCh
}

return &proto.MFARegisterChallenge{Request: &proto.MFARegisterChallenge_Webauthn{
Webauthn: wanlib.CredentialCreationToProto(credentialCreation),
Webauthn: wantypes.CredentialCreationToProto(credentialCreation),
}}, nil

default:
Expand Down Expand Up @@ -2794,7 +2795,7 @@ func (a *Server) registerWebauthnDevice(ctx context.Context, regResp *proto.MFAR
dev, err := webRegistration.Finish(ctx, wanlib.RegisterResponse{
User: req.username,
DeviceName: req.newDeviceName,
CreationResponse: wanlib.CredentialCreationResponseFromProto(regResp.GetWebauthn()),
CreationResponse: wantypes.CredentialCreationResponseFromProto(regResp.GetWebauthn()),
Passwordless: req.deviceUsage == proto.DeviceUsage_DEVICE_USAGE_PASSWORDLESS,
})
return dev, trace.Wrap(err)
Expand Down Expand Up @@ -4579,7 +4580,7 @@ func (a *Server) mfaAuthChallenge(ctx context.Context, user string, passwordless
return nil, trace.Wrap(err)
}
return &proto.MFAAuthenticateChallenge{
WebauthnChallenge: wanlib.CredentialAssertionToProto(assertion),
WebauthnChallenge: wantypes.CredentialAssertionToProto(assertion),
}, nil
}

Expand Down Expand Up @@ -4611,7 +4612,7 @@ func (a *Server) mfaAuthChallenge(ctx context.Context, user string, passwordless
if err != nil {
return nil, trace.Wrap(err)
}
challenge.WebauthnChallenge = wanlib.CredentialAssertionToProto(assertion)
challenge.WebauthnChallenge = wantypes.CredentialAssertionToProto(assertion)
}

return challenge, nil
Expand Down Expand Up @@ -4674,7 +4675,7 @@ func (a *Server) validateMFAAuthResponse(
return nil, "", trace.Wrap(err)
}

assertionResp := wanlib.CredentialAssertionResponseFromProto(res.Webauthn)
assertionResp := wantypes.CredentialAssertionResponseFromProto(res.Webauthn)
var dev *types.MFADevice
if passwordless {
webLogin := &wanlib.PasswordlessFlow{
Expand All @@ -4688,7 +4689,7 @@ func (a *Server) validateMFAAuthResponse(
Webauthn: webConfig,
Identity: a.Services,
}
dev, err = webLogin.Finish(ctx, user, wanlib.CredentialAssertionResponseFromProto(res.Webauthn))
dev, err = webLogin.Finish(ctx, user, wantypes.CredentialAssertionResponseFromProto(res.Webauthn))
}
if err != nil {
return nil, "", trace.AccessDenied("MFA response validation failed: %v", err)
Expand Down
28 changes: 14 additions & 14 deletions lib/auth/auth_login_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ import (
"github.com/gravitational/teleport/api/constants"
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/lib/auth/mocku2f"
wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
"github.com/gravitational/teleport/lib/defaults"
"github.com/gravitational/teleport/lib/services"
)
Expand Down Expand Up @@ -453,7 +453,7 @@ func TestServer_AuthenticateUser_mfaDevices(t *testing.T) {

