FIDO2 WebAuthn Multifactor Authentication - QR Codes

The extension input to set for the appid extension when initiating authentication operations. If this member is set, starting an assertion op will automatically set the appid extension input, and finish assertion op will adjust its verification logic to also accept this AppID as an alternative to the RP ID. By default, this is not set.

The id that will be set as the rp parameter when initiating registration operations, and which id hash will be compared against. This is a required parameter. A successful registration or authentication operation requires rp id hash to exactly equal the SHA-256 hash of this id member. Alternatively, it may instead equal the SHA-256 hash of application id if the latter is present.

The human-palatable name of the Relaying Party.

Set legal headers expected in the metadata BLOB. By using the FIDO Metadata Service, you will be subject to its terms of service. This setting serves two purposes:

To remind you and any adopters/reviewers that you need to read those terms of service before using this feature. To help you detect if the legal header changes, so you can take appropriate action.

If the legal header in the downloaded BLOB does not equal any of the expected headers, an exception will be thrown in the finalizing configuration step.

Note that CAS makes no guarantee that a change to the FIDO Metadata Service terms of service will also cause a change to the legal header in the BLOB.

The current legal header is noted by: #DEFAULT_LEGAL_HEADER which is the following:

"Retrieval and use of this BLOB indicates acceptance of the appropriate agreement located at https://fidoalliance.org/metadata/metadata-legal-terms/".

Download the metadata BLOB from the FIDO website. This is the current FIDO Metadata Service BLOB download URL.

Certificate SHA-256 hash required for PKI to verify the downloaded certificate. Separate hash values with a comma.

Certificate required for PKI to verify the downloaded blob. This is the current FIDO Metadata Service trust root certificate. If the cert is downloaded, it is also written to the cache File. The certificate will be downloaded if it does not exist in the cache, or if the cached certificate is not currently valid.

The location of the resource. Resources can be URLs, or files found either on the classpath or outside somewhere in the file system.

In the event the configured resource is a Groovy script, especially if the script is set to reload on changes, you may need to adjust the total number of inotify instances. On Linux, you may need to add the following line to /etc/sysctl.conf: fs.inotify.max_user_instances = 256.

You can check the current value via cat /proc/sys/fs/inotify/max_user_instances.

In situations and scenarios where CAS is able to automatically watch the underlying resource for changes and detect updates and modifications dynamically, you may be able to specify the following setting as either an environment variable or system property with a value of false to disable the resource watcher: org.apereo.cas.util.io.PathWatcherService.

Configure the authentication flow to allow web-authn to be used as the first primary factor for authentication. Registered accounts with a valid webauthn registration record can choose to login using their device as the first step.

If false finish registration op will only allow registrations where the attestation signature can be linked to a trusted attestation root. This excludes self attestation and none attestation. Regardless of the value of this option, invalid attestation statements of supported formats will always be rejected. For example, a "packed" attestation statement with an invalid signature will be rejected even if this option is set to true.

The allowed origins that returned authenticator responses will be compared against. The default is set to the server name. A successful registration or authentication operation requires origins to exactly equal one of these values.

Accepted values are: DIRECT, INDIRECT, NONE. The argument for the attestation parameter in registration operations. Unless your application has a concrete policy for authenticator attestation, it is recommended to leave this parameter undefined.

Specifies the desired authenticator attachment modality during credential registration.

This is used by the WebAuthn client/browser to select which type of authenticator may be used to create the credential.

If unset, the client may use any available authenticator.

Name of the principal attribute that indicates the principal's display name, primarily used for device registration.

Whether WebAuthn functionality should be activated and enabled.

Expire and forget device registration records after this period.

Device registration record expiration time unit.

User-agent hints, in descending order of preference, sent with registration and authentication requests to guide the browser towards the kind of authenticator to offer first.

Hints do not restrict which authenticator may be used, and where they conflict with the authenticator attachment, browsers that support them follow the hints.

If unset, no hints are sent.

When enabled, allows the user/system to accept multiple accounts and device registrations per user, allowing one to switch between or register new devices/accounts automatically.

URL of the page where a user creates a passkey for the account, published as enroll in the passkey endpoints document at /.well-known/passkey-endpoints, so that password managers can send users straight to it. If unset and account management is enabled, the multifactor devices panel of the account profile is used; otherwise no enrollment page is published.

URL of the page where a user manages the account's passkeys, published as manage in the passkey endpoints document at /.well-known/passkey-endpoints. If unset and account management is enabled, the multifactor devices panel of the account profile is used; otherwise no management page is published.

Offer a passkey right after a password login: CAS shows a short page that asks the browser's password manager to create a passkey for the account on its own (WebAuthn conditional create), then continues as usual. Browsers and password managers that do not support it continue immediately.

Takes effect only when allow-primary-authentication and allow-untrusted-attestation are also enabled, since such passkeys come without attestation and are meant for passkey login; otherwise this setting is ignored.

When enabled, allows the user to a scan a QR code on an external device and authenticate later on the primary device. This is useful in scenarios where the primary authentication device is not registered with CAS and the user has a secondary device that is registered and does not wish to use the primary device to authenticate for security or other practical reasons.

Cache metadata BLOB in the file cache file. If cache file exists, is a normal file, is readable, and is not out of date, then it will be used as the FIDO Metadata Service BLOB.

Otherwise, the metadata BLOB will be downloaded and written to this file.

Cache the trust root certificate in the file cache file. If cache file exists, is a normal file, is readable, matches one of the SHA-256 hashes configured in and contains a currently valid X.509 certificate, then it will be used as the trust root for the FIDO Metadata Service blob.

Otherwise, the trust root certificate will be downloaded and written to this file.

Indicates whether this provider should support trusted devices.

Specifies the relying party's requirement for user verification during credential registration and/or authentication.

User verification means the authenticator verifies the user locally, for example with a PIN, fingerprint, face recognition, or device unlock. This is stronger than simple user presence, such as touching a security key.

The server should validate the resulting authenticator data flags according to the configured requirement.

If true, finish assertion op will fail if the signature counter value in the response is not strictly greater than the stored signature counter value.