WIP! login: Support FIDO2 auth with pam-u2f #22689
Draft
+243
−3
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
To test, you need to use `localhost` as the domain due to limitations in the browser with domains and WebAuthn. `localhost` and any `.local` TLD will work. E.g. ``` TEST_BIND_GLOBAL=localhost bots/vm-run -s cockpit.socket fedora-43 ``` Modifying the system to support pam-u2f: ``` sudo dnf install pam-u2f -y ``` Add this to the top of `/etc/pam.d/cockpit`: ``` auth sufficient pam_u2f.so authfile=/etc/u2f_mappings origin=localhost appid=cockpit manual ``` Several items outstanding: - ID or user agent doesn't work between WebAuthn API and `pam-u2f` config file. - Unclear issue during authentication with sending passkey credentials from browser to `pam-u2f`. - Currently several `converse` requests are sent from browser to backend due to `pam-u2f` in manual mode expecting data on newlines, sending `\n` does not work. Notes: - Registration with discoverable keys should be possible - To make pam-u2f see a key ass discoverable the ID can be replaced with `*` - Check `journalctl -f` to see how `cockpit-session` and `pam-u2f` interacts. - Chromium has a virtual passkey system to help test with passkeys. - Currently Bitwarden doesn't work with registration due to WebAuthn call originating from an iframe, need to be moved to the shell. - `./build.js` is temporarily modified to be able to build and test the login page. See-also: https://developers.yubico.com/libfido2/Manuals/fido2-assert.html Signed-off-by: Freya Gustavsson <[email protected]>
Venefilyn
added
the
no-test
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if (!window.isSecureContext) { | ||
| login_failure(_("This web page was not loaded in a secure context (https). Please try loading the page again using https or make sure you are using a browser with secure context support")) | ||
| } | ||
| if (!isPasskeySupported) { |
Check warning
Code scanning / CodeQL
Useless conditional Warning
| @@ -0,0 +1,120 @@ | |||
| import cockpit from "cockpit"; | |||
| import React, { useState } from 'react'; | |||
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note
Member
Author
|
Output from syslog with Chromium passkey pubkey visible. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
To test, you need to use
localhostas the domain due to limitations inthe browser with domains and WebAuthn.
localhostand any.localTLDwill work.
E.g.
Modifying the system to support pam-u2f:
Add this to the top of
/etc/pam.d/cockpit:Several items outstanding:
pam-u2fconfig file.
from browser to
pam-u2f.converserequests are sent from browser to backenddue to
pam-u2fin manual mode expecting data on newlines, sending\ndoes not work.Notes:
*journalctl -fto see howcockpit-sessionandpam-u2finteracts.
call originating from an iframe, need to be moved to the shell.
./build.jsis temporarily modified to be able to build and test thelogin page.
one registered key works.
See-also: https://developers.yubico.com/libfido2/Manuals/fido2-assert.html
Signed-off-by: Freya Gustavsson [email protected]
Output