switch {
case resp.GetWebauthn() != nil:
authReq.Webauthn = wanlib.CredentialAssertionResponseFromProto(resp.GetWebauthn())
authReq.Webauthn = wantypes.CredentialAssertionResponseFromProto(resp.GetWebauthn())
case resp.GetTOTP() != nil:
authReq.OTP = &OTPCreds{
Password: []byte(password),
Expand Down Expand Up @@ -537,14 +537,14 @@ func TestServer_Authenticate_passwordless(t *testing.T) {
require.NoError(t, err)
pwdKey.SetPasswordless()
const origin = "https://localhost"
ccr, err := pwdKey.SignCredentialCreation(origin, wanlib.CredentialCreationFromProto(registerChallenge.GetWebauthn()))
ccr, err := pwdKey.SignCredentialCreation(origin, wantypes.CredentialCreationFromProto(registerChallenge.GetWebauthn()))
require.NoError(t, err)
_, err = userClient.AddMFADeviceSync(ctx, &proto.AddMFADeviceSyncRequest{
TokenID: token.GetName(),
NewDeviceName: "pwdless1",
NewMFAResponse: &proto.MFARegisterResponse{
Response: &proto.MFARegisterResponse_Webauthn{
Webauthn: wanlib.CredentialCreationResponseToProto(ccr),
Webauthn: wantypes.CredentialCreationResponseToProto(ccr),
},
},
})
Expand All @@ -567,11 +567,11 @@ func TestServer_Authenticate_passwordless(t *testing.T) {
tests := []struct {
name string
loginHooks []LoginHook
authenticate func(t *testing.T, resp *wanlib.CredentialAssertionResponse)
authenticate func(t *testing.T, resp *wantypes.CredentialAssertionResponse)
}{
{
name: "ssh",
authenticate: func(t *testing.T, resp *wanlib.CredentialAssertionResponse) {
authenticate: func(t *testing.T, resp *wantypes.CredentialAssertionResponse) {
loginResp, err := proxyClient.AuthenticateSSHUser(ctx, AuthenticateSSHRequest{
AuthenticateUserRequest: AuthenticateUserRequest{
Webauthn: resp,
Expand All @@ -591,7 +591,7 @@ func TestServer_Authenticate_passwordless(t *testing.T) {
loginHook,
loginHook,
},
authenticate: func(t *testing.T, resp *wanlib.CredentialAssertionResponse) {
authenticate: func(t *testing.T, resp *wantypes.CredentialAssertionResponse) {
loginResp, err := proxyClient.AuthenticateSSHUser(ctx, AuthenticateSSHRequest{
AuthenticateUserRequest: AuthenticateUserRequest{
Webauthn: resp,
Expand All @@ -607,7 +607,7 @@ func TestServer_Authenticate_passwordless(t *testing.T) {
},
{
name: "web",
authenticate: func(t *testing.T, resp *wanlib.CredentialAssertionResponse) {
authenticate: func(t *testing.T, resp *wantypes.CredentialAssertionResponse) {
session, err := proxyClient.AuthenticateWebUser(ctx, AuthenticateUserRequest{
Webauthn: resp,
})
Expand All @@ -620,7 +620,7 @@ func TestServer_Authenticate_passwordless(t *testing.T) {
loginHooks: []LoginHook{
loginHook,
},
authenticate: func(t *testing.T, resp *wanlib.CredentialAssertionResponse) {
authenticate: func(t *testing.T, resp *wantypes.CredentialAssertionResponse) {
session, err := proxyClient.AuthenticateWebUser(ctx, AuthenticateUserRequest{
Webauthn: resp,
})
Expand All @@ -641,7 +641,7 @@ func TestServer_Authenticate_passwordless(t *testing.T) {
_, err := proxyClient.AuthenticateSSHUser(ctx, AuthenticateSSHRequest{
AuthenticateUserRequest: AuthenticateUserRequest{
Username: user,
Webauthn: &wanlib.CredentialAssertionResponse{}, // bad response
Webauthn: &wantypes.CredentialAssertionResponse{}, // bad response
PublicKey: []byte(sshPubKey),
},
TTL: 24 * time.Hour,
Expand All @@ -660,7 +660,7 @@ func TestServer_Authenticate_passwordless(t *testing.T) {
require.NoError(t, err, "Failed to create passwordless challenge")

// Sign challenge (mocks user interaction).
assertionResp, err := pwdKey.SignAssertion(origin, wanlib.CredentialAssertionFromProto(mfaChallenge.GetWebauthnChallenge()))
assertionResp, err := pwdKey.SignAssertion(origin, wantypes.CredentialAssertionFromProto(mfaChallenge.GetWebauthnChallenge()))
require.NoError(t, err)
assertionResp.AssertionResponse.UserHandle = userWebID // identify user, a real device would set this

