search

StrongKey / fido2

Open-source FIDO server, featuring the FIDO2 standard. https://demo4.strongkey.com/getstarted/#/openapi/fido
202 stars 59 forks source link

Unable to define multiple policies #234

Open adityarao1 opened 1 year ago

adityarao1 commented 1 year ago

I am creating two applications- android and IOS for fido authentication. For this I have created two policies-

  1. Minimal (Any Hardware Authenticator) and
  2. Restricted (Apple PassKey) When I am calling the strong-key server for fido registration, it is always taking the 2nd policy. Are there any configuration level changes I have to do to make it work? Please suggest.
mansibudhiraja commented 1 year ago

Hi @adityarao1,

StrongKey FIDO Server (SKFS) manages the security policies with its Policy Module(PM) and if you are doing a default install, SKFS-PM creates eight different domains for SKFS with different policies.

Each cryptographic domain(did) can only have one policy being enforced at a time, so if you did add the two policies to the same domain, SKFS will most likely use the latest policy that was added.

Did you add two policies to the same domain?

If you do want to use two different policies, they have to be in two different domains. Once you have it set up with two domains, you can specify the right domain in the web service calls.

https://docs.strongkey.com/index.php/skfs-home/skfs-sample-code/skfs-api/skfs-rest/skfs-rest-preregister/skfs-rest-preregister-request

You can also look at the logs in the server.log in /usr/local/strongkey/payara5/glassfish/domains/domain1/logs folder or type in aslg and it will take you to the directory of your SKFS logs.

If you do want to use both your applications against the same domain then you will have to come up with a single policy that will be acceptable for both the applications.

You can always get and update the policy for any domain using the following links: https://docs.strongkey.com/index.php/skfs-home/skfs-how-to/skfs-policy-questions/get-policy https://docs.strongkey.com/index.php/skfs-home/skfs-how-to/skfs-policy-questions/update-policy

adityarao1 commented 1 year ago

@mansibudhiraja thanks, i got it working. But i want to add more domains. What steps I have to follow to do the same?

mansibudhiraja commented 1 year ago

Hi @adityarao1,

We are in the process of updating the document on how to create and add a new domain and we will send you a link tomorrow as soon as its up.

push2085 commented 1 year ago

Hi @adityarao1, Our document is updated and here are the steps for you to create a new domain. https://docs.strongkey.com/index.php/skfs-home/skfs-how-to/skfs-operations/create-a-new-domain

PS: Our supporters are encouraged to get SKFS, its updates and support at SourceForge.