Enable per-tenant WebAuthn, MFA fixes & UI#5
Draft
shashankjaintdl wants to merge 1 commit into
Draft
Conversation
Add tenant-level WebAuthn setting and wiring, tighten MFA behavior, and update login UI and config. - Docs: expanded README and ROADMAP with WebAuthn/MFA features and roadmap items. - DB: Liquibase changesets add tenant_settings keys: `webauthn_fingerprint_enabled` and `mfa_biometrics_customize_rp` (defaults=false). - IAM: permit public user flows and MFA setup/confirm endpoints in IamSecurityConfig to support pre-login operations. - WebAuthn service/controller: inject tenant settings, enforce tenant-level WebAuthn via checkWebAuthnEnabled() (throws AccessDenied), and adjust error response code in rename passkey endpoint. - Auth core: JdbcTenantUserDetailsService: refine MFA requirement logic to rely on mfa_enabled only, add debug logs and clearOrphanMfaSecret() to remove abandoned secrets; SecurityConfig now permits tenant root URL and clears orphan secrets after non-MFA login. - LoginController/template: expose tenant WebAuthn flag to the login page; login.html updated (styling/formatting, JS) to show passkey button only when browser supports WebAuthn and tenant setting enabled; JS and markup cleaned up. - Config: increase HTTP session timeout to 4h and enable debug logging for tenant user details service. These changes enable opt-in per-tenant passkeys, avoid orphaned MFA secrets blocking logins, and wire the UI to respect tenant settings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add tenant-level WebAuthn setting and wiring, tighten MFA behavior, and update login UI and config.
webauthn_fingerprint_enabledandmfa_biometrics_customize_rp(defaults=false).These changes enable opt-in per-tenant passkeys, avoid orphaned MFA secrets blocking logins, and wire the UI to respect tenant settings.