Expand Down Expand Up @@ -727,7 +727,7 @@ func TestServer_Authenticate_nonPasswordlessRequiresUsername(t *testing.T) {
}
switch {
case mfaResp.GetWebauthn() != nil:
req.Webauthn = wanlib.CredentialAssertionResponseFromProto(mfaResp.GetWebauthn())
req.Webauthn = wantypes.CredentialAssertionResponseFromProto(mfaResp.GetWebauthn())
case mfaResp.GetTOTP() != nil:
req.OTP = &OTPCreds{
Password: []byte(password),
Expand Down Expand Up @@ -813,7 +813,7 @@ func TestServer_Authenticate_headless(t *testing.T) {
_, err = proxyClient.AuthenticateSSHUser(ctx, AuthenticateSSHRequest{
AuthenticateUserRequest: AuthenticateUserRequest{
Username: username,
Webauthn: &wanlib.CredentialAssertionResponse{}, // bad response
Webauthn: &wantypes.CredentialAssertionResponse{}, // bad response
PublicKey: []byte(sshPubKey),
},
TTL: 24 * time.Hour,
Expand Down Expand Up @@ -857,7 +857,7 @@ func TestServer_Authenticate_headless(t *testing.T) {
AuthenticateUserRequest: AuthenticateUserRequest{
// HeadlessAuthenticationID should take precedence over WebAuthn and OTP fields.
HeadlessAuthenticationID: headlessID,
Webauthn: &wanlib.CredentialAssertionResponse{},
Webauthn: &wantypes.CredentialAssertionResponse{},
OTP: &OTPCreds{},
Username: username,
PublicKey: []byte(sshPubKey),
Expand Down
4 changes: 2 additions & 2 deletions lib/auth/auth_with_roles_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ import (
"github.com/gravitational/teleport/api/types"
apievents "github.com/gravitational/teleport/api/types/events"
"github.com/gravitational/teleport/api/types/installers"
"github.com/gravitational/teleport/api/types/webauthn"
wanpb "github.com/gravitational/teleport/api/types/webauthn"
"github.com/gravitational/teleport/api/types/wrappers"
apiutils "github.com/gravitational/teleport/api/utils"
"github.com/gravitational/teleport/api/utils/sshutils"
Expand Down Expand Up @@ -4881,7 +4881,7 @@ func TestUpdateHeadlessAuthenticationState(t *testing.T) {
// default to failed mfa challenge response
resp := &proto.MFAAuthenticateResponse{
Response: &proto.MFAAuthenticateResponse_Webauthn{
Webauthn: &webauthn.CredentialAssertionResponse{
Webauthn: &wanpb.CredentialAssertionResponse{
Type: "bad response",
},
},
Expand Down
34 changes: 17 additions & 17 deletions lib/auth/grpcserver_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ import (
"github.com/gravitational/teleport/api/utils/sshutils"
"github.com/gravitational/teleport/lib/auth/mocku2f"
"github.com/gravitational/teleport/lib/auth/testauthority"
wanlib "github.com/gravitational/teleport/lib/auth/webauthn"
wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
"github.com/gravitational/teleport/lib/authz"
"github.com/gravitational/teleport/lib/defaults"
"github.com/gravitational/teleport/lib/modules"
Expand Down Expand Up @@ -177,12 +177,12 @@ func TestMFADeviceManagement(t *testing.T) {
authHandler: devs.webAuthHandler,
checkAuthErr: require.NoError,
registerHandler: func(t *testing.T, challenge *proto.MFARegisterChallenge) *proto.MFARegisterResponse {
ccr, err := webKey2.SignCredentialCreation(webOrigin, wanlib.CredentialCreationFromProto(challenge.GetWebauthn()))
ccr, err := webKey2.SignCredentialCreation(webOrigin, wantypes.CredentialCreationFromProto(challenge.GetWebauthn()))
require.NoError(t, err)

return &proto.MFARegisterResponse{
Response: &proto.MFARegisterResponse_Webauthn{
Webauthn: wanlib.CredentialCreationResponseToProto(ccr),
Webauthn: wantypes.CredentialCreationResponseToProto(ccr),
},
}
},
Expand All @@ -204,11 +204,11 @@ func TestMFADeviceManagement(t *testing.T) {
require.NoError(t, err)
key.PreferRPID = true
key.IgnoreAllowedCredentials = true
resp, err := key.SignAssertion(webOrigin, wanlib.CredentialAssertionFromProto(challenge.WebauthnChallenge))
resp, err := key.SignAssertion(webOrigin, wantypes.CredentialAssertionFromProto(challenge.WebauthnChallenge))
require.NoError(t, err)
return &proto.MFAAuthenticateResponse{
Response: &proto.MFAAuthenticateResponse_Webauthn{
Webauthn: wanlib.CredentialAssertionResponseToProto(resp),
Webauthn: wantypes.CredentialAssertionResponseToProto(resp),
},
}
},
Expand All @@ -235,11 +235,11 @@ func TestMFADeviceManagement(t *testing.T) {
key.PreferRPID = true

ccr, err := key.SignCredentialCreation(
"http://badorigin.com" /* origin */, wanlib.CredentialCreationFromProto(challenge.GetWebauthn()))
"http://badorigin.com" /* origin */, wantypes.CredentialCreationFromProto(challenge.GetWebauthn()))
require.NoError(t, err)
return &proto.MFARegisterResponse{
Response: &proto.MFARegisterResponse_Webauthn{
Webauthn: wanlib.CredentialCreationResponseToProto(ccr),
Webauthn: wantypes.CredentialCreationResponseToProto(ccr),
},
}
},
Expand Down Expand Up @@ -267,12 +267,12 @@ func TestMFADeviceManagement(t *testing.T) {
key.PreferRPID = true
key.SetPasswordless()

ccr, err := key.SignCredentialCreation(webOrigin, wanlib.CredentialCreationFromProto(challenge.GetWebauthn()))
ccr, err := key.SignCredentialCreation(webOrigin, wantypes.CredentialCreationFromProto(challenge.GetWebauthn()))
require.NoError(t, err)

return &proto.MFARegisterResponse{
Response: &proto.MFARegisterResponse_Webauthn{
Webauthn: wanlib.CredentialCreationResponseToProto(ccr),
Webauthn: wantypes.CredentialCreationResponseToProto(ccr),
},
}
},
Expand Down Expand Up @@ -355,11 +355,11 @@ func TestMFADeviceManagement(t *testing.T) {
require.NoError(t, err)
key.PreferRPID = true
key.IgnoreAllowedCredentials = true
resp, err := key.SignAssertion(webOrigin, wanlib.CredentialAssertionFromProto(challenge.WebauthnChallenge))
resp, err := key.SignAssertion(webOrigin, wantypes.CredentialAssertionFromProto(challenge.WebauthnChallenge))
require.NoError(t, err)
return &proto.MFAAuthenticateResponse{
Response: &proto.MFAAuthenticateResponse_Webauthn{
Webauthn: wanlib.CredentialAssertionResponseToProto(resp),
Webauthn: wantypes.CredentialAssertionResponseToProto(resp),
},
}
},
Expand Down Expand Up @@ -404,11 +404,11 @@ func TestMFADeviceManagement(t *testing.T) {
},
authHandler: func(t *testing.T, challenge *proto.MFAAuthenticateChallenge) *proto.MFAAuthenticateResponse {
resp, err := webKey2.SignAssertion(
webOrigin, wanlib.CredentialAssertionFromProto(challenge.WebauthnChallenge))
webOrigin, wantypes.CredentialAssertionFromProto(challenge.WebauthnChallenge))
require.NoError(t, err)
return &proto.MFAAuthenticateResponse{
Response: &proto.MFAAuthenticateResponse_Webauthn{
Webauthn: wanlib.CredentialAssertionResponseToProto(resp),
Webauthn: wantypes.CredentialAssertionResponseToProto(resp),
},
}
},
Expand Down Expand Up @@ -458,11 +458,11 @@ func (d *mfaDevices) webAuthHandler(t *testing.T, challenge *proto.MFAAuthentica
require.NotNil(t, challenge.WebauthnChallenge)

resp, err := d.WebKey.SignAssertion(
d.webOrigin, wanlib.CredentialAssertionFromProto(challenge.WebauthnChallenge))
d.webOrigin, wantypes.CredentialAssertionFromProto(challenge.WebauthnChallenge))
require.NoError(t, err)
return &proto.MFAAuthenticateResponse{
Response: &proto.MFAAuthenticateResponse_Webauthn{
Webauthn: wanlib.CredentialAssertionResponseToProto(resp),
Webauthn: wantypes.CredentialAssertionResponseToProto(resp),
},
}
}
Expand Down Expand Up @@ -541,11 +541,11 @@ func addOneOfEachMFADevice(t *testing.T, cl *Client, clock clockwork.Clock, orig
registerHandler: func(t *testing.T, challenge *proto.MFARegisterChallenge) *proto.MFARegisterResponse {
require.NotNil(t, challenge.GetWebauthn())

ccr, err := mfaDevs.WebKey.SignCredentialCreation(origin, wanlib.CredentialCreationFromProto(challenge.GetWebauthn()))
ccr, err := mfaDevs.WebKey.SignCredentialCreation(origin, wantypes.CredentialCreationFromProto(challenge.GetWebauthn()))
require.NoError(t, err)
return &proto.MFARegisterResponse{
Response: &proto.MFARegisterResponse_Webauthn{
Webauthn: wanlib.CredentialCreationResponseToProto(ccr),
Webauthn: wantypes.CredentialCreationResponseToProto(ccr),
},
}
},
Expand Down
Loading